title: Error 403: Required 'compute.organizations.enableXpnHost' permission for project when trying to set up shared VPC via terraform
body: <p>I am trying to set-up a shared VPC host project with terraform and I get</p>
  <pre><code>│ Error: Error enabling Shared VPC Host &quot;master-vpc&quot;: googleapi: Error 403: Required 'compute.organizations.enableXpnHost' permission for 'projects/master-vpc', forbidden
  │
  │   with google_compute_shared_vpc_host_project.host,
  │   on main.tf line 282, in resource &quot;google_compute_shared_vpc_host_project&quot; &quot;host&quot;:
  │  282: resource &quot;google_compute_shared_vpc_host_project&quot; &quot;host&quot; {
  </code></pre>
  <p>I've seen <a href="https://stackoverflow.com/questions/66700942/googleapi-error-403-required-compute-organizations-enablexpnhost-permission">this post</a> that matches exactly my premise, but I can't seem to follow their solution as they are using some service account linked to a cloud run environment, which is not my case. I use a <code>terraform-admin</code> service account that has &quot;organization admin rigths&quot; cf. Image 1 <a href="https://i.stack.imgur.com/2ujRn.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/2ujRn.png" alt="Image 1" /></a></p>
  <p>Since <code>terraform-admin</code> is the one creating resources through <code>terraform</code> (that i run locally via an account key), it should have ample permissions to add the resource <code>google_compute_shared_vpc_host_project</code>.</p>
  <p>Here are the permissions I further assigned to the accounts <code>network-admin</code> (The account that I want to manage the VPC with) and the <code>terraform-admin</code> the general infrastructure super-admin.</p>
  <pre><code>resource &quot;google_project_iam_member&quot; &quot;master-vpc-owner-role&quot; {
    project = google_project.master-vpc.project_id
    member  = &quot;serviceAccount:${google_service_account.master-vpc-network-admin.email}&quot;
    role    = &quot;roles/owner&quot;
  }
  resource &quot;google_project_iam_member&quot; &quot;master-vpc-project-iam-admin-role&quot; {
    project = google_project.master-vpc.project_id
    role    = &quot;roles/resourcemanager.projectIamAdmin&quot;
    member  = &quot;serviceAccount:${google_service_account.master-vpc-network-admin.email}&quot;
  }
  # roles/compute.xpnAdmin does not seem to cascade to the project
  resource &quot;google_folder_iam_member&quot; &quot;net-ops-folder-compute-xpnAdmin-role-for-net-admin&quot; {
    folder = google_folder.net-ops.name
    member  = &quot;serviceAccount:${google_service_account.master-vpc-network-admin.email}&quot;
    role    = &quot;roles/compute.xpnAdmin&quot;
  }
  
  # Create the shared VPC
  resource &quot;google_compute_shared_vpc_host_project&quot; &quot;host&quot; {
    # project = google_project.master-vpc.project_id
    project = &quot;${var.project_master_vpc.project_id}&quot;
  }
  </code></pre>
  <p>Could somebody explain to me what I'm doing wrong?</p>
  <p>Is the fact that I'm running <code>terraform apply</code> locally somehow use the authenticated account via <strong>gcloud auth</strong> ?</p>
  <p>FYI, in order to apply the infrastructure changes to my organization, I use a credentials' file</p>
  <pre><code>provider &quot;google&quot; {
    credentials = file(var.credentials_file)
    region      = var.region
    zone        = var.zone
  }
  </code></pre>
  <ul>
  <li><p>I can't seem to assign the role <code>&quot;roles/compute.xpnAdmin&quot;</code> to the <code>master-vpc</code>, which is why I assign it to the parent folder <code>Net-ops</code>, but the error &quot;requires&quot; the permission on 'projects/master-vpc'. What am I missing?</p>
  </li>
  <li><p>Is enabling this role on the <code>Net-ops</code> folder level sufficient, or do I have to put it in the organization level? (I'm not sure if that's a good idea either, as it would grant the <code>network-admin</code> some organization-level actions)</p>
  </li>
  </ul>