-1

want to create infra in GCP using terraform whenever any new project create in ORG. I want to create only one Service Account and using that SA want to create infra for any future projects as well, I want to automate it using bitbucket pipeline.

Tried to resolve this by giving the org admin access to SA but its not working.

Is there any way for this ?

John Hanley
  • 74,467
  • 6
  • 95
  • 159

2 Answers2

0

The Organization Administrator can do a lot of things but related to the administering the organization and not necessarily to manage resources like projects, VMs, etc.

For example, if you want the SA to be able to create projects you need the Project Creator role. Of course you want to add the necessary roles depending on what resources you want to manage.

In addition, I don't recommend to use the "All Mighty" Owner to manage your resources; instead use just the necessary ones (Read Least privilege)

I'd suggest to first read the documentation and understand the purpose of every GCP role.

Puteri
  • 3,348
  • 4
  • 12
  • 27
0

How to Authorised all projects in GCP with single GCP SA for terraform

That is not possible. Each time a new project is created IAM bindings must be added to the project for the service account. Service accounts do not inherit rights.

John Hanley
  • 74,467
  • 6
  • 95
  • 159