Answers: <p>In the google_compute_instance_template resource, the email property of the service_account block should not start with &quot;serviceAccount:&quot;. Change from:</p>
  <pre><code>service_account {
    email  = &quot;serviceAccount:${google_service_account.frontend_service_account.email}&quot;
    scopes = [&quot;default&quot;]
  }
  </code></pre>
  <p>To this:</p>
  <pre><code>service_account {
    email  = &quot;${google_service_account.frontend_service_account.email}&quot;
    scopes = [&quot;default&quot;]
  }
  </code></pre>
  
Answers: CC BY-SA 4.0
Answers: 2021-01-13T12:41:12.200Z
Answers: 2021-01-13T12:41:12.200Z
Answers: Staffan Hörke
Answers: <p>Try adding permissions on your project level:</p>
  
  <p><code>gcloud projects add-iam-policy-binding &lt;your-project-id&gt; --member=serviceAccount:terraform@vpc-challenge-lab-245114.iam.gserviceaccount.com --role='roles/iam.serviceAccountUser'</code></p>
  
Answers: CC BY-SA 4.0
Answers: 2019-07-05T09:05:16.143Z
Answers: Good shout, unfortunately, it doesn't seem to help.  I'm beginning to suspect that it's because it's an individual GCP account (no organisation or folder) and there are some implicit permissions that would only work if the terraform user created the project - however that's not possible without giving permissions to an organisation or folder.
Answers: Richard Slater
Answers: CC BY-SA 4.0
Answers: 2019-07-04T18:54:02.167Z
Answers: 2019-07-04T18:54:02.167Z
Answers: manasouza
Answers: <p>I fumbled upon this question today as i was struggling with this error, the way credentials are get created in azure is way much better than this google, 
  however i had added service account user through the gcp portal and my terraform was able to create test vm, hope this help.</p>
  
Answers: CC BY-SA 4.0
Answers: 2020-05-22T10:49:23.560Z
Answers: Could you add some more details?
Answers: 030
Answers: CC BY-SA 4.0
Answers: 2021-07-22T14:06:12.330Z
Answers: My apologies, its been long time, i will surely get back with what i did to deploy
Answers: cloudcop
Answers: CC BY-SA 4.0
Answers: 2020-05-22T01:58:34.423Z
Answers: 2020-05-22T01:58:34.423Z
Answers: cloudcop
Body: <p>I'm trying to create a GCE Instance Group Manager using terraform</p>
  
  <pre><code>resource "google_compute_region_instance_group_manager" "frontend_group_manager" {
    name = "frontend-igm"
  
    base_instance_name = "frontend"
    instance_template  = "${google_compute_instance_template.frontend_instance_template.self_link}"
    region             = "${var.region}"
  
    depends_on = [ "google_compute_instance_template.frontend_instance_template" ]
  }
  </code></pre>
  
  <p>When I try I get the following error:</p>
  
  <blockquote>
    <p>Error: Error waiting for Creating InstanceGroupManager: The user does not have access to service account 'One of [serviceAccount:frontend@vpc-challenge-lab-245114.iam.gserviceaccount.com]'.  User: 'terraform@vpc-challenge-lab-245114.iam.gserviceaccount.com'.  Ask a project owner to grant you the iam.serviceAccountUser role on the service account</p>
  </blockquote>
  
  <p>When I validate the IAM policy on the account it appears to be configured correctly:</p>
  
  <pre><code>&gt; gcloud iam service-accounts get-iam-policy frontend@vpc-challenge-lab-245114.iam.gserviceaccount.com
  bindings:
  - members:
    - serviceAccount:terraform@vpc-challenge-lab-245114.iam.gserviceaccount.com
    role: roles/iam.serviceAccountUser
  etag: BwWMpQvtA3w=
  version: 1                                        
  </code></pre>
  
