PERMISSION_DENIED policy auth_error ai_generated true

Permission 'compute.instances.create' denied on resource 'projects/my-project' (or it may not exist).

ID: policy/gcp-iam-role-denied-at-org-level

Also available as: JSON · Markdown · 中文
85%Fix Rate
88%Confidence
1Evidence
2023-03-10First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
Google Cloud IAM v1 active — — —
Google Compute Engine API v1 active — — —

Root Cause

The IAM policy at the organization, folder, or project level denies the 'compute.instances.create' permission for the caller, or the caller's role does not include this permission.

generic

中文

组织、文件夹或项目级别的IAM策略拒绝调用者的'compute.instances.create'权限，或者调用者的角色不包括此权限。

Official Documentation

https://cloud.google.com/iam/docs/understanding-roles

Workarounds

  1. 85% success Grant the required role to the caller at the project level using gcloud: `gcloud projects add-iam-policy-binding my-project --member='user:[email protected]' --role='roles/compute.instanceAdmin.v1'`. Verify with `gcloud projects get-iam-policy my-project`. 
    Grant the required role to the caller at the project level using gcloud: `gcloud projects add-iam-policy-binding my-project --member='user:[email protected]' --role='roles/compute.instanceAdmin.v1'`. Verify with `gcloud projects get-iam-policy my-project`.
  2. 70% success Check organization-level policies by running `gcloud organizations get-iam-policy ORGANIZATION_ID` to see if there is a deny rule. If so, request the organization admin to remove the deny or grant an exception. 
    Check organization-level policies by running `gcloud organizations get-iam-policy ORGANIZATION_ID` to see if there is a deny rule. If so, request the organization admin to remove the deny or grant an exception.
  3. 75% success Create a custom role with the specific permission and assign it to the caller: `gcloud iam roles create customComputeAdmin --project=my-project --permissions=compute.instances.create` then bind it. 
    Create a custom role with the specific permission and assign it to the caller: `gcloud iam roles create customComputeAdmin --project=my-project --permissions=compute.instances.create` then bind it.

中文步骤

  1. Grant the required role to the caller at the project level using gcloud: `gcloud projects add-iam-policy-binding my-project --member='user:[email protected]' --role='roles/compute.instanceAdmin.v1'`. Verify with `gcloud projects get-iam-policy my-project`.
  2. Check organization-level policies by running `gcloud organizations get-iam-policy ORGANIZATION_ID` to see if there is a deny rule. If so, request the organization admin to remove the deny or grant an exception.
  3. Create a custom role with the specific permission and assign it to the caller: `gcloud iam roles create customComputeAdmin --project=my-project --permissions=compute.instances.create` then bind it.

Dead Ends

Common approaches that don't work:

  1. 90% fail

    Re-authentication does not change the IAM policy; the permission is still denied.

  2. 70% fail

    Permissions can be inherited from higher levels (organization, folder); denying at those levels overrides project-level grants.

  3. 85% fail

    The underlying permission is the same; the error will persist.