Pfthb

I'm creating an instance on GCP and am running into some issues using the service account stanza. When I do this:

service_account 
 email = "terraformdeploy-dev@projectxxx.org.com.iam.gserviceaccount.com"
 scopes = 

The instance does provision with that service account but all of the Cloud API access scopes show disabled in the UI.

If I do this:

service_account 
 email = "terraformdeploy-dev@projectxxx.org.com.iam.gserviceaccount.com"
 scopes = ["cloud-platform"]

the instance provisions with full access to all the APIs, but the weird thing is that the above service account doesn't have access to all of those API. I'm confused on how to use the service account stanza here as the documentation isn't very clear.

Can I just assign the service account or do I need to specify the service account and the scopes that it has?

GCE offers two methods to limit the API access that an instance can provide, and you're getting caught up on the two. One is that a GCE instance has a scope which limits ANY API requests from that machine to those services. For example if your GCE instance does not allow GCS Write operations, regardless of the service account associated with the instance you can not perform GCS write operations.

You could SSH in, authenticate with the Project Owner account, and try to write to GCS and it would fail. This is done to allow an extra layer of security, and is primarily useful if you know that 'Instances in this instance group will only ever need GCS Read, and StackDriver API access'.

Now the service account that is associated with the instance is only used when a client library or gcloud command looks up the credentials in the 'application default' location. So if your application includes a service account json key, and reads from it, it doesn't matter the associated key.

So the service account you specify makes all applications default to performing API requests using that accounts credentials.

Also do keep in mind there are much more refined scopes than just 'cloud-platform'.