title: gcloud builds submit of Django website results in error "does not have storage.objects.get access"
body: <p>I'm trying to deploy my Django website with Cloud Run, as described in <a href="https://cloud.google.com/python/django/run#deploy" rel="nofollow noreferrer">Google Cloud Platform's documentation</a>, but I get the error <code>Error 403: 934957811880@cloudbuild.gserviceaccount.com does not have storage.objects.get access to the Google Cloud Storage object., forbidden</code> when running the command <code>gcloud builds submit --config cloudmigrate.yaml --substitutions _INSTANCE_NAME=trouwfeestwebsite-db,_REGION=europe-west6</code>.</p>
  <p>The full output of the command is:  (the error is at the bottom)</p>
  <pre><code>Creating temporary tarball archive of 119 file(s) totalling 23.2 MiB before compression.
  Some files were not included in the source upload.
  
  Check the gcloud log [C:\Users\Sander\AppData\Roaming\gcloud\logs\2021.10.23\20.53.18.638301.log] t
  o see which files and the contents of the
  default gcloudignore file used (see `$ gcloud topic gcloudignore` to learn
  more).
  
  Uploading tarball of [.] to [gs://trouwfeestwebsite_cloudbuild/source/1635015198.74424-eca822c138ec
  48878f292b9403f99e83.tgz]
  ERROR: (gcloud.builds.submit) INVALID_ARGUMENT: could not resolve source: googleapi: Error 403: 934957811880@cloudbuild.gserviceaccount.com does not have storage.objects.get access to the Google Cloud Storage object., forbidden
  </code></pre>
  <p>On the level of my storage bucket, I granted 934957811880@cloudbuild.gserviceaccount.com the permission Storage Object Viewer, as I see on <a href="https://cloud.google.com/storage/docs/access-control/iam-roles" rel="nofollow noreferrer">https://cloud.google.com/storage/docs/access-control/iam-roles</a> that this covers <code>storage.objects.get</code> access.
  I also tried by granting Storage Object Admin and Storage Admin.</p>
  <p>I also added the &quot;Viewer&quot; role on IAM level (<a href="https://console.cloud.google.com/iam-admin/iam" rel="nofollow noreferrer">https://console.cloud.google.com/iam-admin/iam</a>) for 934957811880@cloudbuild.gserviceaccount.com, as suggested in <a href="https://stackoverflow.com/a/68303613/5433896">https://stackoverflow.com/a/68303613/5433896</a> and <a href="https://github.com/google-github-actions/setup-gcloud/issues/105" rel="nofollow noreferrer">https://github.com/google-github-actions/setup-gcloud/issues/105</a>, but it seems fishy to me to give the account such a broad role.</p>
  <p>I enabled Cloud run in the Cloud Build permissons tab: <a href="https://console.cloud.google.com/cloud-build/settings/service-account?project=trouwfeestwebsite" rel="nofollow noreferrer">https://console.cloud.google.com/cloud-build/settings/service-account?project=trouwfeestwebsite</a></p>
  <p>With these changes, I still get the same error when running the gcloud builds submit command.</p>
  <p>I don't understand what I could be doing wrong in terms of credentials/authentication (<a href="https://stackoverflow.com/a/68293734/5433896">https://stackoverflow.com/a/68293734/5433896</a>). I didn't change my google account password nor revoked permissions of that account to the Google Cloud SDK since I initialized that SDK.</p>
  <p>Do you see what I'm missing?</p>
  <p>The content of my <code>cloudmigrate.yaml</code> is:</p>
  <pre><code>steps:
    - id: &quot;build image&quot;
      name: &quot;gcr.io/cloud-builders/docker&quot;
      args: [&quot;build&quot;, &quot;-t&quot;, &quot;gcr.io/${PROJECT_ID}/${_SERVICE_NAME}&quot;, &quot;.&quot;]
  
    - id: &quot;push image&quot;
      name: &quot;gcr.io/cloud-builders/docker&quot;
      args: [&quot;push&quot;, &quot;gcr.io/${PROJECT_ID}/${_SERVICE_NAME}&quot;]
  
    - id: &quot;apply migrations&quot;
      name: &quot;gcr.io/google-appengine/exec-wrapper&quot;
      args:
        [
          &quot;-i&quot;,
          &quot;gcr.io/$PROJECT_ID/${_SERVICE_NAME}&quot;,
          &quot;-s&quot;,
          &quot;${PROJECT_ID}:${_REGION}:${_INSTANCE_NAME}&quot;,
          &quot;-e&quot;,
          &quot;SETTINGS_NAME=${_SECRET_SETTINGS_NAME}&quot;,
          &quot;--&quot;,
          &quot;python&quot;,
          &quot;manage.py&quot;,
          &quot;migrate&quot;,
        ]
  
    - id: &quot;collect static&quot;
      name: &quot;gcr.io/google-appengine/exec-wrapper&quot;
      args:
        [
          &quot;-i&quot;,
          &quot;gcr.io/$PROJECT_ID/${_SERVICE_NAME}&quot;,
          &quot;-s&quot;,
          &quot;${PROJECT_ID}:${_REGION}:${_INSTANCE_NAME}&quot;,
          &quot;-e&quot;,
          &quot;SETTINGS_NAME=${_SECRET_SETTINGS_NAME}&quot;,
          &quot;--&quot;,
          &quot;python&quot;,
          &quot;manage.py&quot;,
          &quot;collectstatic&quot;,
          &quot;--verbosity&quot;,
          &quot;2&quot;,
          &quot;--no-input&quot;,
        ]
  
  substitutions:
    _INSTANCE_NAME: trouwfeestwebsite-db
    _REGION: europe-west6
    _SERVICE_NAME: invites-service
    _SECRET_SETTINGS_NAME: django_settings
  
  images:
    - &quot;gcr.io/${PROJECT_ID}/${_SERVICE_NAME}&quot;
  </code></pre>
  <p>Thank you very much for any help.</p>