由於缺少 storage.buckets.get 訪問權限，用於創建儲存桶的 GCP 部署失敗

我想使用部署管理器以程式方式創建雲儲存桶，但部署失敗並出現以下錯誤：

ERROR: (gcloud.deployment-manager.deployments.create) Error in Operation [operation-1626165906845-5c6fd413930ca-1a833b6c-81671664]: errors:
- code: RESOURCE_ERROR
 location: /deployments/example-config/resources/storage-bucket
 message: '{"ResourceType":"storage.v1.bucket","ResourceErrorCode":"403","ResourceErrorMessage":{"code":403,"errors":[{"domain":"global","message":"471700050969@cloudservices.gserviceaccount.com
   does not have storage.buckets.get access to the Google Cloud Storage bucket.","reason":"forbidden"}],"message":"471700050969@cloudservices.gserviceaccount.com
   does not have storage.buckets.get access to the Google Cloud Storage bucket.","statusMessage":"Forbidden","requestPath":"https://storage.googleapis.com/storage/v1/b/storage-bucket","httpMethod":"GET","suggestion":"Consider
   granting permissions to 471700050969@cloudservices.gserviceaccount.com"}}'

但是，我已添加roles/storage-admin到錯誤中提到的帳戶，並根據策略疑難解答授予storage.buckets.getAPI 呼叫訪問權限：

這是yaml我使用的文件：

imports:
 - path: template.jinja

resources:
 - name: template
   type: template.jinja
   properties:
     storage:
       bucket: qa-bucket-68586

這是jinja模板：

resources:
 - name: storage-bucket
   type: storage.v1.bucket
   properties:
     kind: storage#bucket
     name: {{ properties["storage"]["bucket"] }}
     location: EU
     projectNumber: {{ env["project_number"] }}
     storageClass: STANDARD

根據您的問題，我嘗試重現您的問題但失敗了 - 這意味著我可以使用 DM 創建儲存桶。

我使用了更簡單的方法：

resources:
- type: storage.v1.bucket
 name: tb111
 properties:
   project: proj-name
   name: tb111-1

我沒有使用任何變數來傳遞項目名稱，所以它可能有效。

結果是：

wb@cloudshell:~ (proj-name)$ gcloud deployment-manager deployments create deploy-test111 --config b1.yaml
The fingerprint of the deployment is b'fcW0t5_5DD75iIGyHz='
Waiting for create [operation-1626272156399-fe30b8a9-47-53bbc8c4]...done.
Create operation operation-1626272156399-fe30b8a9-47-53bbc8c4 completed successfully.
NAME   TYPE               STATE      ERRORS  INTENT
tb111  storage.v1.bucket  COMPLETED  []

我可以從控制台 UI 中查看和訪問它。

嘗試在文件中“硬編碼”您的項目名稱jinja或使用我的開始，這應該可以。

引用自：https://serverfault.com/questions/1069444