title: Using Terraform to create a service account with IAM roles
body: <p>I am trying to create a basic Service Account with the <code>roles/logging.logWriter</code> IAM role with Terraform. Below is how I have configured this:</p>
  
  <pre><code>resource "google_service_account" "log_user" {
    account_id   = "log-user"
    display_name = "Logging User"
  }
  
  data "google_iam_policy" "log_policy" {
    binding {
      role = "roles/logging.logWriter"
  
      members = [
        "serviceAccount:${google_service_account.log_user.email}"
      ]
    }
  }
  
  resource "google_service_account_iam_policy" "log_user_policy" {
    service_account_id = "${google_service_account.log_user.name}"
    policy_data        = "${data.google_iam_policy.log_policy.policy_data}"
  }
  </code></pre>
  
  <p>When running <code>terraform apply</code> I am receiving the following error message:</p>
  
  <pre><code>* module.iam.google_service_account_iam_policy.log_user_policy: 1 error(s) occurred:
  
  * google_service_account_iam_policy.log_user_policy: Error setting IAM policy for service account 'projects/arcadia-apps-237918/serviceAccounts/log-user@arcadia-apps-237918.iam.gserviceaccount.com': googleapi: Error 400: Role roles/logging.logWriter is not supported for this resource., badRequest
  </code></pre>
  
  <p>From the digging I've done I can't seem to find a clear cut explanation on how to create a Service Account and then attach a role to it.</p>