Description
Pinned Note
NOTE: THIS IS NOT A BUG IN DJANGO-GCP
What is the current behavior?
On trying to enqueue a task from a django server running in Google Cloud Run, you may get the following error:
Traceback (most recent call last): File "/usr/local/lib/python3.9/site-packages/google/api_core/grpc_helpers.py", line 72, in error_remapped_callable return callable_(*args, **kwargs)
File "/usr/local/lib/python3.9/site-packages/grpc/_channel.py", line 1030, in __call__ return _end_unary_response_blocking(state, call, False, None)
File "/usr/local/lib/python3.9/site-packages/grpc/_channel.py", line 910, in _end_unary_response_blocking raise _InactiveRpcError(state) # pytype: disable=not-instantiable grpc._channel._InactiveRpcError: <_InactiveRpcError of RPC that terminated with:
status = StatusCode.PERMISSION_DENIED
details = "The principal (user or service account) lacks IAM permission "iam.serviceAccounts.actAs" for the resource "[email protected]" (or the resource may not exist)."
Until recently, django-gcp worked as expected. Some time around or somewhat before October 12th 2023, GCP changed something under the hood that broke the ability to place tasks in the queue. We started to get the above error on any attempt to enqueue() a task.
Fix
After a lot of diagnostics and a full measure of total disbelief, it turns out that now, in order to place a task on a queue, you have to allow the service account you're using to impersonate itself.
The solution to this in gcloud is to do:
gcloud iam service-accounts add-iam-policy-binding [email protected] --member serviceAccount:[email protected] --role roles/iam.serviceAccountUser
WARNING!
DO NOT TRY: An alternative solution of applying the roles/iam.serviceAccountUser to your entire project is floating around. This presents a grave security hole - a good discussion on that is given at the end of this thread.