如何解决"googleapi: Error 403: The caller does not have permission, forbidden"

Question

我正在使用terraform在GCP中构建基础设施。我正在尝试使用地形为service account分配角色，但无法这样做。下面是我的代码：

sa.tf:

resource "google_service_account" "mojo-terra" {
account_id   = "mojo-terra"
description  = "Service account used for terraform script"
}
resource "google_project_iam_member" "mojo-roles" {
count = length(var.rolesList)
role =  var.rolesList[count.index]
member = "serviceAccount:${google_service_account.mojo-terra.email}"
}

dev.tfvars:

rolesList = [
"roles/iam.serviceAccountUser"
]

cloudbuild日志：

Step #2: Error: Error when reading or editing Resource "project "poc-dev"" with IAM Policy: Error retrieving IAM policy for project "poc-dev": googleapi: Error 403: The caller does not have permission, forbidden
Step #2: 
Step #2: 
Step #2: 
Step #2: Error: Error when reading or editing Resource "project "poc-dev"" with IAM Member: Role "roles/iam.serviceAccountUser" Member "serviceAccount:[e-mail]": Error retrieving IAM policy for project "poc-dev": googleapi: Error 403: The caller does not have permission, forbidden
Step #2: 

以下是我的cloudbuild service account附带的角色：Custom Role cloudbuild, Cloud Build Service Account, Service Account Admin, Create Service Accounts, Delete Service Accounts, Service Account User, Storage Admin

Answer 1

为Terraform提供授权的服务帐户缺少权限resourcemanager.projects.getIamPolicy，这是错误消息的来源。

服务帐户还缺少更改IAM策略所需的权限resourcemanager.projects.setIamPolicy。

这些权限属于角色roles/resourcemanager.projectIamAdmin(项目IAM管理员(的一部分。

列出分配给服务帐户的角色：

gcloud projects get-iam-policy <YOUR GCLOUD PROJECT ID> 
--flatten="bindings[].members" 
--format='table(bindings.role)' 
--filter="bindings.members:<YOUR SERVICE ACCOUNT>"

列出角色包含的权限：

gcloud iam roles describe roles/resourcemanager.projectIamAdmin

将所需角色添加到服务帐户：

gcloud projects add-iam-policy-binding <YOUR GCLOUD PROJECT ID> 
--member=serviceAccount:<YOUR SERVICE ACCOUNT> 
--role=roles/resourcemanager.projectIamAdmin