使用Terraform创建指定服务账号的CloudBuild Trigger遇权限问题

错误原因 #

你遇到的403权限错误，核心原因是执行Terraform的服务账号（terraform@XXX.iam.gserviceaccount.com）没有被授予模拟自定义Cloud Build服务账号的权限。官方示例中的act_as资源配置逻辑错误：它将roles/iam.serviceAccountUser角色赋予了自定义Cloud Build SA本身，但这个角色应该授予需要使用该SA的调用者——也就是你的Terraform执行SA。

修正后的Terraform代码 #

需要调整IAM权限配置，给Terraform执行SA添加模拟自定义Cloud Build SA的权限，同时保留自定义SA的必要权限（如日志写入）：

data "google_project" "project" {}

resource "google_cloudbuild_trigger" "service-account-trigger" {
  trigger_template {
    branch_name = "main"
    repo_name   = "my-repo"
  }

  service_account = google_service_account.cloudbuild_service_account.id
  filename        = "cloudbuild.yaml"
  depends_on = [
    google_project_iam_member.terraform_impersonate_cloudbuild_sa,
    google_project_iam_member.cloudbuild_sa_logs_writer
  ]
}

resource "google_service_account" "cloudbuild_service_account" {
  account_id = "cloud-sa"
}

# 授予Terraform执行SA模拟自定义Cloud Build SA的权限
resource "google_project_iam_member" "terraform_impersonate_cloudbuild_sa" {
  project = data.google_project.project.project_id
  role    = "roles/iam.serviceAccountUser"
  member  = "serviceAccount:${google_service_account.terraform.email}"
}

# 授予自定义Cloud Build SA日志写入权限（用于构建日志输出）
resource "google_project_iam_member" "cloudbuild_sa_logs_writer" {
  project = data.google_project.project.project_id
  role    = "roles/logging.logWriter"
  member  = "serviceAccount:${google_service_account.cloudbuild_service_account.email}"
}

关键说明 #

• roles/iam.serviceAccountUser是创建指定自定义SA的Cloud Build触发器的核心权限，它允许调用者（Terraform执行SA）模拟目标服务账号运行构建任务
• 若自定义Cloud Build SA需要执行更多操作（如访问云存储、部署GKE资源等），需额外给它添加对应的IAM角色（比如roles/storage.objectAdmin、roles/container.developer等）

内容的提问来源于stack exchange，提问作者Sydney