cannot create vm instance with "resource_policies" parameter and custom service account ?

[keisari-ch]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request.
• Please do not leave +1 or me too comments, they generate extra noise for issue followers and do not help prioritize the request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.
• If an issue is assigned to the modular-magician user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If an issue is assigned to a user, that user is claiming responsibility for the issue. If an issue is assigned to hashibot, a community member has claimed the issue already.

Terraform Version

`Terraform v0.14.11

• provider registry.terraform.io/hashicorp/google v3.74.0
• provider registry.terraform.io/hashicorp/google-beta v3.74.0
• provider registry.terraform.io/hashicorp/random v3.1.0

`

Affected Resource(s)

• google_compute_instance

Terraform Configuration Files

resource "google_compute_instance" "default" {
  for_each     = { for inst in local.instances_list : inst.instance_name => inst }

  name         = each.value.instance_name
  project      = each.value.project_id
  machine_type = each.value.machine_type
  zone         = each.value.instance_zone

  tags = each.value.instance_tags

  boot_disk {
    initialize_params {
      image = each.value.instance_image
      size  = 20
      type  = "pd-standard"
    }
  }

  allow_stopping_for_update = true

  network_interface {
    subnetwork = var.subnetwork[format("%s/%s", var.project_data[each.value.project_name].region, var.project_data[each.value.project_name].subnet)].self_link

    dynamic "access_config" {
      for_each = each.value.static_external_ip ? [1] : []
      content {
        nat_ip = google_compute_address.static-ip-address[each.key].address
      }
    }
  }

  metadata_startup_script = each.value.metadata_script != "" ? base64decode(each.value.metadata_script) : null

  metadata = each.value.metadata

  service_account {
    email = each.value.service_account.email
  #  scopes = concat(each.value.service_account.scopes, ["userinfo-email", "compute-ro", "storage-ro"])
    scopes = ["cloud-platform"]
  }

  resource_policies = [google_compute_resource_policy.schedule_policy[format("tf-instance-class-%s", lower(each.value.instance_class))].self_link]

  lifecycle {
    ignore_changes = [attached_disk]
  }
}

resource "google_compute_resource_policy" "schedule_policy" {
  for_each = { for sp in local.schedule_policies: sp.schedule_name => sp }

  project     = each.value.project
  name        = each.key
  description = each.value.description
  region      = "each.value.region"

  instance_schedule_policy {
    dynamic "vm_start_schedule" {
      for_each = each.value.vm_start_schedule != "" ? [1] : []
      content {
        schedule = each.value.vm_start_schedule
      }
    }

    dynamic "vm_stop_schedule" {
      for_each = each.value.vm_stop_schedule != "" ? [1] : []
      content {
        schedule = each.value.vm_stop_schedule
      }
    }

    time_zone = each.value.time_zone
  }
}

Debug Output

`google_compute_instance.default["gmzucbs00"]: Creating...

Error: Error creating instance: googleapi: Error 412: Compute Engine System service account service-0123456789@compute-system.iam.gserviceaccount.com needs to have [compute.instances.start,compute.instances.stop] permissions applie
d in order to perform this operation., conditionNotMet

on main.tf line 1, in resource "google_compute_instance" "default":
1: resource "google_compute_instance" "default" {

ERRO[0014] Hit multiple errors:
Hit multiple errors:
exit status 1
`

Panic Output

Expected Behavior

Resource created with resource policy attached

Actual Behavior

Will only create resource if i comment the resource_policies parameter

Steps to Reproduce

1. create a project, disable the default compute engine service account
2. create a custom service account with roles iam.serviceAccountUser and compute.admin, also tried "owner" :| )
3. create a compute instance resource with service_account block and resource_policy block
   terraform apply

Important Factoids

References

• Add support for Instance schedules to Google compute resource policy GoogleCloudPlatform/magic-modules#4779
• Add resource_policy resource to compute GoogleCloudPlatform/magic-modules#1850
• Add support for Instance schedules to Google compute resource policy #9176

[edwardmedia]

@p4ranoidandro1d you were receiving below error. Can you add the listed permissions to the account and then try again?

Error: Error creating instance: googleapi: Error 412: Compute Engine System service account service-0123456789@compute-system.iam.gserviceaccount.com needs to have [compute.instances.start,compute.instances.stop] permissions applie
d in order to perform this operation., conditionNotMet

[keisari-ch]

Indeed, those are clearly not the same....
service-0123456789@compute-system.iam.gserviceaccount.com
0123456789-compute@developer.gserviceaccount.com

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.