所以我试图用谷歌云部署管理器创建一个项目，我将设置大致如下：
# Structure
Org -> Folder1 -> Seed-Project(Location where I am running deployment manager from)
Organization:
IAM:
-> {Seed-Project-Number}@cloudservices.gserviceaccount.com:
- Compute Network Admin
- Compute Shared VPC Admin
- Organisation Viewer
- Project Creator
# DeploymentManager Resource:
type cloudresourcemanager.v1.project
name MyNewProject
parent
id: '{folder1-id}'
type: folder
projectId: MyNewProject
期望的结果是 MyNewProject 应该在 Folder1 下创建。然而; 似乎部署管理器服务帐户没有足够的权限：
$ CLOUDSDK_CORE_PROJECT=Seed-Project gcloud deployment-manager deployments \
create MyNewDeployment \
--config config.yaml \
--verbosity=debug
错误信息：</p>
- code: RESOURCE_ERROR
location: /deployments/MyNewDeployment/resources/MyNewProject
message: '{"ResourceType":"cloudresourcemanager.v1.project",
"ResourceErrorCode":"403","ResourceErrorMessage":{"code":403,"message":"The
caller does not have permission","status":"PERMISSION_DENIED","statusMessage":"Forbidden","requestPath":"https://cloudresourcemanager.googleapis.com/v1/projects/MyNewProject","httpMethod":"GET"}}'
我做了一些挖掘，它似乎正在调用resourcemanager.projects.get 方法；“计算共享 VPC 管理员 (roles/compute.xpnAdmin)”角色应提供此权限，如此处所述：https ://cloud.google.com/iam/docs/understanding-roles
除了似乎不是这样，发生了什么？
编辑
我想添加一些从调试工作中收集的额外信息：这些是来自部署管理器的 API 请求（来自种子项目）。
您可以看到调用者是一个匿名服务帐户，这不是 id 期望看到的。（我希望在这里看到 {Seed-Project-Number}@cloudservices.gserviceaccount.com 作为调用帐户）
编辑-2
配置.yaml
imports:
- path: composite_types/project/project.py
name: project.py
resources:
- name: MyNewProject
type: project.py
properties:
parent:
type: folder
id: "{folder1-id}"
billingAccountId: billingAccounts/REDACTED
activateApis:
- compute.googleapis.com
- deploymentmanager.googleapis.com
- pubsub.googleapis.com
serviceAccounts: []
Composite_types/project/* 是此处找到的模板的精确副本：