Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support billing_project in google_project_service #7660

Closed
rileykarson opened this issue Oct 28, 2020 · 2 comments
Closed

Support billing_project in google_project_service #7660

rileykarson opened this issue Oct 28, 2020 · 2 comments

Comments

@rileykarson
Copy link
Collaborator

rileykarson commented Oct 28, 2020

billing_project is a configurable project used in user project overrides (eg https://registry.terraform.io/providers/hashicorp/google/latest/docs/guides/provider_reference#user_project_override)

It works automatically for generated resources, but doesn't work on handwritten resources where it's not manually added. We should support it here.

This is useful particularly for this resource because service activations rely on the actor (credentials) having the serviceusage.googleapis.com service enabled. This is always fine for a user account, but there's a bit of a bootstrapping problem for service accounts.

If I create project foo with my user credentials (or a privileged SA) and then create service account bar within that project, I can't later enable services inside the account because bar's project doesn't have serviceusage enabled. By setting a project override for that request, the override would be checked instead of the project of the service account. Currently-implemented, only the "direct" project (the project where the service is enabled) can be used as an override.

This may not work for all users- bar would required a permission on the billing_project. From https://registry.terraform.io/providers/hashicorp/google/latest/docs/guides/provider_reference:

When [user_project_override is] set to true, the caller must have serviceusage.services.use permission on the resource [/ billing] project.
@rileykarson
Copy link
Collaborator Author

Copy link

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.

@github-actions github-actions bot locked as resolved and limited conversation to collaborators Apr 30, 2024
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Projects
None yet
Development

No branches or pull requests

1 participant