Assign service account to Group Admin role in Workspaces (GSuite)

user_5091805 0
Viewed 71

I'm attempting to assign a service account created in a project to the Group Admin role in Workspaces (GSuite) as part of an experiment to set up IAM automation in Terraform.

I'm essentially following this support guide here: https://support.google.com/a/answer/9807615#zippy=%2Cassign-a-role-to-a-service-account

Once I add the service account to be granted Group Admin, pressing "Assign Role" appears to do nothing. The button visually hovers but no action takes place after clicking it. My only option is to back out and discard the request.

assign role to service account not working

I am signed in as a Super Admin. I've also tried Firefox, Safari, and Chrome hoping it was just a UI bug. I contacted Workspace support and while they were extremely helpful they were not able to find any issue on their end or point me in any direction.

I have also tried assigning a dummy user via the 'Assign User' page and I get the same issue. The button/form just doesn't seem to react or produce any error messages.

Is there something I could be missing in my Org setup?

service-accounts google-workspace
1 Answers

So considering the UI is broken for me, I ended up using the API Explorer to assign the service account to the Group Admin role in Workspaces (GSuite)

Requirements:

  • Service Account unique ID, found by navigating to your service account from IAM in the console.

  • Customer ID, this is the customer ID of your Organisation and can be found in Account Settings in Workspaces or running the command:

$ gcloud organizations list

The customer ID is listed under DIRECTORY_CUSTOMER_ID.

  • You also need to find the roleID of your Group Admin role, I did this via the API Explorer again, requires your Customer ID

https://developers.google.com/admin-sdk/directory/reference/rest/v1/roles/list

Send a request to that and then check the response for:

"roleId": "XXXXXXXXXXXXXXX",
"roleName": "_GROUPS_ADMIN_ROLE",

You then need to use API Explorer to insert your service account using the above details

https://developers.google.com/admin-sdk/directory/reference/rest/v1/roleAssignments/insert

Request body:

{
  "assignedTo": "XXXXXXXXXXX",
  "roleId": "XXXXXXXXXXX",
  "scopeType": "CUSTOMER"
}

Your service account should now be a Group Admin in Workspaces (GSuite)

user_50918050
Related