Terraform google_project_iam_binding deletes GCP compute engine default service account from IAM principals

Solution 1:

You can restore the service accounts using the “gcloud beta iam service-accounts undelete” command.

If you accidentally delete a service account, you can try to undelete the service account instead of creating a new service account.

Please review this link if you need more info. You may notice that in order to restore a deleted account you may need the 21 digit unique ID. If you do not have this ID for the account, you could try this command :

gcloud logging read --freshness=30d --format='table(timestamp,resource.labels.email_id,resource.labels.project_id,resource.labels.unique_id)' protoPayload.methodName="google.iam.admin.v1.DeleteServiceAccount" resource.type="service_account" logName:"cloudaudit.googleapis.com%2Factivity"'

or this command:

gcloud logging read --freshness=30d protoPayload.methodName="google.iam.admin.v1.DeleteServiceAccount" | grep 'email_id|unique_id'