3

I ran gcloud asset export --content-type resource --project jcalderon-openx-sandbox --asset-types container.googleapis.com/Cluster --output-path "gs://mybucket/NEW_FILE"

and got the following error:

details:
- '@type': type.googleapis.com/google.rpc.PreconditionFailure
  violations:
  - subject: ?error_code=110002&resource=services/cloudasset.googleapis.com/consumers/12345678&service=serviceconsumermanagement.googleapis.com&permission=serviceconsumermanagement.consumers.generateServiceAccount
    type: googleapis.com
- '@type': type.googleapis.com/google.rpc.ErrorInfo
  domain: serviceconsumermanagement.googleapis.com
  metadata:
    permission: serviceconsumermanagement.consumers.generateServiceAccount
    resource: services/cloudasset.googleapis.com/consumers/12345678
    service: serviceconsumermanagement.googleapis.com
  reason: AUTH_PERMISSION_DENIED
message: |-
  Permission denied to generate service identity for service [cloudasset.googleapis.com]
  Help Token: Ae-hA1Pj7jG6K2-377AaTz7nATqZQLUKy5c8PGQpT19qHXbCrYOp3NQ2vef4z5WOGKBjHsVXCLrlPyuyhjoiDo99tpAC2y4xv7KY4tCmLIO9EUyA
status: PERMISSION_DENIED

I'm owner of my project. I authenticated with my user and verified that I am in my project.

user994165
  • 9,146
  • 30
  • 98
  • 165
  • I don't know the answer but I have a suspicion. When you enable(d) Cloud Asset API in `jcalderon-openx-sandbox`, was a Service Account of the form `service-{project-num}@gcp-sa-cloudasset.iam.gserviceaccount.com` added to the project's IAM policy? I think the exporter runs using this Service Account as its identity (not your `gcloud` user's identity) and it needs appropriate permissions in the project. This may be a red-herring. – DazWilkin Jun 01 '22 at 23:03
  • Having the same problem since yesterday. Didn't have it before. – Alssanro Jun 02 '22 at 06:38
  • @DazWilkin, no I don't see it in IAM. Is it possible to be created but it not show up on the list of principals? I remember once having to add a principal to IAM once for one that was created but wasn't show up on the list. – user994165 Jun 02 '22 at 15:12
  • I will try an export for myself today. If it works as I suspect, the Google-managed Service Account (`service-{project-num}@gcp-sa-cloudasset.iam.gserviceaccount.com`) **should** be added by the enablement of the Cloud Asset service. It probable that I'm misunderstanding the implementation if you don't see an account present. Yes, it is possible (although unlikely) that it's being created and not being added to the policy. – DazWilkin Jun 02 '22 at 16:24
  • I think (!) this is Google's error. I just tried an export and I see the same behavior. What's curious (do you see this too?) is that, each time I run `gcloud asset export` it prompts to enable `cloudasset.googleapis.com` even though I'm certain the service is enabled in my project (because I `gcloud services enable cloudasset.googleapis.com --project=${PROJECT}` beforehand). I **think** that the Cloud Asset is having problems creating the Service Account that it adds to your project in order to function. I think! – DazWilkin Jun 02 '22 at 17:18
  • It may be worth filing a bug on Google's public [Issue Tracker: Cloud Asset Inventory](https://issuetracker.google.com/issues/new?component=1134288&template=1640627) – DazWilkin Jun 02 '22 at 17:19
  • The error `Permission denied to generate service identity for service [cloudasset.googleapis.com]` kinda accords with my intuition that the service needs to create a Service Account (and it's not being permitted to do so). – DazWilkin Jun 02 '22 at 17:20
  • @DazWilkin, I created issue https://b.corp.google.com/issues/234833177 – user994165 Jun 03 '22 at 14:38
  • 1
    Nice! Thanks. Adding the public link for others outside of the Goo: https://issuetracker.google.com/issues/234833177 – DazWilkin Jun 03 '22 at 15:05

0 Answers0