Unable to create google group with Terraform resource google_cloud_identity_group

user_363281 0
Viewed 1452

The following resource is used to create a google group using the terraform google-beta and version 3.36:

resource "google_cloud_identity_group" "cloud_identity_group_basic" {
  provider = google-beta
  display_name = "aaa bbb"

  parent = "customers/XXX"

  group_key {
    id = "aaa_bbb@evilcorp.com"
  }

  labels = {
    "cloudidentity.googleapis.com/groups.discussion_forum" = ""
  }
}

terraform plan tells me that it will create the resource but performing apply results in an error (Actor does not have permission to create group). The terraform service-account has already a lot of permissions such as Organization Administrator, Google Cloud Managed Identities Admin, Google Cloud Managed Identities Domain Admin, ...

G Suite Domain-wide Delegation also has been tried, but unsure how this might help.

Terraform will perform the following actions:

  # google_cloud_identity_group.cloud_identity_group_basic will be created
  + resource "google_cloud_identity_group" "cloud_identity_group_basic" {
      + create_time  = (known after apply)
      + display_name = "aaa bbb"
      + id           = (known after apply)
      + labels       = {
          + "cloudidentity.googleapis.com/groups.discussion_forum" = ""
        }
      + name         = (known after apply)
      + parent       = "customers/XXX"
      + update_time  = (known after apply)

      + group_key {
          + id = "aaa_bbb@evilcorp.com"
        }
    }

Plan: 1 to add, 0 to change, 0 to destroy.

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

google_cloud_identity_group.cloud_identity_group_basic: Creating...

Error: Error creating Group: googleapi: Error 403: Error(2015): Actor does not have permission to create group 'aaa_bbb@evilcorp.com'.
Details:
[
  {
    "@type": "type.googleapis.com/google.rpc.ResourceInfo",
    "description": "Error(2015): Actor does not have permission to create group 'aaa_bbb@evilcorp.com'.",
    "owner": "domain:cloudidentity.googleapis.com",
    "resourceType": "cloudidentity.googleapis.com/Group"
  }
]

  on groups.tf line 1, in resource "google_cloud_identity_group" "cloud_identity_group_basic":
   1: resource "google_cloud_identity_group" "cloud_identity_group_basic" {
terraform-provider-gcp terraform permissions
2 Answers
user_3632810

Building a bit in top of @Dag answer:

It is also possible to do it through the Admin Console.

Actually, I didn't find any other way, as it seems impossible to obtain the uniqueID of the Default Cloud Build Service Account.

  1. Follow the previous link as a Workspace Super User.
  2. Click on the Groups Admin role.
  3. Click in the down arrow in the Admins section
  4. Finally click on Assign service accounts there you can paste the service account email (<YOUR-PROJECT-ID>@cloudbuild.gserviceaccount.com)

After doing this, it is actually possible to obtain the service accounts uniqueID: Just run the Try this API from the Directory API documentation with the roleId (you can get the roleId from the URL you are after point 2) and the customer id that you can obtain from the Account settings.

user_17766300
Related