Cloud build keeps using legacy service account despite change in settings

In june 2024, GCP changed the default service account for Cloud Build as explained here https://cloud.google.com/build/docs/cloud-build-service-account-updates#what_do_you_need_to_do

Due to this, new builds of old Cloud functions are not possible using the console UI.

No matter what I do , the builds fail and the logs keep mentioning that

The legacy Cloud Build service account xxxxxxxxxxxx@cloudbuild.gserviceaccount.com running this build does not have permission(s) to execute the build.

This happens for new and old cloud builds.

I am trying to create a simple cloud function that never builds because of this.

I have already tried their suggestions for this and I have implemented them all (except organization level policy changes which I am not allowed to do)

• Create new service account and give cloud build permissions
• Or use the project's compute account
• In Cloud Build settings, set such a service account as the preferred service account

I have given Cloud Build permissions to both compute and custom service accounts. I have tried to set both as preferred cloud build service accounts.

I have the IAM role to act as those service accounts.

I would appreciate a solution that doesn't involve gcloud, only the console UI (if such a solution exists).

Try deploying your cloud function using gcloud CLI with gcloud functions deploy then indicate there the build service account you are going to use with the --build-service-account flag.

If the issue still persists, consider filing a bug issue so that the engineering team can look into it. Note that there’s no specific timeline when the fix will be available.