title: How to resolve "googleapi: Error 403: The caller does not have permission, forbidden"
body: <p>I am using terraform to build infra in GCP. I am trying to assign roles to a <code>service account</code> using terraform but unable to do so. Below is my code:</p>
  <p>sa.tf:</p>
  <pre><code>resource &quot;google_service_account&quot; &quot;mojo-terra&quot; {
    account_id   = &quot;mojo-terra&quot;
    description  = &quot;Service account used for terraform script&quot;
  }
  
  resource &quot;google_project_iam_member&quot; &quot;mojo-roles&quot; {
    count = length(var.rolesList)
    role =  var.rolesList[count.index]
    member = &quot;serviceAccount:${google_service_account.mojo-terra.email}&quot;
  }
  </code></pre>
  <p>dev.tfvars:</p>
  <pre><code>rolesList = [
      &quot;roles/iam.serviceAccountUser&quot;
  ]
  </code></pre>
  <p>cloudbuild logs:</p>
  <pre><code>Step #2: Error: Error when reading or editing Resource &quot;project \&quot;poc-dev\&quot;&quot; with IAM Policy: Error retrieving IAM policy for project &quot;poc-dev&quot;: googleapi: Error 403: The caller does not have permission, forbidden
  Step #2: 
  Step #2: 
  Step #2: 
  Step #2: Error: Error when reading or editing Resource &quot;project \&quot;poc-dev\&quot;&quot; with IAM Member: Role &quot;roles/iam.serviceAccountUser&quot; Member &quot;serviceAccount:asadsfs@poc-dev-1221.iam.gserviceaccount.com&quot;: Error retrieving IAM policy for project &quot;poc-dev&quot;: googleapi: Error 403: The caller does not have permission, forbidden
  Step #2: 
  </code></pre>
  <p>Below are the roles attached to my <code>cloudbuild service account</code>:
  <code>Custom Role cloudbuild, Cloud Build Service Account, Service Account Admin, Create Service Accounts, Delete Service Accounts, Service Account User, Storage Admin</code></p>