The Cloud Resource Manager API disabled error occurs when Terraform tries to manage GCP resources but the cloudresourcemanager.googleapis.com API has not been enabled on the project. This is a chicken-and-egg problem where the API must be manually enabled before Terraform can use it.
The Cloud Resource Manager API is a foundational GCP API that Terraform requires to manage other APIs and resources in a project. When you try to use Terraform to enable APIs or manage project-level resources, it needs the Cloud Resource Manager API to be available. This error occurs because the API has either never been enabled on the project, or it was explicitly disabled. The tricky part is that Terraform cannot enable this API itself—you need the API to be enabled before Terraform can make any API calls. This creates a bootstrap problem where manual intervention is required for the first enablement.
The fastest solution is to manually enable the API using the gcloud CLI before running Terraform:
gcloud services enable cloudresourcemanager.googleapis.com --project=YOUR_PROJECT_IDReplace YOUR_PROJECT_ID with your actual GCP project ID. You need the gcloud CLI installed and authenticated.
If you prefer the web interface:
1. Go to [Google Cloud Console](https://console.cloud.google.com)
2. Select your project from the dropdown at the top
3. In the left sidebar, click "APIs & Services" > "Library"
4. Search for "Cloud Resource Manager API"
5. Click on the result and click "Enable"
6. Wait 1-2 minutes for the API to activate
You can also use the URL provided in the error message.
Confirm that the Cloud Resource Manager API is now active:
gcloud services list --enabled --project=YOUR_PROJECT_ID | grep cloudresourcemanagerYou should see cloudresourcemanager.googleapis.com in the output.
If you are using a service account with a JSON key file, you may also need to enable the Service Usage API:
gcloud services enable serviceusage.googleapis.com --project=YOUR_PROJECT_IDThis is required because service accounts use a different API endpoint to enable other APIs.
After enabling the API, retry your Terraform command:
terraform init
terraform plan
terraform applyThe error should no longer appear, and Terraform can now manage your GCP project.
If using the terraform-google-project-factory module, it includes a helper script to set up the seed project:
./modules/bootstrap/bin/create_seed_project.shThis script automatically enables Cloud Resource Manager API on the seed project and configures the service account with the necessary roles.
For CI/CD pipelines, enable the Cloud Resource Manager API on the GCP project before running Terraform. In GitHub Actions, GitLab CI, or other CI systems, add a step that runs gcloud services enable cloudresourcemanager.googleapis.com before the Terraform steps.
When using service accounts, ensure the service account has the "Service Usage Admin" role (roles/serviceusage.serviceUsageAdmin) or "Owner" role. The Cloud Resource Manager API differs from other APIs—it cannot be enabled by Terraform itself due to this circular dependency, unlike compute.googleapis.com, storage.googleapis.com, etc.
For the terraform-google-project-factory module specifically, the TROUBLESHOOTING.md recommends enabling Cloud Resource Manager on the Seed Project (the project where the factory service account is created), not just the target project. Check that both projects have the API enabled if you are using an organization-level setup.
Error: Error installing helm release: cannot re-use a name that is still in use
How to fix "release name in use" error in Terraform with Helm
Error: Error creating GKE Cluster: BadRequest
BadRequest error creating GKE cluster in Terraform
Error: External program failed to produce valid JSON
External program failed to produce valid JSON
Error: Unsupported argument in child module call
How to fix "Unsupported argument in child module call" in Terraform
Error: network is unreachable
How to fix "network is unreachable" in Terraform