Service account permissions error when provisioning instance group from template I'm trying to create a GCE Instance Group Manager using terraform

resource "google_compute_region_instance_group_manager" "frontend_group_manager" {
  name = "frontend-igm"

  base_instance_name = "frontend"
  instance_template  = "${google_compute_instance_template.frontend_instance_template.self_link}"
  region             = "${var.region}"

  depends_on = [ "google_compute_instance_template.frontend_instance_template" ]
}


When I try I get the following error:


  Error: Error waiting for Creating InstanceGroupManager: The user does not have access to service account 'One of [serviceAccount:frontend@vpc-challenge-lab-245114.iam.gserviceaccount.com]'.  User: 'terraform@vpc-challenge-lab-245114.iam.gserviceaccount.com'.  Ask a project owner to grant you the iam.serviceAccountUser role on the service account


When I validate the IAM policy on the account it appears to be configured correctly:

&gt; gcloud iam service-accounts get-iam-policy frontend@vpc-challenge-lab-245114.iam.gserviceaccount.com
bindings:
- members:
  - serviceAccount:terraform@vpc-challenge-lab-245114.iam.gserviceaccount.com
  role: roles/iam.serviceAccountUser
etag: BwWMpQvtA3w=
version: 1                                        


The template is configured as follows:

resource "google_compute_instance_template" "frontend_instance_template" {
  name = "frontend-template"

  instance_description = "Frontend Instances"
  machine_type         = "f1-micro"
  can_ip_forward       = false

  scheduling {
    automatic_restart   = true
    on_host_maintenance = "MIGRATE"
  }

  disk {
    source_image = "${data.google_compute_image.compute_image.self_link}"
    auto_delete  = true
    boot         = true
  }

  network_interface {
    network = "${google_compute_network.frontend_network.name}"
  }

  service_account {
    email  = "serviceAccount:${google_service_account.frontend_service_account.email}"
    scopes = ["default"]
  }

  depends_on = [
    "google_compute_network.frontend_network",
    "google_service_account_iam_member.frontend_service_account_permission",
    "google_project_iam_member.frontend_service_account_role_binding"
  ]
}


And the Service Account is configured as follows:

resource "google_service_account" "frontend_service_account" {
  account_id   = "frontend"
  display_name = "Frontend Service"
}

resource "google_service_account_iam_member" "frontend_service_account_permission" {
  service_account_id = "${google_service_account.frontend_service_account.name}"
  role               = "roles/iam.serviceAccountUser"
  member             = "serviceAccount:${data.google_service_account.terraform.email}"

  depends_on = ["google_service_account.frontend_service_account"]
}

resource "google_project_iam_member" "frontend_service_account_role_binding" {
  role   = "projects/${data.google_project.project.project_id}/roles/${google_project_iam_custom_role.base_compute_role.role_id}"
  member = "serviceAccount:${google_service_account.frontend_service_account.email}"

  depends_on = [
    "data.google_project.project",
    "google_project_iam_custom_role.base_compute_role",
    "google_service_account.frontend_service_account"
  ]
}


Finally, the custom role is as follows:

resource "google_project_iam_custom_role" "base_compute_role" {
  role_id = "base_compute_role"
  title   = "Base Compute Role"
  permissions = [
    "logging.logEntries.create",
    "monitoring.metricDescriptors.create",
    "monitoring.metricDescriptors.get",
    "monitoring.metricDescriptors.list",
    "monitoring.monitoredResourceDescriptors.get",
    "monitoring.monitoredResourceDescriptors.list",
    "monitoring.timeSeries.create"
  ]

  depends_on = ["google_project_service.iam"]
}


Why when everything appears to be in place does that error keep getting thrown by the GCE API.
Try adding permissions on your project level:

gcloud projects add-iam-policy-binding &lt;your-project-id&gt; --member=serviceAccount:terraform@vpc-challenge-lab-245114.iam.gserviceaccount.com --role='roles/iam.serviceAccountUser'