Error when migrating projects in GCP, could someone help me?

Viewed 2552

I'm trying to Migrate 2 projects originating "no Organization" to a newly created organization in GCP.

The user has project-level permissions: Owner

At the organization level the user has the permissions: organization administrator, Project Creator

When trying to perform the migration, it displays the error:

Permission denied You do not have the following required permission to perform this action: "resourcemanager.projects.update"

Could someone help me with this problem?

5 Answers

contacted our partner and we saw that the projects were linked to their organization, for me it appeared as "No organization" because I only had access to the project but not their organization.

To solve it, it was necessary to open a ticket on google to disassociate the projects from their organization and only after that I was able to migrate to my organization.

Thank you very much everyone for your support.

I even created a customized role at the organization level with the permissions: resourcemanager.organizations.get, resourcemanager.organizations.getIamPolicy, resourcemanager.organizations.setIamPolicy, resourcemanager.projects.create,resourcemanager.projects.get, resourcemanager.projects.getIamPolicy, resourcemanager.projects.list, resourcemanager.projects.move, resourcemanager.projects.setIamPolicy, resourcemanager.projects.update, resourcemanager.projects.updateLiens

I created a custom Role also in the project I want to migrate and set the permissions: resourcemanager.projects.get, resourcemanager.projects.getIamPolicy, resourcemanager.projects.move, resourcemanager.projects.setIamPolicy, resourcemanager.projects.update,

Even after these changes I had the same error when migrating

The following instructions are only for moving a project within an organization (such as in this case). To move a project, you need the following IAM roles:

  1. Have the resourcemanager.projects.update permission on the project, which typically comes from having either the Project Editor or Project Owner roles on the project.

  2. Have the resourcemanager.projects.move permission on both the source folder and the destination folder. This permission is typically part of the Project Owner, Project Editor, Folder Admin, or Folder Mover roles. If the resource is not in a folder, you will need this permission on the organization node.

To move a project to another organization:

  1. In the Google Cloud Console, go to the Manage resources page.
  2. Select your Organization from the Organization drop-down on the top left of the page.
  3. Click on your project's row to select your project from the list of resources. Note that you must not click on the name of the project, which takes you to the project's IAM page.
  4. Click on the options menu (the vertical ellipsis) in the row and click Move.
  5. Click Browse to select the folder to which you want to move the project.
  6. Click Move.

If you made sure that your account has all the permissions specified and still getting the error you may want to try the Resource Manager API as per the following link: https://cloud.google.com/resource-manager/docs/project-migration#perform_migration

Hope you find this useful. Regards

Thank you very much, but I have already performed this test, putting these permissions at the project level and at the organization level but it gives the same error.

I've tried to perform the procedure via command too but it didn't work either ERROR: (gcloud.beta.projects.move) User ["my user"] does not have permission to access projects instance ["my project"] (or it may not exist): The caller does not have permission.

Group permission that the user participates at the organizational level: Support Account Administrator, Organization Role Administrator, Organization Policy Administrator, Folder admin, Organization Administrator, Project Creator, Project Mover, Security Center Admin

User permission at the Organization level: Organization Administrator, Project Mover

User permission at project level: Owner, Project Mover, Organization Administrator

Would you have any more suggestions?

When you try to migrate, the error is because of you don't have organization policies. To move a project resource to a new organization, you must first apply an organization policy that will define the organizations to which the project can be moved.

On the parent resource to the project you want to move, set an organization policy that includes the constraints/resourcemanager.allowedExportDestinations This will define the target destination as a valid location to which you can migrate the project.

On the destination resource, set an organization policy that includes the constraints/resourcemanager.allowedImportSources This will define the source as a valid location from which you can migrate your project.

For example, say you had a project my-test-project that existed under an organization with the ID 12345678901, and you wanted to move it to a new organization for your secondary business unit, with the ID 45678901234.

You would set an organization policy on organizations/12345678901with the constraints/resourcemanager.allowedExportDestinations constraint enforced and under:organizations/45678901234 set as an allowed_value.

Then, set an organization policy on organizations/45678901234 with the constraints/resourcemanager.allowedImportSources constraint enforced and under:organizations/12345678901 set as an allowed_value.

Once these organization policies are enforced, you will be able to move my-test-project from organizations/12345678901 to organizations/45678901234, assuming you have the permissions noted in Assign permissions.

https://cloud.google.com/resource-manager/docs/project-migration#configure_organization_policies

Related