Troubleshooting build errors and more

This page provides troubleshooting strategies as well as solutions for some common error messages that you might see when running a build.

Did you look at the build logs?

Use Logging or Cloud Storage build logs to get more information about the build error. Logs written to stdout or stderr are viewable using the Google Cloud console and the gcloud CLI.

Manual builds fail due to user not having access to build logs

You see the following error when trying to run a build manually:

AccessDeniedAccess denied. [EMAIL_ADDRESS] does not have storage.objects.get access to the Google Cloud Storage object.

You see this error because Cloud Build requires that users running manual builds and using the default Cloud Storage logs bucket have the Project Viewer IAM role in addition to the Cloud Build Editor role. To address this error, you can do one of the following:

• Use the default logs bucket, and grant the Project Viewer role and the Cloud Build Editor role to the user running the build. For instructions on granting this permission, see Configure access to Cloud Build resources.

• Create your own Cloud Storage bucket to store logs. For instructions see Storing build logs in a user-created bucket.

Builds fail due to missing iam.serviceAccounts.actAs permission

You see the following error when trying to deploy a build using a managed service such as Cloud Run or App Engine:

Missing necessary permission iam.serviceAccounts.actAs for [USER] on the service account [SERVICE ACCOUNT]

To address this error, configure your specified Cloud Build service account or the default Cloud Build service account to impersonate the service account of the managed service that you're using for your build. For more information about this task, see Configure Cloud Build service account impersonation for managed services.

For additional information about service accounts and permissions, see the following topics:

• Configure user-specified service accounts
• Cloud Build default service account
• Understanding IAM roles
• Granting permissions to the Cloud Build default service account

Permission denied error when deploying on Cloud Run functions

You see the following error when trying to use Cloud Run functions:

ResponseError: status=[403], code=[Ok], message=[Permission 'cloudfunctions.functions.get' denied]

To address this error, grant the Cloud Run functions Developer role to your build service account.

Build trigger fails due to missing cloudbuild.builds.create permission

You see something like the following error when running a build trigger:

Failed to trigger build: Permission 'cloudbuild.builds.create' denied on resource 'projects/xxxxxxxx' (or it may not exist)

Build triggers use a service account to create a build. This error indicates that the service account is missing the cloudbuild.builds.create IAM permission, which is required for the service account to run a build trigger. You can resolve this error by granting the Cloud Build Service Account IAM role to either your user-specified service account or the default service account.

Build submit failure due to missing service agent permissions

If the Cloud Build