gcloud iam service-accounts add-iam-policy-binding ... NOT_FOUND：未知服务帐户

Question

我正在创建一个新的服务帐户并尝试为其分配角色。分配部分无法找到我刚刚创建的帐户。

为什么？

*[master][~]$ gcloud iam service-accounts add-iam-policy-binding some-project --member="serviceAccount:some-name@some-project.iam.gserviceaccount.com" --role="roles/secretmanager.secretAccessor"
ERROR: (gcloud.iam.service-accounts.add-iam-policy-binding) NOT_FOUND: Unknown service account

*[master][~]$ gcloud iam service-accounts add-iam-policy-binding some-project --member="some-name@some-project.iam.gserviceaccount.com" --role="roles/secretmanager.secretAccessor"
ERROR: (gcloud.iam.service-accounts.add-iam-policy-binding) NOT_FOUND: Unknown service account

*[master][~]$ gcloud iam service-accounts list                                                                                                                                                           
DISPLAY NAME                            EMAIL                                                     DISABLED
Compute Engine default service account  01234567890-compute@developer.gserviceaccount.com         False
App Engine default service account      some-project@appspot.gserviceaccount.com                  False
Some Name                               some-name@some-project.iam.gserviceaccount.com            False

有趣的是，新帐户也不会出现在门户的IAM 和管理 > 服务帐户中。当我从 CLI 中列出它们时，它仍然显示。呜呜……

Answer 1

我想你gcloud projects不想gcloud iam service-accounts

gcloud projects add-iam-policy-binding some-project \
--member=serviceAccount:some-name@some-project.iam.gserviceaccount.com \
--role=roles/secretmanager.secretAccessor

我有一个片段（凭记忆）：

PROJECT="some-project"
ACCOUNT="some-name"

EMAIL="${ACCOUNT}@${PROJECT}.iam.gserviceaccount.com"

ROLES=(
  "secretmanager.secretAccessor"
)

gcloud iam service-accounts create ${ACCOUNT} \
--project=${PROJECT}

# Use sparingly
gcloud iam service-accounts keys create ${PWD}/${ACCOUNT}.json \
--project=${PROJECT}

for ROLE in ${ROLES[@]}
do
  gcloud projects add-iam-policy-binding ${PROJECT} \
  --member=serviceAccount:${EMAIL} \
  --role=roles/${ROLE}
done