GCE Service Account with Compute Instance Admin permissions

5
votes

I have setup a compute instance called to run cronjobs on Google Compute engine using a service account with the following roles: Custom Compute Image User + Deletion rights Compute Admin Compute Instance Admin (beta) Kubernetes Engine Developer Logs Writer Logs Viewer Pub/Sub Editor Source Repository Reader Storage Admin Unfortunately, when I ssh into this cronjob runner instance and then run:

sudo gcloud compute --project  {REDACTED} instances create e-latest \
    --zone {REDACTED} --machine-type n1-highmem-8 --subnet default \
    --maintenance-policy TERMINATE  \
    --scopes  https://www.googleapis.com/auth/cloud-platform \
    --boot-disk-size 200  \
    --boot-disk-type pd-standard --boot-disk-device-name e-latest \
    --image {REDACTED} --image-project {REDACTED} \
    --service-account NAME_OF_SERVICE_ACCOUNT \ 
    --accelerator type=nvidia-tesla-p100,count=1 --min-cpu-platform Automatic

I get the following error:

The user does not have access to service account {NAME_OF_SERVICE_ACCOUNT}. User: {NAME_OF_SERVICE_ACCOUNT} . Ask a project owner to grant you the iam.serviceAccountUser role on the service account.

Is there some other privilege besides compute instance admin that I need to be able to create instances with my instance?

Further notes: (1) when I try to not specify --service-account the error is the same except that the service account my user doesn't have access to is the default '[email protected]'. (2) adding/removing sudo doesn't change anything

3
google-compute-enginegoogle-iam

3 Answers

5
votes

Creating an instance that uses a service account requires you have the compute.instances.setServiceAccount permission on that service account. To make this work, grant the iam.serviceAccountUser role to your service account (either on the entire project or on the specific service account you want to be able to create instances with).

0
votes

Find out who are you

  • if using Web UI: what email did you use to login?
  • if using local gcloud or terraform: find the json file that contains your credentials for gcloud (most often named myproject*.json) and see if it contains email: grep client_email myproject*.json

GCP IAM change

  1. Go to https://console.cloud.google.com
  2. Go to IAM
  3. Find the email
  4. Member -> Edit -> Add Another Role -> type role name Service Account User -> Add

(You can narrow it down with a Condition, but lets keep it simple for a while).

0
votes

Make sure that NAME_OF_SERVICE_ACCOUNT is service account from current project.

If you change project ID, and don't change NAME_OF_SERVICE_ACCOUNT, then you will encounter this error.

This can be checked on Google Console -> IAM & Admin -> IAM. Then look for service name [email protected] and check if numbers at the beginning are correct. Each project will have different numbers in this service name.