title: Permission Denied - GCP Cloud Resource Manager setIamPolicy
body: <p>I am getting a 403 PERMISSION_DENIED response from GCP when running the deployment manager to create a deployment that creates a service account and sets IAM policy for it using the cloud resource manager API. Here is the setIamPolicy template for this:</p>
  
  <pre><code>{
          'resources': [
              {
                  'name': context.env['name'],
                  'action': 'gcp-types/cloudresourcemanager-v1:cloudresourcemanager.projects.setIamPolicy',
                  'properties': {
                      'resource': context.properties['resource'],
                      'policy': {
                          'bindings': context.properties['bindings']
                      }
                  }
              }
          ]
      }
  </code></pre>
  
  <p>Response from GCP:</p>
  
  <p>'{"ResourceType":"gcp-types/cloudresourcemanager-v1:cloudresourcemanager.projects.setIamPolicy","ResourceErrorCode":"403","ResourceErrorMessage":{"code":403,"message":"The
      caller does not have permission","status":"PERMISSION_DENIED","statusMessage":"Forbidden","requestPath":"<a href="https://cloudresourcemanager.googleapis.com/v1/projects/project-name@project-name.iam.gserviceaccount.com:setIamPolicy" rel="nofollow noreferrer">https://cloudresourcemanager.googleapis.com/v1/projects/project-name@project-name.iam.gserviceaccount.com:setIamPolicy</a>","httpMethod":"POST"}}'</p>
  
  <p>FYI: The robot account (12345@cloudservices.gserviceaccount.com) is given project owner permissions in IAM. </p>