[SOLVED] What IAM role does serviceaccount need for exporting dns record-sets on GCP?

What IAM role does serviceaccount need for exporting dns record-sets on GCP?

I'm running a bash script from CloudBuild. The bash script is gonna export DNS record to a file.

gcloud dns record-sets export zonedump-$i.tmp --zone-file-format --project $projectname --zone=$i

The serviceaccount of cloudbuild has roles/dns.reader

I get this error when I run cloudbuild:

ERROR: (gcloud.dns.record-sets.export) HTTPError 403: Forbidden
Finished Step #3
ERROR
ERROR: build step 3 "gcr.io/google.com/cloudsdktool/cloud-sdk" failed: step exited with non-zero status: 1

cloudbuild.yaml

steps:
- name: 'bash'
  args: ['echo', 'Backing up DNS zone to Storage!']
- name: 'bash'
  args: ['ls']
- name: 'bash'
  args: ['chmod', '+x', 'scripts/dnszone_backup.bash']
- name: 'gcr.io/google.com/cloudsdktool/cloud-sdk'
  entrypoint: "bash"
  args:
    - "-c"
    - |
      echo "calling script"
      ls -la
      gcloud version
      scripts/dnszone_backup.bash

I would appreciate if someone can help me with this.

Solution

I needed to activate "Cloud Build API".

I found it by testing it via gcloud dns record-sets list and got a clear error message for activating this API.