Github 操作不适用于 GCP。403：权限“iam.serviceAccounts.getAccessToken”被拒绝

Question

我正在尝试创建一个 GithubAction 作业，该作业应通过身份联合在 GCP 中进行身份验证并将一些文件上传到存储桶。

这是 GitHub Action 的完整源代码。

在这项工作中，我有这样一个不起作用的步骤：

    - id: 'auth'
      name: 'Authenticate to Google Cloud'
      uses: 'google-github-actions/auth@v1'
      with:
        workload_identity_provider: 'projects/736194043976/locations/global/workloadIdentityPools/my-pool/providers/my-provider'
        service_account: 'githubsa@learning-words-trial.iam.gserviceaccount.com'
        token_format: 'access_token'

不幸的是，它失败并出现 403 错误：

Error: google-github-actions/auth failed with: retry function failed after 1 attempt: failed to generate Google Cloud access token for githubsa@learning-words-trial.iam.gserviceaccount.com: (403) {
  "error": {
    "code": 403,
    "message": "Permission 'iam.serviceAccounts.getAccessToken' denied on resource (or it may not exist).",
    "status": "PERMISSION_DENIED",
    "details": [
      {
        "@type": "type.googleapis.com/google.rpc.ErrorInfo",
        "reason": "IAM_PERMISSION_DENIED",
        "domain": "iam.googleapis.com",
        "metadata": {
          "permission": "iam.serviceAccounts.getAccessToken"
        }
      }
    ]
  }
}

我的服务帐户githubsa@learning-words-trial.iam.gserviceaccount.com有足够的权限：

主体已设置（我添加了随机角色进行测试）：

另外，my-pool和my-provider根据教程进行配置并与服务帐户连接。

以下是 GCP 的审核日志：

{
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "status": {
      "code": 7,
      "message": "Permission 'iam.serviceAccounts.getAccessToken' denied on resource (or it may not exist)."
    },
    "authenticationInfo": {
      "serviceAccountDelegationInfo": [
        {}
      ],
      "principalSubject": "principal://iam.googleapis.com/projects/736194043976/locations/global/workloadIdentityPools/my-pool/subject/repo:vyshkov/gcp-serverless:ref:refs/heads/main"
    },
    "requestMetadata": {
      "callerIp": "172.176.229.16",
      "callerSuppliedUserAgent": "google-github-actions:auth/1.0.0,gzip(gfe)",
      "requestAttributes": {
        "time": "2023-02-26T15:54:55.543085043Z",
        "auth": {}
      },
      "destinationAttributes": {}
    },
    "serviceName": "iamcredentials.googleapis.com",
    "methodName": "GenerateAccessToken",
    "authorizationInfo": [
      {
        "permission": "iam.serviceAccounts.getAccessToken",
        "resourceAttributes": {}
      }
    ],
    "resourceName": "projects/-/serviceAccounts/103065049355271736573",
    "request": {
      "@type": "type.googleapis.com/google.iam.credentials.v1.GenerateAccessTokenRequest",
      "name": "projects/-/serviceAccounts/githubsa@learning-words-trial.iam.gserviceaccount.com"
    },
    "metadata": {
      "identityDelegationChain": [
        "projects/-/serviceAccounts/githubsa@learning-words-trial.iam.gserviceaccount.com"
      ]
    }
  },
  "insertId": "sbbvpke10rst",
  "resource": {
    "type": "service_account",
    "labels": {
      "unique_id": "103065049355271736573",
      "email_id": "githubsa@learning-words-trial.iam.gserviceaccount.com",
      "project_id": "learning-words-trial"
    }
  },
  "timestamp": "2023-02-26T15:54:55.523760524Z",
  "severity": "ERROR",
  "logName": "projects/learning-words-trial/logs/cloudaudit.googleapis.com%2Fdata_access",
  "operation": {
    "id": "14170752551549534963",
    "producer": "iamcredentials.googleapis.com",
    "first": true,
    "last": true
  },
  "receiveTimestamp": "2023-02-26T15:54:56.249222142Z"
}

你能指出我可能犯错误的地方吗？

Answer 1

403 权限被拒绝错误，例如Permission 'iam.serviceAccounts.getAccessToken' denied on resource (or it may not exist)由于服务账户 IAM 绑定上的委托人集与进行调用的委托人主题不匹配而导致的错误。

为 iam.googleapis.com 和 sts.googleapis.com 启用审核日志记录非常有用。有关更多详细信息，请参阅公共文档。

STS 令牌用于模拟principalSubject 已被授予roles/iam.workloadIdentityUser 角色的服务帐户。有关授予访问权限的更多详细信息，请参见此处。