GAE: Error creating StandardAppVersion: googleapi: Error 403: The caller does not have permission

[dmabuada]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request.
• Please do not leave +1 or me too comments, they generate extra noise for issue followers and do not help prioritize the request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.
• If an issue is assigned to the modular-magician user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If an issue is assigned to a user, that user is claiming responsibility for the issue. If an issue is assigned to hashibot, a community member has claimed the issue already.

Terraform Version

Terraform v1.1.8
on darwin_arm64

Affected Resource(s)

• google_app_engine_standard_app_version

Terraform Configuration Files

provider "google" {
  project     = var.PROJECT_ID
  region      = "us-central1"
  zone        = "us-central1-c"
}

data "archive_file" "source-zip" {
  type        = "zip"
  source_dir  = "./hello_world_engine_app"
  output_path = "hello-world/source.zip"
}

resource "google_storage_bucket" "bdg_terraform_test_bucket" {
  name  = "hello_world_app_engine_terraform_test_app"
  project = var.PROJECT_ID
  location = "US"
}

resource "google_storage_bucket_object" "state-zip" {
  depends_on  = [data.archive_file.source-zip, google_storage_bucket.bdg_terraform_test_bucket]
  name   = "appengine.${data.archive_file.source-zip.output_md5}.zip"
  bucket =  google_storage_bucket.bdg_terraform_test_bucket.name
  source = "hello-world/source.zip"
}
resource "google_app_engine_standard_app_version" "deployment" {
  depends_on = [google_storage_bucket_object.state-zip, google_storage_bucket.bdg_terraform_test_bucket]
  runtime    = "nodejs16"
  version_id = "v1"
  service    = "bdg-terraform-test-app"

  entrypoint {
    shell = "node ./app.js"
  }

  deployment {
    zip {
      source_url = "https://storage.googleapis.com/${google_storage_bucket.bdg_terraform_test_bucket.name}/${google_storage_bucket_object.state-zip.name}"
    }
  }
}

Debug Output

https://gist.github.com/dmabuada/5b2076cfbe4eb0796b23f3ce7f23db65

Panic Output

Expected Behavior

The google_app_engine_standard_app_version resource should have been created & deployed.

Actual Behavior

The resource was not created and an error was thrown:

Error: Error creating StandardAppVersion: googleapi: Error 403: The caller does not have permission
│ 
│   with google_app_engine_standard_app_version.deployment,
│   on main.tf line 25, in resource "google_app_engine_standard_app_version" "deployment":
│   25: resource "google_app_engine_standard_app_version" "deployment" {
│ 
╵

Steps to Reproduce

I'm using Application Default Credentials on my local workstation as I was instructed to do via the docs.

My user has all the correct permissions, as I'm able to deploy the app sans issues when using gcloud app deploy to deploy it instead. cat ~/.config/gcloud/application_default_credentials.json displays the correct credentials, too.

1. terraform apply

Important Factoids

I'm authenticating as a user instead of a service account, though, I also attempted to use a service account by setting it in the provider configuration, to no avail:

provider "google" {
  credentials = file("service_account.json")

  project = var.PROJECT_ID
  region  = "us-central1"
  zone    = "us-central1-c"
}

References

• #0000

[shuyama1]

Hi @dmabuada, thanks for filing the issue. Could you check if the var.PROJECT_ID used in the config is project id or project number. Based on the debug logs, it looks like that project number is used to make the call. Maybe try with project id instead and see if that will fix the problem.

[dmabuada]

That did the trick! Thanks so much. Is there reason why some resources accept Page number for creation while others only accept Page ID?

[shuyama1]

@dmabuada Glad it solved your problem!
I think that really depends on APIs. If I remember correctly, project id should work in nearly every case, while some APIs also accept project number. So I would suggest always use project id if possible.

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.