0 
resources:
- name: practice-service-account
  type: iam.v1.serviceAccount
  properties:
    displayName: practice-service-account
    projectId: {{ project }}
    accountId: practice-service-account
- name: get-iam-policy
  action: 'gcp-types/cloudresourcemanager-v1:cloudresourcemanager.projects.getIamPolicy'
  properties:
    resource: resources-practice {# make this environment variable #}
- name: set-iam-policy
  action: 'gcp-types/cloudresourcemanager-v1:cloudresourcemanager.projects.setIamPolicy'
  properties:
    resource: {{ project }}
    policy: $(ref.get-iam-policy)
    gcpIamPolicyPatch:
      add:
      - role: roles/viewer
        members:
        - user:email1@example.com
        - user:email2@example.com
        - user:email3@example.com

为什么我在尝试创建这些 IAM 资源时总是遇到以下错误？

ERROR: (gcloud.deployment-manager.deployments.update) Error in Operation [operation-1544014242908-57c45d47a0760-6a2ec217-9ee53506]: errors:
- code: RESOURCE_ERROR
  location: /deployments/infrastructure/resources/set-iam-policy
  message: '{"ResourceType":"gcp-types/cloudresourcemanager-v1:cloudresourcemanager.projects.setIamPolicy","ResourceErrorCode":"403","ResourceErrorMessage":{"code":403,"message":"The
    caller does not have permission","status":"PERMISSION_DENIED","statusMessage":"Forbidden","requestPath":"https://cloudresourcemanager.googleapis.com/v1/projects/resources-practice:setIamPolicy","httpMethod":"POST"}}'
4

1 回答 1

4

部署管理器使用[PROJECT_NUMBER]@cloudservices.gserviceaccount.com服务帐户进行操作。此错误表明该服务账户无权更改该项目的 IAM 政策。尝试授予服务帐户iam.roleAdmin项目中的角色（或iam.organizationRoleAdmin组织中的角色）。

于 2018-12-06T00:49:49.170 回答