0

In the process of building and testing some automated infrastructure provisioning, I accidentally removed the "roles/resourcemanager.organizationAdmin" role (and any others that can set IAM Policy) from myself, and all other users. This means I am currently unable to manage IAM policy for my GCP organization.

This is, needless to say, a pretty big problem. Most notably, my account no longer has a Billing administrator or ability to assign one, which will very quickly become problematic.

The IAM control panel shows the following tooltip when attempting to edit policies:

You need permissions for this action.
Required permission(s): resourcemanager.organizations.setIamPolicy

Similarly, I receive an error when attempting to set IAM policies via the gcloud CLI:

~$ gcloud organizations add-iam-policy-binding <ORG_ID_REDACTED> --member="user:<MY_EMAIL_REDACTED>" --role="roles/resourcemanager.organizationAdmin"
ERROR: (gcloud.organizations.add-iam-policy-binding) User [<MY_EMAIL_REDACTED>] does not have permission to access organization [<ORG_ID_REDACTED>:setIamPolicy] (or it may not exist): The caller does not have permission

Neither of these errors are surprising, given that I do not, in fact, have the permission any longer. I have the following roles directly bound to my user account:

  • Organization Role Administrator
  • Service Account Admin
  • Organization Policy Administrator
  • Folder IAM Admin
  • Folder Mover
  • Project IAM Admin

Additionally, I am in GSuite groups that should have the following roles:

  • Compute Network Admin
  • Compute Shared VPC Admin
  • Owner <- this one in particular seems like it should be helpful, but isn't
  • Folder Admin
  • Project Creator
  • Project Deleter
  • Project Mover
  • Compute Security Admin

If it matters, I do have credentials for a GSuite 'Super Admin' account for this organization. Although at first glance, the options in that admin console seem to be totally separate from the GCP IAM configuration.

I cannot find a support option from Google without spending a decent amount of money, which is not a good option given this organization is a sandbox for trying out some tech and not a real business. Do I have any viable options at this point, other than deleting all projects and creating an entirely new organization?

1

So you deleted your Org admin role but you still have Org Admin role, also Organization Policy Admin role....

So in this case I'd recommend you to make sure you're executing the command with your user, I know is redundant but always is good to double check.

If you still can't, please check this steps as you said you had a Super Admin account for GSuite

| improve this answer | |
  • Organization Role Administrator or Organization Policy Administrator do not grant resourcemanager.organizations.setIamPolicy – John Mahowald Nov 21 '19 at 17:39
  • I contacted Billing support, and they sent me the same instructions you linked above. Because the Super Admin account does not show at all on the IAM Admin page, I assumed they didn't have any roles in GCP IAM (since the GSuite admin panel is a different application.) This assumption was incorrect. As a GSuite Super Admin I was able to add the "Organization Administrator" role back, and get the required "resourcemanager.organizations.setIamPolicy" on my primary account. Thanks for the link! – Sean Kleinjung Nov 22 '19 at 3:19
1

Yes, you removed your access to organization IAM. The only predefined role with resourcemanager.organizations.setIamPolicy is Security Admin and Organization Administrator. And you said you had no custom role with those.

Get GCP support to fix this. No access is probably one of the simplest things to fix. I doubt this would be covered under free billing support, but you can try.

If this thing isn't worth any money to you, delete it and start over. Automation means all you lost is some time, and the project name.

| improve this answer | |
  • You are correct in identifying what role is needed. I contacted GCP billing support regarding this (since, technically, I couldn't perform billing administration tasks without this access.) Google did respond with steps to resolve my issue, although someone in a similar situation who has a Super Admin account can resolve it without contacting support using the instructions AdolfoOG provided above: serverfault.com/a/992783/132745 – Sean Kleinjung Nov 22 '19 at 3:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.