GCP IAM: Binding role to Service Account fails

Question

I have created a ServiceAccount and a custom role from the GCP console.

However when trying to associate them, it fails as below:

gcloud projects add-iam-policy-binding my-project \
  --member serviceAccount:[email protected] \
  --role roles/MyCustomRole
ERROR: Policy modification failed. For a binding with condition, run "gcloud alpha iam policies lint-condition" to identify issues in condition.
ERROR: (gcloud.projects.add-iam-policy-binding) INVALID_ARGUMENT: Role roles/ClusterUpscaler is not supported for this resource.

any ideas why?

Answer 1

You might have to create role MyCustomRole before attempting to assign it. No clue what it complains about role ClusterUpscaler, but there might not be a cluster present in that project... besides custom roles usually have names alike projects/{project-id}/roles/{role-name}. They can also be listed:

gcloud iam list-grantable-roles //cloudresourcemanager.googleapis.com/projects/PROJECT_ID