使用Terraform创建GCP Cloud Composer v2时权限缺失错误排查

尝试使用以下Terraform脚本创建GCP Cloud Composer环境：

resource "google_composer_environment" "test" {
  name   = "example-composer-env-tf-c2"
  region = "us-central1"
  config {

    software_config {
      image_version = "composer-2-airflow-2"
    }

    workloads_config {
      scheduler {
        cpu        = 0.5
        memory_gb  = 1.875
        storage_gb = 1
        count      = 1
      }
      web_server {
        cpu        = 0.5
        memory_gb  = 1.875
        storage_gb = 1
      }
      worker {
        cpu        = 0.5
        memory_gb  = 1.875
        storage_gb = 1
        min_count  = 1
        max_count  = 3
      }
    }
    environment_size = "ENVIRONMENT_SIZE_SMALL"

    node_config {
      network         = google_compute_network.test.id
      subnetwork      = google_compute_subnetwork.test.id
      service_account = google_service_account.test.name
    }
  }
}

resource "google_compute_network" "test" {
  name                    = "composer-test-network3"
  auto_create_subnetworks = false
}

resource "google_compute_subnetwork" "test" {
  name          = "composer-test-subnetwork"
  ip_cidr_range = "10.2.0.0/16"
  region        = "us-central1"
  network       = google_compute_network.test.id
}

resource "google_service_account" "test" {
  account_id   = "composer-env-account"
  display_name = "Test Service Account for Composer Environment"
}

resource "google_project_iam_member" "composer-worker" {
  project = "inlaid-ally-373906"
  role    = "roles/composer.worker"
  member  = "serviceAccount:${google_service_account.test.email}"
}

resource "google_project_iam_member" "composer-service-agent-v2-ext" {
  project = "inlaid-ally-373906"
  role    = "roles/composer.ServiceAgentV2Ext"
  member  = "serviceAccount:${google_service_account.test.email}"
}

执行terraform apply时遇到错误：

╷
│ Error: googleapi: Error 400: Composer API Service Agent service account (service-197833231297@cloudcomposer-accounts.iam.gserviceaccount.com) does not have required permissions set. Cloud Composer v2 API Service Agent Extension role might be missing. Please refer to https://cloud.google.com/composer/docs/composer-2/create-environments#grant-permissions and Composer Creation Troubleshooting pages to resolve this issue., failedPrecondition
│ 
│   with google_composer_environment.test,
│   on main.tf line 49, in resource "google_composer_environment" "test":
│   49: resource "google_composer_environment" "test" {
│ 

这个错误的核心原因是：你将roles/composer.ServiceAgentV2Ext角色授予了自定义的服务账号，但该角色需要授予GCP自动生成的Composer API Service Agent账号（即错误信息中提到的service-197833231297@cloudcomposer-accounts.iam.gserviceaccount.com）。

修复步骤：

1. 移除错误的IAM绑定资源：删除google_project_iam_member.composer-service-agent-v2-ext，这个角色不属于你创建的服务账号。
2. 添加正确的IAM绑定：为Composer API Service Agent账号授予roles/composer.ServiceAgentV2Ext角色。该账号的格式为service-<项目编号>@cloudcomposer-accounts.iam.gserviceaccount.com，其中项目编号可从错误信息中获取（此处为197833231297）。
3. 确保执行权限：运行Terraform的账号需要具备roles/iam.roleAdmin或roles/owner等足够权限来修改项目IAM绑定。

修改后的Terraform代码片段：

# 保留原有的自定义服务账号和worker角色绑定
resource "google_service_account" "test" {
  account_id   = "composer-env-account"
  display_name = "Test Service Account for Composer Environment"
}

resource "google_project_iam_member" "composer-worker" {
  project = "inlaid-ally-373906"
  role    = "roles/composer.worker"
  member  = "serviceAccount:${google_service_account.test.email}"
}

# 添加正确的Composer API Service Agent权限绑定
resource "google_project_iam_member" "composer-api-service-agent" {
  project = "inlaid-ally-373906"
  role    = "roles/composer.ServiceAgentV2Ext"
  member  = "serviceAccount:service-197833231297@cloudcomposer-accounts.iam.gserviceaccount.com"
}

完成修改后，重新执行terraform apply即可创建Composer环境。

内容的提问来源于stack exchange，提问作者dhruv