Troubleshoot Terraform solutions for Service Catalog

This page shows you how to resolve issues that you might encounter when you create or update Terraform solutions with Service Catalog, and provides suggestions for how to fix each of them.

Permission denied error

The following issue occurs when you see this validation error:

Permission denied; please check you have the correct IAM permissions and APIs
enabled.

To resolve this issue, take the following actions, depending on whether or not you're providing your own service account:

Provide your own service account

Verify that the service account that you're using appears in the Identity and Access Management (IAM) service accounts page of the Google Cloud project that you're using.

If the service account appears, verify that you have the correct IAM permissions to use it. You must have the permission iam.serviceAccounts.actAs for the Google Cloud project that's using the service account. If you don't have this role, contact the project owner or an administrator who can grant you access.

If the service account is in a different Google Cloud project from your Terraform solution, you must perform the following additional steps for cross-project configuration.

Default service account

Verify that you have the IAM permission iam.serviceAccounts.actAs for the Compute Engine default service account that your Google Cloud project is using. If you don't have this role, contact the project owner or an administrator who can grant you access. For more information, see Compute Engine default service account.

Error creating artifacts bucket

The following issue occurs when you see this validation error:

Error creating artifacts bucket.

To resolve this issue, verify that you have the Storage Admin (roles/storage.admin) role in the current Google Cloud project. If you don't have this role, contact the project owner or an administrator who can grant you access.

Failed to create build error

The following issue occurs when you see this validation error:

Failed to create build.

To resolve this issue, verify that the service account that you're using has the Logs Writer (roles/logging.logWriter) and Storage Admin (roles/storage.admin) roles in the current Google Cloud project. If it doesn't have these roles, contact the project owner or an administrator who can grant the required access to the service account.

Error reading Cloud Storage bucket

The following issue occurs when you see this validation error:

Error reading GCS bucket: GCS_SOURCE.

To resolve this issue, verify that the service account that you're using has the Storage Object Viewer (roles/storage.objectViewer) role in the current Google Cloud project. If it doesn't have this role, contact the project owner or an administrator who can grant the required access to the service account.

No Terraform module

The following issue occurs when you see this validation error:

unable to process terraform module - no terraform module detected. Only TF or
TF.JSON files are currently supported.

To resolve this issue, verify that your Terraform module follows the expected format, and has been created by zipping a sequence of Terraform files.

Note: Service Catalog doesn't support Terraform modules in subdirectories or folders other than the root directory.

Invalid status without validation errors

The following issue occurs when you see a validation status of INVALID, but you don't see any specific validation errors. This can occur if there's an issue with your Terraform config.

To resolve this issue, verify the Terraform config by using the command Terraform apply, and resolve any specific issues that you encounter.