title: Terraform throws Error setting IAM policy for service account ... Permission iam.serviceAccounts.setIamPolicy is required
body: <p>I am trying to create a very simple structure on GCP using Terraform: a compute instance + storage bucket. I did some research across GCP documentation, Terraform documentation, SO questions as well and still can't understand what's the trick here. There is one <a href="https://stackoverflow.com/questions/55737583/using-terraform-to-create-a-service-account-with-iam-roles">suggestion</a> to use <code>google_project_iam_binding</code>, but reading thruogh some articles it seems to be dangerous (read: insecure solution). There's also a general answer with only GCP descriptions, nit using tf terms <a href="https://stackoverflow.com/a/60159018/1598355">here</a>, which is still a bit confusing. And also concluding the similar question <a href="https://stackoverflow.com/questions/59240978/terraform-google-bucket-for-static-website-for-google-storage-403">here</a>, I confirm that the domain name ownership was verified via Google Console.</p>
  <p>So, I ended up with the following:</p>
  <pre class="lang-sh prettyprint-override"><code>data &quot;google_iam_policy&quot; &quot;admin&quot; {
    binding {
      role = &quot;roles/iam.serviceAccountUser&quot;
      members = [
        &quot;user:myemail@domain.name&quot;,
        &quot;serviceAccount:${google_service_account.serviceaccount.email}&quot;,
      ]
    }
  }
  resource &quot;google_service_account&quot; &quot;serviceaccount&quot; {
    account_id   = &quot;sa-1&quot;
  }
  resource &quot;google_service_account_iam_policy&quot; &quot;admin-acc-iam&quot; {
    service_account_id = google_service_account.serviceaccount.name
    policy_data        = data.google_iam_policy.admin.policy_data
  }
  resource &quot;google_storage_bucket_iam_policy&quot; &quot;policy&quot; {
    bucket      = google_storage_bucket.storage_bucket.name
    policy_data = data.google_iam_policy.admin.policy_data
  }
  resource &quot;google_compute_network&quot; &quot;vpc_network&quot; {
    name                    = &quot;vpc-network&quot;
    auto_create_subnetworks = &quot;true&quot;
  }
  resource &quot;google_compute_instance&quot; &quot;instance_1&quot; {
    name         = &quot;instance-1&quot;
    machine_type = &quot;f1-micro&quot;
    boot_disk {
      initialize_params {
        image = &quot;cos-cloud/cos-stable&quot;
      }
    }
    network_interface {
      network = google_compute_network.vpc_network.self_link
      access_config {
      }
    }
  }
  resource &quot;google_storage_bucket&quot; &quot;storage_bucket&quot; {
    name          = &quot;bucket-1&quot;
    location      = &quot;US&quot;
    force_destroy = true
    website {
      main_page_suffix = &quot;index.html&quot;
      not_found_page   = &quot;404.html&quot;
    }
    cors {
      origin          = [&quot;http://the.domain.name&quot;]
      method          = [&quot;GET&quot;, &quot;HEAD&quot;, &quot;PUT&quot;, &quot;POST&quot;, &quot;DELETE&quot;]
      response_header = [&quot;*&quot;]
      max_age_seconds = 3600
    }
  }
  </code></pre>
  <p>but if I <code>terraform apply</code>, logs show me an error like that</p>
  <pre class="lang-sh prettyprint-override"><code>Error: Error setting IAM policy for service account 'trololo': googleapi: Error 403: Permission iam.serviceAccounts.setIamPolicy is required to perform this operation on service account trololo., forbidden
  2020/09/28 19:19:34 [TRACE] statemgr.Filesystem: removing lock metadata file .terraform.tfstate.lock.info
    on main.tf line 35, in resource &quot;google_service_account_iam_policy&quot; &quot;admin-acc-iam&quot;:
    35: resource &quot;google_service_account_iam_policy&quot; &quot;admin-acc-iam&quot; {
  2020/09/28 19:19:34 [TRACE] statemgr.Filesystem: unlocking terraform.tfstate using fcntl flock
  Error: googleapi: Error 403: The bucket you tried to create is a domain name owned by another user., forbidden
    on main.tf line 82, in resource &quot;google_storage_bucket&quot; &quot;storage_bucket&quot;:
  </code></pre>
  <p>and some useless debug info. What's wrong? What account is missing what permissions and how to assign them securely?</p>