GCP创建accessLevel组绑定：三种方式均报INVALID_ARGUMENT

尝试通过Terraform、gcloud CLI和REST API三种方式，将Access Level绑定到Google Groups中创建的组，但全部触发INVALID_ARGUMENT异常。以下是具体操作及结果：

Terraform 操作 #

配置代码 #

resource "google_access_context_manager_access_policy" "access-policy" {
  parent = "organizations/123456789"
  title  = "${var.ENV} Access Policy"
  scopes = ["projects/${lookup(var.project_number, var.ENV)}"]
}

resource "google_access_context_manager_access_level" "firewall-console-access" {
  parent = "accessPolicies/${google_access_context_manager_access_policy.access-policy.name}"
  name   = "accessPolicies/${google_access_context_manager_access_policy.access-policy.name}/accessLevels/firewall_console_access"
  title  = "firewall_console_access"
  basic {
    conditions {
      ip_subnetworks = [
        "182.0.0.0/24"
      ]
      regions = [
        "CA",
      ]
    }
  }
}

resource "google_access_context_manager_gcp_user_access_binding" "console-group-access" {
  organization_id = "123456789"
  group_key       = "test-group-key"
  access_levels   = [
    google_access_context_manager_access_level.firewall-console-access.name
  ]
}

执行结果 #

限定范围的Access Policy和Access Level创建成功：
执行命令 gcloud access-context-manager levels list --policy 123456789，返回：

NAME: firewall_console_access TITLE: firewall_console_access LEVEL_TYPE: Basic

但绑定操作失败，报错：

执行结果显示：google_access_context_manager_gcp_user_access_binding.console-group-access: Creating... 错误：googleapi: Error 400: Request contains an invalid argument., invalidArgument

gcloud CLI 操作 #

执行命令 #

$ gcloud access-context-manager cloud-bindings create --level="accessPolicies/123456789/accessLevels/firewall_console_access" --group-key="test-group-key" --organization="123456789"

执行结果 #

ERROR: (gcloud.access-context-manager.cloud-bindings.create) INVALID_ARGUMENT: Request contains an invalid argument.

REST API 操作 #

请求体（request.json） #

{
  "groupKey": "test-group-key",
  "accessLevels": [ "accessPolicies/123456789/accessLevels/firewall_console_access" ]
}

请求命令及结果 #

curl -X POST     -H "Authorization: Bearer $(gcloud auth print-access-token)"     -H "Content-Type: application/json; charset=utf-8"     -d @request.json     "https://accesscontextmanager.googleapis.com/v1/organizations/123456789/gcpUserAccessBindings"

返回错误：

{
  "error": {
    "code": 400,
    "message": "Request contains an invalid argument.",
    "status": "INVALID_ARGUMENT"
  }
}

补充说明 #

曾猜测错误原因是Access Policy限定在项目级别，于是创建了绑定到组织默认策略的Access Level并尝试绑定，但问题依旧（对应原截图：无范围限制的Access Level绑定仍触发相同错误）。

内容的提问来源于stack exchange，提问作者Shardul Frey