在GCP中创建IAM成员会引发错误策略的大小太大

Question

当我尝试在GCP中创建一个新的IAM用户时，我得到以下错误

Request "Create IAM Members roles/dns.admin serviceAccount:[e-mail] 
for \"project \\\"projectId\\\"\"" returned error:
 Error applying IAM policy for project "projectId": Error setting IAM policy for project "projectId": googleapi: Error 400:
 The size of the policy is too large.
 Consider removing or merging some of the bindings or if using conditions remove 
any lengthy conditions., badRequest

上面显示的是terraform apply命令的输出。当我尝试使用gcloud cli时，我也会得到一个类似的输出，当我尝试通过GCP控制台创建它时，它只是显示“Backend Error”。

Answer 1

很可能你达到了IAM的配额之一。每次执行更新或创建时，您在Terraform中指定的所有绑定都将上载。正如错误所说，您可能正在创建大量可以合并在一起的绑定。我建议尝试找到您正在达到的配额限制以及原因，下面是一些调试命令：

iam绑定数：

gcloud projects get-iam-policy $PROJECT_ID --format=json | jq '.bindings | length'

绑定的总大小：

gcloud projects get-iam-policy $PROJECT_ID --format=json | jq '.bindings' > iam.json
ls -l iam.json

gcloud projects get-iam-policy $PROJECT_ID --format=json | jq ".bindings[].members" | jq -s flatten

{
  "bindings": [
    {
      "members": [
        "user:[e-mail]"
      ],
      "role": "roles/owner"
    },
    {
      "members": [
        "user:[e-mail]"
      ],
      "role": "roles/owner"
    }
  ],
  "etag": "BwUjMhCsNvY=",
  "version": 1
}

{
  "bindings": [
    {
      "members": [
        "user:[e-mail]",
        "user:[e-mail]"
      ],
      "role": "roles/owner"
    }
  ],
  "etag": "BwUjMhCsNvY=",
  "version": 1
}