I'm trying to create a GCE Instance Group Manager using terraform

resource "google_compute_region_instance_group_manager" "frontend_group_manager" {
  name = "frontend-igm"

  base_instance_name = "frontend"
  instance_template  = "${google_compute_instance_template.frontend_instance_template.self_link}"
  region             = "${var.region}"

  depends_on = [ "google_compute_instance_template.frontend_instance_template" ]

When I try I get the following error:

Error: Error waiting for Creating InstanceGroupManager: The user does not have access to service account 'One of [serviceAccount:[email protected]]'. User: '[email protected]'. Ask a project owner to grant you the iam.serviceAccountUser role on the service account

When I validate the IAM policy on the account it appears to be configured correctly:

> gcloud iam service-accounts get-iam-policy [email protected]
- members:
  - serviceAccount:[email protected]
  role: roles/iam.serviceAccountUser
etag: BwWMpQvtA3w=
version: 1                                        

The template is configured as follows:

resource "google_compute_instance_template" "frontend_instance_template" {
  name = "frontend-template"

  instance_description = "Frontend Instances"
  machine_type         = "f1-micro"
  can_ip_forward       = false

  scheduling {
    automatic_restart   = true
    on_host_maintenance = "MIGRATE"

  disk {
    source_image = "${data.google_compute_image.compute_image.self_link}"
    auto_delete  = true
    boot         = true

  network_interface {
    network = "${google_compute_network.frontend_network.name}"

  service_account {
    email  = "serviceAccount:${google_service_account.frontend_service_account.email}"
    scopes = ["default"]

  depends_on = [

And the Service Account is configured as follows:

resource "google_service_account" "frontend_service_account" {
  account_id   = "frontend"
  display_name = "Frontend Service"

resource "google_service_account_iam_member" "frontend_service_account_permission" {
  service_account_id = "${google_service_account.frontend_service_account.name}"
  role               = "roles/iam.serviceAccountUser"
  member             = "serviceAccount:${data.google_service_account.terraform.email}"

  depends_on = ["google_service_account.frontend_service_account"]

resource "google_project_iam_member" "frontend_service_account_role_binding" {
  role   = "projects/${data.google_project.project.project_id}/roles/${google_project_iam_custom_role.base_compute_role.role_id}"
  member = "serviceAccount:${google_service_account.frontend_service_account.email}"

  depends_on = [

Finally, the custom role is as follows:

resource "google_project_iam_custom_role" "base_compute_role" {
  role_id = "base_compute_role"
  title   = "Base Compute Role"
  permissions = [

  depends_on = ["google_project_service.iam"]

Why when everything appears to be in place does that error keep getting thrown by the GCE API.

3 Answers 3


Try adding permissions on your project level:

gcloud projects add-iam-policy-binding <your-project-id> --member=serviceAccount:[email protected] --role='roles/iam.serviceAccountUser'

  • Good shout, unfortunately, it doesn't seem to help. I'm beginning to suspect that it's because it's an individual GCP account (no organisation or folder) and there are some implicit permissions that would only work if the terraform user created the project - however that's not possible without giving permissions to an organisation or folder. Commented Jul 5, 2019 at 9:05

In the google_compute_instance_template resource, the email property of the service_account block should not start with "serviceAccount:". Change from:

service_account {
  email  = "serviceAccount:${google_service_account.frontend_service_account.email}"
  scopes = ["default"]

To this:

service_account {
  email  = "${google_service_account.frontend_service_account.email}"
  scopes = ["default"]

I fumbled upon this question today as i was struggling with this error, the way credentials are get created in azure is way much better than this google, however i had added service account user through the gcp portal and my terraform was able to create test vm, hope this help.

  • 1
    Could you add some more details?
    – 030
    Commented May 22, 2020 at 10:49
  • My apologies, its been long time, i will surely get back with what i did to deploy
    – cloudcop
    Commented Jul 22, 2021 at 14:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.