Service account permissions error when provisioning instance group from template

Question

I'm trying to create a GCE Instance Group Manager using terraform

resource "google_compute_region_instance_group_manager" "frontend_group_manager" {
  name = "frontend-igm"

  base_instance_name = "frontend"
  instance_template  = "${google_compute_instance_template.frontend_instance_template.self_link}"
  region             = "${var.region}"

  depends_on = [ "google_compute_instance_template.frontend_instance_template" ]
}

When I try I get the following error:

Error: Error waiting for Creating InstanceGroupManager: The user does not have access to service account 'One of [serviceAccount:[email protected]]'. User: '[email protected]'. Ask a project owner to grant you the iam.serviceAccountUser role on the service account

When I validate the IAM policy on the account it appears to be configured correctly:

> gcloud iam service-accounts get-iam-policy [email protected]
bindings:
- members:
  - serviceAccount:[email protected]
  role: roles/iam.serviceAccountUser
etag: BwWMpQvtA3w=
version: 1                                        

The template is configured as follows:

resource "google_compute_instance_template" "frontend_instance_template" {
  name = "frontend-template"

  instance_description = "Frontend Instances"
  machine_type         = "f1-micro"
  can_ip_forward       = false

  scheduling {
    automatic_restart   = true
    on_host_maintenance = "MIGRATE"
  }

  disk {
    source_image = "${data.google_compute_image.compute_image.self_link}"
    auto_delete  = true
    boot         = true
  }

  network_interface {
    network = "${google_compute_network.frontend_network.name}"
  }

  service_account {
    email  = "serviceAccount:${google_service_account.frontend_service_account.email}"
    scopes = ["default"]
  }

  depends_on = [
    "google_compute_network.frontend_network",
    "google_service_account_iam_member.frontend_service_account_permission",
    "google_project_iam_member.frontend_service_account_role_binding"
  ]
}

And the Service Account is configured as follows:

resource "google_service_account" "frontend_service_account" {
  account_id   = "frontend"
  display_name = "Frontend Service"
}

resource "google_service_account_iam_member" "frontend_service_account_permission" {
  service_account_id = "${google_service_account.frontend_service_account.name}"
  role               = "roles/iam.serviceAccountUser"
  member             = "serviceAccount:${data.google_service_account.terraform.email}"

  depends_on = ["google_service_account.frontend_service_account"]
}

resource "google_project_iam_member" "frontend_service_account_role_binding" {
  role   = "projects/${data.google_project.project.project_id}/roles/${google_project_iam_custom_role.base_compute_role.role_id}"
  member = "serviceAccount:${google_service_account.frontend_service_account.email}"

  depends_on = [
    "data.google_project.project",
    "google_project_iam_custom_role.base_compute_role",
    "google_service_account.frontend_service_account"
  ]
}

Finally, the custom role is as follows:

resource "google_project_iam_custom_role" "base_compute_role" {
  role_id = "base_compute_role"
  title   = "Base Compute Role"
  permissions = [
    "logging.logEntries.create",
    "monitoring.metricDescriptors.create",
    "monitoring.metricDescriptors.get",
    "monitoring.metricDescriptors.list",
    "monitoring.monitoredResourceDescriptors.get",
    "monitoring.monitoredResourceDescriptors.list",
    "monitoring.timeSeries.create"
  ]

  depends_on = ["google_project_service.iam"]
}

Why when everything appears to be in place does that error keep getting thrown by the GCE API.

Answer 1

Try adding permissions on your project level:

gcloud projects add-iam-policy-binding <your-project-id> --member=serviceAccount:[email protected] --role='roles/iam.serviceAccountUser'

Answer 2

In the google_compute_instance_template resource, the email property of the service_account block should not start with "serviceAccount:". Change from:

service_account {
  email  = "serviceAccount:${google_service_account.frontend_service_account.email}"
  scopes = ["default"]
}

To this:

service_account {
  email  = "${google_service_account.frontend_service_account.email}"
  scopes = ["default"]
}

Answer 3

I fumbled upon this question today as i was struggling with this error, the way credentials are get created in azure is way much better than this google, however i had added service account user through the gcp portal and my terraform was able to create test vm, hope this help.