Service account does not have storage.buckets.get access to the Google Cloud Storage bucket

I am running Ansible with a service the following configuration which should create a storage bucket on Google Cloud.

- name: "Create {{ environ.name }}-cluster-backups"
  google.cloud.gcp_storage_bucket:
    name: "zeipt-io-{{ environ.name }}-cluster-backups"
    location: "{{ google_cloud.region }}"
    storage_class: "NEARLINE"
    lifecycle:
      rule:
        - condition:
            age_days: 28
          action:
            type: "Delete"
    project: "{{ google_cloud.project }}"
    auth_kind: "{{ google_cloud.auth_kind }}"
    service_account_file: "{{ google_cloud.service_account_file }}"
    state: present

Which gives the error

fatal: [localhost]: FAILED! => {"changed": false, "msg": "GCP returned error: {'error': {'code': 403, 'message': '[email protected] does not have storage.buckets.get access to the Google Cloud Storage bucket.', 'errors': [{'message': '[email protected] does not have storage.buckets.get access to the Google Cloud Storage bucket.', 'domain': 'global', 'reason': 'forbidden'}]}}"}

I understand the error but I have checked the roles assigned to this user like so

gcloud projects get-iam-policy staging-environment --flatten="bindings[].members" --format='table(bindings.role)' --filter="bindings.members:[email protected]"
ROLE
roles/owner
roles/storage.admin
roles/storage.objectAdmin
roles/storage.objectCreator
roles/storage.objectViewer

roles/storage.admin should satisfy the requirement as I checked the Google Cloud IAM Roles page which states that this role has the storage.buckets.* permission.

I do not understand why I still get the same error?

I understand that some members of the community have offered you some solutions in order to resolve your issue, but apparently none of them has been useful for your issue. Also, I understand that you're using GCP to create the service account and assign the roles.

Maybe you can try to create the service account and the roles for the service account from ansible, and check if that works.

You can create the service account using this plugin google.cloud.gcp_iam_service_account – Creates a GCP ServiceAccount

Example:

- name: create a service account
  google.cloud.gcp_iam_service_account:
    name: sa-{{ resource_name.split("-")[-1] }}@graphite-playground.google.com.iam.gserviceaccount.com
    display_name: My Ansible test key
    project: test_project
    auth_kind: serviceaccount
    service_account_file: "/tmp/auth.pem"
    state: present

And you can assign the roles using the plugin google.cloud.gcp_iam_role – Creates a GCP Role

Example:

- name: create a role
  google.cloud.gcp_iam_role:
    name: myCustomRole2
    title: My Custom Role
    description: My custom role description
    included_permissions:
    - iam.roles.list
    - iam.roles.create
    - iam.roles.delete
    project: test_project
    auth_kind: serviceaccount
    service_account_file: "/tmp/auth.pem"
    state: present

Remember that these plugins are part of the google.cloud collection, which should be installed if you're using ansible package.