I am currently developing a simple code in GCP cloud functions. The problem is that I need to connect to secret manager to get the api keys. In jupyter this code works perfectly for me: def access_secret_version(secret_id): project_id = os.getenv("GCP_PROJECT", "My_Project") name = f"projects/{project_id}/secrets/{secret_id}/versions/1" response = secret_client.access_secret_version(request={"name": name}) response = response.payload.data.decode("UTF-8") return json.loads(response.replace("'", '"')) ACCESS_TOKEN = access_secret_version("api_key") But when I deploy it via CI/CD, it throws me this error: "message": "Function failed on loading user code. This is likely due to a bug in the user code. Error message: File \"<frozen importlib._bootstrap_external>\", line 995, in exec_module File \"<frozen importlib._bootstrap>\", line 488, in _call_with_frames_removed File \"/workspace/main.py\", line 40, in <module> ACCESS_TOKEN = access_secret_version(\"api_key\") ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File \"/workspace/main.py\", line 35, in access_secret_version response = secret_client.access_secret_version(request={\"name\": name}) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File \"/layers/google.python.pip/pip/lib/python3.12/site-packages/google/cloud/secretmanager_v1/services/secret_manager_service/client.py\", line 1800, in access_secret_version response = rpc( ^^^^ File \"/layers/google.python.pip/pip/lib/python3.12/site-packages/google/api_core/gapic_v1/method.py\", line 131, in __call__ return wrapped_func(*args, **kwargs) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File \"/layers/google.python.pip/pip/lib/python3.12/site-packages/google/api_core/retry/retry_unary.py\", line 293, in retry_wrapped_func return retry_target( ^^^^^^^^^^^^^ File \"/layers/google.python.pip/pip/lib/python3.12/site-packages/google/api_core/retry/retry_unary.py\", line 153, in retry_target _retry_error_helper( File \"/layers/google.python.pip/pip/lib/python3.12/site-packages/google/api_core/retry/retry_base.py\", line 212, in _retry_error_helper raise final_exc from source_exc File \"/layers/google.python.pip/pip/lib/python3.12/site-packages/google/api_core/retry/retry_unary.py\", line 144, in retry_target result = target() ^^^^^^^^ File \"/layers/google.python.pip/pip/lib/python3.12/site-packages/google/api_core/timeout.py\", line 120, in func_with_timeout return func(*args, **kwargs) ^^^^^^^^^^^^^^^^^^^^^ File \"/layers/google.python.pip/pip/lib/python3.12/site-packages/google/api_core/grpc_helpers.py\", line 78, in error_remapped_callable raise exceptions.from_grpc_error(exc) from exc google.api_core.exceptions.PermissionDenied: 403 Permission 'secretmanager.versions.access' denied for resource 'projects/project/secrets/api_key/versions/latest' (or it may not exist).. Please visit https://cloud.google.com/functions/docs/troubleshooting for in-depth troubleshooting documentation." My user and the account service have the same roles, and I have already given the account service admin access to secret manager, secret version, etc. I have also already verified that the secret key exists in secret manager Can someone help me with the problem or what permission I should give the account service? Continue reading...
