ERROR: (gcloud.composer.environments.create) PERMISSION_DENIED: The caller
does not have permission
或
ERROR: (gcloud.composer.environments.create) PERMISSION_DENIED: User not
authorized to act as service account <service-account-name>.
The user must be granted iam.serviceAccounts.actAs permission, included in
Owner, Editor, Service Account User role. See https://cloud.google.com/iam/docs
/understanding-service-accounts for additional details.
Errors in: [Web server]; Error messages:
Creation of airflow web server version failed. This may be an intermittent
issue of the App Engine service. You may retry the operation later.
{"ResourceType":"appengine.v1.version","ResourceErrorCode":"504","ResourceError
Message":"Your deployment has failed to become healthy in the allotted time
and therefore was rolled back. If you believe this was an error, try adjusting
the 'app_start_timeout_sec' setting in the 'readiness_check' section."}
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-08-26 (世界標準時間)。"],[[["\u003cp\u003eThis page provides guidance on troubleshooting issues encountered during the creation of Cloud Composer environments, focusing on Cloud Composer 3.\u003c/p\u003e\n"],["\u003cp\u003eCommon causes of environment creation failures include service account permission problems, incorrect network configurations, quota limitations, and incompatible organization policies.\u003c/p\u003e\n"],["\u003cp\u003eInsufficient permissions often result in specific error messages, and solutions involve assigning proper roles to both the user account and the environment's service account.\u003c/p\u003e\n"],["\u003cp\u003eWarnings about missing IAM roles may be generated, which might be safely ignored if custom roles are properly configured, but they should be checked for missing permissions for service accounts.\u003c/p\u003e\n"],["\u003cp\u003eCertain organization policies, such as \u003ccode\u003ecompute.disableSerialPortLogging\u003c/code\u003e and \u003ccode\u003ecompute.requireOsLogin\u003c/code\u003e, have specific requirements for successful environment creation.\u003c/p\u003e\n"]]],[],null,["# Troubleshooting environment creation\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\n**Cloud Composer 3** \\| [Cloud Composer 2](/composer/docs/composer-2/troubleshooting-environment-creation \"View this page for Cloud Composer 2\") \\| [Cloud Composer 1](/composer/docs/composer-1/troubleshooting-environment-creation \"View this page for Cloud Composer 1\")\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\nThis page provides troubleshooting information for problems that you might\nencounter while creating Cloud Composer environments.\n\nFor troubleshooting information related to updating and upgrading environments,\nsee\n[Troubleshooting environment updates and upgrades](/composer/docs/composer-3/troubleshooting-updates-upgrades).\n\nWhen Cloud Composer environments are created, the majority of\nissues happen because of the following reasons:\n\n- Service account permission problems.\n\n- Incorrect Firewall, DNS or routing information.\n\n- Network-related issues. For example, invalid VPC configuration, IP address\n conflicts, or network IP ranges that are too narrow.\n\n- Quota-related issues.\n\n- Incompatible Organization Policies.\n\nInsufficient permissions to create an environment\n-------------------------------------------------\n\n| **Note:** You can validate that you configured permissions are correct using the [IAM permission validation](https://github.com/arunjvattoly/Composer) script. The script validates the permissions for both Shared VPC and non-Shared VPC configuration.\n\nIf Cloud Composer cannot create an environment because your account\nhas insufficient permissions, it outputs the following error messages: \n\n ERROR: (gcloud.composer.environments.create) PERMISSION_DENIED: The caller\n does not have permission\n\nor \n\n ERROR: (gcloud.composer.environments.create) PERMISSION_DENIED: User not\n authorized to act as service account \u003cservice-account-name\u003e.\n The user must be granted iam.serviceAccounts.actAs permission, included in\n Owner, Editor, Service Account User role. See https://cloud.google.com/iam/docs\n /understanding-service-accounts for additional details.\n\n**Solution** : Assign roles to both to your account and to the service account\nof your environment as described in [Access control](/composer/docs/composer-3/access-control).\n\n- In Cloud Composer 2, make sure that **Cloud Composer Service Agent**\n service account\n (`service-`\u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e`@cloudcomposer-accounts.iam.gserviceaccount.com`)\n has the **Cloud Composer v2 API Service Agent Extension** role assigned.\n\n- Make sure that **Google APIs Service Agent**\n (\u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e`@cloudservices.gserviceaccount.com`)\n has the **Editor** role assigned.\n\n- In the Shared VPC configuration, follow\n [Configure Shared VPC instructions](/composer/docs/composer-3/configure-shared-vpc).