How to set up a test environment?

[dhvogel]

Hi terraform-provider-google team --

I am trying to test changes for my first magic-modules contribution [0]. To do so, I have set up a test project within a test organization, linked to a valid billing account that I have created. I have granted myself administrator access to the billing acocunt, the project, and the organization. However, when I try to run the test [1], I see the following error message [2]. Even after looking at the IAM set up and using Google's IAM policy checker [3], I can't understand understand why I am seeing this message.

Two questions:

1. Do you know why I might be seeing this message?
2. Are there test environment setup docs I can follow to be sure I have the right environment in which to run my test?

Dan

[0] GoogleCloudPlatform/magic-modules#3789
[1] make testacc TEST=./google TESTARGS='-run=TestAccAppEngineStandardAppVersion_update'
[2]

    TestAccAppEngineStandardAppVersion_update: testing.go:674: Step 0 error: errors during apply:
        
        Error: failed pre-requisites: missing permission on "billingAccounts/013FB7-287BC9-55EC71": billing.resourceAssociations.create
        
          on /var/folders/bp/vzfsvm311_10lwj530mwnlgh00kpbn/T/tf-test141220843/main.tf line 2:
          (source code not available)

[3] https://cloud.google.com/iam/docs/troubleshooting-access#gcloud

[edwardmedia]

@dhvogel The test uses Terraform-specific service account for the authentication and authorization, You may want to review https://www.terraform.io/docs/providers/google/guides/provider_reference.html#full-reference for how to create the account.

1. Have you created the environment variable which points to the service account? Like GOOGLE_CREDENTIALS
2. For this service account, does it have right roles? In your case, it looks like the account does not have the permission billing.resourceAssociations.create. To get that permission, you can add a) GCP predefined role like roles/billing.user to the service account or b) create a custom role, add the permission to the role and then add the custom role to the service account
   Please let me know if this addresses your question. Thanks

[dhvogel]

Thanks, I am able to run tests by using a service account and giving the service account permissions on the billing account. Thank you!

[edwardmedia]

@dhvogel I am glad you are able to run tests now. so I am losing this issue. Feel free to reopen it if you still need further discussion. Thanks

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 hashibot-feedback@hashicorp.com. Thanks!