How to install monitoring agent on GCP Compute VM that is set to a Service Account?

1
votes

I have a GCP VM set to use a service account so in the VM instance details on the console:

Service account

[email protected]

When I run the command for installing the monitoring agent I saw this:

Updating project ssh metadata...failed.
Updating instance ssh metadata...failed.
ERROR: (gcloud.beta.compute.ssh) Could not add SSH key to instance metadata:

  • Required 'compute.instances.setMetadata' permission for 'projects/MYPROJECT/zones/us-central1-a/instances/MYVM'

I gave the service account the Compute Admin role on the instance (not the whole project) and re-ran. The results are then more confusing:

Updating project ssh metadata...failed.
Updating instance ssh metadata...failed.
ERROR: (gcloud.beta.compute.ssh) Could not add SSH key to instance metadata:

  • The user does not have access to service account > '[email protected]'. User: '[email protected]'. Ask a project owner to grant you the iam.serviceAccountUser role on the service account

Do I really grant the iam.serviceAccountUser role on the service account so it can use itself? Is there another way I can run the script as me rather than the service account since I am a project admin/owner?

1
google-cloud-platformgoogle-compute-engine
You can run the script as you once you are authenticated using gcloud auth login then selecting you in the auth screen. By the way when you run gcloud auth list is [email protected] account the one selected ? – MBHA Phoenix
If you are creating a resource (VM) that itself will use a service account, you must have the permission iam.serviceAccountUser to deploy that service. It does not matter that the service account is the same and the one referenced by the resource. – John Hanley
@MBHAPhoenix - Yes, [email protected] is shown as selected when running gcloud auth list. Thanks for the command hints – Neil C. Obremski

1 Answers

2
votes

That's correct, per the official documentation of the compute admin role:

Full control of all Compute Engine resources.

If the user will be managing virtual machine instances that are configured to run as a service account, you must also grant the roles/iam.serviceAccountUser role.

Link: https://cloud.google.com/compute/docs/access/iam