Issues with service account permissions while deploying python code in cloud functions

[mahesh_123]

We are using default service account {projectname}@appspot.gserviceaccount.com to perform the cloud function code deploy (python code) through gcp console.
Provided below permissions through terraform 

"roles/iam.serviceAccountUser" = ["serviceAccount:{projectname}@appspot.gserviceaccount.com" ]
"roles/cloudfunctions.developer" = ["group:sample.developers@example.com"]

Getting below error, need some help here
Caller is missing permission 'iam.serviceaccounts.actAs' on service account {projectname}@appspot.gserviceaccount.com. Grant the role 'roles/iam.serviceAccountUser' to the caller on the service account {projectname}@appspot.gserviceaccount.com. You can do that by running 'gcloud iam service-accounts add-iam-policy-binding {projectname}@appspot.gserviceaccount.com --member MEMBER --role roles/iam.serviceAccountUser' where MEMBER has a prefix like 'user:' or 'serviceAccount:'. Details and instructions for the Cloud Console can be found at https://cloud.google.com/functions/docs/reference/iam/roles#additional-configuration. Please visit https://cloud.google.com/functions/docs/troubleshooting for in-depth troubleshooting documentation

[dionv]

Hello mahesh_123,

Checking on your concern encountered, I found a related post from StackOverflow by John Hanley. And seeing that you are deploying it through terraform, you can consider checking this documentation  on how to add the policy binding.

[melchisedekdulc]

Hey, I recently run into this issue as well. I don't know if you're using github at all (I couldn't tell from the question). 

But here are few things you could try: 

- Give your github actions account the role Service Account User.

- Add the Service Account User role to the service account indicated by error.

I did them in the opposite order, so that's why I think you should try the first option first and then the second one if that doesn't fix it.