Error: 7 PERMISSION_DENIED: User not authorized to perform this action when publishing to Pub/Sub from Cloud Function

Goal

Determine how to validate Pub/Sub publish permissions for a Cloud Function before deployment so that the function works both in the local emulator and in production without encountering a PERMISSION_DENIED error.

Constraints and Uncertainty

• The Cloud Functions emulator with --allow-local bypasses IAM checks, allowing the function to use the local user’s default credentials.
• In production the function runs under its configured service account, which may lack the roles/pubsub.publisher role on the target topic.
• It is unclear whether the emulator can be configured to enforce the same IAM checks or to simulate a specific service account for accurate pre‑deployment testing.

Given these factors, what steps or configurations can be used to reliably detect missing IAM permissions during local testing?

Can the emulator be run with a service account key to mimic production IAM enforcement?

What is the minimal IAM binding required on the Pub/Sub topic for the function’s service account to publish successfully?