CODEWITHSUNDEEP
google-cloud-platformgoogle-cloud-storageauthorizationgoogle-iamrole-base-authorization
Nick Charney Kaye
Nick Charney Kaye

Reputation: 4431

Can't add Storage Admin role to GCP service account

I am looking at the IAM Service Accounts tab in the GCP control panel. I am editing a Service Account. I click "Grant Access," enter the email of the service account I am creating and attempt to add Storage Admin.

IAM Service Accounts tab

However, there is no such option in the list.

Cannot find 'Storage Admin' in list

Also, a seemingly equivalent attempt to do this via the CLI fails:

gcloud projects add-iam-policy-binding my-project-id \
  --member='serviceAccount:[email protected]' \
  --role='projects/my-project-id/roles/storage.admin'

ERROR: Policy modification failed. For a binding with condition, run "gcloud alpha iam policies lint-condition" to identify issues in condition.
ERROR: (gcloud.projects.add-iam-policy-binding) INVALID_ARGUMENT: Role (projects/my-project-id/roles/storage.admin) does not exist in the resource's hierarchy.

Clearly, I am failing to understand something about how a service account is supposed to get granted a role.

Upvotes: 1

Views: 4010

Answers (2)

John Hanley
John Hanley

Reputation: 81464

It is not clear what you are doing. Two important concepts. A service account can be both an identity and a resource. You are managing the service account as a resource in the screenshot. Your CLI command is managing the resource as an identity-granted role within a project.

Your CLI command specifies a custom role in the project. Did you create a custom role or are you trying to use an existing Google Cloud IAM role?

Most likely you want to do this:

gcloud projects add-iam-policy-binding my-project-id \
  --member='serviceAccount:[email protected]' \
  --role='roles/storage.admin'

Notice the difference in how the Role Name is specified.

Upvotes: 2

JaysonM
JaysonM

Reputation: 656

Once you already created the service account you can go to IAM Page to add the Storage Admin Role.

  1. Go to IAM Page
  2. Click Add
  3. Enter New Principals (Enter Service Account you created)
  4. Select Desired Role. (In your Case Storage Admin).
  5. Save

In case you still want to add role using Creating Service Account Pane, Don't search with Storage instead scroll down to All Roles > Hover Cloud Storage > Select Storage Admin.

You can also do what John Hanley mentioned using the Cloud Shell.

Upvotes: 10

Related Questions