insufficient permissions: read account_project; write account_project when creating a project

[woile]

Hello everyone! I've been trying to create an account_project with little success. I've created the tokens from the scaleway console. And when I try to deploy I get the following error.

Error: scaleway-sdk-go: insufficient permissions: read account_project; write account_project
│ 
│   with scaleway_account_project.reciperium,
│   on main.tf line 1, in resource "scaleway_account_project" "reciperium":
│    1: resource "scaleway_account_project" "reciperium" {
│ 
╵

I've added my user in the console.scaleway.com as Administrator, any idea what might the issue be?

Thanks!

[Codelax]

Hello, are you sure the used api key belong to the user with permissions ?
If you want to check used api key you can look at debug output using two environment variables SCW_DEBUG=true TF_LOG=DEBUG
In logs you will see requests to scaleway's api, it contains a part of your secret key in headers, it should be enough to verify if it is the correct one.

You can also verify that the key you use is linked to your user or application. A common issue is api keys that existed before IAM are linked to an application instead of your user, this application may miss permissions.

[woile]

Thanks, I'm gonna take a look. I've created the tokens going to my profile > "API Keys", but I might've created them before assigning myself the "Administrator" Policy. I'm gonna take a look at that

[woile]

I just created a new token, my user is under the Administrator group and I still get the same error. I verified with the debug settings, and I get this:

