Unable to add roles/iam.serviceAccountTokenCreator role to the default Pub/Sub service account

[anakovt]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request.
• Please do not leave +1 or me too comments, they generate extra noise for issue followers and do not help prioritize the request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.
• If an issue is assigned to the modular-magician user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If an issue is assigned to a user, that user is claiming responsibility for the issue. If an issue is assigned to hashibot, a community member has claimed the issue already.

Terraform Version

$ terraform -v
Terraform v0.12.20
+ provider.google v3.39.0
+ provider.google-beta v3.39.0
...

Affected Resource(s)

• google_project_iam_member

Terraform Configuration Files

resource "google_project_iam_member" "pubsub_sa_role" {
  project = var.project_id
  role = "roles/iam.ServiceAccountTokenCreator"
  member = "serviceAccount:service-${var.project_number}@gcp-sa-pubsub.iam.gserviceaccount.com"
}

Expected Behavior

Role roles/iam.serviceAccountTokenCreator should have been added to the default Pub/Sub service account to grand the permissions needed to create tokens for the service account.

Actual Behavior

Error: Request "Create IAM Members roles/iam.ServiceAccountTokenCreator serviceAccount:[email protected] for \"project \\\"my-project-123\\\"\"" returned error: Error applying IAM policy for project "my-project-1234": Error setting IAM policy for project "my-project-123": googleapi: Error 400: Role roles/iam.ServiceAccountTokenCreator is not supported for this resource., badRequest

Steps to Reproduce

1. terraform apply

[edwardmedia]

A dup #6833. Closing this

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 [email protected]. Thanks!