Cannot create VPC Service Control perimeter using end-user credentials

[nauris-sadovskis]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request.
• Please do not leave +1 or me too comments, they generate extra noise for issue followers and do not help prioritize the request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.
• If an issue is assigned to the modular-magician user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If an issue is assigned to a user, that user is claiming responsibility for the issue. If an issue is assigned to hashibot, a community member has claimed the issue already.

Terraform Version

Terraform v0.12.12

• provider.google v3.21.0

Affected Resource(s)

• resource.google_access_context_manager_service_perimeter

Terraform Configuration Files

resource "google_access_context_manager_service_perimeter" "service-perimeter" {
  parent = "accessPolicies/1234567890"
  name   = "accessPolicies/1234567890/servicePerimeters/restrict_storage"
  title  = "TestPerimeter"
  status {
    restricted_services = ["storage.googleapis.com"]
    resources = ["projects/123"]
  }
}

Debug Output

https://gist.github.com/nauris-sadovskis/9f815a53cc4c9066b4416301e785b59b

Panic Output

N/A

Expected Behavior

The change should have been applied using end-user credentials. Following gcloud command works with no issues with end-user credentials:

$ gcloud access-context-manager perimeters \
  create TestPerimeter --title="Test Perimeter" \
  --resources=projects/123 \
  --restricted-services=storage.googleapis.com,bigquery.googleapis.com \
  --policy=1234567890
Create request issued for: [TestPerimeter]
Waiting for operation [operations/accessPolicies/1234567890/servicePerimeters/TestPerimeter/create/1589790756407901] to complete...done.
Created perimeter [TestPerimeter].

Actual Behavior

Error: Error creating ServicePerimeter: googleapi: Error 403: Your application has authenticated using end user credentials from the Google Cloud SDK or Google Cloud Shell which are not supported by the accesscontextmanager.googleapis.com. We recommend configuring the billing/quota_project setting in gcloud or using a service account through the auth/impersonate_service_account setting. For more information about service accounts and how to use them in your application, see https://cloud.google.com/docs/authentication/.

Steps to Reproduce

1. terraform apply

Important Factoids

Yes, I'm authenticating as a user and for all other terraform resources it works fine. I'm aware that best practice is to use service accounts, but for the auditing/security/criticality of the resource, it's being run using end-user credentials.

References

N/A

[venkykuberan]

The user/sa should be an org level user for this resource. Can you try setting Access Context Manager Admin role for the user and try running the terraform ..

[nauris-sadovskis]

Hi @venkykuberan, I confirm I have this role on the organization level (hence why I can create it via gcloud command with no problems).

[venkykuberan]

@nauris-sadovskis API isn't allowing to use the regular user creds to create the resource outside of gcloud. I wonder if your user can impersonate to a SA and create the resource. You can look into this doc. Since its an API limitation i am closing this issue

[nauris-sadovskis]

Thanks @venkykuberan, I have stumbled upon the following Medium article which does impersonation via Terraform:
https://medium.com/google-cloud/terraform-assume-role-and-service-account-impersonation-on-google-cloud-ffc553863e72

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 [email protected]. Thanks!