Permission 'cloudkms.cryptoKeys.get' denied on init setup

[dcb-imvaria]

TL;DR

Not enough permission to read from KMS.

Expected behavior

No response

Observed behavior

The following error in VM logs of fresh setup:

Error parsing Seal configuration: error checking key existence: rpc error: code = PermissionDenied desc = Permission 'cloudkms.cryptoKeys.get' denied on resource 'projects/$PROJECT_ID/locations/us-central1/keyRings/vault/cryptoKeys/vault-init' (or it may not exist).

Terraform Configuration

provider "google" {}

data "google_client_config" "current" {}

module "vault" {
  source                                       = "terraform-google-modules/vault/google"
  project_id                                   = data.google_client_config.current.project
  region                                       = "us-west1"
  kms_keyring                                  = "vault-compute-engine"
  vault_version                                = "1.11.12"
  service_account_project_additional_iam_roles = ["roles/iam.serviceAccountKeyAdmin", 
                                                  "roles/iam.serviceAccountAdmin",
                                                  "roles/resourcemanager.projectIamAdmin"]
}

output "vault_addr" {
  value = module.vault.vault_addr
}

Terraform Version

Terraform v1.7.2
on linux_amd64

Additional information

This problem was initially reported in issue #184 but was closed due to inactivity. Another PR, #198, was created but it has not been assigned for review.

[github-actions]

This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 7 days

[dcb-imvaria]

Is project being actively maintained?

On Sun, 2024-05-05 at 16:07 -0700, github-actions[bot] wrote: This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 7 days — Reply to this email directly, view it on GitHub [1], or unsubscribe [2]. You are receiving this because you authored the thread.Message ID: <terraform-google-modules/terraform-google- ***@***.***>

[1] view it on GitHub #204 (comment) [2] unsubscribe https://github.com/notifications/unsubscribe-auth/AWTVZHPPSVEU5AOOMLWZVATZA23SZAVCNFSM6AAAAABEJY4TO6VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDAOJUHE4DMOJRGU

[github-actions]

This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 7 days