fmichaelobrien
commented
2 months ago Robert, good catch. I can confirm that I have seen the same issue periodically in 0-bootstrap. It looks to be an eventually consistent issue with the API. If the error persists then the tfvars may not be set correctly or came in unreferenced.
Error: Error when reading or editing CloudIdentityGroup "groups/035nkun24jo9ze2": googleapi: Error 403: Error(2028): Permission denied for resource groups/035nkun24jo9ze2 (or it may not exist).
Details:
[
{
"@type": "type.googleapis.com/google.rpc.ResourceInfo",
"description": "Error(2028): Permission denied for resource groups/035nkun24jo9ze2 (or it may not exist).",
"owner": "domain:cloudidentity.googleapis.com",
"resourceName": "groups/035nkun24jo9ze2",
"resourceType": "cloudidentity.googleapis.com/Group"
}
]in one of my last runs to 5-app-infra in the fork https://github.com/GoogleCloudPlatform/pbmm-on-gcp-onboarding/issues/360#issuecomment-2045934815
Q1) I have a question, is your example obfuscated with 12345 or did you run with the defaults - as you should be seeing a generated group id like " groups/035nkun24jo9ze2 " not "groups/12345" - this would be a tfvars issue - I ask this because the example in your comment is all defaults for example.org, the billing id, org etc... for example in the cicd tf plan
domains_to_allow = ["obrienlabs.xyz"]
essential_contacts_domains_to_allow = ["@obrienlabs.xyz"]
billing_data_users = "gcp-billing-data-users@obrienlabs.xyz"
audit_data_users = "gcp-security-admins@obrienlabs.xyz"
RaicuRobert
arnodel
ipv1337
lpezet
eeaton
TL;DR
Locally, terraform init/plan/apply works flawlessly.
When using GithubActions, the pipeline fails with:
Expected behavior
For the pipeline to finish successfully
Observed behavior
No response
Terraform Configuration
Terraform Version
Additional information
No response