Error when migrating projects in GCP, could someone help me

google-cloud-platformmigration

I'm trying to Migrate 2 projects originating "no Organization" to a newly created organization in GCP.

When trying to perform the migration, it displays the error:
Permission denied You do not have the following required permission to perform this action: "resourcemanager.projects.update"

I've tried to perform the procedure via command too but it didn't work either:
ERROR: (gcloud.beta.projects.move) User ["my user"] does not have permission to access projects instance ["my project"] (or it may not exist): The caller does not have permission.

Group permission that the user participates at the organizational level:
Support Account Administrator
Organization Role Administrator
Organization Policy Administrator
Folder admin
Organization Administrator
Project Creator
Project Mover
Security Center Admin

User permission at the Organization level:
Organization Administrator
Project Mover

User permission at project level:
Owner
Project Mover
Organization Administrator

Does anyone have any more suggestions?

Best Answer

As per the given error, it looks like you don’t have the permission to perform the action "resourcemanager.projects.update". And for that you need to have a “roles/resourcemanager.projectMover” role. Please check Project move permission.

For more details check Migrating project with no organization

Related Solutions

GCP Service Account IAM Access – Troubleshooting IAM Permissions Issues

You probably used a google_project_iam_policy resource incorrectly, and overwrote the default IAM policy configuration for the project with an incorrect policy (don't ask how I know this...)

google_project_iam_policy is a very dangerous resource in Terraform, and the docs do not sufficiently emphasize how dangerous it is. The problem is that setting the IAM Policy replaces your project's entire IAM configuration with the IAM policy you define. All the default, auto-created service account permissions get wiped out unless you specifically included them in your policy definition.

It is possible to fix your project, but not easy. You need to find all the service accounts that your project needs, and add the correct permissions. Error output from TF_LOG=TRACE terraform apply can guide you. The default project IAM policy should look something like the policy below, though it will differ based on which APIs you have enabled and which Google Cloud features are in use. (policy sanitized with xxxxx replacing project ID)

bindings:
- members:
  - serviceAccount:service-xxxxxxxxxxx@compute-system.iam.gserviceaccount.com
  role: roles/compute.serviceAgent
- members:
  - serviceAccount:xxxxxxxxxxx-compute@developer.gserviceaccount.com
  - serviceAccount:xxxxxxxxxxx@cloudservices.gserviceaccount.com
  - serviceAccount:terraform-service-account@your-terraform-project.iam.gserviceaccount.com
  role: roles/editor
- members:
  - user:owner@example.com
  role: roles/owner
- members:
  - serviceAccount:terraform-service-account@your-terraform-project.iam.gserviceaccount.com
  role: roles/servicenetworking.networksAdmin
- members:
  - serviceAccount:service-xxxxxxxxxxx@service-networking.iam.gserviceaccount.com
  role: roles/servicenetworking.serviceAgent
etag: BwWc0THMaHA=
version: 1

If you are getting this error, run gcloud projects get-iam-policy your-project-name and see what's missing. In all likelihood, the policy change wiped out your owner role, and roles for the default service accounts (the ones that include your project ID in the name).

Summary: if you're using Terraform to manage IAM in Google Cloud Platform, you should generally NOT be using resource google_project_iam_policy, unless you are an expert at hand-writing Google IAM policies. If you must use it, before you begin, run gcloud projects get-iam-policy your-project-name and save the results so you can see what your IAM policy looked like before you broke it.

Google Cloud Platform – Recover GCP Organization After Removing Admin Role

So you deleted your Org admin role but you still have Org Admin role, also Organization Policy Admin role....

So in this case I'd recommend you to make sure you're executing the command with your user, I know is redundant but always is good to double check.

If you still can't, please check this steps as you said you had a Super Admin account for GSuite

Related Topic