Every kit that publishes Eventarc events declares roles/eventarc.eventReceiver and roles/run.invoker but not roles/eventarc.publisher:
kits/firestore-counter/src/index.ts:40kits/firestore-translate-text/src/index.ts:37kits/firestore-bigquery-export/src/index.ts:63kits/speech-to-text/src/index.ts:38
The extensions never declared a publisher role either; they got publish rights on the channel from the Extensions install flow (the events: block in extension.yaml). Kits have no equivalent, so nothing grants it. #3098 reports every publish returning 403 in a test project with EVENTARC_CHANNEL set.
The consequence is worse than missing telemetry, because each handler awaits the publish inline:
firestore-counter src/handlers.ts:65 and firestore-translate-text src/handlers.ts:64 await recordStartEvent as their first action, so with the channel set the function throws before it aggregates or translates anything.firestore-bigquery-export src/handlers.ts:180 does the same before the BigQuery write.speech-to-text awaits recordCompleteEvent at src/handlers.ts:198 after transcription, so the work is done but the invocation fails.
Fix: add "roles/eventarc.publisher" to REQUIRED_ROLES in each of the four kits (one line each, same mechanism as the roles already declared), and re-run the deploy test in #3098 to confirm a subscriber receives the payload. If the intent is for users to grant it themselves, the READMEs need to say so; none do today.
Tracked in #2974.
Every kit that publishes Eventarc events declares
roles/eventarc.eventReceiverandroles/run.invokerbut notroles/eventarc.publisher:kits/firestore-counter/src/index.ts:40kits/firestore-translate-text/src/index.ts:37kits/firestore-bigquery-export/src/index.ts:63kits/speech-to-text/src/index.ts:38The extensions never declared a publisher role either; they got publish rights on the channel from the Extensions install flow (the
events:block inextension.yaml). Kits have no equivalent, so nothing grants it. #3098 reports every publish returning 403 in a test project withEVENTARC_CHANNELset.The consequence is worse than missing telemetry, because each handler awaits the publish inline:
firestore-countersrc/handlers.ts:65andfirestore-translate-textsrc/handlers.ts:64awaitrecordStartEventas their first action, so with the channel set the function throws before it aggregates or translates anything.firestore-bigquery-exportsrc/handlers.ts:180does the same before the BigQuery write.speech-to-textawaitsrecordCompleteEventatsrc/handlers.ts:198after transcription, so the work is done but the invocation fails.Fix: add
"roles/eventarc.publisher"toREQUIRED_ROLESin each of the four kits (one line each, same mechanism as the roles already declared), and re-run the deploy test in #3098 to confirm a subscriber receives the payload. If the intent is for users to grant it themselves, the READMEs need to say so; none do today.Tracked in #2974.