GCP预算警报关联Pub/Sub失败问题求助

问题详情 #

尝试创建可发送Pub/Sub消息的GCP预算警报，通过Cloud Console和Terraform两种方式均失败：

Cloud Console操作报错 #

The attempted action failed. Please try again.

Terraform配置及报错 #

使用的Terraform代码：

resource "google_billing_budget" "budget" {
  display_name    = "test-budget"
  billing_account = "xxxx"
  budget_filter {
    projects               = ["projects/xxx"]
    credit_types_treatment = "INCLUDE_SPECIFIED_CREDITS"
    credit_types = [
      "SUSTAINED_USAGE_DISCOUNT",
      "DISCOUNT",
      "COMMITTED_USAGE_DISCOUNT",
      "COMMITTED_USAGE_DISCOUNT_DOLLAR_BASE",
      "SUBSCRIPTION_BENEFIT",
    ]
  }
  amount {
    specified_amount {
      currency_code = "EUR"
      units         = 10
    }
  }

  all_updates_rule {
    pubsub_topic                   = "projects/xxx/topics/budget_alerts"
  }

  threshold_rules {
    threshold_percent = 1.1
    spend_basis       = "FORECASTED_SPEND"
  }
}

执行后返回错误：

Error 400: Precondition check failed.googleapi: Error 400: Precondition check failed.

排查方向 #

1. 权限验证

   • 确认操作账号拥有billing.budgets.create权限（需绑定Billing Account Administrator或Billing Budget Manager角色）
   • 必须给GCP计费系统服务账号billing-system@gcp-sa-billingbudgets.iam.gserviceaccount.com授予目标Pub/Sub主题的pubsub.publish权限，执行命令：

     gcloud pubsub topics add-iam-policy-binding projects/xxx/topics/budget_alerts \
       --member="serviceAccount:billing-system@gcp-sa-billingbudgets.iam.gserviceaccount.com" \
       --role="roles/pubsub.publisher"
     

2. 参数校验

   • 检查billing_account是否为正确的计费账号ID（格式：012345-ABCDEF-012345）
   • 确认projects列表中的项目路径正确，且该项目已关联到指定计费账号
   • 验证Pub/Sub主题的完整资源路径无误，且主题已提前创建

3. 其他检查

   • 若用Terraform，确保google provider版本为最新，旧版本可能存在API兼容问题
   • 排查是否有组织级政策限制了预算警报或Pub/Sub的配置

内容的提问来源于stack exchange，提问作者Antoine Redier