[p0] Terraform apply fails - IAM permissions not checked before creating gemini model

[chmstimoteo]

│ Error running command 'poetry run bq query --use_legacy_sql=false --max_rows=100 --maximum_bytes_billed=10000000 < ../../sql/query/create_gemini_model.sql Waiting on bqjob_r33a79743008e71dc_00000192bae30f5d_1 ... (0s) Current status: RUNNING │ Waiting on bqjob_r33a79743008e71dc_00000192bae30f5d_1 ... (0s) Current status: DONE
│ Error in query string: Error processing job 'marketing-data-engine- │ demo:bqjob_r33a79743008e71dc_00000192bae30f5d_1': bqcx-216235317801-s3pp@gcp-sa- │ bigquery-condel.iam.gserviceaccount.com does not have the permission to access │ or use the endpoint. Please grant the Vertex AI user role to the service account │ following https://cloud.google.com/bigquery/docs/generate-text-tutorial#grant- │ permissions. If issue persists, contact bqml-feedback@google.com for help. │ Failure details: │ - query: bqcx-216235317801-s3pp@gcp-sa-bigquery- │ condel.iam.gserviceaccount.com does not have the permission to │ access or use the endpoint. Please grant the Vertex AI user role to │ the service account following │ https://cloud.google.com/bigquery/docs/generate-text- │ tutorial#grant-permissions. If issue persists, contact bqml- │ feedback@google.com for help. │ ╵

Workaround: Run terraform .. apply again.

[chmstimoteo]

Maintaining roles assigned to service Agents. E.g. preserving roles assigned to bqcx-@gcp-sa-bigquery-condel.iam.gserviceaccount.com in the event of redeploy of Vertex AI Connection. Integrate deployment of the service account and service agent roles in the Terraform installation