使用Terraform为GCP服务账号绑定Cloud SQL Client角色报错及解决

错误场景 #

使用Terraform为GCP服务账号绑定roles/cloudsql.client角色时，触发如下400错误：

Error setting IAM policy for service account '{}': googleapi: Error 400: Role roles/cloudsql.client is not supported for this resource., badRequest

原错误代码 #

resource "google_service_account" "default" {
  account_id = var.service_account_name
  display_name = "ECB API Caller Cloud Function SA"
}

data "google_iam_policy" "default" {
  binding {
    members = ["serviceAccount:${google_service_account.default.email}"]
    role    = "roles/cloudsql.client"
  }
}

resource "google_service_account_iam_policy" "default" {
  service_account_id = google_service_account.default.name
  policy_data = data.google_iam_policy.default.policy_data
}

问题原因 #

roles/cloudsql.client是项目级IAM角色，仅能在项目层级完成绑定操作，无法直接绑定到服务账号资源本身。原代码错误使用google_service_account_iam_policy（针对服务账号资源的IAM策略）绑定该角色，因此触发资源不支持的报错。

正确实现代码 #

改用google_project_iam_binding资源在项目层级为目标服务账号绑定角色：

resource "google_service_account" "default" {
  account_id = var.service_account_name
  display_name = "ECB API Caller Cloud Function SA"
}

resource "google_project_iam_binding" "project" {
  project = var.project_id
  role    = "roles/cloudsql.client"

  members = [
    "serviceAccount:${google_service_account.default.email}",
  ]
}

内容的提问来源于stack exchange，提问作者Antjes