Search code examples
google-compute-enginegoogle-iam

GCE Service Account with Compute Instance Admin permissions

I have setup a compute instance called to run cronjobs on Google Compute engine using a service account with the following roles: Custom Compute Image User + Deletion rights Compute Admin Compute Instance Admin (beta) Kubernetes Engine Developer Logs Writer Logs Viewer Pub/Sub Editor Source Repository Reader Storage Admin Unfortunately, when I ssh into this cronjob runner instance and then run:

sudo gcloud compute --project  {REDACTED} instances create e-latest \
    --zone {REDACTED} --machine-type n1-highmem-8 --subnet default \
    --maintenance-policy TERMINATE  \
    --scopes  https://www.googleapis.com/auth/cloud-platform \
    --boot-disk-size 200  \
    --boot-disk-type pd-standard --boot-disk-device-name e-latest \
    --image {REDACTED} --image-project {REDACTED} \
    --service-account NAME_OF_SERVICE_ACCOUNT \ 
    --accelerator type=nvidia-tesla-p100,count=1 --min-cpu-platform Automatic

I get the following error:

The user does not have access to service account {NAME_OF_SERVICE_ACCOUNT}. User: {NAME_OF_SERVICE_ACCOUNT} . Ask a project owner to grant you the iam.serviceAccountUser role on the service account.

Is there some other privilege besides compute instance admin that I need to be able to create instances with my instance?

Further notes: (1) when I try to not specify --service-account the error is the same except that the service account my user doesn't have access to is the default '[email protected]'. (2) adding/removing sudo doesn't change anything

Solution

  • Creating an instance that uses a service account requires you have the compute.instances.setServiceAccount permission on that service account. To make this work, grant the iam.serviceAccountUser role to your service account (either on the entire project or on the specific service account you want to be able to create instances with).