Answers: <p>I guess the service ID you're looking for is <code>maps-backend.googleapis.com</code> or <code>static-maps-backend.googleapis.com</code> if you want to generate static maps.</p>
  <pre><code>➜  ~ gcloud services list --available |grep maps
  maps-android-backend.googleapis.com                                                                  Maps SDK for Android
  maps-backend.googleapis.com                                                                          Maps JavaScript API
  maps-embed-backend.googleapis.com                                                                    Maps Embed API
  maps-ios-backend.googleapis.com                                                                      Maps SDK for iOS
  static-maps-backend.googleapis.com                                                                   Maps Static API
  </code></pre>
  <p>I've got these result with Google Cloud SDK version 360.0.0, also there is <code>apikeys.googleapis.com</code> service available with <code>alpha</code> component which makes me think it could be achievable by using <a href="https://registry.terraform.io/modules/terraform-google-modules/gcloud/google/latest" rel="nofollow noreferrer">gcloud module</a> and <code>gcloud alpha services api-keys create</code> command.</p>
  
Answers: CC BY-SA 4.0
Answers: 2021-10-10T02:49:00.517Z
Answers: 2021-10-10T02:49:00.517Z
Answers: Ahmet Aygun
Answers: <p>I faced the similar problem recently, but fixed it by providing additional roles to the service account. I am not sure what permissions you need, you need to look it up. In my case, I was trying to create an appengine project, So I had to add "Appengine Admin" role to the service account and enable "appengine.googleapis.com" via terraform resource "google_project_service"</p>
  
Answers: CC BY-SA 4.0
Answers: 2019-06-14T10:08:40.077Z
Answers: 2019-06-14T10:08:40.077Z
Answers: Prakhar
Answers: <p>Thanks @Ahmet! I put up a bounty for this question and Ahmet came through with a great answer. I tried the <code>gcloud</code> module for terraform and it worked! However I needed to go a step further as the gcloud command wasn't able to save the output and also couldn't read the file due to permission issues. So I actually took the concept and used the <code>local-exec</code> in terraform instead to run a script which does all the gcloud commands I needed.</p>
  <p>You can find a list of APIs here: <a href="https://developers.google.com/apis-explorer/" rel="nofollow noreferrer">https://developers.google.com/apis-explorer/</a></p>
  <p>Go into the documentation for the one you need and copy the url <code>*.googleapis.com</code>, in my example I needed the Geocoding API turned on and an API key for it.</p>
  <pre><code># main.tf
  
  module &quot;project_services&quot; {
    source  = &quot;terraform-google-modules/project-factory/google//modules/project_services&quot;
    version = &quot;11.2.1&quot;
  
    project_id = var.project_id
    activate_apis = [
      &quot;geocoding-backend.googleapis.com&quot;,
    ]
    disable_dependent_services  = false
    disable_services_on_destroy = false
  }
  
  resource &quot;null_resource&quot; &quot;geocode&quot; {
    provisioner &quot;local-exec&quot; {
      command = &quot;chmod +x ./scripts/script.sh &amp;&amp; sh ./scripts/script.sh&quot;
      environment = {
        SERVICE_API = &quot;geocoding-backend.googleapis.com&quot;
        KEY_NAME = &quot;my-key&quot;
        SECRET_NAME = &quot;my-secret&quot;
      }
    }
    depends_on = [
      # e.g. module.secret_manager
    ]
  }
  </code></pre>
  <p>Then you can create a script like so, with the environment variables being injected in:</p>
  <pre class="lang-bash prettyprint-override"><code># ./scripts/script.sh
  
  GCLOUD_LOCATION=$(command -v gcloud)
  echo &quot;Using gcloud from $GCLOUD_LOCATION&quot;
  
  gcloud alpha services api-keys create --api-target=service=&quot;$SERVICE_API&quot; --display-name=&quot;$KEY_NAME&quot; &amp;&amp;
  export KEY_NAME=$(gcloud alpha services api-keys list --format=&quot;value(name)&quot; --sort-by createTime --limit 1) &amp;&amp;
  export API_KEY=$(gcloud alpha services api-keys get-key-string $KEY_NAME --format=&quot;value(keyString)&quot;) &amp;&amp;
  printf $API_KEY | gcloud secrets versions add &quot;$SECRET_NAME&quot; --data-file=-
  </code></pre>
  <p>My above script takes the key and inserts it into an existing Secret I created in terraform.</p>
  
Answers: CC BY-SA 4.0
Answers: 2021-10-10T09:30:41.667Z
Answers: 2021-10-10T09:30:41.667Z
Answers: Ari
Body: <p>I've been trying to spin up a project from scratch over the Christmas break to automate the creation of my home network, one of those components is the <a href="https://www.amazon.co.uk/dp/B017T2QB22/" rel="nofollow noreferrer">Ubiquiti Controller</a> which requires a <a href="https://developers.google.com/maps/documentation/embed/get-api-key" rel="nofollow noreferrer">Google Maps API key</a> to plot devices onto maps.</p>
  
