I am setting up a service which I want to deploy to Cloud Run from Github Actions. However although the authentication action step is successful:

- name: Authenticate to Google Cloud
  id: auth
  uses: google-github-actions/auth@v2
  with:
  workload_identity_provider: "projects/<my-project>/locations/global/workloadIdentityPools/<workload-identity-pool-name>/providers/<provider-id>"
  service_account: <service-account-email>

After I build my docker image and I attempt to push to GCR:

- name: Push Docker images
  run: |
   docker push gcr.io/${{ env.PROJECT_ID }}/<project-name>:${{ github.sha }}

I get the error:

There was a problem refreshing your current auth tokens: ('Unable to acquire impersonated credentials', '{n  "error": {n    "code": 403,n    "message": "Permission 'iam.serviceAccounts.getAccessToken' denied on resource (or it may not exist).",n    "status": "PERMISSION_DENIED",n    "details": [n      {n        "@type": "type.googleapis.com/google.rpc.ErrorInfo",n        "reason": "IAM_PERMISSION_DENIED",n        "domain": "iam.googleapis.com",n        "metadata": {n          "permission": "iam.serviceAccounts.getAccessToken"n        }n      }n    ]n  }n}n')

In my GCP console I’ve set up:

• A provider using the standard issuer for GH, a ‘default audience’ selection, mapping the attributes audience, actor and subject
• A workload identity pool using this provider
• A service account with the permissions I require (gets iam.serviceAccounts.getAccessToken via Workload Identity User)
• A Principal with a principalSet entry for the repository where the GitHub Action itself lives

Could anyone shed some light on what I might be missing here?

I have checked to see if any organizational limits exist on permissions but can’t find anything.

I had expected to be able to do something in my pipeline for debugging purposes to tell me exactly what permissions are applied to the authenticated user after the first step but have had no luck.