GCP google_project_iam_member在terraform上给出无效参数消息 &

Question

我使用terraform来部署以下内容

resource "google_project_iam_custom_role" "brw-user-function-item-registered-role" {
role_id     = "brw_user_function_item_registered_role"
title       = "brw-user-function-item-registered-role"
description = "Role used by the brw-user-function item-registered"
permissions = [     
"storage.objects.create",
"storage.objects.get",
"storage.objects.list"
]
}
resource "google_service_account" "brw-user-function-item-registered-service-account" {
account_id   = "brw-user-function-item-reg-svc"
display_name = "brw-user-function-item-registered-service_account"
}
resource "google_project_iam_member" "brw-user-function-item-registered-service-account-binding" {  
project = local.project
role    = "roles/${google_project_iam_custom_role.brw-user-function-item-registered-role.role_id}"
member  = "serviceAccount:${google_service_account.brw-user-function-item-registered-service-account.email}"
depends_on = [
google_project_iam_custom_role.brw-user-function-item-registered-role,
google_service_account.brw-user-function-item-registered-service-account
]
}

然而，当我试图通过terraform部署它时，我得到以下错误

Request "Create IAM Members roles/brw_user_function_item_registered_role serviceAccount:[e-mail] for "project \"BRW-User\""" returned error: Error retrieving IAM policy for project "BRW-User": googleapi: Error 400: Request contains an invalid argument., badRequest

我不确定这里有什么问题，我也添加了depends_on，以确保它以正确的顺序创建。member属性可能是错误的，我试着给account_id，我仍然得到同样的错误。

Answer 1

只有预定义角色有字符串roles/在名字前面。

您正在使用字符串:

role = "roles/${google_project_iam_custom_role.brw-user-function-item-registered-role.role_id}"

改为:

role = google_project_iam_custom_role.brw-user-function-item-registered-role.name

注意删除角色/，修改role_id到名称，并删除字符串插值。

Answer 2

在资源google_project_iam_member中，如果您传递的是自定义角色，那么它的格式必须是:

[projects|organizations]/{parent-name}/roles/{role-name}

下面是一个例子:

resource "google_project_iam_member" "access" {
project = var.project_name
role    = "projects/${var.project_name}/roles/${google_project_iam_custom_role.customer_access.role_id}"
member  = "serviceAccount:${google_service_account.service_account.email}"
}

此外，作为最佳实践，避免在资源名称中使用破折号(最好是下划线)，并且尽量不要让它太长。我遇到过长名字的问题。