  <p>I've been able to automate the creation of the project using Terraform:</p>
  
  <pre><code>resource "google_project" "slaterfamily_network" {
    depends_on      = ["data.google_organization.org"]
    name            = "Slater Family Network"
    project_id      = "slaterfamily-network"
    org_id          = "${data.google_organization.org.id}"
    billing_account = "${var.billing_account}"
  }
  
  resource "google_project_iam_binding" "account_owner" {
    project = "${google_project.slaterfamily_network.project_id}"
  
    # It's important to specify ALL members, as this replaces them:
    #   https://twitter.com/devopsreact/status/840233052194320384
    members = [
      "user:richard@slaterfamily.name",
      "serviceAccount:${data.google_service_account.terraform_service_account.email}",
    ]
  
    role = "roles/owner"
  }
  </code></pre>
  
  <p>This works fine for configuring Google Cloud DNS, however, I can't seem to find a way of enabling Google Maps and generating an API key, the following statements enable the Service Usage API, however it fails enabling the Maps API:</p>
  
  <pre><code>resource "google_project_service" "service_usage" {
    project = "${var.project_id}"
    service = "serviceusage.googleapis.com"
  }
  
  resource "google_project_service" "maps" {
    depends_on = ["google_project_service.service_usage"]
    project = "${var.project_id}"
    service = "maps.googleapis.com"
  }
  </code></pre>
  
  <p>With this error:</p>
  
  <pre><code>google_project_service.maps: Error enabling service: failed to issue request: googleapi: Error 403: The caller does not have permission, forbidden
  </code></pre>
  
  <p>Which after tracing the HTTP calls gives me the following, formatted as cURL for ease of reproduction:</p>
  
  <pre><code>curl -H 'Host: serviceusage.googleapis.com' -H 'content-type: application/json' -H 'authorization: Bearer {{ BEARER_TOKEN }}' -H 'user-agent: google-api-go-client/0.5 Terraform/0.11.7 (+https://www.terraform.io) terraform-provider-google/1.20.0' --data-binary "{}" --compressed 'https://serviceusage.googleapis.com/v1beta1/projects/slaterfamily-network/services/maps.googleapis.com:enable?alt=json&amp;prettyPrint=false'
  </code></pre>
  
  <p>Which results in:</p>
  
  <pre><code>{
    "error": {
      "code": 403,
      "message": "The caller does not have permission",
      "errors": [
        {
          "message": "The caller does not have permission",
          "domain": "global",
          "reason": "forbidden"
        }
      ],
      "status": "PERMISSION_DENIED"
    }
  }
  </code></pre>
  
Comments: CC BY-SA 4.0
Comments: 2020-05-18T07:26:35.777Z
Comments: Did you ever find a way to create the api key after enabling the api?
Comments: Koesper
Comments: CC BY-SA 4.0
Comments: 2022-03-15T12:55:03.510Z
Comments: It's not yet possible to create api key with terraform. https://stackoverflow.com/questions/60828348/can-i-create-gcp-api-keys-using-terraform
Comments: intotecho
Tags: <terraform><google-cloud-platform>
Title: How to enable Google Maps and generate an API key using Terraform?
UserDisplayName: Richard Slater
ThreadText: # How to enable Google Maps and generate an API key using Terraform?
  
  (Asked by: username_0 on 2018-12-27)
  
  I've been trying to spin up a project from scratch over the Christmas break to automate the creation of my home network, one of those components is the [Ubiquiti Controller](https://www.amazon.co.uk/dp/B017T2QB22/) which requires a [Google Maps API key](https://developers.google.com/maps/documentation/embed/get-api-key) to plot devices onto maps.
  
  I've been able to automate the creation of the project using Terraform:
  
  ```
  resource "google_project" "slaterfamily_network" {
    depends_on      = ["data.google_organization.org"]
    name            = "username_0 Family Network"
    project_id      = "slaterfamily-network"
    org_id          = "${data.google_organization.org.id}"
    billing_account = "${var.billing_account}"
  }
  
  resource "google_project_iam_binding" "account_owner" {
    project = "${google_project.slaterfamily_network.project_id}"
  
    # It's important to specify ALL members, as this replaces them:
    #   https://twitter.com/devopsreact/status/840233052194320384
    members = [
      "user:username_0@slaterfamily.name",
      "serviceAccount:${data.google_service_account.terraform_service_account.email}",
    ]
  
    role = "roles/owner"
  }
  
  ```
  
  This works fine for configuring Google Cloud DNS, however, I can't seem to find a way of enabling Google Maps and generating an API key, the following statements enable the Service Usage API, however it fails enabling the Maps API:
  
  ```
  resource "google_project_service" "service_usage" {
    project = "${var.project_id}"
    service = "serviceusage.googleapis.com"
  }
  
  resource "google_project_service" "maps" {
    depends_on = ["google_project_service.service_usage"]
    project = "${var.project_id}"
    service = "maps.googleapis.com"
  }
  
  ```
  
  With this error:
  
