<p>I removed a bunch of IAM policies and think this is preventing me from creating k8s clusters in Google Cloud (through the UI).</p>

<p>Every time I click <code>Create cluster</code>, it processes for a bit, before hanging up and throwing the following error:</p>

<pre><code>Create Kubernetes Engine cluster "standard-cluster-1"
Just now
MyProject
Google Compute Engine: Required 'compute.zones.get' permission for 'projects/&lt;MY_PROJECT_ID&gt;/zones/us-central1-a'.
</code></pre>

<p>I'm mainly doing this through my host shell (iTerm) and <strong>NOT</strong> through the interactive shell found on cloud.google.com.</p>

<p>Here's the IAM policy for a user (I use my google email address under the <code>Member</code> column):</p>

<p><a href="https://i.stack.imgur.com/7zsks.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/7zsks.png" alt="clou"></a></p>

<p>Really hoping to get unblocked so I can start creating clusters in my shell again and not have to use the interactive shell on the Google Cloud website.</p>

bob_cobb
<p>You are missing ServiceAgent roles. But only service accounts can be granted those roles.</p>

<p>1) First,  copy you <a href="https://console.cloud.google.com/?_ga=2.90704154.-1064291117.1550565601" rel="nofollow noreferrer">project number</a></p>

<p>2) create following members for the Service Agents replacing <em>77597574896</em> with your project number and set appropriate roles: </p>

<pre><code>service-77597574896@container-engine-robot.iam.gserviceaccount.com  - Kubernetes Engine Service Agent
service-77597574896@compute-system.iam.gserviceaccount.com - Kubernetes Engine Service Agent
77597574896@cloudservices.gserviceaccount.com - Editor
</code></pre>

<p><a href="https://i.stack.imgur.com/Xfrqc.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/Xfrqc.png" alt="enter image description here"></a></p>

<p>This should work now, because I've tested it with my cluster</p>
