A developer uses the above cloudbuild.yaml. The build fails with error: 'unauthorized: You don't have the permission to push to this repository.' What is the most likely cause?
The service account needs the Writer role to push images; without it, push is unauthorized.
Why this answer
The error 'unauthorized: You don't have the permission to push to this repository' indicates that the Cloud Build service account lacks the necessary IAM permissions to push the container image to Artifact Registry. By default, Cloud Build uses the default compute engine service account (PROJECT_NUMBER-compute@developer.gserviceaccount.com) or a user-specified service account, which must have the Artifact Registry Writer role (roles/artifactregistry.writer) to push images. Without this role, the push is denied regardless of the image tag, registry URL, or project ID spelling.
Exam trap
The PCD exam often tests the distinction between authentication/authorization errors and configuration errors (like invalid tags or URLs), so the trap here is that candidates may confuse a permission issue with a typo or invalid tag, especially when the error message says 'unauthorized' but the real root cause is missing IAM roles.
How to eliminate wrong answers
Option A is wrong because the 'latest' tag is a valid and commonly used tag; an invalid tag would cause a different error (e.g., 'invalid reference format'), not an authorization error. Option B is wrong because an incorrect Docker registry URL would result in a 'not found' or 'connection refused' error, not an 'unauthorized' permission error. Option C is wrong because a misspelled project ID would cause a 'project not found' or 'invalid project ID' error, not an authorization failure; the error message specifically mentions lack of permission, not an invalid project.