A DevOps engineer is using Terraform to automate infrastructure deployment into a dedicated target project named `app-prod-1029`. The service account executing the Terraform pipeline resides in a shared management project `mgmt-hub-8821`. During execution, the pipeline fails with an error indicating that the Compute Engine API (`compute.googleapis.com`) is not enabled for the operation. Which action should the engineer perform to successfully deploy the resources?
- Enable the Compute Engine API in the target project `app-prod-1029` where the infrastructure resources are being provisioned.Answer
- BEnable the Compute Engine API in the shared management project `mgmt-hub-8821` where the execution service account is hosted.
- CEnable the Compute Engine API at the organization node level so that API activation inherits automatically down to all child projects.
- DGrant the Service Account User role to the execution identity in the `mgmt-hub-8821` project to bypass project API requirements.
Answer
Enable the Compute Engine API in the target project `app-prod-1029` where the infrastructure resources are being provisioned.
In Google Cloud, infrastructure service APIs (such as `compute.googleapis.com`) must be enabled specifically within the target project where the resources are created. Even if a Terraform execution service account resides in a separate central management project, resource calls target the destination project, requiring the API to be enabled there.
Step-by-Step Solution
Key Concept
API enablement in Google Cloud target projects for IaC deployments