（Terraform，GCP）錯誤 403：需要權限 iam.serviceAccounts.setIamPolicy 才能對服務帳戶項目/myproject-17 執行此操作

Question

在GCP上，我正在嘗試使用以下Terraform代碼將“服務帳戶 2”作為成員添加到“服務帳戶 1” ：

resource "google_service_account" "service_account_1" {
  display_name = "Service Account 1"
  account_id   = "service-account-1"
}

resource "google_service_account" "service_account_2" {
  display_name = "Service Account 2"
  account_id   = "service-account-2"
}

resource "google_service_account_iam_member" "service-account-iam_member" {
  service_account_id = google_service_account.service_account_1.name
  role               = "roles/iam.serviceAccountUser"
  member             = "serviceAccount:${google_service_account.service_account_2.email}"
  depends_on = [
    google_service_account.service_account_1,
    google_service_account.service_account_2
  ]
}

但我在下面收到此錯誤：

為服務帳戶“projects/myproject-173831/serviceAccounts/service-account-1@myproject-173831.iam.gserviceaccount.com”應用 IAM 策略時出錯：為服務帳戶“projects/myproject-173831/serviceAccounts/service”設置 IAM 策略時出錯-account-1@myproject-173831.iam.gserviceaccount.com'：googleapi：錯誤 403：需要權限 iam.serviceAccounts.setIamPolicy 才能對服務帳戶項目/myproject-173831/serviceAccounts/service-account-1@ 執行此操作myproject-173831.iam.gserviceaccount.com.，禁止

所以現在，我正在嘗試添加一個角色來解決上面的這個錯誤，但是有太多角色可供選擇：

我需要選擇什么角色？

Answer 1

您需要選擇角色“服務帳戶管理員”將“服務帳戶 2”作為成員添加到“服務帳戶 1” ：