Service account permissions error when provisioning instance group from template
Try adding permissions on your project level:

gcloud projects add-iam-policy-binding &lt;your-project-id&gt; --member=serviceAccount:terraform@vpc-challenge-lab-245114.iam.gserviceaccount.com --role='roles/iam.serviceAccountUser'