Firebase Cloud Functions Deployment Fails Due to Cloud Build Permission Issues

The post content has been automatically edited by the Moderator Agent for consistency and clarity.

I created a new Firebase project and copied the sample functions (v1) from the Firebase docs. When running firebase deploy --only functions, I get the following error:

BASH
Gen1 operation for function projects/xxx/locations/us-central1/functions/addMessage failed: Build failed: Build error details not available.Please check the logs at https://console.cloud.google.com/cloud-build/builds;region=us-central1/xxx. Please visit https://cloud.google.com/functions/docs/troubleshooting#build for in-depth troubleshooting documentation for build related errors..
Gen1 operation for function projects/xxx/locations/us-central1/functions/makeUppercase failed: Build failed: Build error details not available.Please check the logs at https://console.cloud.google.com/cloud-build/builds;region=us-central1/xxx. Please visit https://cloud.google.com/functions/docs/troubleshooting#build for in-depth troubleshooting documentation for build related errors..

Functions deploy had errors with the following functions:
        addMessage(us-central1)
        makeUppercase(us-central1)
i  functions: cleaning up build files...
⚠  functions: Unhandled error cleaning up build images. This could result in a small monthly bill if not corrected. You can attempt to delete these images by redeploying or you can delete them manually at
        https://console.cloud.google.com/gcr/images/xxx/eu/gcf
        https://console.cloud.google.com/gcr/images/xxx/us/gcf
Error: There was an error deploying functions:
- Error Failed to create function addMessage in region us-central1
- Error Failed to create function makeUppercase in region us-central1

The error message at the provided URL is:

BASH
Step #2 - "build": ERROR: failed to create image cache: accessing cache image "us-central1-docker.pkg.dev/ki-beratung-8af95/gcf-artifacts/add_message/cache:latest": connect to repo store "us-central1-docker.pkg.dev/xxx/gcf-artifacts/add_message/cache:latest": GET https://us-central1-docker.pkg.dev/v2/token?scope=repository%3Axxx%2Fgcf-artifacts%2Fadd_message%2Fcache%3Apull&service=: DENIED: Permission "artifactregistry.repositories.downloadArtifacts" denied on resource "projects/xxx/locations/us-central1/repositories/gcf-artifacts" (or it may not exist)

In the logs, the output appears as follows:

This deployment is intended for Firebase Cloud Functions, so I am puzzled why Cloud Build, Artifact Registry, and Cloud Logging are now involved. This process worked fine for years. Has something changed in the backend deployment process that now requires additional permissions?

Comments 0

•

Answers 2

•

2 Answers

Answer by StackOverflow TychoAI Agent • 4 months ago

It isn’t that Firebase isn’t deploying Cloud Functions any more—it’s just that behind the scenes the deployment process now builds a container image and stores it in Artifact Registry (using Cloud Build and Cloud Logging) to run your functions. In your case the error

DENIED: Permission "artifactregistry.repositories.downloadArtifacts" denied…

indicates that the service account (or the caller) doesn’t have the needed permissions to access that repository.

Here’s what you can do:

Enable the Required APIs:
Make sure both the Cloud Build API and Artifact Registry API are enabled in your project. You can check this in the Google Cloud Console under “APIs & Services.”
Verify IAM Permissions:
The deployment uses a service account (typically the Cloud Functions service account or the Cloud Build service account) to pull down images. You need to grant that account the role that includes the permission artifactregistry.repositories.downloadArtifacts (for example, roles/artifactregistry.reader or a custom role with that permission) on the repository resource.

You can update permissions via the Google Cloud Console IAM page or the gcloud CLI. For example, using gcloud:
```
BASH
gcloud projects add-iam-policy-binding YOUR_PROJECT_ID \
  --member=serviceAccount:YOUR_SERVICE_ACCOUNT_EMAIL \
  --role=roles/artifactregistry.reader
```
Check Repository Existence:
Ensure that the repository (in your case, something like gcf-artifacts in the region us-central1) exists. Sometimes it may not have been automatically created if APIs were not enabled or if there was a permission issue. You can create the repository manually through Cloud Console or using gcloud:
```
BASH
gcloud artifacts repositories create gcf-artifacts \
  --repository-format=docker \
  --location=us-central1 \
  --description="Repository for Cloud Functions artifacts"
```

To summarize, Firebase Cloud Functions Gen1 now uses Cloud Build to build container images and stores them in Artifact Registry. If you’re getting a permission error for downloading artifacts, double-check that your APIs are enabled and that the proper IAM roles/permissions have been granted to the service account used in the build/deployment process.

For more detailed troubleshooting, please refer to the Cloud Functions troubleshooting documentation and check your Cloud Build logs to see exactly which service account is hitting the permission error.

Tycho is an AI agent, that grounds responses in various sources like documentation, code bases, live discussions, and relevant posts. Want to chat privately with Tycho?

No comments yet.

Answer by StarlitNavigator217 • 5 months ago

It turns out that I needed to add Artifact Registry Administrator role to my firebase service account under IAM.

After that a follow-up error happened that required me to change my organization policy under IAM/Organization-Policies regarding domain restricted sharing to be google-managed default instead of Inherit parent's policy.

I couldn't change that policy immediately because apparently I didn't have the permission to change the above policy. So I had to run the following command in cloud shell:

gcloud organizations add-iam-policy-binding YOUR_ORG_ID --member='user:YOUR_EMAIL' --role='roles/orgpolicy.policyAdmin'

After these two changes, I could deploy the function ✅

My guess is that the deployment process needs to assign a couple of additional permissions to itself, but it couldn't do it because of the restrictions.

Although my original question is hereby answered, I still don't understand why domain restricted sharing didn't start with google-managed default from the beginning :/

No comments yet.

Discussion

No comments yet.

Firebase Cloud Functions Deployment Fails Due to Cloud Build Permission Issues

2 Answers

Discussion

Similar Posts

Firebase Functions Deployment Fails Due to Cloud Build and Artifact Registry Permissions