<p>In the google_compute_instance_template resource, the email property of the service_account block should not start with &quot;serviceAccount:&quot;. Change from:</p>
<pre><code>service_account {
  email  = &quot;serviceAccount:${google_service_account.frontend_service_account.email}&quot;
  scopes = [&quot;default&quot;]
}
</code></pre>
<p>To this:</p>
<pre><code>service_account {
  email  = &quot;${google_service_account.frontend_service_account.email}&quot;
  scopes = [&quot;default&quot;]
}
</code></pre>

CC BY-SA 4.0
2021-01-13T12:41:12.200Z
2021-01-13T12:41:12.200Z
Staffan Hörke
<p>Try adding permissions on your project level:</p>

<p><code>gcloud projects add-iam-policy-binding &lt;your-project-id&gt; --member=serviceAccount:terraform@vpc-challenge-lab-245114.iam.gserviceaccount.com --role='roles/iam.serviceAccountUser'</code></p>

CC BY-SA 4.0
2019-07-05T09:05:16.143Z
Good shout, unfortunately, it doesn't seem to help.  I'm beginning to suspect that it's because it's an individual GCP account (no organisation or folder) and there are some implicit permissions that would only work if the terraform user created the project - however that's not possible without giving permissions to an organisation or folder.
Richard Slater
CC BY-SA 4.0
2019-07-04T18:54:02.167Z
2019-07-04T18:54:02.167Z
manasouza
<p>I fumbled upon this question today as i was struggling with this error, the way credentials are get created in azure is way much better than this google, 
however i had added service account user through the gcp portal and my terraform was able to create test vm, hope this help.</p>

CC BY-SA 4.0
2020-05-22T10:49:23.560Z
Could you add some more details?
030
CC BY-SA 4.0
2021-07-22T14:06:12.330Z
My apologies, its been long time, i will surely get back with what i did to deploy
cloudcop
CC BY-SA 4.0
2020-05-22T01:58:34.423Z
2020-05-22T01:58:34.423Z
cloudcop
<p>I'm trying to create a GCE Instance Group Manager using terraform</p>

<pre><code>resource "google_compute_region_instance_group_manager" "frontend_group_manager" {
  name = "frontend-igm"

  base_instance_name = "frontend"
  instance_template  = "${google_compute_instance_template.frontend_instance_template.self_link}"
  region             = "${var.region}"

  depends_on = [ "google_compute_instance_template.frontend_instance_template" ]
}
</code></pre>

<p>When I try I get the following error:</p>

<blockquote>
  <p>Error: Error waiting for Creating InstanceGroupManager: The user does not have access to service account 'One of [serviceAccount:frontend@vpc-challenge-lab-245114.iam.gserviceaccount.com]'.  User: 'terraform@vpc-challenge-lab-245114.iam.gserviceaccount.com'.  Ask a project owner to grant you the iam.serviceAccountUser role on the service account</p>
</blockquote>

<p>When I validate the IAM policy on the account it appears to be configured correctly:</p>

<pre><code>&gt; gcloud iam service-accounts get-iam-policy frontend@vpc-challenge-lab-245114.iam.gserviceaccount.com
bindings:
- members:
  - serviceAccount:terraform@vpc-challenge-lab-245114.iam.gserviceaccount.com
  role: roles/iam.serviceAccountUser
etag: BwWMpQvtA3w=
version: 1                                        
</code></pre>

<p>The template is configured as follows:</p>

<pre><code>resource "google_compute_instance_template" "frontend_instance_template" {
  name = "frontend-template"

  instance_description = "Frontend Instances"
  machine_type         = "f1-micro"
  can_ip_forward       = false

  scheduling {
    automatic_restart   = true
    on_host_maintenance = "MIGRATE"
  }

  disk {
    source_image = "${data.google_compute_image.compute_image.self_link}"
    auto_delete  = true
    boot         = true
  }

  network_interface {
    network = "${google_compute_network.frontend_network.name}"
  }

  service_account {
    email  = "serviceAccount:${google_service_account.frontend_service_account.email}"
    scopes = ["default"]
  }

  depends_on = [
    "google_compute_network.frontend_network",
    "google_service_account_iam_member.frontend_service_account_permission",
    "google_project_iam_member.frontend_service_account_role_binding"
  ]
}
</code></pre>

<p>And the Service Account is configured as follows:</p>

<pre><code>resource "google_service_account" "frontend_service_account" {
  account_id   = "frontend"
  display_name = "Frontend Service"
}

resource "google_service_account_iam_member" "frontend_service_account_permission" {
  service_account_id = "${google_service_account.frontend_service_account.name}"
  role               = "roles/iam.serviceAccountUser"
  member             = "serviceAccount:${data.google_service_account.terraform.email}"

  depends_on = ["google_service_account.frontend_service_account"]
}

resource "google_project_iam_member" "frontend_service_account_role_binding" {
  role   = "projects/${data.google_project.project.project_id}/roles/${google_project_iam_custom_role.base_compute_role.role_id}"
  member = "serviceAccount:${google_service_account.frontend_service_account.email}"

  depends_on = [
    "data.google_project.project",
    "google_project_iam_custom_role.base_compute_role",
    "google_service_account.frontend_service_account"
  ]
}
</code></pre>

<p>Finally, the custom role is as follows:</p>

<pre><code>resource "google_project_iam_custom_role" "base_compute_role" {
  role_id = "base_compute_role"
  title   = "Base Compute Role"
  permissions = [
    "logging.logEntries.create",
    "monitoring.metricDescriptors.create",
    "monitoring.metricDescriptors.get",
    "monitoring.metricDescriptors.list",
    "monitoring.monitoredResourceDescriptors.get",
    "monitoring.monitoredResourceDescriptors.list",
    "monitoring.timeSeries.create"
  ]

  depends_on = ["google_project_service.iam"]
}
</code></pre>

<p>Why when everything appears to be in place does that error keep getting thrown by the GCE API.</p>

