Error map
Cloud Run 403: Your client does not have permission to get URL Cloud Run: Error: Forbidden — Your client does not have permission to get URL / from this server
Google Cloud / Firebase · layer 6, Platform & cloud
Centre: this error. First ring: errors it is linked with (11). Outer ring: what those are linked with. Colours show the layer of a request each error belongs to. Click any dot to re-centre the map on it; hover to follow its connections. The centre dot opens the error page.
Directly related (11)
Cloud Run: 504 Gateway Timeout — The request has been terminated because it has reached the maximum request timeout
The request ran longer than the service's request timeout (default 5 minutes, max 60), so Cloud Run closed it.
Cloud Run: 503 Service Unavailable — The request was aborted because there was no available instance
Cloud Run could not serve the request: no instance was ready, instances crashed, or the service hit its max-instances/concurrency…
Cloud Run: Memory limit of 512 MiB exceeded with 530 MiB used. Consider increasing the memory limit
The container used more memory than the Cloud Run service allows, so the instance was terminated.
Cloud Run: Revision 'svc-00005' is not ready — Image 'gcr.io/proj/app:latest' not found / Permission 'artifactregistry.repositories.downloadArtifacts' denied
Cloud Run cannot pull the container image — it doesn't exist, the tag is wrong, or the service identity lacks access to the regis…
GKE: google.api_core.exceptions.Forbidden: 403 Caller does not have required permission — Workload Identity: unable to generate access token
A pod tried to call Google APIs but its Kubernetes service account is not bound to a Google service account (or the binding lacks…
Google Cloud: 403 PERMISSION_DENIED — Permission 'storage.objects.get' denied on resource (or it may not exist)
The caller's identity lacks the IAM permission named in the message on that resource.
GCP: FAILED_PRECONDITION: Key creation is not allowed on this service account (constraints/iam.disableServiceAccountKeyCreation)
An organisation policy forbids creating downloadable JSON keys for service accounts.
Google Cloud: Constraint constraints/compute.vmExternalIpAccess violated for project — Request violates constraint 'constraints/...'
An organisation policy forbids what you asked (external IP on a VM, public bucket, allowed regions, public Cloud Run).
Cloud Storage: 403 Forbidden — user@example.com does not have storage.objects.get access to the Google Cloud Storage object
The identity making the request has no read permission on that bucket or object.
BigQuery: Access Denied: Project my-project: User does not have bigquery.jobs.create permission in project my-project
The principal can read data but is not allowed to run query jobs in the project used for billing.
Secret Manager: 7 PERMISSION_DENIED: Permission 'secretmanager.versions.access' denied for resource 'projects/123/secrets/db-pass/versions/latest'
The calling identity lacks the Secret Accessor role on that secret, or the secret/version does not exist.
Two steps away (23)
Google Cloud: 403 SERVICE_DISABLED — Cloud Resource Manager API has not been used in project 123456 before or it is disabled. Enable it by visiting
The Google API you called is not enabled for the project that the request is billed to.
gcloud/ADC: WARNING: Your active project does not match the quota project in your local Application Default Credentials file
Application Default Credentials bill API usage to a different project than the one you have set as active, which can cause surpri…
Cloud Functions: Function execution took 60002 ms, finished with status: 'timeout'
The function ran past its timeout (default 60s for HTTP 1st gen) and was terminated.
Cloud Run: The user-provided container failed to start and listen on the port defined provided by the PORT=8080 environment variable
Cloud Run started your container, but nothing listened on $PORT within the startup timeout — the app crashed, listens on another…
GKE Ingress: Some backend services are in UNHEALTHY state / 502 Server Error from the load balancer
The Google load balancer's health checks fail for the Ingress backends, so it returns 502 or 'no healthy upstream'.
Cloud SQL: FATAL: remaining connection slots are reserved / MySQL: ERROR 1040 (08004): Too many connections
The instance's maximum connections was reached, often because serverless instances each open their own connection pool.
Kubernetes: OOMKilled (exit code 137)
The container used more memory than its limit, and the kernel killed it.
FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory
The V8 heap hit its limit — a large build (webpack, tsc, Next.js) needs more memory, or the app leaks.
MaxListenersExceededWarning: Possible EventEmitter memory leak detected. 11 listeners added
More than 10 listeners were added to one event — often a leak where listeners are added repeatedly.
exec /usr/local/bin/docker-entrypoint.sh: exec format error
The container tried to run a binary built for a different CPU architecture (arm64 vs amd64) — or a script with a broken shebang /…
Docker push: denied: Permission "artifactregistry.repositories.uploadArtifacts" denied on resource "projects/p/locations/l/repositories/r"
Your identity cannot push or pull images in that Artifact Registry repository, or Docker isn't authenticated to the registry host.
Google Cloud: Error: Could not load the default credentials. Browse to https://cloud.google.com/docs/authentication/getting-started
The Google client library found no Application Default Credentials (ADC) on this machine or environment.
GKE/Compute: Quota 'CPUS' exceeded. Limit: 8.0 in region us-central1 (QUOTA_EXCEEDED)
Creating nodes or clusters needs more vCPUs than your project's regional quota allows.
GKE/Kubernetes: Pod unschedulable — 0/3 nodes are available: 3 Insufficient cpu
The scheduler found no node with enough free CPU/memory for the pod's resource requests.
Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?
The docker CLI can’t talk to the Docker engine — it isn’t running, or your user can’t access the socket.
OAuth 2.0 Error: invalid_scope / insufficient_scope
The requested scope is unknown or not allowed for this client — or the token lacks the scope the API endpoint requires.
Error: listen EACCES: permission denied 0.0.0.0:80
Node isn’t allowed to bind that port — ports below 1024 need root on Linux/macOS, and some Windows ports are reserved.
Pod stuck ContainerCreating: MountVolume.SetUp failed / Unable to attach or mount volumes: timed out waiting for the condition
The kubelet couldn’t mount one of the pod’s volumes, so the pod stays in ContainerCreating.
Multi-Attach error for volume: Volume is already exclusively attached to one node and can't be attached to another
A ReadWriteOnce volume (EBS, Azure Disk, PD) is still attached to another node, so the new pod on a different node can’t use it.
PersistentVolumeClaim stuck in Pending (no persistent volumes available / waiting for first consumer)
The PVC hasn’t been bound to a volume, so pods using it can’t be scheduled.
gcloud: ERROR: (gcloud.auth.print-access-token) There was a problem refreshing your current auth tokens: Reauthentication failed. cannot prompt during non-interactive execution
Your cached Google credentials expired or require a fresh login (session control or password change), and gcloud can't prompt.
Google Cloud: 403 This API method requires billing to be enabled. Please enable billing on project and retry
The project has no active billing account, and the API/service needs one.
Compute Engine: ERROR: (gcloud.compute.instances.create) Could not fetch resource: The resource 'projects/p/zones/z/instances/vm-1' already exists
You tried to create a resource whose name is already taken in that scope.
Map another error
Popular: 500403400ORA-009331064Critical errorFileNotFoundException assemblyTypeError