Permissions required by setup-sa.sh not documented

[chrislovecnm]

I have a user that does not have the correct permissions to run the setup-sa.sh script. The documentation does not tell me what permissions I need in order to run this scripts. Here is my error:

 $ ./helpers/setup-sa.sh my-org my-project
Verifying organization...
Verifying project...
Skipping billing account verification... (parameter not passed)
Creating Seed Service Account...
Created service account [project-factory-6999].
Downloading key to credentials.json...
Applying permissions for org org-number and project chlove-baseproject...
ERROR: (gcloud.organizations.add-iam-policy-binding) User [[email protected]] does not have permission to access organization [org-number:getIamPolicy] (or it may not exist): The caller does not have permission

I removed org number and project id for security sake.

What permissions does the user need to run the setup-sa.sh script?

[morgante]

I believe Organization Admin should be sufficient, we should add this under the script helper documentation.

[chrislovecnm]

Many ops people will not have .org admin. Do we know the perms?

[morgante]

I believe the org permissions required are:

• resourcemanager.organizations.get
• resourcemanager.organizations.getIamPolicy
• resourcemanager.organizations.setIamPolicy

Additional perms are required on the seed project.

[aaron-lane]

@chrislovecnm can you please confirm if these permissions were sufficient to unblock your user?

[chrislovecnm]

Have not had a chance to validate