IssueTracker

This will create a public issue which anybody can view and comment on.

Please provide as much information as possible. At least, this should include a description of your issue and steps to reproduce the problem. If possible please provide a summary of what steps or workarounds you have already tried, and any docs or articles you found (un)helpful.

Problem you have encountered:

• The error message being triggered when trying to deploy a Cloud Functions using ActAs when the account does not have the required role (Service Account User) is misleading as it can be interpreted that the account missing the permissions is the SA instead of the actual account.

What you expected to happen:

• An error message to be triggered that is easily understandable, instead of the current error message which might lead to a possible confusion.
• Directly mentioning the account missing the permission instead of writing “caller” should also help to understand that the account missing the permissions is the actual account, and not the SA.

Steps to reproduce:

• Trying to deploy a Cloud Function while using an ActAs on a Service Account with an account that does not have the Service Account User role.
• When failing, an error message similar to [1] will be triggered, which is easily misleading as does not directly mention the caller account, therefore making it really confusing as you might think the account that needs the permissions is the Service Account, when the account missing the permissions is the actual caller.

[1]

Caller is missing permission 'iam.serviceaccounts.actAs' on service account projects/-/serviceAccounts/[SERVICE_ACCOUNT]. Grant the role 'roles/iam.serviceAccountUser' to the caller on the service account projects/-/serviceAccounts/[SERVICE_ACCOUNT]. You can do that by running 'gcloud iam service-accounts add-iam-policy-binding projects/-/serviceAccounts/[SERVICE_ACCOUNT] --member MEMBER --role roles/iam.serviceAccountUser'where MEMBER has a prefix like 'user:' or 'serviceAccount:'.Details and instructions for the Cloud Console can be found at https://cloud.google.com/functions/docs/reference/iam/roles#additional-configuration.

Other information (workarounds you have tried, documentation consulted, etc): N/A