GCP restore with encryption key failed with an error message
GCP restore with encryption key failed with the following error message:
Creating disk "disk1" failed. Error: Cloud KMS error when using key projects/cloudpoint-development/locations/global/keyRings/test-ring/cryptoKeys/test-key2: Permission 'cloudkms.cryptoKeyVersions.useToEncrypt' denied on resource 'projects/cloudpoint-development/locations/global/keyRings/test-ring/cryptoKeys/test-key2' (or it may not exist).
Workaround:
The Google Cloud Platform is configured with Cloud KMS CryptoKey Encrypter/Decrypter permission which is missing for service-<default-service-account>@compute-system.iam.gserviceaccount.com service account.
To resolve this issue, assign the following permission to the service account:
bash# gcloud kms keys add-iam-policy-binding test-key2 --keyring test-ring --location global --member serviceAccount:service-<default-service-account>@compute-system.iam.gserviceaccount.com --role roles/cloudkms.cryptoKeyEncrypterDecrypter Updated IAM policy for key [test-key2]. bindings: - members: - serviceAccount:service-<default-service-account>@compute-system.iam.gserviceaccount.com role: roles/cloudkms.cryptoKeyEncrypterDecrypter etag: BwX-yNgMdSE= version: 1