使用Google Cloud Project Factory添加计费权限及解决预算创建403错误

我正在使用Google的Terraform项目工厂模块编写代码，代码如下：

module "project" {
  source  = "terraform-google-modules/project-factory/google"
  version = "~> 14.1"

  name                        = "project"
  random_project_id           = true
  org_id                      = var.organization_id
  billing_account             = var.billing_account
  default_service_account     = "deprivilege"
  budget_amount               = var.budget_amount
  budget_alert_spent_percents = var.budget_alert_spent_percents
  activate_apis = [
    "compute.googleapis.com",
    "dns.googleapis.com",
    "domains.googleapis.com",
    "cloudresourcemanager.googleapis.com",
    "billingbudgets.googleapis.com",
    "serviceusage.googleapis.com",
  ]
}

执行时持续收到403权限错误，错误信息如下：

Error: Error creating Budget: googleapi: Error 403: The caller does not have permission
with module.project.module.budget.google_billing_budget.budget[0]
on .terraform/modules/project/modules/budget/main.tf line 41, in resource "google_billing_budget" "budget":
resource "google_billing_budget" "budget" {

一、通过模块自动配置权限 #

该模块的预算子模块不会自动为执行账号添加权限，但可以通过模块的service_accounts参数，给负责执行Terraform的账号（用户账号或服务账号）授予计费预算相关角色。

修改后的模块配置示例：

module "project" {
  source  = "terraform-google-modules/project-factory/google"
  version = "~> 14.1"

  name                        = "project"
  random_project_id           = true
  org_id                      = var.organization_id
  billing_account             = var.billing_account
  default_service_account     = "deprivilege"
  budget_amount               = var.budget_amount
  budget_alert_spent_percents = var.budget_alert_spent_percents
  activate_apis = [
    "compute.googleapis.com",
    "dns.googleapis.com",
    "domains.googleapis.com",
    "cloudresourcemanager.googleapis.com",
    "billingbudgets.googleapis.com",
    "serviceusage.googleapis.com",
  ]

  # 添加权限配置，给执行账号授予预算编辑角色
  service_accounts = {
    terraform_executor = {
      account_id = "your-terraform-service-account@your-project.iam.gserviceaccount.com" # 替换为你的执行账号
      roles = [
        "roles/billingbudgets.editor",
      ]
    }
  }
}

二、手动添加所需权限 #

如果不想通过模块配置，直接在Google Cloud控制台给执行Terraform的账号（用户或服务账号）添加以下任一角色（需在计费账号级别授予，而非仅项目级别）：

• roles/billingbudgets.editor：具备创建、修改计费预算的完整权限，满足需求
• roles/billing.admin：更高权限的计费管理员角色，包含预算管理权限
• 细粒度权限（不推荐，不如预设角色便捷）：billingbudgets.budgets.create + billingbudgets.budgets.get 等具体权限

内容的提问来源于stack exchange，提问作者andar1an