使用Cloud Functions查询BigQuery表遇403权限拒绝问题求助

我尝试用Cloud Functions查询BigQuery表，Python代码如下：

data_dict = {"project_id": "propane-nomad-396712", "dataset_name": "my_data", "table_name": "db_table", "row_count": 1, "csv_size": 1, "blob_size": 0, "timestamp": "2023-08-27T19:13:52.167462"}
project_id = data_dict["project_id"]
dataset_name = data_dict["dataset_name"]
table_name = data_dict["table_name"]
row_count = data_dict["row_count"]
csv_size = data_dict["csv_size"]
blob_size = data_dict["blob_size"]
timestamp = data_dict["timestamp"]

bq_client = bigquery.Client(project=project_id, location="europe-west3")
# 也试过这个查询语句：SELECT MAX(id) as last_id FROM {dataset_name}.{table_name}
query = f"""
    SELECT MAX(id) as last_id FROM {project_id}.{dataset_name}.{table_name}
"""
query_job = bq_client.query(query)
query_result = query_job.result()
for row in query_result:
    last_id = row['last_id']

Cloud Functions使用的服务账号拥有以下角色：

roles/bigquery.user
roles/cloudfunctions.invoker
roles/pubsub.subscriber
roles/storage.admin

但执行时遇到如下错误：

403 Access Denied: Table propane-nomad-396712:my_data.db_table: User does not have permission to query table propane-nomad-396712:my_data.db_table, or perhaps it does not exist in location europe-west3.

我曾为数据集授予权限，但问题依旧：

GRANT `roles/bigquery.user`
ON SCHEMA `propane-nomad-396712`.my_data
TO "serviceAccount:sa-func-b@propane-nomad-396712.iam.gserviceaccount.com";

已确认该表存在于europe-west3区域，且能在BigQuery SQL编辑器中手动查询：

SELECT * FROM `my_data.db_table`

1. 补充数据读取权限
   roles/bigquery.user仅允许创建查询作业，没有读取表数据的权限。需要给服务账号授予roles/bigquery.dataViewer角色，或更细粒度的bigquery.tables.getData权限。

2. 执行正确的授权语句

• 针对整个数据集授权：

GRANT `roles/bigquery.dataViewer`
ON SCHEMA `propane-nomad-396712`.my_data
TO "serviceAccount:sa-func-b@propane-nomad-396712.iam.gserviceaccount.com";

• 仅针对目标表授权（更安全）：

GRANT `roles/bigquery.dataViewer`
ON TABLE `propane-nomad-396712`.my_data.db_table
TO "serviceAccount:sa-func-b@propane-nomad-396712.iam.gserviceaccount.com";

3. 等待权限生效
   IAM权限变更可能需要1-5分钟才能完全同步，授权后等待片刻再测试。

4. 确认区域配置一致性
   确保Cloud Functions的运行区域与BigQuery表所在的europe-west3一致，当前代码已指定Client的location，此步骤可忽略，若问题仍存在可在查询语句末尾添加LOCATION europe-west3。

内容的提问来源于stack exchange，提问作者Daniel