使用KMS密钥在Terraform中为GCP创建VM时出错(创建实例时出错:googleapi:错误503)

Question

我不能使用terraform在GCP上创建VM，我想在属性中附加一个kms键"kms_key_self_link"；，但当创建机器时，时间会流逝，等待2分钟后(在任何情况下(都会出现错误503。我要分享我的剧本，值得一提的是带有属性的"kms_key_self_link"；如果禁用，脚本运行正常。

data "google_compute_image" "tomcat_centos" {
name = var.vm_img_name
}
data "google_kms_key_ring" "keyring" {
name     = "keyring-example"
location = "global"
}
data "google_kms_crypto_key" "cmek-key" {
name     = "crypto-key-example"
key_ring = data.google_kms_key_ring.keyring.self_link
}
data "google_project" "project" {}
resource "google_kms_crypto_key_iam_member" "key_user" {
crypto_key_id = data.google_kms_crypto_key.cmek-key.id
role          = "roles/owner"
member        = "serviceAccount:service-${data.google_project.project.number}@compute-system.iam.gserviceaccount.com"
}

resource "google_compute_instance" "vm-hsbc" {
name         = var.vm_name
machine_type = var.vm_machine_type
zone         = var.zone
allow_stopping_for_update = true
can_ip_forward            = false
deletion_protection       = false
boot_disk {
kms_key_self_link = data.google_kms_crypto_key.cmek-key.self_link
initialize_params {
type = var.disk_type
#GCP-CE-CTRL-22
image = data.google_compute_image.tomcat_centos.self_link
}
}

network_interface {
network = var.network
}

#GCP-CE-CTRL-2-...-5, 7, 8 
service_account {
email  = var.service_account_email
scopes = var.scopes
}
#GCP-CE-CTRL-31
shielded_instance_config {
enable_secure_boot          = true
enable_vtpm                 = true
enable_integrity_monitoring = true
}
}

这是一个完整的错误：

Error creating instance: googleapi: Error 503: Internal error. Please try again or contact Google Support. (Code: '5C54C97EB5265.AA25590.F4046F68'), backendError

Answer 1

我解决了这个问题，通过以下资源授予我的计算服务帐户加密器/解密器的角色：

resource "google_kms_crypto_key_iam_binding" "key_iam_binding" {
crypto_key_id = data.google_kms_crypto_key.cmek-key.id
role          = "roles/cloudkms.cryptoKeyEncrypter"
members = [
"serviceAccount:service-${data.google_project.gcp_project.number}@compute-system.iam.gserviceaccount.com",
]
}