使用Terraform生成GCP服务账号AccessToken时遇Error 403

核心问题 #

出现Error: googleapi: Error 403: Permission 'iam.serviceAccounts.getAccessToken' denied的原因：

• 权限授予对象错误：你之前给**目标服务账号（artifact-registry-sa）添加令牌创建权限，但实际需要给执行Terraform的服务账号（即my-app-terraform.json对应的Owner权限SA）**授予对目标服务账号的roles/iam.serviceAccountTokenCreator角色。
• 数据源执行时机：google_service_account_access_token是Terraform数据源，默认在计划阶段执行，此时IAM绑定可能尚未生效，需显式声明依赖。

修正后的配置 #

模块代码调整 #

resource "google_artifact_registry_repository" "registry" {
  location      = var.gcp_region
  repository_id = "frontend-repository"
  description   = "front end artifact registry"
  format        = "DOCKER"
}

resource "google_service_account" "service_account" {
  account_id   = "artifact-registry-sa"
  display_name = "Artifact Registry Service Account"
  project      = var.gcp_project
}

# 保留目标SA的Artifact Registry权限配置
resource "google_project_iam_member" "service_account_registry_permission" {
  project = var.gcp_project
  role    = "roles/artifactregistry.repoAdmin"
  member  = "serviceAccount:${google_service_account.service_account.email}"
}

# 关键：给执行Terraform的SA授予目标SA的令牌创建权限
resource "google_service_account_iam_binding" "terraform_sa_token_creator" {
  service_account_id = google_service_account.service_account.name
  role               = "roles/iam.serviceAccountTokenCreator"
  # 替换为你的Terraform执行SA邮箱，或用动态方式获取
  members = [
    "serviceAccount:terraform@your-project-id.iam.gserviceaccount.com",
  ]
}

# 声明依赖，确保IAM绑定生效后再获取令牌
data "google_service_account_access_token" "access_token" {
  target_service_account = google_service_account.service_account.email
  scopes                 = ["cloud-platform"]
  lifetime               = "300s"

  depends_on = [google_service_account_iam_binding.terraform_sa_token_creator]
}

动态获取执行SA邮箱（可选） #

如果不想硬编码执行SA邮箱，可通过数据源自动获取当前认证的SA：

data "google_client_openid_userinfo" "me" {}

resource "google_service_account_iam_binding" "terraform_sa_token_creator" {
  service_account_id = google_service_account.service_account.name
  role               = "roles/iam.serviceAccountTokenCreator"
  members = [
    "serviceAccount:${data.google_client_openid_userinfo.me.email}",
  ]
}

注意事项 #

• 删除之前给目标SA添加roles/iam.serviceAccountTokenCreator的无效配置。
• GCP IAM权限可能有1-2分钟生效延迟，若首次执行仍报错，等待片刻后重试。
• 可通过以下命令验证权限是否生效：

gcloud iam service-accounts get-iam-policy artifact-registry-sa@your-project-id.iam.gserviceaccount.com \
  --flatten="bindings[].members" \
  --format='table(bindings.role)' \
  --filter="bindings.members:terraform@your-project-id.iam.gserviceaccount.com"

内容的提问来源于stack exchange，提问作者Kieran Finn