How to fix Error: Error creating Service Account: AlreadyExists in Terraform

The recommended solution is to add the create_ignore_already_exists = true flag to your google_service_account resource. This tells Terraform to skip creation if the account already exists.

resource "google_service_account" "my_service_account" {
  account_id   = "my-service-account"
  display_name = "My Service Account"
  project      = "my-project-id"

  create_ignore_already_exists = true
}

This is the safest fix because it prevents the error without destructive changes. Terraform will create the account on first apply, and on subsequent applies it will recognize the account exists and skip creation.

If the service account was created outside Terraform, import it into your state file. First, get the service account email from GCP Console, then run the terraform import command:

terraform import google_service_account.my_service_account projects/MY_PROJECT_ID/serviceAccounts/[email protected]

Replace the values:
- google_service_account.my_service_account: Your resource address in Terraform
- MY_PROJECT_ID: Your GCP project ID
- [email protected]: The full service account email

After import, terraform plan should show no changes. The account is now tracked in your state.

Before importing or troubleshooting, confirm the account exists:

gcloud iam service-accounts list --project=MY_PROJECT_ID

Look for your service account email in the output. If it's there, you need to import it (step 2). If it's not there, the error may be transient—wait a few seconds and retry terraform apply.

You can also describe a specific account:

gcloud iam service-accounts describe [email protected] --project=MY_PROJECT_ID

If the existing account is orphaned or misconfigured, you can delete it from GCP and let Terraform recreate it:

gcloud iam service-accounts delete [email protected] --project=MY_PROJECT_ID

Wait a few seconds for the deletion to propagate, then run:

terraform apply

Warning: Deleting a service account also removes all associated keys and IAM bindings. If the account is in use, make sure to recreate those bindings in your Terraform configuration or manually restore them afterward.

If you're creating IAM roles or keys immediately after the service account in the same Terraform config, GCP's eventual consistency can cause downstream failures. Add a small delay using local-exec:

resource "google_service_account" "my_service_account" {
  account_id   = "my-service-account"
  display_name = "My Service Account"
  project      = "my-project-id"

  create_ignore_already_exists = true
}

resource "null_resource" "eventual_consistency" {
  depends_on = [google_service_account.my_service_account]

  provisioner "local-exec" {
    command = "sleep 2"
  }
}

resource "google_service_account_key" "my_key" {
  depends_on             = [null_resource.eventual_consistency]
  service_account_id     = google_service_account.my_service_account.name
  public_key_type        = "TYPE_X509_PEM_FILE"
}

This ensures GCP has time to replicate the account before attempting to create dependent resources.

Update Terraform and the Google provider to latest versions, as GCP service account issues have been fixed in recent releases:

terraform version

Update your provider in versions.tf or main.tf:

terraform {
  required_providers {
    google = {
      source  = "hashicorp/google"
      version = "~> 6.0"  # Use latest stable version
    }
  }
}

Then run:

terraform init -upgrade
terraform apply

Check the GitHub issues for the terraform-provider-google project to see if your specific scenario has a known workaround.