FYI I was able to resolve this by adding permission to the data set and with an IAM role binding.

const sinkBuilder = (source) => { const dataset = new gcp.bigquery.Dataset(source, { project: PROJECT_ID, datasetId:

${source}_webhook

, location: 'US', accesses: [ { userByEmail: "cloud-logs@system.gserviceaccount.com", role: "WRITER" } ] }) const bigquerySink = new gcp.logging.ProjectSink(source, { destination:

<http://bigquery.googleapis.com/projects/${PROJECT_ID}/datasets/${source}_webhook|bigquery.googleapis.com/projects/${PROJECT_ID}/datasets/${source}_webhook>

, filter:

resource.type="global" AND logName="projects/${PROJECT_ID}/logs/${source}"

, uniqueWriterIdentity: false }) const log_writer = new gcp.projects.IAMBinding(

${source}_logwriter

, { members: ["serviceAccount:cloud-logs@system.gserviceaccount.com"], project: PROJECT_ID, role: "roles/bigquery.dataEditor", });