使用Terraform创建GCP SQL Server实例出现403未授权错误如何解决

现有配置 #

provider "google-beta" {
  credentials = file("key.json")
  project     = "spatial-cat-319209"
  region      = "asia-south1"
  zone        = "asia-south1-a"
}

data "google_project" "project" {
  provider = google-beta
}

data "google_client_config" "myconfig" {
  provider = google-beta
}

resource "random_id" "suffix" {
  count = 1

  byte_length = 4
}

resource "random_password" "password" {
  length           = 16
  special          = true
  override_special = "_%@"
}

resource "google_sql_database_instance" "master" {
  name             = "master-instance-${random_id.suffix[0].hex}"
  database_version = "SQLSERVER_2017_STANDARD"
  region           = data.google_client_config.myconfig.region
  project = data.google_project.project.number
  root_password    = random_password.password.result
  deletion_protection = false

  settings {
    # Second-generation instance tiers are based on the machine
    # type. See argument reference below.
    tier = "db-custom-2-3840"
  }
}

报错信息 #

Error: Error, attempting to list users associated with instance master-instance-1e474e58: googleapi: Error 403: The client is not authorized to make this request., notAuthorized
│
│   with google_sql_database_instance.master,
│   on main.tf line 28, in resource "google_sql_database_instance" "master":
│   28: resource "google_sql_database_instance" "master" {
│

排查修复步骤 #

• 首先修正配置中的project字段错误：你当前在google_sql_database_instance资源中填的project = data.google_project.project.number是项目编号，而GCP SQL Server相关的API要求传入项目ID，PostgreSQL的API兼容两种参数格式所以不会报错，修改为project = data.google_project.project.project_id即可，也可以直接写死为你的项目ID spatial-cat-319209。
• 升级google-beta provider版本到4.60.0及以上，旧版本provider对SQL Server实例的权限调用逻辑存在缺陷，即使账号权限足够也会抛出403错误。
• 单独给你使用的服务账号授予Cloud SQL Admin角色，部分组织的权限策略会限制Owner角色的部分操作权限，单独绑定角色可以避免继承问题。
• 验证key.json对应的服务账号和你授权的账号一致，避免密钥混用的问题。

内容的提问来源于stack exchange，提问作者Vikram