How To Solve: Error when reading or editing Project Service Foo/container.googleapis.com: googleapi: Error 403

user_14372775 0
Viewed 1478

I'm new to GCP and I'm trying to enable a number of API's via Terraform.

variable "gcp_service_list" {
  description ="Projectof apis"
  type = list(string)
  default = [
    "cloudresourcemanager.googleapis.com",
    "serviceusage.googleapis.com"
  ]
}

resource "google_project_service" "gcp" {
  for_each = toset(var.gcp_service_list)
  project = "project-id"
  service = each.key
}

but I keep running into the error

Error when reading or editing Project Service Foo/compute.googleapis.com: googleapi: Error 403: The caller does not have permission, forbidden

What permissions do I need to grant my service account in order for it to be able to do this please?

terraform0.12+ terraform-provider-gcp terraform google-cloud-platform
1 Answers

In order to enable service APIs in GCP, your user or service account which is being used to run Terraform needs to have the following role:

roles/serviceusage.serviceUsageAdmin

So, you will either have to grant the user or SA the role above from the console or if you have a Terraform resource to bind roles to users/SA that can be used as well.

From Terraform authentication perspective, if you are using a user account make sure you are properly authenticating from the terminal to GCP using the following command:

gcloud auth application-default login

If you are using a service account, you will need to specify the environment variable GOOGLE_APPLICATION_CREDENTIALS passing the json key file.

For Terraform authentication reference: https://registry.terraform.io/providers/hashicorp/google/latest/docs/guides/provider_reference

user_60353120
Related