Creating automation with Terraform and Cloubuild on GCP

Question

I have been testing automation with IaC with terraform and am wanting to take these steps from this tutorial Manageing GCP Projects with Terraform and automate them using version control.

But I come across an error thrown

err: failed pre-requisites: missing permission on "billingAccounts/billingaccountid": billing.resourceAssociations.create

IAM TF config

resource "google_organization_iam_binding" "tfadmin" {


 org_id = var.org_id
  role    = "roles/billing.resourceAssociations.create"

  members = [
    "serviceAccount:tfadmin@project_id.iam.gserviceaccount.com",
  ]
}

resource "google_billing_account_iam_member" "binding" {
  billing_account_id = var.billing_account
  role               = "roles/billing.user"

  member            =  "serviceAccount:tfadmin@project_id.iam.gserviceaccount.com"



 }

resource "google_service_account" "tfadmin" {
  project      = google_project.project.project_id
  account_id   = "tfadmin"
  display_name = "tfadmin"

}
resource "google_project_iam_binding" "project_name" {
  project = google_project.project.project_id
  role    = "roles/bill.user"

  members = [
   "serviceAccount:${google_service_account.tfadmin.email}",  
    "user:var.billing_account_user",
  ]
}

resource "google_project_iam_policy" "project_id" {
  project     = google_project.project.project_id
  policy_data = data.google_iam_policy.tfadmin.policy_data
}

data "google_iam_policy" "tfadmin" {
  binding {
    role = "roles/resourcemanager.projectCreator"

    members = [
      "serviceAccount:tfadmin@project_id.iam.gserviceaccount.com",
    ]
  }
}

I'm looking to add the service account to create another GCP project with other gcp services (cloudsql, compute engine, app engine)

Is there something I'm missing are have not found?

yes this is correlating to the other post I created. I want to be able to replicate the tutorial as automation without having to supply keys and other confidential info in the ci/cd pipeline. — Gruido
I was facing same issue and resolved mine as I described in here: stackoverflow.com/questions/61053649/… — hadican

guillaume blaquiere guillaume blaquiere · Accepted Answer · 2020-04-19T18:45:05

Cloud Build use, for now, only the default Cloud Build service account <PROJECT_NUMBER>@cloudbuild.gserviceaccount.com.

When you run terraform on Cloud Build, you can forgive to specify an account key.

provider "google" {
//  Useless with Cloud Build
//  credentials = file("${var.CREDENTIAL_FILE}}")
  project = var.PROJECT_ID
  region = "europe-west1"
}

Like this, the service account of the environment is used. Here it's Cloud Build, thus the Cloud Build default service account.

Grant the correct role on the Cloud Build default service account and it should work.

Creating automation with Terraform and Cloubuild on GCP

1 Answers