🐛 [firestore-bigquery-export] Failed to install the extension with PERMISSION_DENIED

[sfujiwara]

Describe your configuration

• Extension name: firestore-bigquery-export
• Extension version: 0.2.5

Configuration values: I tried to install the extension with Terraform settings below (and the problem also reproduces with manual installation in Firebase Web console).

resource "google_firebase_extensions_instance" "firestore_bigquery_export" {
  provider    = google-beta
  project     = xxx
  instance_id = "firestore-bigquery-export"

  config {
    extension_ref     = "firebase/firestore-bigquery-export"
    extension_version = "0.2.5"
    params = {
      "BIGQUERY_PROJECT_ID"           = xxx
      "COLLECTION_PATH"               = yyy
      "DATABASE"                      = "(default)"
      "DATABASE_REGION"               = "us-centrals"
      "DATASET_ID"                    = "firestore_export"
      "DATASET_LOCATION"              = "us-centrals"
      "EXCLUDE_OLD_DATA"              = "no"
      "LOG_LEVEL"                     = "info"
      "MAX_DISPATCHES_PER_SECOND"     = "100"
      "MAX_ENQUEUE_ATTEMPTS"          = "3"
      "TABLE_ID"                      = yyy
      "TABLE_PARTITIONING"            = "NONE"
      "TIME_PARTITIONING_FIELD_TYPE"  = "omit"
      "USE_NEW_SNAPSHOT_QUERY_SYNTAX" = "no"
      "VIEW_TYPE"                     = "view"
      "WILDCARD_IDS"                  = "false"
    }
  }
}

Describe the problem

The first Installation is failed with the errors below.

{
  "ResourceType": "gcp-types/cloudfunctions-v1:projects.locations.functions",
  "ResourceErrorCode": "403",
  "ResourceErrorMessage": {
    "code": 403,
    "message": "Failed to create 1st Gen function projects/xxx/locations/us-central1/functions/ext-firestore-bigquery-export-predictions-initBigQuerySync: Unable to retrieve the repository metadata for projects/xxx/locations/us-central1/repositories/gcf-artifacts. Ensure that the Cloud Functions service account has 'artifactregistry.repositories.list' and 'artifactregistry.repositories.get' permissions. You can add the permissions by granting the role 'roles/artifactregistry.reader'.",
    "status": "PERMISSION_DENIED",
    "statusMessage": "Forbidden",
    "requestPath": "https://cloudfunctions.googleapis.com/v1/projects/xxx/locations/us-central1/functions",
    "httpMethod": "POST"
  }
}

{
  "ResourceType": "gcp-types/cloudfunctions-v2beta:projects.locations.functions",
  "ResourceErrorCode": "400",
  "ResourceErrorMessage": {
    "code": 400,
    "message": "Validation failed for trigger projects/xxx/locations/us-central1/triggers/ext-firestore-bigquery-export-predictions-fsexportbigque-382835: Invalid resource state for \"\": Permission denied while using the Eventarc Service Agent. If you recently started to use Eventarc, it may take a few minutes before all necessary permissions are propagated to the Service Agent. Otherwise, verify that it has Eventarc Service Agent role.",
    "status": "FAILED_PRECONDITION",
    "statusMessage": "Bad Request",
    "requestPath": "https://cloudfunctions.googleapis.com/v2beta/projects/xxx/locations/us-central1/functions",
    "httpMethod": "POST"
  }
}

Steps to reproduce:

It would reproduces in a new Google Cloud project. But, if you try it again, the installation succeed.

[google-oss-bot]

This issue does not seem to follow the issue template. Make sure you provide all the required information.

[HassanBahati]

Hi @sfujiwara , thank you for opening this issue. We will look into it and keep you posted. Thanks!