部署GCP Cloud Function遇403权限错误：run.services.setIamPolicy缺失

问题现象 #

部署GCP Cloud Function时，控制台显示函数已成功部署，但命令行返回如下错误：

Preparing function...
.done.
Updating function (may take a while)...
[Build].....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................warning
[Service]........................................................................warning
Completed with warnings:
Warning: G] *** Improve build performance by generating and committing package-lock.json.
  [INFO] A new revision will be deployed serving with 100% traffic.
ERROR: (gcloud.functions.deploy) ResponseError: status=[403], code=[Ok], message=[Permission 'run.services.setIamPolicy' denied on resource 'projects/my-project-abcdef/locations/us-central1/services/my-function-name' (or resource may not exist).]
Error: Process completed with exit code 1.

当前使用的IAM服务账号已拥有以下权限：

• Cloud Build Service Account
• Cloud Functions Developer
• Kubernetes Engine Admin
• Kubernetes Engine Cluster Viewer
• Service Account User
• Storage Admin

且已在Cloud Build设置面板中启用Cloud Functions和Service Accounts服务。

解决方案 #

1. 添加Cloud Run Admin角色 #

Cloud Functions底层依赖Cloud Run服务，部署过程中需要设置Cloud Run服务的IAM策略，因此需要给服务账号添加Cloud Run Admin角色（roles/run.admin），该角色包含run.services.setIamPolicy权限。

2. 或添加单独权限 #

若不想赋予完整的Cloud Run Admin权限，可直接给服务账号添加run.services.setIamPolicy单独权限：

• 进入GCP IAM控制台，找到目标服务账号
• 点击「添加权限」，搜索并添加run.services.setIamPolicy权限

3. 验证权限生效 #

添加权限后重新运行部署命令，确认错误消失。

内容的提问来源于stack exchange，提问作者Fez Vrasta