GitHub Actions中无法执行GCP Terraform命令的问题求助

已按官方教程为GitHub Actions流水线配置Workload Identity Federation无密钥认证，但执行terraform init时触发以下403错误：

│ Error: Failed to get existing workspaces: querying Cloud Storage failed: Get "https://storage.googleapis.com/storage/v1/b/lws-dev-common-bucket/o?alt=json&delimiter=%2F&pageToken=&prefix=global%2Fnetworking.state%2F&prettyPrint=false&projection=full&versions=false": oauth2/google: status code 403: {
│   "error": {
│     "code": 403,
│     "message": "Permission 'iam.serviceAccounts.getAccessToken' denied on resource (or it may not exist).",
│     "status": "PERMISSION_DENIED",
│     "details": [
│       {
│         "@type": "type.googleapis.com/google.rpc.ErrorInfo",
│         "reason": "IAM_PERMISSION_DENIED",
│         "domain": "iam.googleapis.com",
│         "metadata": {
│           "permission": "iam.serviceAccounts.getAccessToken"
│         }
│       }
│     ]
│   }
│ }

当前使用的服务账号lws-d-iac-sa@lefewaresolutions-poc.iam.gserviceaccount.com已配置以下权限：

• Cloud Run Admin
• Cloud Run Service Agent

流水线代码片段：

- id: 'auth'
  name: 'Authenticate to Google Cloud'
  uses: 'google-github-actions/auth@v0.4.0'
  with:
    workload_identity_provider: 'projects/385050593732/locations/global/workloadIdentityPools/my-pool/providers/my-provider'
    service_account: 'lws-d-iac-sa@lefewaresolutions-poc.iam.gserviceaccount.com'

- name: Terraform Init
  working-directory: ./Terraform/QuickStartDeployments/EKSCluster
  run: terraform init

Terraform代码片段：

terraform {
  required_providers {
    google = {
      source = "hashicorp/google"
      version = "3.89.0"
    }
  }

  backend "gcs" {
    bucket  = "lws-dev-common-bucket"
    prefix  = "global/networking.state"
  }

  required_version = ">= 0.14.9"
}

provider "google" {
  project = var.project_id
  region  = var.region
}


module "vpc" {
  source  = "../../Modules/VPC"

  project_id = var.project_id
  region     = "us-west1"
  vpc_name   = var.vpc_name
}

1. 补充服务账号的Token创建权限 #

错误明确指出缺少iam.serviceAccounts.getAccessToken权限，该权限包含在预定义角色roles/iam.serviceAccountTokenCreator中，直接给服务账号分配此角色即可：

gcloud projects add-iam-policy-binding lefewaresolutions-poc \
  --member="serviceAccount:lws-d-iac-sa@lefewaresolutions-poc.iam.gserviceaccount.com" \
  --role="roles/iam.serviceAccountTokenCreator"

2. 验证Workload Identity绑定关系 #

确认身份池提供者已将GitHub流水线的身份（如特定仓库、分支）与目标服务账号绑定，且绑定关系中已授予roles/iam.workloadIdentityUser角色给对应的GitHub主体（示例：principalSet://iam.googleapis.com/projects/385050593732/locations/global/workloadIdentityPools/my-pool/attribute.repository/你的GitHub用户名/仓库名）。

3. 添加GCS存储桶权限 #

由于Terraform使用GCS作为状态后端，服务账号还需要对lws-dev-common-bucket具备读写权限，建议分配roles/storage.objectAdmin角色：

gcloud storage buckets add-iam-policy-binding gs://lws-dev-common-bucket \
  --member="serviceAccount:lws-d-iac-sa@lefewaresolutions-poc.iam.gserviceaccount.com" \
  --role="roles/storage.objectAdmin"

内容的提问来源于stack exchange，提问作者Josh L