Terraform实现GCP服务账号Impersonation时Service Usage API权限问题解决

1. 补充服务账号权限 #

给目标服务账号 svc-gke@projectx-4567.iam.gserviceaccount.com 添加 roles/serviceusage.serviceUsageAdmin 角色（也可选择更细粒度的roles/serviceusage.apiEditor，前者权限覆盖更完整），该角色允许账号管控项目内API的启用、禁用等操作。

可通过gcloud命令完成权限添加：

gcloud projects add-iam-policy-binding projectx-4567 \
  --member="serviceAccount:svc-gke@projectx-4567.iam.gserviceaccount.com" \
  --role="roles/serviceusage.serviceUsageAdmin"

2. 修改Terraform配置自动启用API #

在现有Terraform代码中新增google_project_service资源，显式启用Service Usage API（serviceusage.googleapis.com），确保后续资源操作前API已处于可用状态：

locals {
 terraform_service_account = "svc-gke@projectx-4567.iam.gserviceaccount.com"
}

provider "google" {
 alias = "impersonation"
 scopes = [
   "https://www.googleapis.com/auth/cloud-platform",
   "https://www.googleapis.com/auth/userinfo.email",
 ]
}

data "google_service_account_access_token" "default" {
 provider                   = google.impersonation
 target_service_account     = local.terraform_service_account
 scopes                     = ["userinfo-email", "cloud-platform"]
 lifetime                   = "1200s"
}

provider "google" {
 project        = "projectx-4567"
 access_token   = data.google_service_account_access_token.default.access_token
 request_timeout    = "60s"
}

# 显式启用Service Usage API
resource "google_project_service" "service_usage" {
  project = "projectx-4567"
  service = "serviceusage.googleapis.com"

  # 可选：等待API完全生效，避免后续操作因状态不同步报错
  provisioner "local-exec" {
    command = "sleep 30"
  }
}

# 后续所有依赖该API的资源（如GKE集群）需添加依赖声明
# 示例：
# resource "google_container_cluster" "primary" {
#   ...
#   depends_on = [google_project_service.service_usage]
# }

3. 关键说明 #

• 权限补充完成后，服务账号具备了API启用权限，Terraform执行时会优先完成API启用操作，再推进后续资源部署。
• 可选的sleep操作是为了规避API启用后的短暂状态同步延迟，部分GCP API启用后需要几秒到几十秒完成全链路生效。

内容的提问来源于stack exchange，提问作者Aparna Raman