missing permission on "billingAccounts/XXXXXXXXXXXXXXXXXXXXXXXX": billing.resourceAssociations.create Terraform (GCP)

Question

I tried to automate the Shared VPC creation on GCP by using Terraform. I have enabled all the access to my service account (Org Admin, XpnAdmin, Storage Admin, Compute admin, Billing Admin)

But when i executed terraform apply it's throwing me following error:

missing permission on "billingAccounts/CXXXXXXXXXXXXXXXXXX": billing.resourceAssociations.create

I'm referring the Google provider Github code for this demo.

Acidimetry

Billing Account Administrator has the required permissions. This means that the service account that you are using with Terraform does not have the role roles/billing.admin. – Mojgan

I've run into the same issue and I have Billing Admin permissions. – Navarra

Hey @john Hanley Thanks for your comment, Yup after i gave a billing admin access issue got resoled. Thanks a lot. May God Bless You:) – Acidimetry

Answer 1

It's quite likely you have the billing admin, but you also need the ability to create billing assignments, or "Billing Project Manager".

https://cloud.google.com/billing/v1/how-tos/access-control

billing.resourceAssociations.create AND resourcemanager.projects.createBillingAssignment on the Cloud Billing account.

There's some handy code to bootstrap a service account - Google Project Factory - You might want to have a look at that. Once that SA is created you shouldn't have permissions issues

Hoarfrost

Thanks for your answer, now i resolved this issue by enabling the billing admin access to my SA. May God Bless You :) – Acidimetry

@Ravi k I've the same error, could you please explain how did you solve this issue? How should I enableing the billing admin to my already exists SA? – Irremissible

Answer 2

I was getting same error even my "Service Account" had the necessary "Organization" level permissions. Then I figured out, I need to give permission from "Billing Account". It worked.

I was following this tutorial to create projects via "Service Account" and "Terraform", but still was getting error. After some research, I followed this how-to and gave permission from "Billing Account".

Project, Organization and Billing are 3 separate components for permissions. Giving "Organization" level is not enough. The permission should be given from "Billing Account" as well.

Glabrescent

Answer 3

I faced the same problem and consumed about 3 hours.

As a result, I found that we needed to set up the role on the Billing account side.

As shown in the picture below, you need to grant the Billing role to the *** service account*** where Cloud Billing will run.

Cleocleobulus

Answer 4

I faced the same issue. You can now assign the role to an identity with this gcloud CLI command (as of the time of writing is still on alpha):

gcloud alpha billing accounts add-iam-policy-binding 123456-ABCDEF-123ABD \
  --member "serviceAccount:[e-mail]" \
  --role="roles/billing.user"

https://cloud.google.com/sdk/gcloud/reference/alpha/billing/accounts/add-iam-policy-binding

Venita

Answer 5

This error generally comes when you are logged into to machine/laptop and set default credentials to run terraform. Thereafter you got a new account or have been asked to use new account and you are authenticating using gcloud auth login / or gcloud auth application-default login. This will still use the previous account billing account. It is recommended to use Google CloudShell to run terraform script first time.

Depressed

Answer 6

I was getting this error when I had an old (deleted) billing account Id in my Terraform config.

<facePalm>Doh!</facePalm>

Urquhart