How to fix Error: Error creating Service Account: AlreadyExists in Terraform

TerraformINTERMEDIATEMEDIUMUpdated Dec 31, 2025· 129 views

This error occurs when Terraform attempts to create a GCP Service Account that already exists in your project. The fix involves either using the create_ignore_already_exists flag or importing the existing account into your Terraform state.

Quick fix

Fixes Error: Error creating Service Account: AlreadyExists

resource "google_service_account" "my_service_account" {
  account_id   = "my-service-account"
  display_name = "My Service Account"
  project      = "my-project-id"

  create_ignore_already_exists = true
}
  1. Use create_ignore_already_exists to skip duplicate creation
  2. Import the existing service account into Terraform state
  3. Verify the service account exists in GCP
  4. Delete the service account from GCP if you want to recreate it
terraform — error
resource "google_service_account" "my_service_account" {
  account_id   = "my-service-account"
  display_name = "My Service Account"
  project      = "my-project-id"
  create_ignore_already_exists = true
}
Error: Error creating Service Account: AlreadyExists

What this error means

When you run Terraform to create a Google Cloud Platform (GCP) Service Account, you may receive the "AlreadyExists" error (HTTP 409). This happens because Terraform tried to create a service account, but GCP already has one with that email address in your project. The root cause is usually GCP's eventual consistency model. Terraform makes the initial create request, but GCP's backend may return an error on the subsequent verification call, even though the account was created. When you retry the apply, Terraform sees the account exists and throws the AlreadyExists error. In other cases, the service account may have been created outside Terraform (via gcloud CLI, Console, or by another process) but isn't tracked in your Terraform state, causing a conflict.

Typical symptoms

  • terraform apply fails with "Error 409: Service account already exists within project"
  • The error message includes the service account email (e.g., my-sa@my-project.iam.gserviceaccount.com)
  • Manually checking GCP Console confirms the service account exists
  • The error persists even after waiting and retrying terraform apply

Common causes

  1. GCP's eventual consistency model causes verify-after-create to fail, triggering a retry on subsequent applies
  2. The service account was created outside Terraform (via gcloud, Console, or another tool) but isn't in your Terraform state
  3. The Terraform state file is out of sync with actual GCP resources
  4. Multiple Terraform runs executed simultaneously, both attempting to create the same account

How to fix "Error: Error creating Service Account: AlreadyExists"

1Use create_ignore_already_exists to skip duplicate creation

The recommended solution is to add the create_ignore_already_exists = true flag to your google_service_account resource. This tells Terraform to skip creation if the account already exists.

hcl
resource "google_service_account" "my_service_account" {
  account_id   = "my-service-account"
  display_name = "My Service Account"
  project      = "my-project-id"

  create_ignore_already_exists = true
}

This is the safest fix because it prevents the error without destructive changes. Terraform will create the account on first apply, and on subsequent applies it will recognize the account exists and skip creation.

2Import the existing service account into Terraform state

If the service account was created outside Terraform, import it into your state file. First, get the service account email from GCP Console, then run the terraform import command:

bash
terraform import google_service_account.my_service_account projects/MY_PROJECT_ID/serviceAccounts/my-service-account@my-project-id.iam.gserviceaccount.com

Replace the values:
- google_service_account.my_service_account: Your resource address in Terraform
- MY_PROJECT_ID: Your GCP project ID
- my-service-account@my-project-id.iam.gserviceaccount.com: The full service account email

After import, terraform plan should show no changes. The account is now tracked in your state.

3Verify the service account exists in GCP

Before importing or troubleshooting, confirm the account exists:

bash
gcloud iam service-accounts list --project=MY_PROJECT_ID

Look for your service account email in the output. If it's there, you need to import it (step 2). If it's not there, the error may be transient—wait a few seconds and retry terraform apply.