  ```
  google_project_service.maps: Error enabling service: failed to issue request: googleapi: Error 403: The caller does not have permission, forbidden
  
  ```
  
  Which after tracing the HTTP calls gives me the following, formatted as cURL for ease of reproduction:
  
  ```
  curl -H 'Host: serviceusage.googleapis.com' -H 'content-type: application/json' -H 'authorization: Bearer {{ BEARER_TOKEN }}' -H 'user-agent: google-api-go-client/0.5 Terraform/0.11.7 (+https://www.terraform.io) terraform-provider-google/1.20.0' --data-binary "{}" --compressed 'https://serviceusage.googleapis.com/v1beta1/projects/slaterfamily-network/services/maps.googleapis.com:enable?alt=json&prettyPrint=false'
  
  ```
  
  Which results in:
  
  ```
  {
    "error": {
      "code": 403,
      "message": "The caller does not have permission",
      "errors": [
        {
          "message": "The caller does not have permission",
          "domain": "global",
          "reason": "forbidden"
        }
      ],
      "status": "PERMISSION_DENIED"
    }
  }
  
  ```
  
  **Tags:** terraform, google-cloud-platform
  
  > **Comments:**
  > **username_1**: Did you ever find a way to create the api key after enabling the api?  
  > **username_2**: It's not yet possible to create api key with terraform. https://stackoverflow.com/questions/60828348/can-i-create-gcp-api-keys-using-terraform  
  
  ---
  
  ## 3 answers
  
  ### Answer by username_3 on 2021-10-10. Score: 2
  
  I guess the service ID you're looking for is `maps-backend.googleapis.com` or `static-maps-backend.googleapis.com` if you want to generate static maps.
  
  ```
  ➜  ~ gcloud services list --available |grep maps
  maps-android-backend.googleapis.com                                                                  Maps SDK for Android
  maps-backend.googleapis.com                                                                          Maps JavaScript API
  maps-embed-backend.googleapis.com                                                                    Maps Embed API
  maps-ios-backend.googleapis.com                                                                      Maps SDK for iOS
  static-maps-backend.googleapis.com                                                                   Maps Static API
  
  ```
  
  I've got these result with Google Cloud SDK version 360.0.0, also there is `apikeys.googleapis.com` service available with `alpha` component which makes me think it could be achievable by using [gcloud module](https://registry.terraform.io/modules/terraform-google-modules/gcloud/google/latest) and `gcloud alpha services api-keys create` command.
  
  
  ---
  
  ### Answer by username_4 on 2019-06-14. Score: 1
  
  I faced the similar problem recently, but fixed it by providing additional roles to the service account. I am not sure what permissions you need, you need to look it up. In my case, I was trying to create an appengine project, So I had to add "Appengine Admin" role to the service account and enable "appengine.googleapis.com" via terraform resource "google\_project\_service"
  
  
  ---
  
  ### Answer by username_5 on 2021-10-10. Score: 0
  
  Thanks @username_3! I put up a bounty for this question and username_3 came through with a great answer. I tried the `gcloud` module for terraform and it worked! However I needed to go a step further as the gcloud command wasn't able to save the output and also couldn't read the file due to permission issues. So I actually took the concept and used the `local-exec` in terraform instead to run a script which does all the gcloud commands I needed.
  
  You can find a list of APIs here: <https://developers.google.com/apis-explorer/>
  
  Go into the documentation for the one you need and copy the url `*.googleapis.com`, in my example I needed the Geocoding API turned on and an API key for it.
  
  ```
  # main.tf
  
  module "project_services" {
    source  = "terraform-google-modules/project-factory/google//modules/project_services"
    version = "11.2.1"
  
    project_id = var.project_id
    activate_apis = [
      "geocoding-backend.googleapis.com",
    ]
    disable_dependent_services  = false
    disable_services_on_destroy = false
  }
  
  resource "null_resource" "geocode" {
    provisioner "local-exec" {
      command = "chmod +x ./scripts/script.sh && sh ./scripts/script.sh"
      environment = {
        SERVICE_API = "geocoding-backend.googleapis.com"
        KEY_NAME = "my-key"
        SECRET_NAME = "my-secret"
      }
    }
    depends_on = [
      # e.g. module.secret_manager
    ]
  }
  
  ```
  
  Then you can create a script like so, with the environment variables being injected in:
  
  ```bash
  # ./scripts/script.sh
  
  GCLOUD_LOCATION=$(command -v gcloud)
  echo "Using gcloud from $GCLOUD_LOCATION"
  
  gcloud alpha services api-keys create --api-target=service="$SERVICE_API" --display-name="$KEY_NAME" &&
  export KEY_NAME=$(gcloud alpha services api-keys list --format="value(name)" --sort-by createTime --limit 1) &&
  export API_KEY=$(gcloud alpha services api-keys get-key-string $KEY_NAME --format="value(keyString)") &&
  printf $API_KEY | gcloud secrets versions add "$SECRET_NAME" --data-file=-
  
  ```
  
  My above script takes the key and inserts it into an existing Secret I created in terraform.
  
  
  ---
  
  