ERROR: (gcloud.composer.environments.update) Failed to impersonate when terraform runs impersonating as a second account

Question

I am getting the following error (Please see below) when I run my terraform apply.

I am running Terraform 12.x.

GCP Cloud Build runs in a different project other than project-abcd (where these accounts are)

My terraform code tries execute a gcloud command in a GCP cloud build container. It does so by impersonating as [email protected]

The service account that terraform runs as is: terraform_service_account = "[email protected]" (before impersonating)

This IAM account ([email protected]) (NOT service account) has the following role bindings (TOTAL 9): (There is no Service Account with that email)

Composer Administrator
Compute Network Admin
Service Account Token Creator
Owner
Access Context Manager Admin
Security Admin
Service Account Admin
Logs Configuration Writer
Security Center Notification Configurations Editor

The service account ([email protected]) has as one of its members: [email protected] When I look at the screen titled "Members with access to this service account" and look at [email protected] , I see that it has the following role-bindings (ONLY 4):

Service Account Token Creator
Owner
Security Admin
Service Account Admin

Why am I getting the error below even though IAM account has apparently the right roles and it is one of the members of the service account it is impersonating as?

ERROR

module.gcloud_composer_bucket_env_var.null_resource.run_command[0] (local-exec): WARNING: This command 
is using service account impersonation. All API calls will be executed as [**[email protected]**].
module.gcloud_composer_bucket_env_var.null_resource.run_command[0] (local-exec): ERROR: 
(gcloud.composer.environments.update) Failed to impersonate [**[email protected]**]. Make sure the account that's trying to impersonate it has access to the service account itself and the "roles/iam.serviceAccountTokenCreator" role.

Have a look at this document and manually check everything Terraform does. If you encounter more errors, please update the question. — Sergiusz
Thank you. Indeed, the issue was that [email protected] was not given explicit permission to impersonate [email protected]. That document you refereed had the instructions to do so. If you add the above as the answer, I will accept it as the correct answer. Thank you. — Mamun

Unknown Unknown · Accepted Answer · 2021-04-15T10:04:50

Recapping:
In order to grant user permission to impersonate a Service Account follow instructions listed in this document.
Depending on the use case, you may grant user following roles:

roles/iam.serviceAccountUser
roles/iam.serviceAccountTokenCreator
roles/iam.workloadIdentityUser

ERROR: (gcloud.composer.environments.update) Failed to impersonate when terraform runs impersonating as a second account

1 Answers