Zum Hauptinhalt springen
tsecurity.de LIVE
Echtzeit-Radar & Feeds
Alle RSS Feeds
👥 Community & Social
Sichere ProgrammierungFirst-touch attribution on a cookieless static Nuxt site(21.09.2026 um 02:51 Uhr)
Sichere ProgrammierungWho Is the Customer? It Might Not Be Who Uses the Product(21.09.2026 um 02:57 Uhr)
Sichere ProgrammierungOn My Japanese Team, We Greet Each Other by Saying "You Must Be Tired"(21.09.2026 um 03:06 Uhr)
Sichere ProgrammierungRedis vs Memcached: Complete Comparison(21.09.2026 um 03:16 Uhr)
Sichere ProgrammierungHow Databricks Serverless Compute Cost My Team $14k in One Weekend(21.09.2026 um 03:20 Uhr)
Sichere ProgrammierungStop trying to make Airflow work for Medallion pipelines(21.09.2026 um 03:21 Uhr)
Sichere ProgrammierungI built an app that turns workout videos into actual workouts(21.09.2026 um 03:39 Uhr)
Sichere ProgrammierungFirst-touch attribution on a cookieless static Nuxt site(21.09.2026 um 02:51 Uhr)
Sichere ProgrammierungWho Is the Customer? It Might Not Be Who Uses the Product(21.09.2026 um 02:57 Uhr)
Sichere ProgrammierungOn My Japanese Team, We Greet Each Other by Saying "You Must Be Tired"(21.09.2026 um 03:06 Uhr)
Sichere ProgrammierungRedis vs Memcached: Complete Comparison(21.09.2026 um 03:16 Uhr)
Sichere ProgrammierungHow Databricks Serverless Compute Cost My Team $14k in One Weekend(21.09.2026 um 03:20 Uhr)
Sichere ProgrammierungStop trying to make Airflow work for Medallion pipelines(21.09.2026 um 03:21 Uhr)
Sichere ProgrammierungI built an app that turns workout videos into actual workouts(21.09.2026 um 03:39 Uhr)
Intelligence View
⚡ tsecurity.de Intelligence

GCP Undocumented: Fix Error 403: Permission to delete log notification rules denied

Reagiere als Erste:r — dein Feedback zählt!

This is a part of a series where I post solutions to problems I solved when working with Google Cloud as a Cloud Engineer. In many cases, I couldn't find those fixes in the Internet myself, and I want to document them to act as a future reference.

I'm currently creating some Cloud Monitoring Alerting Policies using Terraform. The policy we'll discuss today is the one for Service Health.

Google Cloud Service Health

The Service Health page lets you see any active issues with Google Cloud services affecting your workloads.

You can easily create an alerting policy from that page, so you can receive a notification almost instantly, when something happens to Google's infrastructure running your applications.

Here's an example of Terraform code for this alerting policy:

resource "google_monitoring_alert_policy" "service_health_alerts" {
  combiner     = "OR"
  display_name = "Service Health - All incidents, all updates"
  enabled      = true
  notification_channels = [
    google_monitoring_notification_channel.notification-channel-email.name,
  ]
  project     = var.scoping_project
  user_labels = {}

  alert_strategy {
    auto_close           = "1800s"
    notification_prompts = []

    notification_rate_limit {
      period = "300s"
    }
  }

  conditions { [redacted] }
  documentation { [redacted] }
}

The Problem

Somehow all went well when I created the policy with code and applied it. The problem started when I tried to apply any changes to the Terraform resource - changes as simple as switching the policy from enabled = true to enabled = false.

All I was getting with the terraform apply command was the following error:

googleapi: Error 403: Permission to delete log notification rules denied (or the resource may not exist).

This exact error was not documented anywhere.

The Solution

It took me hours to find out but the solution is quite simple.

To create the policy from code, I was using the account that had the Owner role on the monitoring project.

The error came up when the terraform apply command was issued with a GitHub Actions Service Account, which didn't have an Owner role.

The Service Account was a Monitoring AlertPolicy Editor on this project, but that was not enough. To work with a Service Health alert policy, it also needed to be a Logs Configuration Writer on the monitoring project.

Lessons Learned

Here's what I'll take out from this case:

  1. Always verify which account you use to implement changes from the code.
  2. To create and change the alerting policy for Google Cloud Service Health monitoring, your principal needs two roles: Monitoring AlertPolicy Editor and Logs Configuration Writer.
Ähnliche Beiträge
🔍 Verwandte News

Auch interessante Nachrichten GCP Undocumented: Fix Error 403: Permission to delete log notification rules denied

Thematisch verwandte Begriffe: Undocumented, Error, Permission, delete · 6 Treffer

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Zum Aktualisieren ziehen
ZERO-DAY CVE-2026-93974 | A flaw has been found in SourceCodester Online Reviewer Management Syste…
Advisory →
TTS Reader • tsecurity.de Voice
tsecurity.de Icon
tsecurity.de App
Offline-Lesen, Eilmeldungen & 0ms Ladezeit

Installiere tsecurity.de direkt auf deinen Home-Bildschirm für das ultimative Vollbild-Magazinerlebnis ohne Browser-Leisten.

Nächster Beitrag
Themen-Radar & Intelligence Matrix
Echtzeit-Taxonomie nach Angriffsvektoren & Plattformen

tsecurity.de Live Threat Radar

🔴 LIVE RADAR
MONITORING
AKTIV
CVE-DATENBANK
LIVE
🔍
Community Radar & Live Chat
Sentinel Bot online • Live-Stream
Dein Cluster: Security Explorer
Match:
lädt…
Verbindung zum Community-Stream wird aufgebaut...
Bearbeitungsmodus — Senden überschreibt deine Nachricht
Community-Puls — was gerade passiert
lädt…
Aktivitäten deiner Analysten
lädt…
Neues Thema oder Eilmeldung einreichen

Reiche interessante Links, Zero-Days oder Debatten ein. Die Community entscheidet per Upvote über die Veröffentlichung.

Heiß diskutierte Einreichungen
🔖 Gespeicherte Artikel
📂 Keine gespeicherten Artikel vorhanden.
Zurück Ziehen Vor
Links: vorheriger Artikel Rechts: nächster Artikel unten: schließen
News NIS-2 Frühwarnung Tier-1 Intel ⏱️ 3 Min vor 10 Min
Artikeldaten werden geladen...

Zurück: vorheriger Vor: nächster
↗ Original-Quelle
Social Reaktionen Deine Reaktion zählt
Einstufung & Relevanz-Poll 0 Stimmen
In sozialen Netzwerken teilen 1-Klick