search

terraform-google-modules / terraform-google-bastion-host

Generates a bastion host VM compatible with OS Login and IAP Tunneling that can be used to access internal VMs
https://registry.terraform.io/modules/terraform-google-modules/bastion-host/google
Apache License 2.0
128 stars 92 forks source link

Authentication fails to "iap.googleapis.com" when using service account not associated with compute instance #79

Closed caddac closed 3 years ago

caddac commented 3 years ago

I'm using a custom service account to apply this module from an external service (not running in GCP). When applying this module I'm seeing an authentication failed (HTTP 403) error to iap.googleapis.com/v1/projects/my_service_project/iap_tunnel/zones/us-west1-a/instances/my_bastion_instance:getIamPolicy?alt=json HTTP/1.1. From these docs my service account requires the Access Scope https://www.googleapis.com/auth/cloud-platform. However I can't figure out how to assign a scope to a custom service account. Per this SO answer, I need to associate my service account with an instance.

Can I apply this module using a service account not associated with a compute instance? Or does it have to be associated with an instance so I can assign this Access Scope?

caddac commented 3 years ago

well, looks like I was just missing IAP Policy Admin role. Google docs aren't really clear you need this role to manage IAP, https://github.com/hashicorp/terraform-provider-google/issues/4515#issuecomment-750497295 finally led me to the solution. Adding required roles to the readme for this would really awesome.

onetwopunch commented 3 years ago

@caddac thanks for finding this. We are always trying to improve docs. Please feel free to update the README in a PR and I’ll happily review it