When you run terraform apply you get an error on the deploy of the cloud functions:
Error: Error waiting for Creating CloudFunctions Function: error while retrieving operation: googleapi: Error 403: Your application has authenticated using end user credentials from the Google Cloud SDK or Google Cloud Shell which are not supported by the cloudfunctions.googleapis.com. We recommend configuring the billing/quota_project setting in gcloud or using a service account through the auth/impersonate_service_account setting. For more information about service accounts and how to use them in your application, see https://cloud.google.com/docs/authentication/., accessNotConfigured
Provide alternative instructions on how to use a service account to deploy SRA
if we provide instructions to use a service account, some changes in the terraform scripts are necessary.
The service account used on the deploy should not have Org Admin role, which is necessary to give the SRA service account the role "roles/securitycenter.findingSecurityMarksWriter". This role needs to be granted manually by the user.
When you run terraform apply you get an error on the deploy of the cloud functions:
Error: Error waiting for Creating CloudFunctions Function: error while retrieving operation: googleapi: Error 403: Your application has authenticated using end user credentials from the Google Cloud SDK or Google Cloud Shell which are not supported by the cloudfunctions.googleapis.com. We recommend configuring the billing/quota_project setting in gcloud or using a service account through the auth/impersonate_service_account setting. For more information about service accounts and how to use them in your application, see https://cloud.google.com/docs/authentication/., accessNotConfigured
There is an open issue on terraform github to fix this: https://github.com/terraform-providers/terraform-provider-google/issues/5885
Possible workarounds until the issue is fixed:
if we provide instructions to use a service account, some changes in the terraform scripts are necessary.
The service account used on the deploy should not have Org Admin role, which is necessary to give the SRA service account the role "roles/securitycenter.findingSecurityMarksWriter". This role needs to be granted manually by the user.
related SRA issue: https://github.com/GoogleCloudPlatform/security-response-automation/issues/162