Google Cloud Platform Service Account is Unable to Access Project - google-cloud-platform

Question

I encounter the following warning:
WARNING: You do not appear to have access to project [$PROJECT] or it does not exist.
after running the following commands locally:
Activate and set a service account:
gcloud auth activate-service-account \
$SERVICE_ACCOUNT \
--key-file=key.json
#=>
Activated service account credentials for: [$SERVICE_ACCOUNT]
Select $PROJECT as the above service account:
gcloud config set project $PROJECT
#=>
Updated property [core/project].
WARNING: You do not appear to have access to project [$PROJECT] or it does not exist.
My own GCP account is associated with the following roles:
App Engine Admin
Cloud Build Editor
Cloud Scheduler Admin
Storage Object Creator
Storage Object Viewer
Why is this service account unable to set $PROJECT? Is there a role or permission I am missing?

Answer 1

The solution to this issue might be to enable the Cloud Resource Manager API in your Google Cloud Console here by clicking enable.

Answer 2

I believe this is an erroneous warning message. I see the same warning message on my service account despite the fact that the account has permissions on my GCP project and can successfully perform necessary actions.
You might be seeing this error due to an unrelated problem. In my case, I was trying to deploy to AppEngine from a continuous integration environment (Circle CI), but I hadn't enabled the App Engine Admin API. Once I enabled the API, I was able to deploy successfully.

Answer 3

I encountered this error when I started out with Google CLoud Platform.
The issue was that I configured/set a non-existing project (my-kube-project)
as my default project using the command below:
gcloud config set project my-kube-project
Here's how I solved it:
I had to list my existing projects first:
gcloud projects list
And then I copied the ID of the project that I wanted, and rannthe command again this time:
gcloud config set project gold-magpie-258213
And it worked fine.
Note: You cannot change the ID of a project's ID or Number,you can only change the Name.
That's all.
I hope this helps

Answer 4

I was encountering the same error when trying to deploy an app to Google App Engine via a service account configured in CircleCI and resolved it by having the following roles (permissions) attached to my service role:
App Engine Deployer
App Engine Service Admin
Cloud Build Editor
Storage Object Creator
Storage Object Viewer
I also had the App Engine Admin API enabled, but not the Cloud Resource Manager API.

Answer 5

The
WARNING: You do not appear to have access to project [$PROJECT_ID] or it does not exist.
warning will appear if there isn't at least one role granted to the service account that contains the resourcemanager.projects.get permission.
In other words, the warning will appear if the result of the following commands is blank:
Gather all roles for a given $SERVICE_ACCOUNT (this works for any account, not just service accounts):
gcloud projects get-iam-policy $PROJECT_ID \
--flatten='bindings[].members' \
--format='table(bindings.role)' \
--filter="bindings.members:${SERVICE_ACCOUNT}"
#=>
ROLE
. . .
For each $ROLE gathered above, either:
gcloud iam roles describe $ROLE \
--flatten='includedPermissions' \
--format='value(includedPermissions)' \
--project=$PROJECT_ID | grep \
--regexp '^resourcemanager.projects.get$'
if the $ROLE is a custom (projects/$PROJECT_ID/roles/$ROLE), or:
gcloud iam roles describe roles/$ROLE \
--flatten='includedPermissions' \
--format='value(includedPermissions)' | grep \
--regexp '^resourcemanager.projects.get$'
if the $ROLE is a curated (roles/$ROLE).
Note: the difference between gcloud command formatting for custom and curated roles is what makes listing all permissions associated with all roles associated with a single account difficult.
If you have confirmed that none of the roles associated with a service account contain the resourcemanager.projects.get permission, then either:
Update at least one of the custom roles associated with the service account with the resourcemanager.projects.get permission:
gcloud iam roles update $ROLE \
--add-permissions=resourcemanager.projects.get \
--project=$PROJECT_ID
#=>
description: $ROLE_DESCRIPTION
etag: . . .
includedPermissions:
. . .
- resourcemanager.projects.get
. . .
name: projects/$PROJECT_ID/roles/$ROLE
stage: . . .
title: $ROLE_TITLE
Warning: make sure to use the --add-permissions flag here when updating, as the --permissions flag will remove any other permissions the custom role used to have.
Create a custom role:
gcloud iam roles create $ROLE \
--description="$ROLE_DESCRIPTION" \
--permissions=resourcemanager.projects.get \
--project=$PROJECT_ID \
--title='$ROLE_TITLE'
#=>
Created role [$ROLE].
description: $ROLE_DESCRIPTION
etag: . . .
includedPermissions:
- resourcemanager.projects.get
name: projects/$PROJECT_ID/roles/$ROLE
stage: . . .
title: $ROLE_TITLE
and associate it with the service account:
gcloud projects add-iam-policy-binding $PROJECT_ID \
--member=serviceAccount:$SERVICE_ACCOUNT \
--role=projects/$PROJECT_ID/roles/$ROLE
#=>
Updated IAM policy for project [$PROJECT_ID].
auditConfigs:
. . .
Associate the service account with a curated role that already contains the resourcemanager.projects.get permission, which has been discussed above.
If you want to know which curated roles already contain the resourcemanager.projects.get permission and don't want to craft a complex shell loop, it might be easier to go here and filter all roles by Permission:resourcemanager.projects.get.
Note: if you are running into issues, be sure to read the requirements for granting access to resources here.