Question

A Compute Engine VM runs a data-processing job that must write objects to a Cloud Storage bucket. The VM uses a custom service account that has been granted the roles/storage.objectAdmin IAM role on the bucket. However, the job fails with a 403 error when attempting to write objects. You inspect the VM and confirm the service account is correctly attached. What is the MOST likely cause of the failure?

Accepted Answer

The VM's access scopes do not include storage write access, so the token is limited despite the IAM role.

Answer

The roles/storage.objectAdmin role does not include permission to write objects and must be replaced with roles/storage.admin.

Answer

IAM roles granted at the bucket level are not honored; the role must be granted at the project level instead.

Answer

Custom service accounts cannot be used with Compute Engine VMs and must be replaced with the default service account.