<p>I am working on a Terraform script to create a cluster (tf code below). It gets 90% done then errors. When trying to apply another change or delete this cluster, I run into lack of permission. I made every account in the project Owner and still have the issue. How do I clear this out?</p>
<p>Error:</p>
<pre><code>(1) (1) (1) Google Compute Engine: Required 'compute.instanceGroupManagers.delete' permission for 'projects/gke-eval-319218/zones/us-east4-a/instanceGroupManagers/gke-hello-default-pool-6e16e226-grp' (2) Google Compute Engine: Required 'compute.instanceGroupManagers.delete' permission for 'projects/gke-eval-319218/zones/us-east4-b/instanceGroupManagers/gke-hello-default-pool-a00f72b6-grp' (3) Google Compute Engine: Required 'compute.instanceGroupManagers.delete' permission for 'projects/gke-eval-319218/zones/us-east4-c/instanceGroupManagers/gke-hello-default-pool-ea0634bc-grp' (2) (1) Google Compute Engine: Required 'compute.projects.get' permission for 'projects/gke-eval-319218' (2) retry budget exhausted (5 attempts): Google Compute Engine: Required 'compute.routes.list' permission for 'projects/gke-eval-319218' (3) Google Compute Engine: Required 'compute.firewalls.delete' permission for 'projects/gke-eval-319218/global/firewalls/gke-hello-c4849243-all' (4) Google Compute Engine: Required 'compute.firewalls.delete' permission for 'projects/gke-eval-319218/global/firewalls/gke-hello-c4849243-ssh' (5) Google Compute Engine: Required 'compute.firewalls.delete' permission for 'projects/gke-eval-319218/global/firewalls/gke-hello-c4849243-vms' (2) Google Compute Engine: Required 'compute.subnetworks.get' permission for 'projects/gke-eval-319218/regions/us-east4/subnetworks/default'.
</code></pre>
<p>Script that created this mess:</p>
<pre><code>variable project_id {}
variable zones {}
variable region {}
variable name {}
variable network {}
variable subnetwork {}
variable ip_range_pods { default = null }
variable ip_range_services { default = null }

locals {
  service_account = &quot;${var.name}-sa&quot;
}

resource &quot;google_service_account&quot; &quot;service_account&quot; {
  project = var.project_id
  account_id   = &quot;${local.service_account}&quot;
  display_name = &quot;${var.name} cluster service account&quot;
}

resource &quot;google_project_iam_binding&quot; &quot;service_account_iam&quot; {
  project = var.project_id
  role = &quot;roles/container.admin&quot;

  members = [
    &quot;serviceAccount:${local.service_account}@${var.project_id}.iam.gserviceaccount.com&quot;,
  ]
}

module &quot;gke&quot; {
  source                     = &quot;terraform-google-modules/kubernetes-engine/google&quot;
  project_id                 = var.project_id
  name                       = var.name
  region                     = var.region
  zones                      = var.zones
  network                    = var.network
  subnetwork                 = var.subnetwork
  ip_range_pods              = var.ip_range_pods
  ip_range_services          = var.ip_range_services
  http_load_balancing        = true
  horizontal_pod_autoscaling = false
  network_policy             = false
  service_account            = &quot;${local.service_account}@${var.project_id}.iam.gserviceaccount.com&quot;

  node_pools = [
    {
      name                      = &quot;default-pool&quot;
      machine_type              = &quot;e2-medium&quot;
      min_count                 = 3
      max_count                 = 20
      local_ssd_count           = 0
      disk_size_gb              = 100
      auto_repair               = true
      auto_upgrade              = true
      preemptible               = false
      initial_node_count        = 10
    },
  ]

  node_pools_oauth_scopes = {
    all = []

    default-pool = [
      &quot;https://www.googleapis.com/auth/cloud-platform&quot;,
    ]
  }

  node_pools_labels = {
    all = {}

    default-pool = {
      default-pool = true
    }
  }

  node_pools_metadata = {
    all = {}

    default-pool = {
      node-pool-metadata-custom-value = &quot;my-node-pool&quot;
    }
  }

  node_pools_taints = {
    all = []

    default-pool = [
      {
        key    = &quot;default-pool&quot;
        value  = true
        effect = &quot;PREFER_NO_SCHEDULE&quot;
      },
    ]
  }

  node_pools_tags = {
    all = []

    default-pool = [
      &quot;default-pool&quot;,
    ]
  }
}
</code></pre>

jws
<p>You might require to enable API if you are forgetting any</p>
<p>like</p>
<pre><code>gcloud services enable container.googleapis.com
</code></pre>
<p>also, make sure service account you are have the role or policy attached.</p>
<pre><code> --role  roles/compute.admin
</code></pre>