  <p>The template is configured as follows:</p>
  
  <pre><code>resource "google_compute_instance_template" "frontend_instance_template" {
    name = "frontend-template"
  
    instance_description = "Frontend Instances"
    machine_type         = "f1-micro"
    can_ip_forward       = false
  
    scheduling {
      automatic_restart   = true
      on_host_maintenance = "MIGRATE"
    }
  
    disk {
      source_image = "${data.google_compute_image.compute_image.self_link}"
      auto_delete  = true
      boot         = true
    }
  
    network_interface {
      network = "${google_compute_network.frontend_network.name}"
    }
  
    service_account {
      email  = "serviceAccount:${google_service_account.frontend_service_account.email}"
      scopes = ["default"]
    }
  
    depends_on = [
      "google_compute_network.frontend_network",
      "google_service_account_iam_member.frontend_service_account_permission",
      "google_project_iam_member.frontend_service_account_role_binding"
    ]
  }
  </code></pre>
  
  <p>And the Service Account is configured as follows:</p>
  
  <pre><code>resource "google_service_account" "frontend_service_account" {
    account_id   = "frontend"
    display_name = "Frontend Service"
  }
  
  resource "google_service_account_iam_member" "frontend_service_account_permission" {
    service_account_id = "${google_service_account.frontend_service_account.name}"
    role               = "roles/iam.serviceAccountUser"
    member             = "serviceAccount:${data.google_service_account.terraform.email}"
  
    depends_on = ["google_service_account.frontend_service_account"]
  }
  
  resource "google_project_iam_member" "frontend_service_account_role_binding" {
    role   = "projects/${data.google_project.project.project_id}/roles/${google_project_iam_custom_role.base_compute_role.role_id}"
    member = "serviceAccount:${google_service_account.frontend_service_account.email}"
  
    depends_on = [
      "data.google_project.project",
      "google_project_iam_custom_role.base_compute_role",
      "google_service_account.frontend_service_account"
    ]
  }
  </code></pre>
  
  <p>Finally, the custom role is as follows:</p>
  
  <pre><code>resource "google_project_iam_custom_role" "base_compute_role" {
    role_id = "base_compute_role"
    title   = "Base Compute Role"
    permissions = [
      "logging.logEntries.create",
      "monitoring.metricDescriptors.create",
      "monitoring.metricDescriptors.get",
      "monitoring.metricDescriptors.list",
      "monitoring.monitoredResourceDescriptors.get",
      "monitoring.monitoredResourceDescriptors.list",
      "monitoring.timeSeries.create"
    ]
  
    depends_on = ["google_project_service.iam"]
  }
  </code></pre>
  
  <p>Why when everything appears to be in place does that error keep getting thrown by the GCE API.</p>
  
Tags: <terraform><google-cloud-platform><google-compute-engine>
Title: Service account permissions error when provisioning instance group from template
UserDisplayName: Richard Slater
ThreadText: # Service account permissions error when provisioning instance group from template
  
  (Asked by: username_0 on 2019-07-01)
  
  I'm trying to create a GCE Instance Group Manager using terraform
  
  ```
  resource "google_compute_region_instance_group_manager" "frontend_group_manager" {
    name = "frontend-igm"
  
    base_instance_name = "frontend"
    instance_template  = "${google_compute_instance_template.frontend_instance_template.self_link}"
    region             = "${var.region}"
  
    depends_on = [ "google_compute_instance_template.frontend_instance_template" ]
  }
  
  ```
  
  When I try I get the following error:
  
  > Error: Error waiting for Creating InstanceGroupManager: The user does not have access to service account 'One of [serviceAccount:frontend@vpc-challenge-lab-245114.iam.gserviceaccount.com]'. User: 'terraform@vpc-challenge-lab-245114.iam.gserviceaccount.com'. Ask a project owner to grant you the iam.serviceAccountUser role on the service account
  
  When I validate the IAM policy on the account it appears to be configured correctly:
  
  ```
  > gcloud iam service-accounts get-iam-policy frontend@vpc-challenge-lab-245114.iam.gserviceaccount.com
  bindings:
  - members:
    - serviceAccount:terraform@vpc-challenge-lab-245114.iam.gserviceaccount.com
    role: roles/iam.serviceAccountUser
  etag: BwWMpQvtA3w=
  version: 1                                        
  
  ```
  
  The template is configured as follows:
  
