如何在Terraform中为GCP项目绑定roles/bigquery.jobUser角色？

问题背景 #

运行BigQuery查询时触发权限错误：

google.api_core.exceptions.Forbidden: 403 POST https://bigquery.googleapis.com/bigquery/v2/projects/my-project/jobs?prettyPrint=false: Access Denied: Project my-project: User does not have bigquery.jobs.create permission in project my-project.

需要为目标服务账号在my-project项目级别授予BigQuery Job User角色，此前错误编写了数据集级别的IAM绑定代码，现需改为项目级绑定。

原数据集级绑定代码：

resource "google_bigquery_dataset_iam_binding" "dataset_job_user" {
  dataset_id = google_bigquery_dataset.dataset.dataset_id
  role       = "roles/bigquery.user"
  members    = [
    "serviceAccount:${google_service_account.my_service_account.email}"
  ]
}

解决方案：项目级IAM绑定 #

使用Terraform的google_project_iam_binding资源实现项目级角色绑定，代码示例如下：

resource "google_project_iam_binding" "project_bigquery_job_user" {
  project = "my-project" # 可替换为Terraform项目资源引用，如 google_project.my_project.project_id
  role    = "roles/bigquery.jobUser"
  members = [
    "serviceAccount:${google_service_account.my_service_account.email}"
  ]
}

关键说明 #

• 替换原数据集级资源google_bigquery_dataset_iam_binding为项目级资源google_project_iam_binding
• 角色需指定为roles/bigquery.jobUser（该角色包含bigquery.jobs.create权限，匹配需求）
• project字段支持直接填写项目ID，或通过Terraform资源动态引用项目ID

内容的提问来源于stack exchange，提问作者thclark