Project creation

[antoinecastex]

After create a project with TF by using a specific service account

The SA inherit the OWNER role on this project

That's not so beautiful

Do you recommend to add another step in TF which will remove the SA from OWNER IAM ?

[upodroid]

Hi

Please use the issue template.

That behaviour is not specific to terraform. Google grants Owner role to the identity that creates a project.

I don't see why you would want to remove that. The google_project resource executes https://cloud.google.com/billing/docs/how-to/modify-project#permissions_required_for_this_task_3 as part of setting the billing account on a project which you can't do without permissions on the project.

[antoinecastex]

You right this is not specific to Terraform

I'm just saying to you think it's acceptable to let the SA Owner, or do you recommend to remove it at the end of the operation ? :)

[upodroid]

It is acceptable because the identity is used for other operations in the project.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 [email protected]. Thanks!