Getting error while allowing accounts and roles in Terraform for GCP

Admin 1
Viewed 6988

I am trying to allocate the roles to the user in the Terraform file in a GCP project, but I am getting the below error :

Error: Request "Create IAM Members roles/compute.networkAdmin user:someone@google.com for "project \"vibrant-mantis-296207\""" returned error: Batch request and retried single request "Create IAM Members roles/compute.networkAdmin user:someone@google.com for "project \"vibrant-mantis-296207\""" both failed. Final error: Error applying IAM policy for project "vibrant-mantis-296207": Error setting IAM policy for project "vibrant-mantis-296207": googleapi: Error 403: Policy update access denied., forbidden

I used the below piece of code :

module "projects_iam_bindings" {
 source  = "terraform-google-modules/iam/google//modules/projects_iam"
 version = "~> 6.4"

 projects = ["vibrant-mantis-296207"]

 bindings = {
 "roles/storage.admin" = [
 "user:someone@google.com",
    ]

 "roles/compute.networkAdmin" = [
 "user:someone@google.com",
    ]
google-cloud-iam google-iam terraform-provider-gcp terraform google-cloud-platform
3 Answers

The user/service-account that Terraform is using for authorization does not have the permission resourcemanager.projects.setIamPolicy.

The solution is to edit the IAM permissions for the user/service-account to include a role which as that permission.

Example roles with the permission resourcemanager.projects.setIamPolicy:

  • roles/iam.securityAdmin
  • roles/resourcemanager.projectIamAdmin
  • roles/resourcemanager.folderAdmin
  • roles/resourcemanager.organizationAdmin

Granting, changing, and revoking access to resources

user_80167200

On the Google Cloud Platform go to IAM, in IAM & Admin select your terraform service yourproject.iam.gserviceaccount.com and add/change the role to Owner.

In the console, run your terraform command(s) again and it should be fixed.

Commands:

terraform init
terraform plan
terraform apply
user_136410640

Found this via google because I got

Error: 
Request `Create IAM Members roles/artifactregistry.reader 
serviceAccount:mvp-service-account@[[project]].iam.gserviceaccount.com for project "[[project]]"` returned error: 

Error retrieving IAM policy for project "[[project]]": 
googleapi: Error 403: The caller does not have permission, forbidden

Turns out, I had a typo in my project name and got the error due to this. Hope this helps anyone.

user_12757780
Related