Error: googleapi: Error 403: (65dfaf1943a29d07): Current user cannot act as service account

yc2984 · May 5, 2022, 9:07pm

Hi, I have the exact same issue as described here, however the issue has been closed. Anyone has idea on how to resolve it?

github.com/hashicorp/terraform-provider-google

google_dataflow_job: current user cannot act as service account error

opened 12:17PM - 27 Aug 20 UTC

closed 04:44PM - 23 Sep 20 UTC

medzin

bug waiting-response

### Community Note * Please vote on this issue by adding a 👍 [reaction](https…://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request. * Please do not leave _+1_ or _me too_ comments, they generate extra noise for issue followers and do not help prioritize the request. * If you are interested in working on this issue or have submitted a pull request, please leave a comment. * If an issue is assigned to the `modular-magician` user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If an issue is assigned to a user, that user is claiming responsibility for the issue. If an issue is assigned to `hashibot`, a community member has claimed the issue already. ### Terraform Version ``` Terraform v0.12.29 + provider.external v1.2.0 + provider.google v3.36.0 + provider.google-beta v3.36.0 + provider.kubernetes v1.12.0 + provider.local v1.4.0 ``` ### Affected Resource(s) * `google_dataflow_job` ### Terraform Configuration Files ```tf resource "google_dataflow_job" "XXX" { name = "XXX" template_gcs_path = "XXX" temp_gcs_location = "XXX" region = "europe-west3" zone = "europe-west3-a" subnetwork = "XXX" network = "staging" max_workers = "1" service_account_email = "serviceAccount:${var.dataflow_pubsub_to_bq_service_account.email}" parameters = { inputTopic = "XXX" outputTableSpec = "XXX" } } ``` ### Expected Behavior The definition should create a dataflow job. ### Actual Behavior I get the following error: ``` Error: googleapi: Error 400: (c60e031d12c3026c): Current user cannot act as service account serviceAccount:XXX ``` ### Important Factoids * I'm authenticating as a user with organization `roles/owner` and `roles/iam.serviceAccountUser` roles * I'm using credentials generated by `gcloud auth application-default login`

pango07 · May 11, 2022, 3:58am

Hey yc,

Can you post your tf configuration?

Thanks