Error: 7 PERMISSION_DENIED: User not authorized to perform this action when publishing to Pub/Sub from Cloud Function

The Solution

To resolve the PERMISSION_DENIED error, you must grant the roles/pubsub.publisher role to the specific service account assigned to your Cloud Function. This binding must be applied either at the project level or, preferably, directly on the target Pub/Sub topic to follow the principle of least privilege.

Minimal IAM Binding

The minimal permission required to publish messages is pubsub.topics.publish. This is bundled into the following predefined role:

• Role: roles/pubsub.publisher (Pub/Sub Publisher)
• Member: serviceAccount:[YOUR_FUNCTION_SERVICE_ACCOUNT]@[PROJECT_ID].iam.gserviceaccount.com

Local Testing vs. Production IAM

There is a fundamental difference in how identity is handled between the emulator and the cloud environment:

The Emulator Gap

The Cloud Functions emulator does not connect to the GCP IAM policy engine to validate permissions in real-time. When using --allow-local, the emulator typically relies on Application Default Credentials (ADC). If you are logged in via gcloud auth application-default login, the function uses your personal user permissions, which are usually broader than the production service account, masking potential permission gaps.

Simulating Production Permissions

To detect missing permissions before deployment, you can force the emulator to use a specific service account identity by pointing to a JSON key file. This mimics the production identity plane:

1. Create a service account that mirrors the production function's permissions (or lacks them for testing).
2. Download the JSON key for that account.
3. Set the environment variable before starting the emulator:

   export GOOGLE_APPLICATION_CREDENTIALS="/path/to/your/service-account-file.json"

Note: Never commit service account JSON keys to version control. Use a secret manager or local environment variables.

Verification Steps

If the error persists in production, verify the following:

• Check Runtime Identity: In the GCP Console, navigate to your Cloud Function → Details tab to confirm which service account is actually being used.
• Check Topic Permissions: Navigate to Pub/Sub → Topics → [Your Topic] → Permissions tab to ensure the service account is listed as a Publisher.

Diagnostic Detail Needed: Are you using the default App Engine service account or a user-managed custom service account? Default accounts often have broader permissions (like Editor) that can hide configuration errors until they are tightened for security.