Google Cloud Platform Terraform and Cloud Build Issue

[noll_6451]

Description: I am encountering an issue when using Terraform in conjunction with Cloud Build on Google Cloud Platform to create a sequence of resources, including project creation and load balancer setup. Specifically, I am facing issues when Cloud Build, executed by the default service account, attempts to create a project and associate it with a billing account using permissions borrowed from another service account. Terraform plan runs without errors, but Terraform apply fails with a "lack of project creation permissions" error.

Issue Details:

1. Problem Description:

   Only when running with cloudbuild, I get a 403 no permissions error when creating a project.
   When local, it succeeds.

2. Error Messages:

   • Error 403: The caller does have permission,forbidden.

Environment Details:

1. Service Accounts:

   • sample@cloudbuild.gserviceaccount.com
     • ServiceAccount.User,ServiceAccount.TokenCreator,roles/billing.user
   • administrator@sample.iam.gseerviceaccount.com
     
     • roles/resourcemanager.projectCreator,roles/billing.user

2. Terraform and Cloud Build Versions:

   • terraform 1.5.0

[kateF]

In order to create a project your cloudbuild SA will need a few more permissions. See here: 

https://cloud.google.com/resource-manager/docs/creating-managing-projects#creating_a_project

[noll_6451]

Thanks for the reply.
I want to create a project by borrowing and running another SA's permissions instead of granting them directly to CloudBuildSA.

[kateF]

ok, you mentioned you are running your terraform scripts thru cloud build. is that with the use of a cloud build trigger? If that's the case, did you set the service account, to run the cloud build deployment, in the cloud build trigger settings? It's available at the bottom of the cloud build trigger setup form. Then it won't automatically use the cloud build SA when running your cloud build pipeline (FYI - I don't see the ability to set the service account in the gcloud cli command when running a build).

make sure that your service account you do use, has the required permissions to create the project. usually if a process fails due to permission issues, it will let you know what permissions are missing.

[noll_6451]

Yes you are right.
And I am using cloud build trigger.
I have tried both ways, with and without setting the service account in cloud build trigger settings.

The way I do it without setting the service account is as described above.
And the problem is also as written above.

The way not to set the service account is,
administrator@sample.iam.gseerviceaccount.com
I did this by setting the
However, I was able to set up the trigger, but I could not find the error code or the error message, so I did not include it in the question this time.

[robertcarlos]

Hi @noll_6451,

Welcome to Google Cloud Community!

There are several factors that lead to this error message. Based on this documentation on error 403:

• If there is no email address, then make sure that your authentication is working properly.
• If there is an email address, but it's not the service account that you wanted to impersonate, then make sure that your service account impersonation is set up correctly
• If the correct email address is showing, make sure that it has the following permissions on the project:
  • getIamPolicy
  • resourcemanager.projects.get

Run the command with --verbosity=debug and look for a message like Terraform is using this identity:. It should be followed by an email address, which is the account being used for API requests.

You may also check these related Stack Overflow links as this could help resolve the issue:

• Error 403, "The caller does not have permission" when trying to impersonate Service Account in GCP 
• How to resolve "googleapi: Error 403: The caller does not have permission, forbidden" 

Hope these help.

[noll_6451]

Hi @robertcarlos 

Thanks for the reply.

I reviewed everything as you said.
I also looked at the reference articles, but they didn't come close to solving my problem.
Is --verbosity=debug an option for the gcloud command? Or is it a terraform option?

[robertcarlos]

Hi @noll_6451,

It's a gcloud command.

[noll_6451]

Hi, @robertcarlos 

terraform was running using cloud build SA.
What I was hoping to do was to borrow privileges to run a temporarily created service account.

A new question arose here.
If a user account borrows a service account and another service account borrows a service account

Are the required privileges the same?