Error when creating gcp vm instance via terraform

user_9867708 0
Viewed 312

service account has all permission to create an vm instance (Service Account User, Project Owner, Project Editor). When I run terraform, this occurs:

│ Error: Error waiting for instance to create: The user does not have access to service account 'mymail@gmail.com'.  User: 'terraform@direct-keel-275713.iam.gserviceaccount.com'.  Ask a project owner to grant you the iam.serviceAccountUser role on the service account
│ 
│ 
│   with module.vm.google_compute_instance.icinga,
│   on modules/vm/main.tf line 23, in resource "google_compute_instance" "icinga":
│   23: resource "google_compute_instance" "icinga" {

enter image description here

terraform-provider-gcp terraform google-cloud-platform virtual-machine
1 Answers

There is something wrong with how you have Terraform setup.

The error message includes the text The user does not have access to service account 'mymail@gmail.com'.

The identity mymail@gmail.com is not a service account.

Once you have the credentials set up correctly, the identity that Terraform is using for authorization must have the role roles/iam.serviceAccountUser or similar. The role you select must have the permission iam.serviceAccounts.actAs.

Service Accounts Roles

Note: roles such as roles/compute.admin do not have the permission iam.serviceAccounts.actAs.

Terraform by default will look for the environment variable GOOGLE_APPLICATION_CREDENTIALS. That variable should point to the full path of a service account JSON key file.

Next, Terraform will look for the CLI/SDK credentials created by gcloud auth application-default login.

I prefer to specify the service account in the Terraform HCL (usually in a variables file).

provider "google" {
  project = "PROJECT_ID"
  credentials = "/path/to/service-account.json"
}
user_80167200
Related