Facing issues while running the initial stage of bootstrap

[Aviato-Architect-2]

Hey @ludoo @juliocc I am facing issues while running the initial terraform apply -var bootstrap_user=$(gcloud config list --format 'value(core.account)') . I have all the necessary permission but still i am not able to run the CFF.
Below is the error

Error: Error applying IAM policy for organization "1005726241605": Error setting IAM policy for organization "1005726241605": googleapi: Error 403: The caller does not have permission, forbidden
│
│ with module.organization.google_organization_iam_binding.authoritative["roles/resourcemanager.folderAdmin"],
│ on ../../../modules/organization/iam.tf line 103, in resource "google_organization_iam_binding" "authoritative":
│ 103: resource "google_organization_iam_binding" "authoritative" {
│
╵
╷
│ Error: Error applying IAM policy for organization "1005726241605": Error setting IAM policy for organization "1005726241605": googleapi: Error 403: The caller does not have permission, forbidden
│
│ with module.organization.google_organization_iam_binding.authoritative["roles/resourcemanager.projectCreator"],
│ on ../../../modules/organization/iam.tf line 103, in resource "google_organization_iam_binding" "authoritative":
│ 103: resource "google_organization_iam_binding" "authoritative" {
│
╵
╷
│ Error: Error applying IAM policy for organization "1005726241605": Error setting IAM policy for organization "1005726241605": googleapi: Error 403: The caller does not have permission, forbidden
│
│ with module.organization.google_organization_iam_binding.authoritative["roles/resourcemanager.tagAdmin"],
│ on ../../../modules/organization/iam.tf line 103, in resource "google_organization_iam_binding" "authoritative":
│ 103: resource "google_organization_iam_binding" "authoritative" {

I have completed all the pre requisite and assigned all the necessary permission to my bootstrap user still I am not able run

[juliocc]

This is a permission issue. Please confirm you have the Organization Admin role

[Aviato-Architect-2]

Hello @juliocc I have all the necessary roles for running the CFF

[juliocc]

Are you running terraform using that identity? Are you sure you're not using impersonation?

[Aviato-Architect-2]

I am running using a service account because my initial bootstrap account is not able to run CFF even though i have given org admin permission.

[juliocc]

you have a permissions issue. Ensure you run bootstrap as explained in the docs using the permissions detailed there. The error you're getting is saying that the identity running terraform does not have the Organization Admin role.

[Aviato-Architect-2]

Hey @juliocc i have managed to fix the error thanks for your help