Google API Node.js Library - Permission denied on `getIamPolicy` for projects in organization

Question

Goal

get and set IAM Policies for auto-provisioned GCP Projects and Service Accounts within said projects using the Node.js Client Library for Google APIs. As well as give a the service account in the project the Dialogflow API Admin role (roles/dialogflow.admin)

Issue

I get the following error when I try to get the IAM policy for a project I just automatically created.

Error: 7 PERMISSION_DENIED: Permission 'resourcemanager.projects.getIamPolicy' denied on resource '//cloudresourcemanager.googleapis.com/projects/va-31b899e6' (or it may not exist).
    at Object.callErrorFromStatus (/home/aeglad22/va-project-provisioning/node_modules/@grpc/grpc-js/build/src/call.js:31:26)
    at Object.onReceiveStatus (/home/aeglad22/va-project-provisioning/node_modules/@grpc/grpc-js/build/src/client.js:180:52)
    at Object.onReceiveStatus (/home/aeglad22/va-project-provisioning/node_modules/@grpc/grpc-js/build/src/client-interceptors.js:365:141)
    at Object.onReceiveStatus (/home/aeglad22/va-project-provisioning/node_modules/@grpc/grpc-js/build/src/client-interceptors.js:328:181)
    at /home/aeglad22/va-project-provisioning/node_modules/@grpc/grpc-js/build/src/call-stream.js:182:78
    at processTicksAndRejections (node:internal/process/task_queues:78:11) {
  code: 7,
  details: "Permission 'resourcemanager.projects.getIamPolicy' denied on resource '//cloudresourcemanager.googleapis.com/projects/va-31b899e6' (or it may not exist).",
  metadata: Metadata {
    internalRepr: Map(3) {
      'grpc-server-stats-bin' => [Array],
      'google.rpc.errorinfo-bin' => [Array],
      'grpc-status-details-bin' => [Array]
    },
    options: {}
  },
  note: 'Exception occurred in retry method that was not classified as transient'
}

Here is the function I am trying to do this in.

async function setServiceAccountRolesV2(projectID, serviceAccountID){
    const authClient = await auth.getClient();
    const resourcemanagerClient = new ProjectsClient();
    var request = {
        resource: "projects/"+projectID,
        auth: authClient
    }
    await resourcemanagerClient.getIamPolicy(request, function(err, response) {
        if (err) {
          console.error(err);
          return;
        }
        console.log(JSON.stringify(response, null, 2));
      });
}

Authentication Info

I am using a service account key to authenticate all of my functions in this node app with. This service account has the following permissions granted at the organization level

This service account I am using to authenticate my app with succeeds at getIamPolicy when I try to get the policy of the project it was created in itself. But I get the error when I try to get the policy of new projects I have created using this "admin project" service account.

Summary

Why is permissions denied when trying to get the IAM Policy of projects I have created programmatically, but successful when getting the policy of the "admin" project that I have this service account and the node.js app running. I thought that if I granted my service account proper permissions at the organization level, and the projects I am creating programmatically were in that same organization, my authenticating service account should inherit all of the right permissions to grant service account roles and change IAM policy in these newly generated accounts.

A potential thought/gut feeling I have that could be completely wrong - is it possible these new projects I'm making don't have IAM Policies at all? so when I try to get and set them there's nothing to change?

Update for clarifications

I have a project that acts as an "administration project" which contain hosts the VM my Node.js app for provisioning GCP resources runs on.

This project is also where I created my service account that the Node.js app authenticates with.

I am creating new projects and service accounts within those projects with this Node.js app.

I have given the aforementioned service account the Owner permission at the organization level.

In my setServiceAccountRolesV2() method, I have tried making the resource my provisioned project manually, as opposed to passed as a parameter to make sure the the project is located correctly. I manually copy and pasted the project ID from one of the auto-provisioned projects into the resource field like this for example

resource: "projects/va-31b899e6",

and I get the same permission denied error (full error message shown above).

However when I try to use this getIamPolicy method with the "admin" project that my node.js app and service account were created in, I get a successful policy return.

resource: "projects/provisioning-admin-339515"

I don't understand why one works, and one doesn't while the service account I'm using to make the call has Owner role at the organization level. The va-31b899e6 project shown above is in fact under the same organization my admin project is.

