google-cloud-platform - 通过 deploymentmanager 创建 GCP 项目

Question

所以我正在尝试使用谷歌云部署管理器创建一个项目，我的设置大致如下:

# Structure
Org -> Folder1 -> Seed-Project(Location where I am running deployment manager from)

Organization:
  IAM:
    -> {Seed-Project-Number}@cloudservices.gserviceaccount.com:
        - Compute Network Admin
        - Compute Shared VPC Admin
        - Organisation Viewer
        - Project Creator

# DeploymentManager Resource:
type    cloudresourcemanager.v1.project
name    MyNewProject
parent  
  id: '{folder1-id}'
  type: folder
projectId: MyNewProject

期望的结果是应该在 Folder1 下创建 MyNewProject。然而;部署管理器服务帐户似乎没有足够的权限:

$ CLOUDSDK_CORE_PROJECT=Seed-Project gcloud deployment-manager deployments \
  create MyNewDeployment \
  --config config.yaml \
  --verbosity=debug

错误信息:

- code: RESOURCE_ERROR
  location: /deployments/MyNewDeployment/resources/MyNewProject
  message: '{"ResourceType":"cloudresourcemanager.v1.project",
             "ResourceErrorCode":"403","ResourceErrorMessage":{"code":403,"message":"The
    caller does not have permission","status":"PERMISSION_DENIED","statusMessage":"Forbidden","requestPath":"https://cloudresourcemanager.googleapis.com/v1/projects/MyNewProject","httpMethod":"GET"}}'

我做了一些挖掘，它似乎在调用 resourcemanager.projects.get 方法； 'Compute Shared VPC Admin (roles/compute.xpnAdmin)' 角色应该提供此权限，如下所述:https://cloud.google.com/iam/docs/understanding-roles

但似乎并非如此，这是怎么回事？

编辑

我想添加一些从调试工作中收集的额外信息:这些是来自部署管理器的 API 请求(来自种子项目)。

您可以看到调用者是一个匿名服务帐户，这不是 id 希望看到的。 (我希望在这里看到 {Seed-Project-Number}@cloudservices.gserviceaccount.com 作为调用帐户)

编辑-2

配置文件

imports:
  - path: composite_types/project/project.py
    name: project.py

resources:
  - name: MyNewProject
    type: project.py
    properties:
      parent:
        type: folder
        id: "{folder1-id}"
      billingAccountId: billingAccounts/REDACTED
      activateApis:
        - compute.googleapis.com
        - deploymentmanager.googleapis.com
        - pubsub.googleapis.com
      serviceAccounts: []

composite_types/project/* 是此处模板的精确副本:

https://github.com/GoogleCloudPlatform/deploymentmanager-samples/tree/master/community/cloud-foundation/templates/project

Answer 1

关键是这是一个 GET 操作，而不是尝试创建项目。这是为了验证请求的项目 ID 的全局唯一性，如果不唯一，则抛出 PERMISSION_DENIED。

糟糕的错误消息，浪费了很多开发人员的时间!