search

FirebaseExtended / action-hosting-deploy

Automatically deploy shareable previews for your Firebase Hosting sites
https://firebase.google.com/docs/hosting/github-integration
Apache License 2.0
671 stars 195 forks source link

[BUG] Service Account created without cloud functions permissions #253

Open maximveksler opened 1 year ago

maximveksler commented 1 year ago

New Firebase account, new GCP account.

Timeline:

  1. On 1st run the API for Cloud Build API was not enabled. CI Failed with link to enable API.
  2. API enabled in GCP console
  3. 5 min of wait, while change propogates
  4. Relaunched the buid, still fails with 403 permission error.

Action config

# This file was auto-generated by the Firebase CLI
# https://github.com/firebase/firebase-tools

name: Deploy to Firebase Hosting on merge
"on":
  push:
    branches:
      - master
jobs:
  build_and_deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - run: npm ci && npm run build
        working-directory: src
      # https://github.com/FirebaseExtended/action-hosting-deploy/issues/251
      - run: /usr/local/bin/npx firebase-tools@latest experiments:enable webframeworks
      - uses: FirebaseExtended/action-hosting-deploy@v0
        with:
          repoToken: "${{ secrets.GITHUB_TOKEN }}"
          firebaseServiceAccount: "${{ secrets.FIREBASE_SERVICE_ACCOUNT_REFRAMED_XXX }}"
          channelId: live
          projectId: reframed-XXX

Error message

Error: HTTP Error: 403, Permission denied to get service [cloudfunctions.googleapis.com]
  Help Token: AZWD64qjGY7kpTyVX0ZKnHv4y7i-P-c1SxiKSbJevd0hA3JJINEVy0MJG_B1SKeytwFfbgMNo5v4yLffFVRBLI6mS80E_Ad4Ld5fNPkgpj6ia8pD
  [2022-11-08T10:56:59.367Z] Error Context: ***
    "body": ***
      "error": ***
        "code": 403,
        "message": "Permission denied to get service [cloudfunctions.googleapis.com]\nHelp Token: AZWD64qjGY7kpTyVX0ZKnHv4y7i-P-c1SxiKSbJevd0hA3JJINEVy0MJG_B1SKeytwFfbgMNo5v4yLffFVRBLI6mS80E_Ad4Ld5fNPkgpj6ia8pD",
        "status": "PERMISSION_DENIED",
        "details": [
          ***
            "@type": "type.googleapis.com/google.rpc.PreconditionFailure",
            "violations": [
              ***
                "type": "googleapis.com",
                "subject": "?error_code=110002&service=serviceusage.googleapis.com&permission=serviceusage.services.get&resource=projects/reframed-XXX"
              ***
            ]
          ***,
          ***
            "@type": "type.googleapis.com/google.rpc.ErrorInfo",
            "reason": "AUTH_PERMISSION_DENIED",
            "domain": "serviceusage.googleapis.com",
            "metadata": ***
              "service": "serviceusage.googleapis.com",
              "permission": "serviceusage.services.get",
              "resource": "projects/reframed-XXX"
            ***
          ***
        ]
      ***
    ***,
    "response": ***
      "statusCode": 403
    ***
  ***
maximveksler commented 1 year ago

Here are the permissions created for the service account by the firebase-tools CLI

image

maximveksler commented 1 year ago

Summary

To get it to work I had to

1 - Enable the following API's:

image

  1. Cloud Build
  2. Cloud Functions
  3. Artifact Registry

2 - Grant to the service account the following permissions:

image

  1. Cloud Functions Admin
  2. Artifact Registry Administrator

The deploy is still not working for me, however for different reasons (Will open a followup bug)

fachrezamuslim commented 1 year ago

I can fix this issue by adding these 3 IAM roles.