Terraform初始化报错：未知凭证类型impersonated_service_account求助

执行terraform init时遇到凭证类型不识别错误：

Error: google: error getting credentials using well-known file (/Users/fakeuser/.config/gcloud/application_default_credentials.json): unknown credential type: "impersonated_service_account"

前置操作：

1. 执行gcloud auth application-default login
2. 设置环境变量：export GOOGLE_IMPERSONATE_SERVICE_ACCOUNT=gitlab-runner-service-account@fake-project.iam.gserviceaccount.com

当前环境：

• Terraform版本：v1.3.2
• 应用默认凭证文件application_default_credentials.json内容：

{
  "delegates": [],
  "service_account_impersonation_url": "https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/gitlab-runner-service-account@fake-project.iam.gserviceaccount.com:generateAccessToken",
  "source_credentials": {
    "client_id": "replaced.apps.googleusercontent.com",
    "client_secret": "replaced",
    "refresh_token": "replaced",
    "type": "authorized_user"
  },
  "type": "impersonated_service_account"
}

Terraform配置：

terraform {
  backend "gcs" {
    bucket = "fake-project-tfstate-bucket"
    prefix = "state/fake-project"
  }
}

1. 升级Terraform与Google Provider版本 #

Terraform v1.3.2对应的Google Provider版本不支持impersonated_service_account类型凭证，该特性从Google Provider v4.40.0开始支持，同时建议将Terraform升级到v1.4及以上版本以保证兼容性。

修改Terraform配置，指定最低Provider版本：

terraform {
  required_providers {
    google = {
      source  = "hashicorp/google"
      version = ">= 4.40.0"
    }
  }
  backend "gcs" {
    bucket = "fake-project-tfstate-bucket"
    prefix = "state/fake-project"
  }
}

执行terraform init -upgrade完成版本升级。

2. 临时凭证替代方案（无需升级） #

通过gcloud直接生成模拟服务账号的临时访问令牌，让Terraform使用该令牌绕过凭证类型识别问题：

# 生成并导出临时访问令牌
export GOOGLE_OAUTH_ACCESS_TOKEN=$(gcloud auth application-default print-access-token --impersonate-service-account=gitlab-runner-service-account@fake-project.iam.gserviceaccount.com)

之后执行terraform init即可正常初始化。

3. 验证源账号权限 #

确保执行gcloud auth application-default login的账号拥有roles/iam.serviceAccountTokenCreator角色，该角色是账号模拟目标服务账号生成凭证的必要权限。

内容的提问来源于stack exchange，提问作者Gary Turner