setIAM 403 禁止访问

Question

resources:
- name: practice-service-account
  type: iam.v1.serviceAccount
  properties:
    displayName: practice-service-account
    projectId: {{ project }}
    accountId: practice-service-account
- name: get-iam-policy
  action: 'gcp-types/cloudresourcemanager-v1:cloudresourcemanager.projects.getIamPolicy'
  properties:
    resource: resources-practice {# make this environment variable #}
- name: set-iam-policy
  action: 'gcp-types/cloudresourcemanager-v1:cloudresourcemanager.projects.setIamPolicy'
  properties:
    resource: {{ project }}
    policy: $(ref.get-iam-policy)
    gcpIamPolicyPatch:
      add:
      - role: roles/viewer
        members:
        - user:email1@example.com
        - user:email2@example.com
        - user:email3@example.com

为什么我在尝试创建这些 IAM 资源时总是遇到以下错误？

ERROR: (gcloud.deployment-manager.deployments.update) Error in Operation [operation-1544014242908-57c45d47a0760-6a2ec217-9ee53506]: errors:
- code: RESOURCE_ERROR
  location: /deployments/infrastructure/resources/set-iam-policy
  message: '{"ResourceType":"gcp-types/cloudresourcemanager-v1:cloudresourcemanager.projects.setIamPolicy","ResourceErrorCode":"403","ResourceErrorMessage":{"code":403,"message":"The
    caller does not have permission","status":"PERMISSION_DENIED","statusMessage":"Forbidden","requestPath":"https://cloudresourcemanager.googleapis.com/v1/projects/resources-practice:setIamPolicy","httpMethod":"POST"}}'

Answer 1

部署经理 acts using the [PROJECT_NUMBER]@cloudservices.gserviceaccount.com service account. This error indicates that that service account doesn't have permission to change the IAM policy on that project. Try granting 服务帐户 iam.roleAdmin 项目角色（或 iam.organizationRoleAdmin 组织角色）。

setIAM 403 禁止访问

setIAM 403 Forbidden

google-cloud-platform

google-deployment-manager