\n\nThe service account of the environment has insufficient permissions\n-------------------------------------------------------------------\n\nWhen creating a Cloud Composer environment, you specify a service\naccount that runs the environment's GKE cluster nodes. If this\nservice account does not have enough permissions for the requested operation,\nCloud Composer outputs the following error: \n\n Errors in: [Web server]; Error messages:\n Creation of airflow web server version failed. This may be an intermittent\n issue of the App Engine service. You may retry the operation later.\n {\"ResourceType\":\"appengine.v1.version\",\"ResourceErrorCode\":\"504\",\"ResourceError\n Message\":\"Your deployment has failed to become healthy in the allotted time\n and therefore was rolled back. If you believe this was an error, try adjusting\n the 'app_start_timeout_sec' setting in the 'readiness_check' section.\"}\n\n**Solution** : Assign roles to both to your account and to the service account\nof your environment as described in [Access control](/composer/docs/composer-3/access-control).\n\nWarnings about missing IAM roles in service accounts\n----------------------------------------------------\n\nWhen an environment creation fails, Cloud Composer generates the\nfollowing warning message after an error occurred:\n`The issue may be caused by missing IAM roles in the following Service Accounts\n...`.\n\nThis warning message highlights possible causes for the error.\nCloud Composer checks for required roles on the service accounts in\nyour project, and if these roles are not present, it generates this warning\nmessage.\n| **Note:** This check applies only to the project where you create the environment. In case of Shared VPC configuration, Cloud Composer does not perform this check in the host project. To enable this check in Shared VPC, the Cloud Composer Service Agent account from the service project must have permission to view roles in the host project. To allow it, grant the **Role Viewer** (`roles/iam.roleViewer`) role to the Cloud Composer Service Agent account from the service project at the host project level.\n\n**Solution** : Check that service accounts mentioned in the warning message have\nthe required roles. For more information about roles and permissions in\nCloud Composer, see [Access control](/composer/docs/composer-3/access-control).\n\nIn some cases, you can ignore this warning. Cloud Composer does not\ncheck individual permissions assigned to roles. For example, If you use\ncustom IAM roles, it is possible that the service account\nmentioned in the warning message already has all required permissions. In this\ncase, you can ignore this warning.\n\nIncompatible organization policies\n----------------------------------\n\nThe following policies must be configured appropriately so that\nCloud Composer environments can be created successfully.\n| **Important:** This page only **lists incompatible organization policies** for Cloud Composer and how they must be configured. For **detailed\n| instructions about configuring each policy** , see [Organization policy constraints](/resource-manager/docs/organization-policy/org-policy-constraints) in the Resource Manager documentation.\n\nIncompatible principal access boundary policies\n-----------------------------------------------\n\n[Principal access boundary policies](/iam/docs/principal-access-boundary-policies) configured in your organization\ncan be configured in a way that blocks some of your environment's operations or\nprevents the creation of new environments.\n\nIf this is the case, you might see the following line in the error messages: \n\n Operations on resource are denied due to an IAM Principal Access Boundary Policy.\n\nThe components of your environment are located in\n[a tenant and a customer project](/composer/docs/composer-3/environment-architecture#about-customer-tenant). The tenant\nproject is Google-managed and doesn't belong to the organization where the\nenvironment is located. The\n[service account of your environment](/composer/docs/composer-3/access-control#service-account) must have\npermissions to perform operations in the tenant project.\n\n**Solution**:\n\n- Add a condition expression to the policy's binding to exclude the environment's service account from the policy. For an example of how to exclude a principal so that the policy doesn't apply to it, see [Conditional policy bindings for principal access boundary policies](/iam/docs/principal-access-boundary-policies#conditions) in the Identity and Access Management documentation.\n\nRestricting services used within organization or project\n--------------------------------------------------------\n\nOrganization or project administrators can restrict what Google services can be\nused in their projects using the\n[`gcp.restrictServiceUsage`](/resource-manager/docs/organization-policy/restricting-resources)\norganization policy constraint.\n\nWhen using this organization policy, it's important to\n[allow all the services required by Cloud Composer](/composer/docs/composer-3/enable-composer-service#required-services).\n\nWhat's next\n-----------\n\n- [Creating environments](/composer/docs/composer-3/create-environments)\n- [Troubleshooting environment updates and upgrades](/composer/docs/composer-3/troubleshooting-updates-upgrades)\n- [Access control](/composer/docs/composer-3/access-control)"]]
