CloudTasksClient.create_task权限拒绝问题排查求助

问题描述 #

通过Firestore触发器调用CloudTasksClient.create_task接口创建Cloud Tasks任务时，遇到权限拒绝错误，核心提示为：Permission denied on 'locations/supportedregion.asia_northeast1' (or it may not exist)。

相关代码 #

@firestore_fn.on_document_created(
    document="users/{user_id}/Documents/{document_id}",
    min_instances=MIN_INSTANCES)
def trigger_create_document(event: firestore_fn.Event) -> None:
    import json
    from datetime import datetime

    from google.cloud import tasks_v2
    from firebase_functions import params

    user_id = event.params['user_id']
    document_id = event.params['document_id']

    tasks_client = tasks_v2.CloudTasksClient()
    task_queue = tasks_client.queue_path(
        params.PROJECT_ID.value,
        options.SupportedRegion.ASIA_NORTHEAST1,
        "documenttask"
    )
    target_uri = get_function_url("documenttask")
    if target_uri == '':
        return

    schedule_time = datetime.now()

    body = {"data": {
        "user_id": user_id,
        "document_id": document_id,
    }}
    task = tasks_v2.Task(
        http_request={
            "http_method": tasks_v2.HttpMethod.POST,
            "url": target_uri,
            "headers": {"Content-Type": "application/json"},
            "body": json.dumps(body).encode(),
        },
        schedule_time=schedule_time,
    )
    tasks_client.create_task(parent=task_queue, task=task)
    return None

错误信息 #

[2023-10-26 14:14:01,823][ERROR] Exception on / [POST]
Traceback (most recent call last): File "/layers/google.python.pip/pip/lib/python3.11/site-packages/google/api_core/grpc_helpers.py", line 72, in error_remapped_callable return callable_(*args, **kwargs)
^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/layers/google.python.pip/pip/lib/python3.11/site-packages/grpc/_channel.py", line 1030, in __call__
return _end_unary_response_blocking(state, call, False, None)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/layers/google.python.pip/pip/lib/python3.11/site-packages/grpc/_channel.py", line 910, in _end_unary_response_blocking
raise _InactiveRpcError(state) # pytype: disable=not-instantiable
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
grpc._channel._InactiveRpcError: <_InactiveRpcError of RPC that terminated with:
status = StatusCode.PERMISSION_DENIED
details = "Permission denied on 'locations/supportedregion.asia_northeast1' (or it may not exist)."
debug_error_string = "UNKNOWN:Error received from peer ipv4:142.251.42.202:443 {grpc_message:"Permission denied on \'locations/supportedregion.asia_northeast1\' (or it may not exist).", grpc_status:7, created_time:"2023-10-26T14:14:01.822482107+00:00"}"
>
The above exception was the direct cause of the following exception:
Traceback (most recent call last): File "/layers/google.python.pip/pip/lib/python3.11/site-packages/flask/app.py", line 2190, in wsgi_app response = self.full_dispatch_request()
^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/layers/google.python.pip/pip/lib/python3.11/site-packages/flask/app.py", line 1486, in full_dispatch_request
rv = self.handle_user_exception(e)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/layers/google.python.pip/pip/lib/python3.11/site-packages/flask/app.py", line 1484, in full_dispatch_request
rv = self.dispatch_request()
^^^^^^^^^^^^^^^^^^^^^^^
File "/layers/google.python.pip/pip/lib/python3.11/site-packages/flask/app.py", line 1469, in dispatch_request
return self.ensure_sync(self.view_functions[rule.endpoint])(**view_args)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/layers/google.python.pip/pip/lib/python3.11/site-packages/functions_framework/__init__.py", line 174, in view_func
function(event)
File "/layers/google.python.pip/pip/lib/python3.11/site-packages/firebase_functions/firestore_fn.py", line 308, in on_document_created_wrapped
return _firestore_endpoint_handler(
^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/layers/google.python.pip/pip/lib/python3.11/site-packages/firebase_functions/firestore_fn.py", line 181, in _firestore_endpoint_handler
func(database_event)
File "/workspace/main.py", line 91, in trigger_create_document
tasks_client.create_task(parent=task_queue, task=task)
File "/layers/google.python.pip/pip/lib/python3.11/site-packages/google/cloud/tasks_v2/services/cloud_tasks/client.py", line 2199, in create_task
response = rpc(
^^^^
File "/layers/google.python.pip/pip/lib/python3.11/site-packages/google/api_core/gapic_v1/method.py", line 113, in __call__
return wrapped_func(*args, **kwargs)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/layers/google.python.pip/pip/lib/python3.11/site-packages/google/api_core/timeout.py", line 120, in func_with_timeout
return func(*args, **kwargs)
^^^^^^^^^^^^^^^^^^^^^
File "/layers/google.python.pip/pip/lib/python3.11/site-packages/google/api_core/grpc_helpers.py", line 74, in error_remapped_callable
raise exceptions.from_grpc_error(exc) from exc
google.api_core.exceptions.PermissionDenied: 403 Permission denied on 'locations/supportedregion.asia_northeast1' (or it may not exist).

排查步骤 #

• 修正区域格式：错误信息中的区域supportedregion.asia_northeast1不符合GCP标准格式（正确应为asia-northeast1）。检查options.SupportedRegion.ASIA_NORTHEAST1的实际返回值，大概率是该枚举输出了错误格式，直接替换为字符串"asia-northeast1"再测试。
• 验证队列存在性：登录GCP控制台进入Cloud Tasks页面，确认asia-northeast1区域下存在名为documenttask的队列，区域和名称必须完全匹配。
• 确认服务账号权限：Firestore触发器使用的默认服务账号（[你的项目ID]@appspot.gserviceaccount.com）需要被授予Cloud Tasks Enqueuer角色（roles/cloudtasks.enqueuer），权限范围要覆盖目标队列所在区域或整个项目。
• 排查网络限制：如果函数配置了VPC连接器，检查连接器是否允许访问Cloud Tasks API端点，同时确认防火墙规则未阻止相关请求。
• 本地测试权限：下载服务账号密钥到本地，编写简化版创建任务代码，用本地环境调用Cloud Tasks API，验证是否能成功创建任务，排除GCP环境中的配置问题。

内容的提问来源于stack exchange，提问作者Kicchan