iam.serviceAccounts.getIamPolicy is required to perform this operation on service account

Question

From: https://cloud.google.com/iam/docs/granting-roles-to-service-accounts

running this command:

gcloud iam service-accounts get-iam-policy \
    mysa@my-project.iam.gserviceaccount.com

I get:

gcloud iam service-accounts get-iam-policy mysa@my-project.iam.gserviceaccount.com
ERROR: (gcloud.iam.service-accounts.get-iam-policy) PERMISSION_DENIED: Permission iam.serviceAccounts.getIamPolicy is required to perform this operation on service account projects/-/serviceAccounts/mysa@my-project.iam.gserviceaccount.com

But I do have iam.serviceAccounts.getIamPolicy permission on the current user(role Owner)?

Are you specifying the **Service Account** (listed in your project) correctly? [Link](https://console.cloud.google.com/iam-admin/serviceaccounts?project=) — Deniss T., Jan 07 '20 at 11:51
Try running the `gcloud auth list` command. Is the active account set the correct one (the one that has the Owner role)? — Deniss T., Jan 07 '20 at 13:05
Yes the current user is "Owner", already did that - good suggestion. — Chris G., Jan 07 '20 at 13:07
It's strange as it should be sufficient to get the policy with that command. The only time I was able to get exactly the same error is when the service account I specified was wrong (e.g. **not a [service account](https://console.cloud.google.com/iam-admin/serviceaccounts?project=)** or had a **typo** in it). — Deniss T., Jan 07 '20 at 13:12
I will investigate if something else is causing this error and will inform you. — Deniss T., Jan 07 '20 at 13:13
Just found it, see my answer. Thanks again, if you want to describe / give a better answer I will accept it. — Chris G., Jan 07 '20 at 13:36

score 1 · Answer 1 · answered Jan 07 '20 at 13:32

1

The problem was with the email member(Service Account email) to the project - in IAM users.

When I deleted this (SA member) in IAM, it worked giving "etag: ACAB" as a result.

I Need to figure out what that is, but it worked. Just found this

This account, should maybe have been deleted automatically when deleting a Service Account - but what do I know :-)

answered Jan 07 '20 at 13:32

Chris G.

23,930
48
177
302

1

`etag: ACAB` means that you have not assigned a role to the service account yet - [link](https://cloud.google.com/iam/docs/granting-roles-to-service-accounts#viewing-roles) – Deniss T. Jan 07 '20 at 14:20
@DenisT. - That is not correct. The `ACAB` is a token that is used to track updates and does not represent an empty service account role list. When you modify the roles, the tag will change. If you try to update the roles with an incorrect tag, the request will fail. – John Hanley Jan 07 '20 at 14:50
Thanks, John. That's right, the output will show only an `etag` value if you haven't assigned a role to the service account. – Deniss T. Jan 07 '20 at 15:01

iam.serviceAccounts.getIamPolicy is required to perform this operation on service account

1 Answers1