instance creation failed: Required 'compute.images.useReadOnly'

Question

I have created a dedicated GCP project with images I want to share with people from other organizations. I gave those people a custom role on the whole project with the following permissions:

compute.images.get
compute.images.getFromFamily
compute.images.list
compute.images.useReadOnly
resourcemanager.projects.get
serviceusage.services.get
serviceusage.services.list

But people have reported that they are getting the following error:

instance creation failed: Required 'compute.images.useReadOnly' permissions for <specific image>

I don't understand why they need that permission on the specific image when they have it on all the images of the project.

What am I missing?

Answer 1

Found the issue, it appears the GCP console made the operation when acting as a service account and not as the user itself. That service account didn't have the attached role.

Answer 2

To fix this issue, grant access for the service account wanting to use the custom image per the instructions here:

https://cloud.google.com/compute/docs/images/managing-access-custom-images