Terraform auth problem with the google_firebase_project resource

user_5151909 0
Viewed 417

I've imported my firebase project as a terraform resource, but got this when ran terraform plan:

│ Error: Error when reading or editing FirebaseProject "projects/myproject": googleapi: Error 403: Your application has authenticated using end user credentials from the Google Cloud SDK or Google Cloud Shell which are not supported by the firebase.googleapis.com. We recommend configuring the billing/quota_project setting in gcloud or using a service account through the auth/impersonate_service_account setting. For more information about service accounts and how to use them in your application, see https://cloud.google.com/docs/authentication/. If you are getting this error with curl or similar tools, you may need to specify 'X-Goog-User-Project' HTTP header for quota and billing purposes. For more information regarding 'X-Goog-User-Project' header, please check https://cloud.google.com/apis/docs/system-parameters.
│ Details:
│ [
│   {
│     "@type": "type.googleapis.com/google.rpc.ErrorInfo",
│     "domain": "googleapis.com",
│     "metadata": {
│       "consumer": "projects/774686551450",
│       "service": "firebase.googleapis.com"
│     },
│     "reason": "SERVICE_DISABLED"
│   }
│ ]
│ 
│   with google_firebase_project.default,
│   on main.tf line 27, in resource "google_firebase_project" "default":
│   27: resource "google_firebase_project" "default" {

If I set the GOOGLE_APPLICATION_CREDENTIALS env var to a service account of that project, it seems to work, but I'd like to avoid it as it is required to re-export that variable each time I'm changing environment.

I've authenticated to gcloud via my user, which is admin for all the relevant project.

terraform-provider-gcp terraform firebase
1 Answers

As an external tool, terraform requires some method of authenticating with GCP. You have only two options:

  1. A service account with the required permissions.
  2. A GSuite user or group with the required permissions.

One service or group or user account can be granted permissions on multiple projects, although this has security implications (blast radius mainly) and I wouldn't recommend it.

Switching accounts when working with different projects might be annoying, but is currently the best way.

If you're working with GKE, you may be able to leverage their workload identity feature. I'm not exactly sure about how this works, but I believe it enables automatic switching to the correct service account depending on the workload. Ultimately, separate service accounts are still required.

user_16373200
Related