gcloud: The user does not have access to service account "default"
Solution 1
After talking to Google Support, the issue was that the service account did not have a "Service Account User" permissions activated. Adding "Service Account User" resolves this error.
Solution 2
Add the following role to the service account who makes the operation:
Service Account User
Also see:
https://cloud.google.com/kubernetes-engine/docs/how-to/iam#service_account_user
https://cloud.google.com/iam/docs/service-accounts#the_service_account_user_role
Solution 3
For those that ended up here trying to do an Import of Firebase Firestore documents with a command such as:
gcloud beta firestore import --collection-ids='collectionA','collectionB' gs://YOUR_BUCKET
I got around the issue by doing the following:
- From the Google Cloud Console Storage Bucket Browser, add the service account completing the operation to the list of members with a role of
Storage Admin
. - Re-attempt the operation.
For security, I revoked the role after the operation completed, but that's optional.
Comments
-
DrMarshall about 2 years
I attempting to use an activated service account scoped to create and delete gcloud container clusters (k8s clusters), using the following commands:
gcloud config configurations create my-svc-account \ --no-activate \ --project myProject gcloud auth activate-service-account [email protected] \ --key-file=/path/to/keyfile.json \ --configuration my-svc-account gcloud container clusters create a-new-cluster \ --configuration my-svc-account \ --project= my-project --zone "my-zone"
I always receive the error:
...ERROR: (gcloud.container.clusters.create) ResponseError: code=400, message=The user does not have access to service account "default".
How do I grant my-svc-account access to the default service account for GKE?
-
mongrelion almost 7 yearsCheers. This definitely did it. Only thing to note is that the role is now called "Service Account User".
-
matt b over 6 yearsfor more info on the above point see cloud.google.com/iam/docs/…
-
vanduc1102 about 5 yearswork well for me, my case, I call
ssh
from Google Cloud Build to Google Engine VM Instance