gcloudgoogle-cloud-buildcloudbuild.yaml

ERROR: (gcloud.builds.submit) INVALID_ARGUMENT: could not parse service account URL

I want to use a custom Service Account to build my docker container with Cloud Build. Using gcloud iam service-accounts list and gcloud config list I have confirmed that the service account is in the project environment and I used gcloud services list --enabled to check that cloudbuild.googleapis.com is enabled. I get the error: ERROR: (gcloud.builds.submit) INVALID_ARGUMENT: could not parse service account URL. I tried all of the available service accounts and I tried with and without the prefix path. What is the correct URL or config after steps to get the service account working?

steps:
- name: 'gcr.io/cloud-builders/docker'
  args: ['build', '-t', 'gcr.io/my-project-id/my-app']
images: ['gcr.io/my-project-id/my-app']
serviceAccount: 'projects/my-project-id/serviceAccount/my-sa@my-project-id.iam.gserviceaccount.com'
options:
  logging: CLOUD_LOGGING_ONLY
Solution

  • The build config for serviceAccount references this page and there's an example that shows the structure:

    projects/{project-id}/serviceAccounts/{service-account-email}

    So, it follows Google's API convention of a plural noun (i.e. serviceAccounts) followed by the unique identifier.

    Another way to confirm this is via APIs Explorer for Cloud Build.

    The service's Build resource defines serviceAccount too.