I've been trying to spin up a project from scratch over the Christmas break to automate the creation of my home network, one of those components is the Ubiquiti Controller which requires a Google Maps API key to plot devices onto maps.

I've been able to automate the creation of the project using Terraform:

resource "google_project" "slaterfamily_network" {
  depends_on      = ["data.google_organization.org"]
  name            = "Slater Family Network"
  project_id      = "slaterfamily-network"
  org_id          = "${data.google_organization.org.id}"
  billing_account = "${var.billing_account}"

resource "google_project_iam_binding" "account_owner" {
  project = "${google_project.slaterfamily_network.project_id}"

  # It's important to specify ALL members, as this replaces them:
  #   https://twitter.com/devopsreact/status/840233052194320384
  members = [

  role = "roles/owner"

This works fine for configuring Google Cloud DNS, however, I can't seem to find a way of enabling Google Maps and generating an API key, the following statements enable the Service Usage API, however it fails enabling the Maps API:

resource "google_project_service" "service_usage" {
  project = "${var.project_id}"
  service = "serviceusage.googleapis.com"

resource "google_project_service" "maps" {
  depends_on = ["google_project_service.service_usage"]
  project = "${var.project_id}"
  service = "maps.googleapis.com"

With this error:

google_project_service.maps: Error enabling service: failed to issue request: googleapi: Error 403: The caller does not have permission, forbidden

Which after tracing the HTTP calls gives me the following, formatted as cURL for ease of reproduction:

curl -H 'Host: serviceusage.googleapis.com' -H 'content-type: application/json' -H 'authorization: Bearer {{ BEARER_TOKEN }}' -H 'user-agent: google-api-go-client/0.5 Terraform/0.11.7 (+https://www.terraform.io) terraform-provider-google/1.20.0' --data-binary "{}" --compressed 'https://serviceusage.googleapis.com/v1beta1/projects/slaterfamily-network/services/maps.googleapis.com:enable?alt=json&prettyPrint=false'

Which results in:

  "error": {
    "code": 403,
    "message": "The caller does not have permission",
    "errors": [
        "message": "The caller does not have permission",
        "domain": "global",
        "reason": "forbidden"
    "status": "PERMISSION_DENIED"
  • Did you ever find a way to create the api key after enabling the api? – Koesper May 18 '20 at 7:26

I faced the similar problem recently, but fixed it by providing additional roles to the service account. I am not sure what permissions you need, you need to look it up. In my case, I was trying to create an appengine project, So I had to add "Appengine Admin" role to the service account and enable "appengine.googleapis.com" via terraform resource "google_project_service"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.