<terraform><google-cloud-platform><google-compute-engine>
Service account permissions error when provisioning instance group from template
Richard Slater
# Service account permissions error when provisioning instance group from template

(Asked by: username_0 on 2019-07-01)

I'm trying to create a GCE Instance Group Manager using terraform
resource "google_compute_region_instance_group_manager" "frontend_group_manager" {
  name = "frontend-igm"

  base_instance_name = "frontend"
  instance_template  = "${google_compute_instance_template.frontend_instance_template.self_link}"
  region             = "${var.region}"

  depends_on = [ "google_compute_instance_template.frontend_instance_template" ]
}

When I try I get the following error:

Error: Error waiting for Creating InstanceGroupManager: The user does not have access to service account 'One of [serviceAccount:frontend@vpc-challenge-lab-245114.iam.gserviceaccount.com]'.  User: 'terraform@vpc-challenge-lab-245114.iam.gserviceaccount.com'.  Ask a project owner to grant you the iam.serviceAccountUser role on the service account

When I validate the IAM policy on the account it appears to be configured correctly:
> gcloud iam service-accounts get-iam-policy frontend@vpc-challenge-lab-245114.iam.gserviceaccount.com
bindings:
- members:
  - serviceAccount:terraform@vpc-challenge-lab-245114.iam.gserviceaccount.com
  role: roles/iam.serviceAccountUser
etag: BwWMpQvtA3w=
version: 1                                        

The template is configured as follows:
resource "google_compute_instance_template" "frontend_instance_template" {
  name = "frontend-template"

  instance_description = "Frontend Instances"
  machine_type         = "f1-micro"
  can_ip_forward       = false

  scheduling {
    automatic_restart   = true
    on_host_maintenance = "MIGRATE"
  }

  disk {
    source_image = "${data.google_compute_image.compute_image.self_link}"
    auto_delete  = true
    boot         = true
  }

  network_interface {
    network = "${google_compute_network.frontend_network.name}"
  }

  service_account {
    email  = "serviceAccount:${google_service_account.frontend_service_account.email}"
    scopes = ["default"]
  }

  depends_on = [
    "google_compute_network.frontend_network",
    "google_service_account_iam_member.frontend_service_account_permission",
    "google_project_iam_member.frontend_service_account_role_binding"
  ]
}

And the Service Account is configured as follows:
resource "google_service_account" "frontend_service_account" {
  account_id   = "frontend"
  display_name = "Frontend Service"
}

resource "google_service_account_iam_member" "frontend_service_account_permission" {
  service_account_id = "${google_service_account.frontend_service_account.name}"
  role               = "roles/iam.serviceAccountUser"
  member             = "serviceAccount:${data.google_service_account.terraform.email}"

  depends_on = ["google_service_account.frontend_service_account"]
}

resource "google_project_iam_member" "frontend_service_account_role_binding" {
  role   = "projects/${data.google_project.project.project_id}/roles/${google_project_iam_custom_role.base_compute_role.role_id}"
  member = "serviceAccount:${google_service_account.frontend_service_account.email}"

  depends_on = [
    "data.google_project.project",
    "google_project_iam_custom_role.base_compute_role",
    "google_service_account.frontend_service_account"
  ]
}

Finally, the custom role is as follows:
resource "google_project_iam_custom_role" "base_compute_role" {
  role_id = "base_compute_role"
  title   = "Base Compute Role"
  permissions = [
    "logging.logEntries.create",
    "monitoring.metricDescriptors.create",
    "monitoring.metricDescriptors.get",
    "monitoring.metricDescriptors.list",
    "monitoring.monitoredResourceDescriptors.get",
    "monitoring.monitoredResourceDescriptors.list",
    "monitoring.timeSeries.create"
  ]

  depends_on = ["google_project_service.iam"]
}

Why when everything appears to be in place does that error keep getting thrown by the GCE API.

**Tags:** terraform, google-cloud-platform, google-compute-engine


---

## 3 answers

### Answer by username_1 on 2021-01-13. Score: 1

In the google_compute_instance_template resource, the email property of the service_account block should not start with "serviceAccount:". Change from:
service_account {
  email  = "serviceAccount:${google_service_account.frontend_service_account.email}"
  scopes = ["default"]
}

To this:
service_account {
  email  = "${google_service_account.frontend_service_account.email}"
  scopes = ["default"]
}


---

### Answer by username_2 on 2019-07-04. Score: 1

Try adding permissions on your project level:

`gcloud projects add-iam-policy-binding  --member=serviceAccount:terraform@vpc-challenge-lab-245114.iam.gserviceaccount.com --role='roles/iam.serviceAccountUser'`

> **Comments:**
> **username_0**: Good shout, unfortunately, it doesn't seem to help.  I'm beginning to suspect that it's because it's an individual GCP account (no organisation or folder) and there are some implicit permissions that would only work if the terraform user created the project - however that's not possible without giving permissions to an organisation or folder.  

---

### Answer by username_3 on 2020-05-22. Score: 0

I fumbled upon this question today as i was struggling with this error, the way credentials are get created in azure is way much better than this google,
however i had added service account user through the gcp portal and my terraform was able to create test vm, hope this help.

> **Comments:**
> **username_4**: Could you add some more details?  
> **username_3**: My apologies, its been long time, i will surely get back with what i did to deploy  

---

