Permissions required for projects.subscriptions.acknowledge and projects.subscriptions.pull method

[Mouzma]

My understanding is "pubsub.subscriptions.consume" is the permission for both APIs, but the API documentation for PubSub doesn't have the IAM permission.

[ms4446 · Accepted solution]

You are correct that the pubsub.subscriptions.consume permission is required for consuming messages from subscriptions in Pub/Sub. This permission allows a user or service account to pull messages from a subscription or to receive messages via push delivery. Google Cloud assigns broader roles such as roles/pubsub.subscriber, which include pubsub.subscriptions.consume. This role specifically grants the necessary permissions to consume messages, unlike roles/pubsub.viewer, which is read-only.

The Pub/Sub API documentation focuses more on the API's functionality rather than granular permission details, which are covered in the IAM documentation.

Verify the roles assigned to your user or service account, especially if you can consume messages. Ensure you have roles/pubsub.subscriber or another role that includes pubsub.subscriptions.consume.

You can find the IAM permissions for Pub/Sub operations in the Google Cloud Pub/Sub IAM documentation.