the inventory API of cloud run failed to start due to Missing or insufficient permissions

[yul88]

Hang on step 11, the first run of terraform apply. There are no output, but error messages.

│ Error: Error waiting to create Service: Error waiting for Creating Service: Error code 13, message: Revision 'inventory-00001-958' is not ready and cannot serve traffic. The user-provided container failed to start and listen on the port defined provided by the PORT=8000 environment variable. Logs for this revision might contain more information.
│ 
│ Logs URL: https://console.cloud.google.com/logs/viewer?project=dragon-demo-duetai&resource=cloud_run_revision/service_name/inventory/revision_name/inventory-00001-958&advancedFilter=resource.type%3D%22cloud_run_revision%22%0Aresource.labels.service_name%3D%22inventory%22%0Aresource.labels.revision_name%3D%22inventory-00001-958%22 
│ For more troubleshooting guidance, see https://cloud.google.com/run/docs/troubleshooting#container-failed-to-start

Not sure which permission is missing. Here is the error detail at cloud run console.

[yul88]

run in local mode. It seems that the SA has no sufficient privilege.

node:internal/process/promises:289
            triggerUncaughtException(err, true /* fromPromise */);
            ^

Error: 7 PERMISSION_DENIED: Request had insufficient authentication scopes.
    at callErrorFromStatus (/usr/app/node_modules/@grpc/grpc-js/build/src/call.js:31:19)
    at Object.onReceiveStatus (/usr/app/node_modules/@grpc/grpc-js/build/src/client.js:357:73)
    at Object.onReceiveStatus (/usr/app/node_modules/@grpc/grpc-js/build/src/client-interceptors.js:323:181)
    at /usr/app/node_modules/@grpc/grpc-js/build/src/resolving-call.js:94:78
    at process.processTicksAndRejections (node:internal/process/task_queues:77:11)
for call at
    at ServiceClientImpl.makeServerStreamRequest (/usr/app/node_modules/@grpc/grpc-js/build/src/client.js:340:32)
    at ServiceClientImpl.<anonymous> (/usr/app/node_modules/@grpc/grpc-js/build/src/make-client.js:105:19)
    at /usr/app/node_modules/@google-cloud/firestore/build/src/v1/firestore_client.js:227:29
    at /usr/app/node_modules/google-gax/build/src/streamingCalls/streamingApiCaller.js:38:28
    at /usr/app/node_modules/google-gax/build/src/normalCalls/timeout.js:44:16
    at Object.request (/usr/app/node_modules/google-gax/build/src/streamingCalls/streaming.js:130:40)
    at makeRequest (/usr/app/node_modules/retry-request/index.js:141:28)
    at retryRequest (/usr/app/node_modules/retry-request/index.js:109:5)
    at StreamProxy.setStream (/usr/app/node_modules/google-gax/build/src/streamingCalls/streaming.js:121:37)
    at StreamingApiCaller.call (/usr/app/node_modules/google-gax/build/src/streamingCalls/streamingApiCaller.js:54:16)
Caused by: Error
    at Query._get (/usr/app/node_modules/@google-cloud/firestore/build/src/reference.js:1719:23)
    at Query.get (/usr/app/node_modules/@google-cloud/firestore/build/src/reference.js:1707:21)
    at addOrUpdateFirestore (/usr/app/dist/index.js:204:10)
    at initFirestoreCollection (/usr/app/dist/index.js:153:9)
    at Object.<anonymous> (/usr/app/dist/index.js:98:1)
    at Module._compile (node:internal/modules/cjs/loader:1376:14)
    at Module._extensions..js (node:internal/modules/cjs/loader:1435:10)
    at Module.load (node:internal/modules/cjs/loader:1207:32)
    at Module._load (node:internal/modules/cjs/loader:1023:12)
    at Function.executeUserEntryPoint [as runMain] (node:internal/modules/run_main:135:12) {
  code: 7,
  details: 'Request had insufficient authentication scopes.',
  metadata: Metadata {
    internalRepr: Map(3) {
      'google.rpc.errorinfo-bin' => [
        Buffer(136) [Uint8Array] [
           10,  31,  65,  67,  67,  69,  83,  83,  95,  84,  79,  75,
           69,  78,  95,  83,  67,  79,  80,  69,  95,  73,  78,  83,
           85,  70,  70,  73,  67,  73,  69,  78,  84,  18,  14, 103,
          111, 111, 103, 108, 101,  97, 112, 105, 115,  46,  99, 111,
          109,  26,  48,  10,   6, 109, 101, 116, 104, 111, 100,  18,
           38, 103, 111, 111, 103, 108, 101,  46, 102, 105, 114, 101,
          115, 116, 111, 114, 101,  46, 118,  49,  46,  70, 105, 114,
          101, 115, 116, 111, 114, 101,  46,  82, 117, 110,  81, 117,
          101, 114, 121,  26,
          ... 36 more items
        ]
      ],
      'grpc-status-details-bin' => [
        Buffer(235) [Uint8Array] [
            8,   7,  18,  47,  82, 101, 113, 117, 101, 115, 116,  32,
          104,  97, 100,  32, 105, 110, 115, 117, 102, 102, 105,  99,
          105, 101, 110, 116,  32,  97, 117, 116, 104, 101, 110, 116,
          105,  99,  97, 116, 105, 111, 110,  32, 115,  99, 111, 112,
          101, 115,  46,  26, 181,   1,  10,  40, 116, 121, 112, 101,
           46, 103, 111, 111, 103, 108, 101,  97, 112, 105, 115,  46,
           99, 111, 109,  47, 103, 111, 111, 103, 108, 101,  46, 114,
          112,  99,  46,  69, 114, 114, 111, 114,  73, 110, 102, 111,
           18, 136,   1,  10,
          ... 135 more items
        ]
      ],
      'www-authenticate' => [
        'Bearer realm="https://accounts.google.com/", error="insufficient_scope", scope="https://www.googleapis.com/auth/datastore https://www.googleapis.com/auth/cloud-platform"'
      ]
    },
    options: {}
  },
  statusDetails: [
    ErrorInfo {
      metadata: {
        method: 'google.firestore.v1.Firestore.RunQuery',
        service: 'firestore.googleapis.com'
      },
      reason: 'ACCESS_TOKEN_SCOPE_INSUFFICIENT',
      domain: 'googleapis.com'
    }
  ],
  reason: 'ACCESS_TOKEN_SCOPE_INSUFFICIENT',
  domain: 'googleapis.com',
  errorInfoMetadata: {
    method: 'google.firestore.v1.Firestore.RunQuery',
    service: 'firestore.googleapis.com'
  }
}

[yul88]

I grant the Service Account of Cloud Run a "Cloud Datastore User" role as quick and dirty fix.
There should be a more graceful way to fix it.