权限被拒绝 - GCP 云资源管理器 setIamPolicy

Question

我从 GCP 收到 403 PERMISSION_DENIED 响应时运行部署管理器创建一个部署，该部署创建一个服务帐户并使用云资源管理器为其设置 IAM 策略 API.这是为此设置的 setIamPolicy 模板：

{
        'resources': [
            {
                'name': context.env['name'],
                'action': 'gcp-types/cloudresourcemanager-v1:cloudresourcemanager.projects.setIamPolicy',
                'properties': {
                    'resource': context.properties['resource'],
                    'policy': {
                        'bindings': context.properties['bindings']
                    }
                }
            }
        ]
    }

来自 GCP 的响应：

'{"ResourceType":"gcp-types/cloudresourcemanager-v1:cloudresourcemanager.projects.setIamPolicy","ResourceErrorCode":"403","ResourceErrorMessage":{"code":403,"message": “这来电者没有权限","status":"PERMISSION_DENIED","statusMessage":"Forbidden","requestPath":"https://cloudresourcemanager.googleapis.com/v1/projects/project-name@project-name.iam.gserviceaccount.com:setIamPolicy","httpMethod" :"POST"}}'

仅供参考：机器人帐户 (12345@cloudservices.gserviceaccount.com) 在 IAM 中被授予项目所有者权限。

Answer 1

正确的做法是：

    {
        # Set the IAM policy by patching the existing policy with the
        # config contents.
        'name': policy_add_name,
        'action': 'gcp-types/cloudresourcemanager-v1:cloudresourcemanager.projects.setIamPolicy',
        'properties':
            {
                'resource': project_id,
                'policy': '$(ref.' + policy_get_name + ')',
                'gcpIamPolicyPatch': {
                    'add': policies_to_add,
                }
            }
    }

权限被拒绝 - GCP 云资源管理器 setIamPolicy

Permission Denied - GCP Cloud Resource Manager setIamPolicy

google-cloud-platform

google-deployment-manager