I had the exact same issue, and I can confirm that the comment from @raghavendra-n was the answer for me. You need to find the name of your backend, which is at the top of the App Hosting section of the firebase console.

firebase apphosting:secrets:grantaccess VARIABLE_NAME --backend appname

This then sets up some IAM stuff which made my deployment work.