无法使用 Terraform 创建 google 项目

Question

我正在遵循Google GKE 和 SQL with terraform教程，但我无法创建google_project.project。我已经尝试过作为项目所有者和教程中描述的服务。两次尝试均以以下错误结束：

Error: Error applying plan:

1 error(s) occurred:

* google_project.project: 1 error(s) occurred:

* google_project.project: error creating project terraform-dev-357aa670 
 (terraform-dev): googleapi: Error 403: User is not authorized., forbidden. 
  If you received a 403 error, make sure 
  you have the `roles/resourcemanager.projectCreator` permission

我认为我作为项目所有者拥有正确的权限，但显然没有。

以下是我创建服务帐户的方法：

$ gcloud organizations add-iam-policy-binding ${TF_VAR_org_id} \                                (gke_my-domain-218910_europe-west1-b_my-domain-vpc-native/default)
> --member serviceAccount:terraform@${TF_ADMIN}.iam.gserviceaccount.com \
> --role roles/resourcemanager.projectCreator
Updated IAM policy for organization [00000].
bindings:
- members:
  - domain:my-domain.no
  role: roles/billing.creator
- members:
  - serviceAccount:terraform@my-domain-terraform-admin-3.iam.gserviceaccount.com
  - serviceAccount:terraform@my-domain-terraform-admin.iam.gserviceaccount.com
  role: roles/billing.user
- members:
  - domain:min-familie.no
  - serviceAccount:terraform@my-domain-terraform-admin-3.iam.gserviceaccount.com
  - serviceAccount:terraform@my-domain-terraform-admin.iam.gserviceaccount.com
  role: roles/resourcemanager.projectCreator
etag: BwWJxJTDnQs=
version: 19d

“手动”创建项目是可行的。 $ gcloud projects create ${TF_ADMIN}。

有什么想法可能是错的吗？

Answer 1

为了创建文件夹和项目，您的帐户需要具有相应的权限，当然您需要确保您使用的是正确的帐户。

首先确保用户拥有正确的权限：

gcloud organizations add-iam-policy-binding YOUR_ORGANIZATION_ID --member=user:your@email.com --role=roles/billing.admin
gcloud organizations add-iam-policy-binding YOUR_ORGANIZATION_ID --member=user:your@email.com --role=roles/resourcemanager.organizationAdmin
gcloud organizations add-iam-policy-binding YOUR_ORGANIZATION_ID --member=user:your@email.com --role=roles/resourcemanager.folderCreator
gcloud organizations add-iam-policy-binding YOUR_ORGANIZATION_ID --member=user:your@email.com --role=roles/resourcemanager.projectCreator

然后确保您设置应用程序默认值并登录到此帐户：

gcloud auth application-default login

设置 API 调用默认计费的项目。请在此处阅读更多相关信息。如果不设置此项，则在运行时可能会出现配额错误terraform apply。

gcloud auth application-default set-quota-project SOME_BILLING_PROJECT