Terraform on GCP fails to create pubsub topic stating permission denied

Question

Created a service user to manage terraform under the project and gave it roles/owner . Created the key for this terraform user.

Terraform code is simple:

resource "google_pubsub_topic" "my_topic" {
  name    = "my_topic"
  project = "${var.project_id}"
}

just creating a pub-sub topic.

terraform plan works but terraform apply gives me:

google_pubsub_topic.my_topic: googleapi: Error 403: User not authorized to perform this action., forbidden

I have even tried giving the service account roles/pubsub.admin not sure I understand what's going on because my service account has the owner role associated with it yet it can't create a pubsub topic.

Can anybody help me figure this out please?

Thanks in advance.

Edit (to expand on my comment about what worked) : I had created the service account using gcloud.

gcloud iam service-accounts create terraform \
  --display-name "Terraform admin account"

gcloud projects add-iam-policy-binding myproject-182220 \
 --member serviceAccount:terraform@myproject-182220.iam.gserviceaccount.com \
 --role roles/owner

gcloud iam service-accounts keys create terraform-admin.json \
 --iam-account terraform@myproject-182220.iam.gserviceaccount.com

To continue my debugging, I created a new service account using the console / GUI --> API & Services --> Credentials --> Create Credentials --> Service Account Key --> New Service Account (With the owner role). With this new service key json file, I was able to run my terraform code without a problem.

Now my confusion is, why did this work but not when I used gcloud to create a service account and give it the same role?

Answer 1

您必须通过Google Cloud启用pub / sub api，否则可能会使用terraform。

Answer 2

The sample usage configuration for the Google provider looks more like:

// Configure the Google Cloud provider
provider "google" {
  credentials = "${file("account.json")}"
  project     = "my-gce-project"
  region      = "us-central1"
}

// Create a new instance
resource "google_compute_instance" "default" {
  # ...
}

This can be read in more detail on the "Google Cloud Provider" documentation page from Terraform.