You can also describe a specific account:

bash
gcloud iam service-accounts describe my-service-account@my-project-id.iam.gserviceaccount.com --project=MY_PROJECT_ID
4Delete the service account from GCP if you want to recreate it

If the existing account is orphaned or misconfigured, you can delete it from GCP and let Terraform recreate it:

bash
gcloud iam service-accounts delete my-service-account@my-project-id.iam.gserviceaccount.com --project=MY_PROJECT_ID

Wait a few seconds for the deletion to propagate, then run:

bash
terraform apply

Warning: Deleting a service account also removes all associated keys and IAM bindings. If the account is in use, make sure to recreate those bindings in your Terraform configuration or manually restore them afterward.

5Handle eventual consistency delays in dependent resources

If you're creating IAM roles or keys immediately after the service account in the same Terraform config, GCP's eventual consistency can cause downstream failures. Add a small delay using local-exec:

hcl
resource "google_service_account" "my_service_account" {
  account_id   = "my-service-account"
  display_name = "My Service Account"
  project      = "my-project-id"

  create_ignore_already_exists = true
}

resource "null_resource" "eventual_consistency" {
  depends_on = [google_service_account.my_service_account]

  provisioner "local-exec" {
    command = "sleep 2"
  }
}

resource "google_service_account_key" "my_key" {
  depends_on             = [null_resource.eventual_consistency]
  service_account_id     = google_service_account.my_service_account.name
  public_key_type        = "TYPE_X509_PEM_FILE"
}

This ensures GCP has time to replicate the account before attempting to create dependent resources.

6Check Terraform and provider versions for known bugs

Update Terraform and the Google provider to latest versions, as GCP service account issues have been fixed in recent releases:

bash
terraform version

Update your provider in versions.tf or main.tf:

hcl
terraform {
  required_providers {
    google = {
      source  = "hashicorp/google"
      version = "~> 6.0"  # Use latest stable version
    }
  }
}

Then run:

bash
terraform init -upgrade
terraform apply

Check the GitHub issues for the terraform-provider-google project to see if your specific scenario has a known workaround.

Advanced notes

Eventual Consistency in GCP: Service accounts are eventually consistent across GCP's infrastructure. When you create an account, the API may return success but the get operation might briefly fail, causing Terraform's validate-after-create to error. The create_ignore_already_exists flag was added specifically to handle this edge case.

Service Account Quotas: Each GCP project has a limit on the number of service accounts (typically 100). If you're near the quota, you may see 409 errors even when not explicitly duplicating. Check your quota usage in GCP Console under APIs & Services > Quotas.

State File Synchronization: Always commit your Terraform state file (if not using remote state) to version control with team members, or use Terraform Cloud/Enterprise for shared state. Diverged state causes "account exists but not in state" issues across teams.

Rootless Docker and Service Accounts: If running Terraform in containers, ensure the container has proper credentials (via GOOGLE_APPLICATION_CREDENTIALS or Application Default Credentials). Service account creation can fail with permission errors if credentials aren't configured correctly.

Frequently asked questions

What does "Error: Error creating Service Account: AlreadyExists" mean?
When you run Terraform to create a Google Cloud Platform (GCP) Service Account, you may receive the "AlreadyExists" error (HTTP 409). This happens because Terraform tried to create a service account, but GCP already has one with that email address in your project. The root cause is usually GCP's eventual consistency model.
How do I fix "Error: Error creating Service Account: AlreadyExists"?
This error occurs when Terraform attempts to create a GCP Service Account that already exists in your project. The fix involves either using the create_ignore_already_exists flag or importing the existing account into your Terraform state.
What causes "Error: Error creating Service Account: AlreadyExists"?
GCP's eventual consistency model causes verify-after-create to fail, triggering a retry on subsequent applies The service account was created outside Terraform (via gcloud, Console, or another tool) but isn't in your Terraform state The Terraform state file is out of sync with actual GCP resources
Is the "Error: Error creating Service Account: AlreadyExists" error serious?
It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading