title: Error creating Job: googleapi: Error 403: lacks IAM permission
body: <p>I am getting the following error at the moment to deploy this Cloud Scheduler resource on my dev environment.</p>
  <pre><code>1. Step #1 - &quot;Terraform plan&quot;: │ Error: Error creating Job: googleapi:
      Error 403: The principal (user or service account) lacks IAM
      permission &quot;cloudscheduler.jobs.create&quot; for the resource
      &quot;projects/whg-dev/locations/us-east1&quot; (or the resource may not
      exist).
          
          Step #1 - &quot;Terraform plan&quot;: │ 
          
          Step #1 - &quot;Terraform plan&quot;: │   with google_cloud_scheduler_job.scheduler,
          
          Step #1 - &quot;Terraform plan&quot;: │   on scheduler_template.tf line 11, in resource &quot;google_cloud_scheduler_job&quot; &quot;scheduler&quot;:
          
          Step #1 - &quot;Terraform plan&quot;: │   11: resource &quot;google_cloud_scheduler_job&quot; &quot;scheduler&quot; {
          
          Step #1 - &quot;Terraform plan&quot;: │
  </code></pre>
  <p>find below my TF configuration, i could not find what is missing...</p>
  <pre><code># Google-Cloud-Scheduler
  
  resource &quot;google_project_service&quot; &quot;scheduler_api&quot; {
    service            = &quot;cloudscheduler.googleapis.com&quot;
    provider           = google-beta
    project            = var.project_id
    disable_on_destroy = false
  }
  
  
  resource &quot;google_cloud_scheduler_job&quot; &quot;scheduler&quot; {
    name               = &quot;NotificationsRemindersBatch-test&quot;
    description        = &quot;test http job&quot;
    schedule           = &quot;*/30 * * * *&quot;
    time_zone          = &quot;Etc/UTC&quot;
    region             = &quot;us-east1&quot;
    attempt_deadline   = &quot;180s&quot;
    project            = var.project_id
    depends_on         = [google_project_service.scheduler_api]
  
    retry_config {
      retry_count = 1
    }
  
    http_target {
      http_method      = &quot;POST&quot;
      uri              = &quot;https://notifications-reminders-service-v35463ja-ue.a.run.app/&quot;
      body             = base64encode(&quot;{\&quot;foo\&quot;:\&quot;bar\&quot;}&quot;)
    }
  }
  </code></pre>
  <p>IAM ROLES config and Authorize</p>
  <p>These config are setting in a different repository as main.tf, and this is the setup:</p>
  <pre><code>resource &quot;google_cloud_run_service_iam_member&quot; &quot;authorize&quot; {
    location = google_cloud_run_service.main.location
    project  = google_cloud_run_service.main.project
    service  = google_cloud_run_service.main.name
    role     = &quot;roles/run.invoker&quot;
    member   = &quot;allUsers&quot;
  }
  
  resource &quot;google_project_iam_member&quot; &quot;project&quot; {
      count   = length(var.roles)
    project = google_cloud_run_service.main.project
    role    = var.roles[count.index]
    member  = &quot;serviceAccount:${google_service_account.sa.email}&quot;
  }
  </code></pre>
  <p>And in the variable folder there is a &quot;roles&quot; paramater created as well.</p>
  <p>Hope this helps.</p>