2023-06-27T19:54:22.250+0200 [DEBUG] provider.terraform-provider-scaleway_v2.22.0: --------------- Scaleway SDK REQUEST 1 : ---------------
2023-06-27T19:54:22.250+0200 [DEBUG] provider.terraform-provider-scaleway_v2.22.0: POST /account/v2/projects HTTP/1.1
2023-06-27T19:54:22.250+0200 [DEBUG] provider.terraform-provider-scaleway_v2.22.0: Host: api.scaleway.com
2023-06-27T19:54:22.250+0200 [DEBUG] provider.terraform-provider-scaleway_v2.22.0: User-Agent: scaleway-sdk-go/v1.0.0-beta.7+dev (go1.19.10; darwin; amd64) terraform-provider/2.22.0 terraform/1.4.6
2023-06-27T19:54:22.250+0200 [DEBUG] provider.terraform-provider-scaleway_v2.22.0: Content-Length: 119
2023-06-27T19:54:22.250+0200 [DEBUG] provider.terraform-provider-scaleway_v2.22.0: Content-Type: application/json
2023-06-27T19:54:22.250+0200 [DEBUG] provider.terraform-provider-scaleway_v2.22.0: X-Auth-Token: ed7417af-xxxx-xxxx-xxxx-xxxxxxxxxxxx
2023-06-27T19:54:22.250+0200 [DEBUG] provider.terraform-provider-scaleway_v2.22.0: Accept-Encoding: gzip
2023-06-27T19:54:22.250+0200 [DEBUG] provider.terraform-provider-scaleway_v2.22.0: 
2023-06-27T19:54:22.250+0200 [DEBUG] provider.terraform-provider-scaleway_v2.22.0: {"name":"reciperium","organization_id":"631db6a8-xxxxxxxxxxxxx","description":"Manage recipes with ease"}
2023-06-27T19:54:22.250+0200 [DEBUG] provider.terraform-provider-scaleway_v2.22.0: ---------------------------------------------------------
2023-06-27T19:54:22.250+0200 [INFO]  provider.terraform-provider-scaleway_v2.22.0: 2023/06/27 19:54:22 [DEBUG] [DEBUG] POST https://api.scaleway.com/account/v2/projects: timestamp=2023-06-27T19:54:22.250+0200
2023-06-27T19:54:22.451+0200 [DEBUG] provider.terraform-provider-scaleway_v2.22.0: DEBUG: 2023/06/27 19:54:22 
2023-06-27T19:54:22.451+0200 [DEBUG] provider.terraform-provider-scaleway_v2.22.0: --------------- Scaleway SDK RESPONSE 1 : ---------------
2023-06-27T19:54:22.451+0200 [DEBUG] provider.terraform-provider-scaleway_v2.22.0: HTTP/2.0 403 Forbidden
2023-06-27T19:54:22.451+0200 [DEBUG] provider.terraform-provider-scaleway_v2.22.0: Content-Length: 173
2023-06-27T19:54:22.451+0200 [DEBUG] provider.terraform-provider-scaleway_v2.22.0: Content-Security-Policy: default-src 'none'; frame-ancestors 'none'
2023-06-27T19:54:22.451+0200 [DEBUG] provider.terraform-provider-scaleway_v2.22.0: Content-Type: application/json
2023-06-27T19:54:22.451+0200 [DEBUG] provider.terraform-provider-scaleway_v2.22.0: Date: Tue, 27 Jun 2023 17:54:22 GMT
2023-06-27T19:54:22.451+0200 [DEBUG] provider.terraform-provider-scaleway_v2.22.0: Server: Scaleway API-Gateway
2023-06-27T19:54:22.451+0200 [DEBUG] provider.terraform-provider-scaleway_v2.22.0: Strict-Transport-Security: max-age=63072000
2023-06-27T19:54:22.451+0200 [DEBUG] provider.terraform-provider-scaleway_v2.22.0: X-Content-Type-Options: nosniff
2023-06-27T19:54:22.451+0200 [DEBUG] provider.terraform-provider-scaleway_v2.22.0: X-Frame-Options: DENY
2023-06-27T19:54:22.451+0200 [DEBUG] provider.terraform-provider-scaleway_v2.22.0: X-Request-Id: 5ad42264-b0a6-4384-8417-fed13c8414bb
2023-06-27T19:54:22.451+0200 [DEBUG] provider.terraform-provider-scaleway_v2.22.0: 
2023-06-27T19:54:22.451+0200 [DEBUG] provider.terraform-provider-scaleway_v2.22.0: {"details":[{"action":"read","resource":"account_project"},{"action":"write","resource":"account_project"}],"message":"insufficient permissions","type":"permissions_denied"}
2023-06-27T19:54:22.451+0200 [DEBUG] provider.terraform-provider-scaleway_v2.22.0: ----------------------------------------------------------
2023-06-27T19:54:22.452+0200 [ERROR] provider.terraform-provider-scaleway_v2.22.0: Response contains error diagnostic: diagnostic_summary="scaleway-sdk-go: insufficient permissions: read account_project; write account_project" tf_proto_version=5.3 tf_resource_type=scaleway_account_project @caller=github.com/hashicorp/[email protected]/tfprotov5/internal/diag/diagnostics.go:55 @module=sdk.proto diagnostic_detail= diagnostic_severity=ERROR tf_provider_addr=provider tf_req_id=255a55d9-4e33-96ba-6ca4-319f07e271d3 tf_rpc=ApplyResourceChange timestamp=2023-06-27T19:54:22.451+0200
2023-06-27T19:54:22.475+0200 [ERROR] vertex "scaleway_account_project.reciperium" error: scaleway-sdk-go: insufficient permissions: read account_project; write account_project
╷
│ Error: scaleway-sdk-go: insufficient permissions: read account_project; write account_project
│ 
│   with scaleway_account_project.reciperium,
│   on main.tf line 1, in resource "scaleway_account_project" "reciperium":
│    1: resource "scaleway_account_project" "reciperium" {
│ 
╵
2023-06-27T19:54:22.499+0200 [DEBUG] provider.stdio: received EOF, stopping recv loop: err="rpc error: code = Unavailable desc = error reading from server: EOF"
2023-06-27T19:54:22.501+0200 [DEBUG] provider: plugin process exited: path=.terraform/providers/registry.terraform.io/scaleway/scaleway/2.22.0/darwin_amd64/terraform-provider-scaleway_v2.22.0 pid=44108
2023-06-27T19:54:22.501+0200 [DEBUG] provider: plugin exited

Do I need to enable something like MFA for the API token to work? what am I missing?
Thanks

[Codelax]

When you look at the request log, you can see an anonymized secret key

X-Auth-Token: ed7417af-xxxx-xxxx-xxxx-xxxxxxxxxxxx

It should be enough to check if it is the correct one you are using.
If you have correct permissions for your user and the token belong to the same user, you should not have issues.

[woile]

I know, I verified and it's the correct token. The strange thing is that this token is created under the "default" project. Which I would expect would allow me to create another project. Is this correct?

[woile]

Just to be clear. When I click on API Keys (1), it automatically chooses my Default project (2). And that's the token I'm using.

My goal is to use terraform to actually create one of these projects using the resource scaleway_account_project.

Is there a different way to get an Access token then? Am I understanding something wrong?

[woile]

I was able to fix it, I was using the wrong organization_id.

In order to retrieve the proper organization id, go to https://console.scaleway.com/organization/settings

The organization happens to be your profile, and you get a different Id if you go to your user and see the ID