GCP中无法为实例分配服务账号问题求助

错误信息 #

ERROR: (gcloud.deployment-manager.deployments.update) 操作[operation-1663746707027-5e92b3777f488-7748cc3b-a3d3cc8f]出错:

• 代码: RESOURCE_ERROR
• 位置: /deployments/demo-vm/resources/test-vm
• 消息: {"ResourceType":"compute.v1.instance","ResourceErrorCode":"SERVICE_ACCOUNT_ACCESS_DENIED","ResourceErrorMessage":"用户无访问服务账号'serviceAccount:test-vm-gke-init-vm@.iam.gserviceaccount.com'的权限。用户: 'xxxxxxxxxx@cloudservices.gserviceaccount.com'。请联系项目所有者为您授予该服务账号的iam.serviceAccountUser角色"}

部署模板代码 #

resources:
- type: compute.v1.instance
  name: {{ properties.name }}
  properties:
    machineType: https://www.googleapis.com/compute/v1/projects/{{ env["project"] }}/zones/{{ properties["zone"] }}/machineTypes/{{ properties["machineType"] }}
    zone: {{ properties["zone"] }}
    disks:
    - deviceName: boot
      type: PERSISTENT
      boot: true
      autoDelete: true
      initializeParams:
        diskName: disk-{{ env["deployment"] }}
        sourceImage: https://www.googleapis.com/compute/v1/projects/debian-cloud/global/images/debian-11-bullseye-v20220822
    networkInterfaces:
    - network: https://www.googleapis.com/compute/v1/projects/{{ env["project"] }}/global/networks/default
      accessConfigs:
      - name: External NAT
        type: ONE_TO_ONE_NAT  
    serviceAccounts: 
    - email: serviceAccount:$(ref.{{ properties.name }}-sa.email) 
      scopes:
      - https://www.googleapis.com/auth/devstorage.read_only
      - https://www.googleapis.com/auth/logging.write
      - https://www.googleapis.com/auth/monitoring.write
      - https://www.googleapis.com/auth/servicecontrol
      - https://www.googleapis.com/auth/service.management.readonly
      - https://www.googleapis.com/auth/compute
      - https://www.googleapis.com/auth/cloud-platform


- name: {{ properties.name }}-sa
  type: gcp-types/iam-v1:projects.serviceAccounts
  properties:
    accountId: {{ properties.name }}-gke-init-vm
    displayName: {{ properties.name }}-gke-init-vm
  accessControl:
    gcpIamPolicy:
      bindings:
      - role: roles/iam.serviceAccountUser
        members:
        - "serviceAccount:<myproject>@cloudservices.gserviceaccount.com"

- name: {{ env["project"] }}-{{ properties.name }}-initnode-sa-binding
  type: gcp-types/cloudresourcemanager-v1:virtual.projects.iamMemberBinding
  properties:
    resource: {{ env["project"] }}
    member: serviceAccount:$(ref.{{ properties.name }}-sa.email)
    role: roles/container.clusterAdmin 



- name: {{ env["project"] }}-{{ properties.name }}-initnode-sa-binding-v2
  type: gcp-types/cloudresourcemanager-v1:virtual.projects.iamMemberBinding
  properties:
    resource: {{ env["project"] }}
    member: serviceAccount:$(ref.{{ properties.name }}-sa.email)
    role: roles/container.admin 

问题分析 #

已为xxxxxxxxxx@cloudservices.gserviceaccount.com授予Owner及iam.serviceAccountUser权限，且在目标服务账号的访问控制中添加该账号并赋予对应角色，但仍报错，核心原因有两点：

1. 资源并行创建导致权限未生效：Deployment Manager默认并行创建所有资源，VM实例可能在服务账号的IAM绑定完成前就尝试关联服务账号，此时权限检查未通过。
2. 服务账号IAM绑定的成员账号错误：模板中服务账号的accessControl部分填写的成员是<myproject>@cloudservices.gserviceaccount.com，但错误信息中的实际用户是xxxxxxxxxx@cloudservices.gserviceaccount.com（项目号格式的cloudservices账号），二者不匹配导致权限未正确赋予。

解决方案 #

1. 修正服务账号IAM绑定的成员账号 #

将模板中服务账号的accessControl成员改为错误信息中显示的正确账号xxxxxxxxxx@cloudservices.gserviceaccount.com：

- name: {{ properties.name }}-sa
  type: gcp-types/iam-v1:projects.serviceAccounts
  properties:
    accountId: {{ properties.name }}-gke-init-vm
    displayName: {{ properties.name }}-gke-init-vm
  accessControl:
    gcpIamPolicy:
      bindings:
      - role: roles/iam.serviceAccountUser
        members:
        - "serviceAccount:xxxxxxxxxx@cloudservices.gserviceaccount.com"

2. 强制资源创建顺序 #

在VM实例资源中添加dependsOn字段，依赖服务账号资源及所有相关IAM绑定资源，确保VM在权限配置完成后再创建：

- type: compute.v1.instance
  name: {{ properties.name }}
  dependsOn:
  - {{ properties.name }}-sa
  - {{ env["project"] }}-{{ properties.name }}-initnode-sa-binding
  - {{ env["project"] }}-{{ properties.name }}-initnode-sa-binding-v2
  properties:
    # 原VM配置内容保持不变...

3. 手动验证权限配置 #

执行以下命令确认xxxxxxxxxx@cloudservices.gserviceaccount.com已正确获得目标服务账号的iam.serviceAccountUser权限：

gcloud iam service-accounts get-iam-policy test-vm-gke-init-vm@<myproject>.iam.gserviceaccount.com --project=<myproject>

检查输出中是否包含如下绑定内容：

bindings:
- members:
  - serviceAccount:xxxxxxxxxx@cloudservices.gserviceaccount.com
  role: roles/iam.serviceAccountUser

4. 确认Deployment Manager服务账号权限 #

确保xxxxxxxxxx@cloudservices.gserviceaccount.com拥有项目级的roles/deployment-manager.editor或更高权限，保证其能管理服务账号及IAM绑定。

内容的提问来源于stack exchange，提问作者Vaishnav