Cloud Function in project A receives 403 when writing to a Cloud Storage bucket in project B. How do you fix it?
Choose an answer
Tap an option to check your answer.
Correct answer: Grant the service-PROJECTA@gcf-admin-robot.iam.gserviceaccount.com service account the roles/storage.objectCreator role for the Cloud Storage bucket..
Why this is the answer
The correct answer is to grant the Cloud Function's service account (service-PROJECTA@gcf-admin-robot.iam.gserviceaccount.com) the roles/storage.objectCreator role on the Cloud Storage bucket in Project B. Cloud Functions execute using a service account, not a user account. This service account needs explicit permissions to interact with resources in other projects. The roles/storage.objectCreator role provides the necessary permissions to write objects to a bucket. Granting your user account roles is incorrect because the Cloud Function operates under its service account, not your user identity. Granting roles/iam.serviceAccountUser to your user account is irrelevant to the Cloud Function's permissions to Cloud Storage. Enabling the Cloud Storage API in Project B is necessary for the bucket to exist and be accessible, but it doesn't grant the Cloud Function specific write permissions; those are handled by IAM roles.
Pass your exam — without the endless answer hunt
Get every verified question and explanation for this exam in one place, and save hours of prep. 1,000+ certifications · 20+ languages · free to start.
Pass your exam faster → No card needed