1

My service account has the following roles:

  • App Engine Admin
  • App Engine Creator
  • Cloud Datastore Owner
  • Editor
  • Owner

I am trying to create the database through Terraform with the following configuration:

resource "google_app_engine_application" "app" {
  project     = var.project_id #"my-project-id-xxxxx"
  location_id = var.region # "us-central1"
  database_type = "CLOUD_FIRESTORE"
}

Unfortunately it throws an error:

│ Error: Error creating App Engine application: googleapi: Error 403: The caller does not have permission, forbidden
│
│   with google_app_engine_application.app,
│   on main.tf line 28, in resource "google_app_engine_application" "app":
│   28: resource "google_app_engine_application" "app" {

I am using my personal GCP account, it's not managed by any organization. I have no problem with other resources in Terraform (like cloud functions, gateway api and etc) What have I missed?

0

1 Answer 1

1

For creating a Cloud Firestore DB, you must own the project. You need to have an App Engine Owner Role on the project to make it work.

If you are using the primitive roles refer to official GCP documentation on Roles that Grant Access to App Engine(Primitive Roles) :

Owner:Role

Google Cloud console permissions: Required to create App Engine applications. All viewer and editor privileges, plus the ability to view deployed source code, invite users, change user roles, and delete an application. Has admin privileges to all project resources.

Tools permissions: Required to create App Engine applications. Can also deploy application code and update all configurations.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.