title: Unable to submit build to Cloud Build due to permissions error
body: <p>When submitting a Cloud Build run via <code>gcloud builds submit ...</code> I'm getting a forbidden error saying I don't have access to the bucket(s). There are 2 places where buckets are normally involved in submitting a Cloud Build, the staging and logs bucket. I specified the buckets for each as buckets (the same one, just different folders) that I do have access too so the command looks like this:</p>
  <pre><code>gcloud builds submit 
  --gcs-log-dir $my_bucket/logs 
  --gcs-source-staging-dir $my_bucket/source  
  </code></pre>
  <p>The error I get is:</p>
  <pre><code>ERROR: (gcloud.builds.submit) 403: The user is forbidden from accessing the bucket [$my_bucket]: Please check your organization's policy.
  </code></pre>
  <p>I re-ran with <code>--log-http</code> and <code>--verbosity debug</code> and the expanded error shows the real reason:</p>
  <pre><code>DEBUG: https://storageapis.google.com &quot;GET /storage/v1/b/$my_bucket?alt=json&quot;
  ... 
  {
    &quot;error&quot;: {
      &quot;code&quot;: 403,
      &quot;message&quot;: &quot;$user does not have serviceusage.services.use access to the Google Cloud Project.&quot;
    }
  }
  </code></pre>
  <p>I did some digging and see that's this error shows up when supplying a quota/billing project with the request (in addition to not having service consumer role). I confirmed this when inspecting the request's HTTP headers which included <code>X-Goog-User-Project: $my_project</code>.</p>
  <p>What's weird is that I have access to objects in this bucket and can run <code>gsutil</code>/HTTP commands just fine which are using the same API endpoints with the difference being that <code>gsutil</code> doesn't include that user project in the request.</p>
  <p>Is there a way to submit a build that doesn't include the project so that I don't need <code>serviceusage.services.use</code> permission? I tried unsetting the project in my gcloud config but it prompted me that I needed to either set it or pass it with <code>--project</code> flag.</p>
  <p>edit: the bucket isn't &quot;requester pays&quot; enabled either which is why gsutil and client libraries work fine</p>