无法从 GitHub 操作运行 GCP terraform 命令

Question

I have setup keyless authentication for my Github Actions pipeline using Workload Identity Federation by following the official tutorial

When running a terraform init command from my pipeline I get the following error:

│ Error: Failed to get existing workspaces: querying Cloud Storage failed: Get "https://storage.googleapis.com/storage/v1/b/lws-dev-common-bucket/o?alt=json&delimiter=%2F&pageToken=&prefix=global%2Fnetworking.state%2F&prettyPrint=false&projection=full&versions=false": oauth2/google: status code 403: {
│   "error": {
│     "code": 403,
│     "message": "Permission 'iam.serviceAccounts.getAccessToken' denied on resource (or it may not exist).",
│     "status": "PERMISSION_DENIED",
│     "details": [
│       {
│         "@type": "type.googleapis.com/google.rpc.ErrorInfo",
│         "reason": "IAM_PERMISSION_DENIED",
│         "domain": "iam.googleapis.com",
│         "metadata": {
│           "permission": "iam.serviceAccounts.getAccessToken"
│         }
│       }
│     ]
│   }
│ }

I have ensured that the service account that I am using has proper permissions including:

• Cloud Run Admin
• Cloud Run Service Agent

Below is a snippet of my pipeline code:

- id: 'auth'
  name: 'Authenticate to Google Cloud'
  uses: 'google-github-actions/auth@v0.4.0'
  with:
    workload_identity_provider: 'projects/385050593732/locations/global/workloadIdentityPools/my-pool/providers/my-provider'
    service_account: 'lws-d-iac-sa@lefewaresolutions-poc.iam.gserviceaccount.com'

- name: Terraform Init
  working-directory: ./Terraform/QuickStartDeployments/EKSCluster
  run: terraform init

and my terraform code:

terraform {
  required_providers {
    google = {
      source = "hashicorp/google"
      version = "3.89.0"
    }
  }

  backend "gcs" {
    bucket  = "lws-dev-common-bucket"
    prefix  = "global/networking.state"
  }

  required_version = ">= 0.14.9"
}

provider "google" {
  project = var.project_id
  region  = var.region
}


module "vpc" {
  source  = "../../Modules/VPC"

  project_id = var.project_id
  region     = "us-west1"
  vpc_name   = var.vpc_name
}

Answer 1

I ran into the same issue and was able to fix it by granting the service account Service Account Token Creator role in the project IAM page manually

Answer 2

This can also happen if your service account doesn't have permission to access the storage bucket where your terraform state file is stored, or if your service account doesn't have the Workload Identity User role set properly.