title: GCP CDN service account is not created
body: <p>Currently I try to use Google's CDN to reduce the traffic to my Google cloud storage.</p>
  <p>I followed the <a href="https://cloud.google.com/cdn/docs/setting-up-cdn-with-bucket" rel="nofollow noreferrer">doc</a> to configure the CDN and the bucket, first for public access, then for private access with signed urls <a href="https://cloud.google.com/cdn/docs/using-signed-urls" rel="nofollow noreferrer">doc</a></p>
  <p>/edit steps I made:</p>
  <ul>
  <li>Created a bucket, copied a file into it and made it public accessible.</li>
  <li>Reserved an external ip adress.</li>
  <li>Created a load balancer with, created a backed bucket which can access the bucket.</li>
  </ul>
  <p>After that the files are available via CDN.</p>
  <p>After that I made the following changes:</p>
  <ul>
  <li>Added a singing key to the backend bucket.</li>
  </ul>
  <p>When I use the bucket url to generate a signed url with the gcloud tool I am able to access the files:</p>
  <pre><code>gcloud compute sign-url \
  &quot;https://storage.cloud.google.com/*/sampleFile&quot; \
  --key-name test-sign \
  --key-file test-sign \
  --expires-in 30m \
  --validate
  </code></pre>
  <p>Now should be a service account automatically added, but when I run:</p>
  <pre><code>gsutil iam ch \
    serviceAccount:service-MYPROJECTNUMBER@cloud-cdn-fill.iam.gserviceaccount.com:objectViewer \
    gs://MYBUCKET
  </code></pre>
  <p>there is an error:</p>
  <pre><code> 400 Service account service-MYPROJECTNUMBER@cloud-cdn-fill.iam.gserviceaccount.com does not exist.
  </code></pre>
  <p>I tried to create an account manually and add it to the bucket, but when I try to access the urls via CDN there is an error:</p>
  <blockquote>
  <pre><code>403. That’s an error.
  
  Your client does not have permission to get URL /example-signed/SampleFile.jpg from this server. That’s all we know.
  </code></pre>
  </blockquote>
  <p>I think that the CDN does not have access to my bucket. According to the instructions, this should happen via the service account, which should be created &quot;automatically&quot; in the following step.</p>
  <p><a href="https://cloud.google.com/cdn/docs/using-signed-urls#configuring_permissions" rel="nofollow noreferrer">Doc</a></p>
  <p>I have now tried several times, but nowhere is a service account created for me.  I have now manually created a service account, but I do not know how to assign it to the CDN.</p>
  <p>Someone has a hint for me?</p>