gcloud iam服务-帐户添加-iam-策略绑定.NOT_FOUND:未知服务帐户

Question

我正在创建一个新的服务帐户，并试图为它指定一个角色。分配部分找不到我刚刚创建的帐户。

为什么？

*[master][~]$ gcloud iam service-accounts add-iam-policy-binding some-project --member="serviceAccount:some-name@some-project.iam.gserviceaccount.com" --role="roles/secretmanager.secretAccessor"
ERROR: (gcloud.iam.service-accounts.add-iam-policy-binding) NOT_FOUND: Unknown service account

*[master][~]$ gcloud iam service-accounts add-iam-policy-binding some-project --member="some-name@some-project.iam.gserviceaccount.com" --role="roles/secretmanager.secretAccessor"
ERROR: (gcloud.iam.service-accounts.add-iam-policy-binding) NOT_FOUND: Unknown service account

*[master][~]$ gcloud iam service-accounts list                                                                                                                                                           
DISPLAY NAME                            EMAIL                                                     DISABLED
Compute Engine default service account  01234567890-compute@developer.gserviceaccount.com         False
App Engine default service account      some-project@appspot.gserviceaccount.com                  False
Some Name                               some-name@some-project.iam.gserviceaccount.com            False

有趣的是，新帐户也没有出现在门户中的IAM & Admin >服务帐户中。当我将它们全部从CLI中列出时，它仍然显示。普拉夫..。

Answer 1

我想你想要的是gcloud projects而不是gcloud iam service-accounts

gcloud projects add-iam-policy-binding some-project \
--member=serviceAccount:some-name@some-project.iam.gserviceaccount.com \
--role=roles/secretmanager.secretAccessor

我有一个片段(从内存中)：

PROJECT="some-project"
ACCOUNT="some-name"

EMAIL="${ACCOUNT}@${PROJECT}.iam.gserviceaccount.com"

ROLES=(
  "secretmanager.secretAccessor"
)

gcloud iam service-accounts create ${ACCOUNT} \
--project=${PROJECT}

# Use sparingly
gcloud iam service-accounts keys create ${PWD}/${ACCOUNT}.json \
--project=${PROJECT}

for ROLE in ${ROLES[@]}
do
  gcloud projects add-iam-policy-binding ${PROJECT} \
  --member=serviceAccount:${EMAIL} \
  --role=roles/${ROLE}
done

Answer 2

第五步应该这样做：

gcloud iam service-accounts add-iam-policy-binding \
    user-sa-name@project-id.iam.gserviceaccount.com \
    --member=serviceAccount:service-agent-email \
    --role=roles/iam.serviceAccountTokenCreator