PERMISSION_DENIED Error When Creating a Queue with Google Cloud Tasks

Question

I'm developing a Node.js application and trying to create a queue using Google Cloud Tasks, but I encounter the following error:

Error: 7 PERMISSION_DENIED: The principal (user or service account) lacks IAM permission "cloudtasks.queues.create" for the resource "projects/XXXXXX/locations/europe-central2" (or the resource may not exist).

Steps Taken:

1- Service Account Creation: I created a service account and assigned it the "Cloud Tasks Queue Admin" role (roles/cloudtasks.queueAdmin), which includes the cloudtasks.queues.create permission.

2- Client Configuration: I configured the Cloud Tasks client in my code as follows:

const { CloudTasksClient } = require('@google-cloud/tasks');
const clientCloudTasks = new CloudTasksClient({
  keyFilename: "./serviceAccountKey.json",
});

3- Queue Creation Attempt: I attempted to create a queue with the following code:

const queuePath = clientCloudTasks.queuePath('my-project-id', 'europe-central2', 'my-queue-id');

const queue = {
  name: queuePath,
  rateLimits: {
    maxDispatchesPerSecond: 1,
  },
};

const request = {
  parent: clientCloudTasks.locationPath('my-project-id', 'europe-central2'),
  queue: queue,
};

await clientCloudTasks.createQueue(request);

Additional Details:

• I verified that the "Cloud Tasks Queue Admin" role includes the cloudtasks.queues.create permission.
• The service account is correctly configured, and the JSON key file is properly referenced in the code.
• The specified project and location exist and are correctly referenced.

Question:

Why am I receiving this permission error despite the configurations made?

Answer 1

Before we focus on the permission error, let’s go back to the basics and make sure you performed these checks:

1. Enable billing for your project

2. Enable the Cloud Tasks API

For the permission error, here are the things you can try:

• Inspect the resources; make sure to use the project ID (alphanumeric) not project number (numerical value)

• If Cloud Tasks API was enabled prior to March 19, 2019

  • you need to manually add role “Cloud Tasks Service Agent”

  • verify if you have the Google-managed Cloud Task service account service-[project-number]@gcp-sa-cloudtasks.iam.gserviceaccount.com within the project

• grant access to your service account with the following command (if applicable or have equivalent steps for your environment):

gcloud projects add-iam-policy-binding {project} \ 
--member=serviceAccount:{service-account-email} \ 
--role=roles/cloudtasks.queueAdmin 

(or roles/cloudtasks.admin -- not advisable but for testing purposes to see if there's any difference. Although @DazWilkin repro suggests that queueAdmin is working fine)

• Delete roles and add it again