Performing the association of an existing service account to a newly created subscription in gcloud

Question

I have a service account in gcloud that i am using to create a new topic and subscription to that topic in that order.

However i need to be able to assign the newly created subscription to the service account explicitly. In the UI this is done by going to

Pubsub > Subscription > Selecting the subscription and then clicking on "Search member" > Adding the service account.

However I want to automate this using the gcloud command.

So far I have been able to :

1) Activate a service account serviceAccountA 2) Create Topic 3) Create subscription to the Topic

While trying to use the following command to set iam policy on the service account so as to give pubsub.editor role to the service account.

gcloud iam service-accounts set-iam-policy serviceAccountA <json> file path>

Json file content is as below:

{
    "bindings": [
      {
        "role": "roles/pubsub.editor",
        "members": ["serviceAccountA"]
      }
    ]
  }

The above gcloud command results in the error:

 ERROR: (serviceAccountA PERMISSION_DENIED: Not allowed to get project settings for project <id>

I am missing something. Is there an easy way to associate the subscription with a specific service account?

Harrison Gregg Harrison Gregg · Accepted Answer · 2018-07-17T14:55:04

I suspect the problem is that the service account you've activated doesn't have permissions to give itself permissions. Try setting this with a gcloud account that has edit permissions for the project. You can set the current account with gcloud auth login or gcloud config configurations activate <your_config>.

Performing the association of an existing service account to a newly created subscription in gcloud

1 Answers