Google cloud platform 我使用terraform创建了一个GCP项目，但它没有'；不显示在项目列表中。为什么？

我现在正在学习教程

基本上，它可以归结为创建一个

terraform admin

默认项目，并有权成为

角色/resourcemanager.projectCreator

$ gcloud organizations get-iam-policy $TF_VAR_org_id
bindings:
...snipped...
- members:
  - domain:raverun.com
  - serviceAccount:terraform@terraform-admin.iam.gserviceaccount.com
  role: roles/resourcemanager.projectCreator

我不打算在这里复制

project.tf

文件，但主要内容如下：

provider "google" {
    ...snipped...
}

resource "google_project" "proj" {
    ...snipped...
    project_id      = "tf-foobar"
}

resource "google_project_services" "svcs" {
     ...snipped...
}

在运行

terraform之前应用

$ gcloud projects list
PROJECT_ID          NAME              PROJECT_NUMBER
terraform-admin     terraform-admin     300000000000

$ terraform apply
...snipped...
Apply complete! Resources: 0 added, 1 changed, 0 destroyed.

Outputs:

project_id = tf-foobar

$ gcloud projects list
PROJECT_ID          NAME              PROJECT_NUMBER
terraform-admin     terraform-admin     300000000000

运行
terraform后应用

$ gcloud projects list
PROJECT_ID          NAME              PROJECT_NUMBER
terraform-admin     terraform-admin     300000000000

$ terraform apply
...snipped...
Apply complete! Resources: 0 added, 1 changed, 0 destroyed.

Outputs:

project_id = tf-foobar

$ gcloud projects list
PROJECT_ID          NAME              PROJECT_NUMBER
terraform-admin     terraform-admin     300000000000

我的问题是为什么新项目
tf foobar
没有出现
 我想我已经找到了问题所在。我需要提供域所有者的用户帐户
owner@mydomain.com
有权编辑新创建项目的项目角色。我试过这个：

resource "google_project_iam_binding" "projiambinding1" {
  project = "${google_project.proj.project_id}"
  role    = "roles/editor"

  members = [
    "user:owner@mydomain.com",
    "serviceAccount:xxxxxxxxx-compute@developer.gserviceaccount.com",
    "serviceAccount:yyyyyyyyyyyyy@cloudservices.gserviceaccount.com",
  ]
}


现在，我新创建的项目可见：

$ gcloud projects list
PROJECT_ID          NAME                   PROJECT_NUMBER
terraform-admin     terraform-admin        300000000000
tf-foobar           tf-foobar              111111111111

我想我已经发现了问题所在。我需要提供域所有者的用户帐户
owner@mydomain.com
有权编辑新创建项目的项目角色。我试过这个：

resource "google_project_iam_binding" "projiambinding1" {
  project = "${google_project.proj.project_id}"
  role    = "roles/editor"

  members = [
    "user:owner@mydomain.com",
    "serviceAccount:xxxxxxxxx-compute@developer.gserviceaccount.com",
    "serviceAccount:yyyyyyyyyyyyy@cloudservices.gserviceaccount.com",
  ]
}


现在，我新创建的项目可见：

$ gcloud projects list
PROJECT_ID          NAME                   PROJECT_NUMBER
terraform-admin     terraform-admin        300000000000
tf-foobar           tf-foobar              111111111111