Missing Project Input for Service Account Key

Hello!

• Vote on this issue by adding a 👍 reaction
• To contribute a fix for this issue, leave a comment (and link to your pull request, if you’ve opened one already)

Issue details

I noticed that gcp.serviceAccount.Key does not have a Project input. I would like to create a project, service account and service account key in the same stack. I don’t think this is currently possible.

serviceAccountKey, err := serviceaccount.NewKey(ctx, "service-account-key", &serviceaccount.KeyArgs{
    Project: project.ProjectId, // <-- This field is missing
    ServiceAccountId: serviceAccount.AccountId,
})

Diagnostics:
  gcp:serviceAccount:Key (service-account-key):
    error: 1 error occurred:
        * project: required field is not set

Steps to reproduce

I don’t think these are necessary since this seems like more of an oversight than a bug.

[jdmaguire]

Thanks for the link Johannes and describing your workaround! For me, I was able to work around this by using Workload Identity; which I found is Google’s suggested approach.

I hope between the two of use, people stumbling into this issue have a workaround they can use.

[johannesdrescher]

Hi @guineveresaenger, I see. I reported the limitation to Google. Will add a comment to this issue when/if it gets fixed.