title: My account has certain permissions on GCP console but not in Terraform/command line
body: <p>On GCP console, I can successfully create a GCE VM and create a primary and an alias IP addresses for the VM in a subnet of a shared VPC.</p>
  <p>But the strange thing is when I tried to repeat the process with Terraform, I got the following error:</p>
  <pre><code>Error: Error creating Address: googleapi: Error 403: Required 'compute.addresses.createInternal' permission for 'projects/xxx/regions/us-central1/addresses/yyy', forbidden
  </code></pre>
  <p>I also got another permission error on 'compute.instances.setDeletionProtection' in a slightly different attempt.</p>
  <p>Other information to share:</p>
  <ul>
  <li>I'm using the same identity (my user account) for both console and Terraform/command line.</li>
  <li>I have a limited custom &quot;developer&quot; role in the project granted by our org admin. I don't know the specific permissions it includes, but I assume it's sufficient, as I can do my task on GCP console.</li>
  <li>The VM is in project A, while the shared VPC/subnet is in project B. I've used the follow Terraform code in another scenario where I'm the owner of the VM-residing project, and had no problem:</li>
  </ul>
  <pre><code>resource &quot;google_compute_address&quot; &quot;alias-ips&quot; {
    name = var.name
    address_type = &quot;INTERNAL&quot;
    purpose = &quot;GCE_ENDPOINT&quot;
  
    region = var.region
  
    subnetwork = &quot;https://www.googleapis.com/compute/v1/projects/${var.subnet_project}/regions/${var.region}/subnetworks/${var.subnet}&quot;
  
    project = var.project
  }
  </code></pre>
  <ul>
  <li>I tried Policy Troubleshooter, but the result isn't helpful. It showed &quot;Unknown&quot; on the project level, and &quot;Unknown&quot; on the custom &quot;developer&quot; role. I &quot;do not have permissions to view access&quot; on the Findings column.</li>
  </ul>
  <p>The next thing I'll try is to use <code>gcloud</code> to create the same resource. But I doubt it will generate any useful errors either.</p>
  <p>Update 1:</p>
  <p>I tried <code>gcloud</code> to create a VM. I was able to create the VM, and its primary and alias IPs. But when I tried to set deletion protection (using <code>gcloud compute instances update XXX --deletion-protection</code> or use the option <code>--deletion-protection</code> when creating a VM, I got the 403 error again. But what's perplexing is that I could create IPs. This could imply that I wrote my TF not the exactly correct way or the way TF handles alias IP creation is different from <code>gcloud</code>.</p>
  <p>Update 2:</p>
  <p>As per request, I set up GCP authN for TF by <code>gcloud auth application-default login</code>. I have never touch <code>GOOGLE_APPLICATION_CREDENTIALS</code> so it's empty. I'm very sure I'm using the same account/identity. And I run Terraform in an environment where I have no issue running Terraform to do everything in other GCP projects I work with, where I have less constrained permissions.</p>