When I run the gcloud command gcloud projects get-iam-policy va-31b899e6 --format=json > ~/policy.json to check the policy of the api-generated project (not the admin project), I get the following policy back:

{
  "bindings": [
    {
      "members": [
        "serviceAccount:[email protected]"      ],
      "role": "roles/owner"
    }
  ],
  "etag": "ByXXh29efSc=",
  "version": 1
}

This service account listed in the members is the service account I authenticate my Node app with. Again, Owner granted at the Org level. This to me looks like it should be able to use the get and setIamPolicy methods on this project, as well as any other project in my organization.

New edits to follow trouble shooting tips from answer.

1

Confirmed I am using the correct project in the api call:

async function setServiceAccountRolesV2(projectID, serviceAccountID){
    const authClient = await auth.getClient();
    const resourcemanagerClient = new ProjectsClient();
    var request = {
        resource: "projects/va-31b899e6",

        auth: authClient
    }; 
    await resourcemanagerClient.getIamPolicy(request, function(err, response) {
        if (err) {
          console.error(err);
          return;
        }
        console.log(JSON.stringify(response, null, 2));
      });
}

(project ID copied from GCP Console) : resource: "projects/va-31b899e6",

2

I have verified my credentials are used correctly, I am using a json key file of the service account I created to create more projects and service accounts programmatically. This is how I am authenticating :

const auth = new google.auth.GoogleAuth({
  keyFile: 'provisioner-admin-339515-411d1e284a77.json',
  scopes: ['https://www.googleapis.com/auth/cloud-platform'],
});

Then in my function, I create a new instance of auth like this: const authClient = await auth.getClient(); which is then sent in the request of the api call: auth: authClient

3

Verified permissions for my authenticating service account: When I run

gcloud projects get-iam-policy va-31b899e6  \
--flatten="bindings[].members" \
--format="table(bindings.role)" \
--filter="bindings.members:[email protected]"

I get the output ROLE: roles/owner

Answer 1

Your service account has too many roles. Most of the roles are redundant and included within other roles that you assigned. For example, Billing Account Administrator contains the permissions of Billing Account User. The role Owner possesses almost all of the roles in your screenshot.

Next, you need to understand the Principle of Least Privilege. Seth Vargo put together a good intro video. In summary, only grant the required privileges and no more. Your service account IAM roles are vast and a serious security weakness.

To solve the problem in your question, follow these steps:

STEP 1:

Confirm that the Project ID is correct in the API call. Make sure you are using the Project ID and not the Project Name. List the projects:

gcloud projects list

STEP 2:

Verify that your code is using the correct credentials (the ones you think you configured). Your question does not show how you are authorizing your code. You are using ADC (Application Default Credentials) which means the credentials could be found from several sources (CLI remembered credentials, the environment variable, metadata server).

If you are using the environment variable GOOGLE_APPLICATION_CREDENTIALS, open the file using the variable and make sure that it is a service account JSON key:

vi $GOOGLE_APPLICATION_CREDENTIALS

If you are using the CLI credentials, verify which identity is being used:

gcloud auth list

As a debugging test, clear the environment variable and use a user identity that has the role Owner and then login. Then retest your application.

unset GOOGLE_APPLICATION_CREDENTIALS
gcloud auth application-default login

STEP 3:

Once you have determined the correct Project ID and which service account your code is using, double-check the roles assigned to the service account at the project level. List the IAM roles with this command. Replace with your Project ID and Service Account Email address:

gcloud projects get-iam-policy <PROJECT_ID>  \
--flatten="bindings[].members" \
--format="table(bindings.role)" \
--filter="bindings.members:<SERVICE_ACCOUNT_EMAIL>"

The service account needs one of these roles or similar to view IAM bindings:

roles/browser aka Browser
roles/iam.roleViewer aka Viewer

The service account needs this role or similar to modify IAM bindings:

roles/resourcemanager.projectIamAdmin aka Project IAM Admin

Manage access to projects, folders, and organizations