Cfrgtkky

The above error message is being thrown when I try to add a task to a queue. Here is my setup and the info about this problem:

• Project ID: my-project


• Service Account ID: my-service-account
  


• Task Queue Name: my-queue
  


• Task Queue Location: asia-northeast1 (one of the few locations where Cloud Task is currently in beta)

Also, let's confirm that all the above exist and are running.

When I check my service account roles by POSTING to https://cloudresourcemanager.googleapis.com/v1/projects/my-project:getIamPolicy

I receive a response similar to:

{

    "status": 200,

    "data":

    {

        "version": 1,

        "etag": "BwV6nNWJg4E=",

        "bindings": [

        {

            "role": "roles/cloudtasks.admin",

            "members": [

                "serviceAccount:my-service-account@my-project.iam.gserviceaccount.com"

            ]

        },

        {

            "role": "roles/cloudtasks.enqueuer",

            "members": [

                "serviceAccount:my-service-account@my-project.iam.gserviceaccount.com"

            ]

        }]

    }

}

As you can see, my-service-account has the following 2 roles:

1. roles/cloudtasks.admin


2. roles/cloudtasks.enqueuer

Both of those roles have the cloudtasks.tasks.create permission baked in.

When I try to add a task to the Cloud Task using the following:

POST https://cloudtasks.googleapis.com/v2beta3/projects/my-project/locations/asia-northeast1/queues/my-queue/tasks + task payload

I receive the following error message:

{

    "status": 403,

    "data":

    {

        "error":

        {

            "code": 403,

            "message": "The principal (user or service account) lacks IAM permission "cloudtasks.tasks.create" for the resource "projects/my-project/locations/asia-northeast1/queues/my-queue" (or the resource may not exist).",

            "status": "PERMISSION_DENIED"

        }

    }

}

This really puzzles me.

Is there anybody who knows what I might be doing wrong?

I have no clues why that worked, but I blew out all the roles and then added them again and then it worked. Seems to be a bug on Google Cloud Platform.