github terraform auth with google cloud self hosted runner

Question

I am using the github actions to run the terrafrom code to create resource in google cloud. The github action run on self-hosted runner which is VM in my google cloud account only. While running the terraform plan, I am getting the error as:

Error: Error acquiring the state lock Error message: 2 errors occurred:     * writing "gs://<BUCKET_NAME>/poc/auto-image/default.tflock" failed: googleapi: Error 403: Access denied., forbidden    * storage: object doesn't exist

the github action file is:

name: Create Compute Image
on:
  push:
    branches: ["main"]

jobs:
  terraform:
    name: "Terraform"
    runs-on: self-hosted

    defaults:
      run:
        shell: bash

    steps:
      # Checkout the repository to the GitHub Actions runner
      - name: Checkout
        uses: actions/checkout@v2

      - uses: hashicorp/setup-terraform@v1
        with:
          terraform_wrapper: false

      - name: Terraform init
        run: |
          cd terraform/create-image-automatically
          terraform init

      - name: Terraform plan
        run: |
          cd terraform/create-image-automatically
          terraform plan -input=false
        env:
          TF_LOG: DEBUG

      - name: Terraform apply
        run: |
          cd terraform/create-image-automatically
          terraform apply --auto-approve

Please help me how to fix this issue. Thanks.

Answer 1

It looks like you are getting an error when trying to acquire the state lock when running Terraform on a GitHub Action. This error can occur if the service account that the self-hosted runner is using does not have the necessary permissions to access the specified Google Cloud Storage bucket.

To fix this issue, you will need to ensure that the service account that the self-hosted runner is using has the necessary permissions to access the Google Cloud Storage bucket. You can do this by granting the service account the "Storage Object Viewer" and "Storage Object Creator" roles.

You can also try creating a new service account and granting it the necessary permissions, and then specifying this service account as the one that the self-hosted runner should use when running Terraform.