gcloud iam service-accounts add-iam-policy-binding ... NOT_FOUND：未知的服务帐户答案

【问题标题】：gcloud iam service-accounts add-iam-policy-binding ... NOT_FOUND: Unknown service accountgcloud iam service-accounts add-iam-policy-binding ... NOT_FOUND：未知的服务帐户
【发布时间】：2021-12-16 19:38:03
【问题描述】：

我正在创建一个新的服务帐户并尝试为其分配一个角色。分配部分找不到我刚刚创建的帐户。

为什么？

*[master][~]$ gcloud iam service-accounts add-iam-policy-binding some-project --member="serviceAccount:some-name@some-project.iam.gserviceaccount.com" --role="roles/secretmanager.secretAccessor"
ERROR: (gcloud.iam.service-accounts.add-iam-policy-binding) NOT_FOUND: Unknown service account

*[master][~]$ gcloud iam service-accounts add-iam-policy-binding some-project --member="some-name@some-project.iam.gserviceaccount.com" --role="roles/secretmanager.secretAccessor"
ERROR: (gcloud.iam.service-accounts.add-iam-policy-binding) NOT_FOUND: Unknown service account

*[master][~]$ gcloud iam service-accounts list                                                                                                                                                           
DISPLAY NAME                            EMAIL                                                     DISABLED
Compute Engine default service account  01234567890-compute@developer.gserviceaccount.com         False
App Engine default service account      some-project@appspot.gserviceaccount.com                  False
Some Name                               some-name@some-project.iam.gserviceaccount.com            False

有趣的是，新帐户也不会出现在门户的 IAM & Admin > Service Accounts 中。当我从 CLI 列出它们时，它仍然显示。呸呸呸……

【问题讨论】：

标签： gcloud google-iam

【解决方案1】：

我想你想要gcloud projects 而不是gcloud iam service-accounts

gcloud projects add-iam-policy-binding some-project \
--member=serviceAccount:some-name@some-project.iam.gserviceaccount.com \
--role=roles/secretmanager.secretAccessor

我有一个 sn-p 是（从记忆中）：

PROJECT="some-project"
ACCOUNT="some-name"

EMAIL="${ACCOUNT}@${PROJECT}.iam.gserviceaccount.com"

ROLES=(
  "secretmanager.secretAccessor"
)

gcloud iam service-accounts create ${ACCOUNT} \
--project=${PROJECT}

# Use sparingly
gcloud iam service-accounts keys create ${PWD}/${ACCOUNT}.json \
--project=${PROJECT}

for ROLE in ${ROLES[@]}
do
  gcloud projects add-iam-policy-binding ${PROJECT} \
  --member=serviceAccount:${EMAIL} \
  --role=roles/${ROLE}
done

【讨论】：

哦，是的！这在文档中很容易被误读！
谢谢。现在我给了它一个角色，它会显示在控制台中。
不客气！希望您喜欢 GCP 入门。