Diagnose: Permission secretmanager.versions.access denied

TL;DR

For "Permission 'secretmanager.versions.access' denied for resource projects/[P]/secrets/[S]/versions/[V]": check the Cloud Run service's --service-account or the GCE SA. 3. gcloud secrets versions describe [V] --secret [S] - state must be ENABLED. Disabled or destroyed versions fail regardless of IAM. ` gcloud secrets add-iam-policy-binding [S] --project [P] --member serviceAccount:[WORKLOAD-SA] --role roles/secretmanager.secretAccessor 3.

Permission 'secretmanager.versions.access' denied for resource projects/[P]/secrets/[S]/versions/[V]

When to use

You are seeing this: Symptom: "Permission 'secretmanager.versions.access' denied for resource projects/[P]/secrets/[S]/versions/[V]" (or PERMISSION_DENIED on access). Use this skill when you run into "Diagnose: Permission secretmanager.versions.access denied".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Steps

1. Symptom: "Permission 'secretmanager.versions.access' denied for resource projects/[P]/secrets/[S]/versions/[V]" (or PERMISSION_DENIED on access).
2. Confirm in order:
3. gcloud secrets get-iam-policy [S] --project [P] - is the calling identity bound to roles/secretmanager.secretAccessor?
4. Which identity is calling? The workload's SA, not yours. Check the Cloud Run service's --service-account or the GCE SA.
5. gcloud secrets versions describe [V] --secret [S] - state must be ENABLED. Disabled or destroyed versions fail regardless of IAM.

gcloud secrets add-iam-policy-binding [S] --project [P] --member serviceAccount:[WORKLOAD-SA] --role roles/secretmanager.secretAccessor

3. Prefer binding on the secret, not the project. Project-wide secretAccessor is overbroad.
4. Traps:

• Granting on the wrong secret name (typo) or wrong project. The error names the exact resource; copy it.
• The SA was just created: IAM propagation takes a minute or two.
• Using latest while a rotation disabled the newest version: pin a known-enabled version or re-enable.

5. Verify: call accesssecretversion as the workload identity (or deploy and read at startup) and confirm success without logging the value.

Verified 2026-09-26 on the Secret Manager access docs (resource name format, access pattern) and IAM docs (secretAccessor role, versions.access permission). Version states from the managing-secrets docs.