IssueTracker

This will create a public issue which anybody can view and comment on.

Please provide as much information as possible. At least, this should include a description of your issue and steps to reproduce the problem. If possible please provide a summary of what steps or workarounds you have already tried, and any docs or articles you found (un)helpful.

Problem you have encountered:

1. When using a Custom Service Account for Cloud Build Jobs the Cloud build tries to create a default Compute Service account when it was disabled leading to unnecessary “service accounts already exist”.
2. This also occurs despite disabling the following as per Cloud Build Service Account change [1]
   • Not Enforced: constraints/cloudbuild.disableCreateDefaultServiceAccount
   • Not enforced: constraints/cloudbuild.useComputeServiceAccount
   • Enforced: constraints/cloudbuild.useBuildServiceAccount
3. A sample logs on how this appears in Cloud Logging [2] :

{
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "status": {
      "code": 6,
      "message": "ALREADY_EXISTS"
    },
    "authenticationInfo": {},
    "requestMetadata": {
      "callerIp": "private",
      "requestAttributes": {
        "time": "2024-06-12T22:00:03.024584921Z",
        "auth": {}
      },
      "destinationAttributes": {}
    },
    "serviceName": "iam.googleapis.com",
    "methodName": "google.iam.admin.v1.CreateServiceAccount",
    "authorizationInfo": [
      {
        "resource": "projects/<project-id>",
        "permission": "iam.serviceAccounts.create",
        "granted": true,
        "resourceAttributes": {},
        "permissionType": "ADMIN_WRITE"
      }
    ],
    "resourceName": "projects/<project-id>",
    "request": {
      "account_id": "service-1234567890",
      "name": "<project-id>",
      "@type": "type.googleapis.com/google.iam.admin.v1.CreateServiceAccountRequest",
      "service_account": {
        "email": "1234567890-compute@developer.gserviceaccount.com",
        "display_name": "Default compute service account"
      }
    },
    "response": {
      "@type": "type.googleapis.com/google.iam.admin.v1.ServiceAccount"
    }
  },
  "insertId": "qwertyuiop",
  "resource": {
    "type": "service_account",
    "labels": {
      "unique_id": "",
      "email_id": "",
      "project_id": "<project-id>"
    }
  },
  "timestamp": "2024-06-12T22:00:03.006234766Z",
  "severity": "ERROR",
  "logName": "projects/<project-id>/logs/cloudaudit.googleapis.com%2Factivity",
  "receiveTimestamp": "2024-06-12T22:00:04.036560869Z"
}

What you expected to happen: These logs should not appear in the Cloud Logging for that specific build id.

Steps to reproduce:

1. Disable Default Compute Engine Service Account, create a Cloud Build Job which uses a custom Service account with Cloud Build Editor role.
2. The Cloud Build Job gets successfully executed however within Job there were observed multiple audit requests on creating Default Compute Engine Service Account
3. Since the Default Compute Engine Service Account is disabled but now we get “service accounts already exist” error logs. However the build execution got successfully completed. Indicating that the logs may appear unnecessarily.

Other information (workarounds you have tried, documentation consulted, etc):

• Is it possible to suppress these logs or provide more meaningful logs if there appears to be an issue with Service Account use. Because in these logs authenticationInfo always appears to be empty which makes it hard to track down from which Service Account / Service Agent this request was raised.