1

I have created a GCP service account with org viewer permissions (I assume therefore having read rights in all projects)

▶ gcloud organizations get-iam-policy 83838383838383 --flatten="bindings[].members" --format='table(bindings.role)' --filter="bindings.members:[email protected]"
ROLE
roles/resourcemanager.organizationViewer

I then activate this locally

▶ gcloud auth activate-service-account [email protected] --key-file=keyfile.json
Activated service account credentials for: [[email protected]]

and then try to perform a compute disk list (on the same project the SA was created)

▶ gcloud compute disks list
ERROR: (gcloud.compute.disks.list) Some requests did not succeed:
 - Required 'compute.disks.list' permission for 'projects/my-project-id'

Why is that?

3
  • Add project viewer role to see the resources of the project Commented Jun 16, 2021 at 7:34
  • I did that and to my surprise it gave project viewer to all projects under the same org
    – pkaramol
    Commented Jun 16, 2021 at 9:57
  • If you set project viewer at the org level, yes, you have project viewer role in all project of the org, by inheritance. Commented Jun 16, 2021 at 10:34

1 Answer 1

3

The error messages states that the service account does not have the permission compute.disks.list.

What permissions does the role roles/resourcemanager.organizationViewer have?

gcloud iam roles describe roles/resourcemanager.organizationViewer --format=json

Notice that the role only has one permission resourcemanager.organizations.get

{
  "description": "Access only to view an Organization.",
  "etag": "AA==",
  "includedPermissions": [
    "resourcemanager.organizations.get"
  ],
  "name": "roles/resourcemanager.organizationViewer",
  "stage": "GA",
  "title": "Organization Viewer"
}

That permssions allows viewing the organization details, but not the resources of the organization.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.