Closed jacek-git closed 2 years ago
Must try using Linux machine
I also just ran into this, and realized that the role is noted as required in the readme for the bootstrap phase (step 5, last one): https://github.com/terraform-google-modules/terraform-example-foundation/tree/master/0-bootstrap#prerequisites
One thing I also noticed, unrelated to this error, is I also needed to add the roles/orgpolicy.policyAdmin
role on the organization. That is not called out in the bootstrap readme (but it does link to the bootstrap module which mentions it).
This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 7 days
TL;DR
cannot create folder using account which has sufficient priviledges (checked from console) using org admin and dedicated terraform account - "reason": "IAM_PERMISSION_DENIED"
Expected behavior
as described in https://github.com/terraform-google-modules/terraform-example-foundation/tree/master/0-bootstrap "Bootstraps a Google Cloud organization, creating all the required resources and permissions to start using the Cloud Foundation Toolkit (CFT)"
Observed behavior
google_folder.bootstrap: Creating... ╷ │ Error: Error creating folder 'fldr-bootstrap' in 'folders/820932490523': googleapi: Error 403: Permission 'resourcemanager.folders.create' denied on resource '//cloudresourcemanager.googleapis.com/folders/820932490523' (or it may not exist). │ Details: │ [ │ { │ "@type": "type.googleapis.com/google.rpc.ErrorInfo", │ "domain": "cloudresourcemanager.googleapis.com", │ "metadata": { │ "permission": "resourcemanager.folders.create", │ "resource": "folders/820932490523" │ }, │ "reason": "IAM_PERMISSION_DENIED" │ } │ ] │ , forbidden │ │ with google_folder.bootstrap, │ on main.tf line 27, in resource "google_folder" "bootstrap": │ 27: resource "google_folder" "bootstrap" {
C:\Windows\system32>gcloud auth list Credentialed Accounts
ACTIVE: * ACCOUNT: terraform@.com
Terraform Configuration
Terraform Version
Additional information
Verry beginning - probably first step in 0-bootstrap; friend of mine has the same issue