1

我正在尝试使用https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/workflows_workflow terraform 资源部署工作流，但失败并出现错误：

Error: Error creating Workflow: googleapi: Error 400: request contains errors
Details:
[
  {
    "@type": "type.googleapis.com/google.rpc.BadRequest",
    "fieldViolations": [
      {
        "description": "The referenced service account is not user-managed, please verify the correctness of the service account name",
        "field": "workflow.service_account"
      }
    ]
  }
]

我可以从运行terraform plan中看到这是我的工作流程的定义：

  + resource "google_workflows_workflow" "my_first_workflow" {
      + create_time     = (known after apply)
      + description     = "Magic"
      + id              = (known after apply)
      + name            = "myworkflow"
      + name_prefix     = (known after apply)
      + project         = "myproject"
      + region          = "europe-west4"
      + revision_id     = (known after apply)
      + service_account = "projects/myproject/serviceAccounts/service-account"
      + source_contents = <<-EOT

              - postCallBigqueryStoredProcedure:
                  call: http.post
                  args:
                      url: https://bigquery.googleapis.com/bigquery/v2/projects/myproject/jobs
                      body: {
                                "configuration": {
                                    "query": {
                                    "query": "call mydataset.mystoredprocedure()"
                                    }
                                }
                            }
        EOT
      + state           = (known after apply)
      + update_time     = (known after apply)
    }

错误消息抱怨服务帐户，但是我确定此处命名的服务帐户：projects/myproject/serviceAccounts/service-account是有效的并且存在，所以我不知道为什么会收到此错误。谷歌搜索错误消息并没有发现任何有用的信息。

有谁知道可能是什么问题？

4

1 回答 1

2

您提到服务帐户有效并且存在。当您引用它时，您是否包括完整的帐户名称，包括“@”之后的详细信息，即。7**********-compute@developer.gserviceaccount.com?

通过使用不正确的名称或没有完整电子邮件地址的服务帐户名称，我能够复制此行为。

您必须使用服务帐户的完整电子邮件地址。这是正确格式的示例。我目前正在使用 Terraform v0.14.7：

service_account = "projects/project_id/serviceAccounts/7**********-compute@developer.gserviceaccount.com"
于 2021-04-13T00:42:45.623 回答