  ```
  resource "google_compute_instance_template" "frontend_instance_template" {
    name = "frontend-template"
  
    instance_description = "Frontend Instances"
    machine_type         = "f1-micro"
    can_ip_forward       = false
  
    scheduling {
      automatic_restart   = true
      on_host_maintenance = "MIGRATE"
    }
  
    disk {
      source_image = "${data.google_compute_image.compute_image.self_link}"
      auto_delete  = true
      boot         = true
    }
  
    network_interface {
      network = "${google_compute_network.frontend_network.name}"
    }
  
    service_account {
      email  = "serviceAccount:${google_service_account.frontend_service_account.email}"
      scopes = ["default"]
    }
  
    depends_on = [
      "google_compute_network.frontend_network",
      "google_service_account_iam_member.frontend_service_account_permission",
      "google_project_iam_member.frontend_service_account_role_binding"
    ]
  }
  
  ```
  
  And the Service Account is configured as follows:
  
  ```
  resource "google_service_account" "frontend_service_account" {
    account_id   = "frontend"
    display_name = "Frontend Service"
  }
  
  resource "google_service_account_iam_member" "frontend_service_account_permission" {
    service_account_id = "${google_service_account.frontend_service_account.name}"
    role               = "roles/iam.serviceAccountUser"
    member             = "serviceAccount:${data.google_service_account.terraform.email}"
  
    depends_on = ["google_service_account.frontend_service_account"]
  }
  
  resource "google_project_iam_member" "frontend_service_account_role_binding" {
    role   = "projects/${data.google_project.project.project_id}/roles/${google_project_iam_custom_role.base_compute_role.role_id}"
    member = "serviceAccount:${google_service_account.frontend_service_account.email}"
  
    depends_on = [
      "data.google_project.project",
      "google_project_iam_custom_role.base_compute_role",
      "google_service_account.frontend_service_account"
    ]
  }
  
  ```
  
  Finally, the custom role is as follows:
  
  ```
  resource "google_project_iam_custom_role" "base_compute_role" {
    role_id = "base_compute_role"
    title   = "Base Compute Role"
    permissions = [
      "logging.logEntries.create",
      "monitoring.metricDescriptors.create",
      "monitoring.metricDescriptors.get",
      "monitoring.metricDescriptors.list",
      "monitoring.monitoredResourceDescriptors.get",
      "monitoring.monitoredResourceDescriptors.list",
      "monitoring.timeSeries.create"
    ]
  
    depends_on = ["google_project_service.iam"]
  }
  
  ```
  
  Why when everything appears to be in place does that error keep getting thrown by the GCE API.
  
  **Tags:** terraform, google-cloud-platform, google-compute-engine
  
  
  ---
  
  ## 3 answers
  
  ### Answer by username_1 on 2021-01-13. Score: 1
  
  In the google\_compute\_instance\_template resource, the email property of the service\_account block should not start with "serviceAccount:". Change from:
  
  ```
  service_account {
    email  = "serviceAccount:${google_service_account.frontend_service_account.email}"
    scopes = ["default"]
  }
  
  ```
  
  To this:
  
  ```
  service_account {
    email  = "${google_service_account.frontend_service_account.email}"
    scopes = ["default"]
  }
  
  ```
  
  
  ---
  
  ### Answer by username_2 on 2019-07-04. Score: 1
  
  Try adding permissions on your project level:
  
  `gcloud projects add-iam-policy-binding <your-project-id> --member=serviceAccount:terraform@vpc-challenge-lab-245114.iam.gserviceaccount.com --role='roles/iam.serviceAccountUser'`
  
  > **Comments:**
  > **username_0**: Good shout, unfortunately, it doesn't seem to help.  I'm beginning to suspect that it's because it's an individual GCP account (no organisation or folder) and there are some implicit permissions that would only work if the terraform user created the project - however that's not possible without giving permissions to an organisation or folder.  
  
  ---
  
  ### Answer by username_3 on 2020-05-22. Score: 0
  
  I fumbled upon this question today as i was struggling with this error, the way credentials are get created in azure is way much better than this google,
  however i had added service account user through the gcp portal and my terraform was able to create test vm, hope this help.
  
  > **Comments:**
  > **username_4**: Could you add some more details?  
  > **username_3**: My apologies, its been long time, i will surely get back with what i did to deploy  
  
  ---
  
  