ResMan, tenant folders and project factory: IAM denied in PF to create projects under tenant folder

[joe-flumen]

Hi,

This is similar to top-level-folder IAM permissions issue, but for simple tenant.

I want to use project-factory for simple tenants, to create project testproj under tenant simple tenant.

I got permission denied error, because service account tstcld-dev-resman-pf-0@tstcld-prod-iac-core-0.iam.gserviceaccount.com doesn't have any permissions for the tenant folder.

│ Error: error creating project tstcld-dev-backend-proj (tstcld-dev-backend-proj): googleapi: Error 403: The caller does not have permission, forbidden. If you received a 403 error, make sure you have the `roles/resourcemanager.projectCreator` permission
│ 
│   with module.projects.module.projects["testproj"].google_project.project[0],
│   on ../../../../modules/project/main.tf line 44, in resource "google_project" "project":
│   44: resource "google_project" "project" {

• Is there a way to give organization project factory service account permission to tenant using 1-tenant-factory step?
• Is it recommended to use organization service accounts to create project under tenants or I should use the tenant service account?

[wiktorn]

How did you create tstcld-dev-resman-pf-0 service account? You can ensure that while creating this service account.

One way of doing that, is deploying into "Simple" tenant extremely trimmed down resman stage, which only creates said service account. But if the "simple" tenant is meant only as project factory, it may be viable just to reuse tenant-<tenant-short-name>-0 to act as a identity that is executing the project factory