Open jwaibel-pons opened 1 month ago
@jwaibel-pons this is how it works. Project where your service account resides needs to have API enabled. This is not a bug
Let me rephrase my question:
but
What is the logic and reasoning behind this behaviour?
@jwaibel-pons there are some services for which client side APIs are need for quota check etc. For those you need to enable API in client project. Then there are Some APIs that are enabled by default.
https://cloud.google.com/service-usage/docs/enabled-service#default
@imrannayer
This is the state of the terraform project. The last one was added as a workaround for this issue.
$ gcloud services list --enabled --project <terraform-project>
NAME TITLE
cloudbilling.googleapis.com Cloud Billing API
cloudresourcemanager.googleapis.com Cloud Resource Manager API
iam.googleapis.com Identity and Access Management (IAM) API
iamcredentials.googleapis.com IAM Service Account Credentials API
serviceusage.googleapis.com Service Usage API
sqladmin.googleapis.com Cloud SQL Admin API
TL;DR
Our terraform is executed using a dedicated service account and service account impersonation as described here
This terraform service account is part of a dedicated terraform project where only terraform stuff (like the storage for the state) is located.
When I use terraform and the impersonated service account user to create a new project, a database and some additional databases and users, everything works fine, except the creation of the additional users - I get an error that I have to activate the Clous SQL API on the terraform(!) project.
Expected behavior
The module should created the additional database users as expected.
Observed behavior
I'm getting this error. Note that project=850542690668 is the project where the service account is residing ("the terraform project"), NOT the target project for the database.
Terraform Configuration
provider.tf (for impersonation)
Additional information
A google_sql_database_instance has been created succesfully by terraform in the target project using the service account impersonation. Regarding this resource (any many others like vpc or k8s) this whole impersonation is working fine.
These resources are still planned:
As a failing example lets have a look at the creation of the additional user "user1".
This is the debug output for the creation of this user. As you can the, the POST request is referring the correct target project (where the Cloud SQL Admin API of course has been activated), but the error message claims the API needs to activated on the home project of the terraform service account (once again: 850542690668 is the ID of the terraform project where the service account is located, NOT the target project "schrom-project-with-tg-6857").
NOTE: If I switch of the service account impersonation and run the very same terraform with my personal account, everything is working as expected.