No matter how you like to participate in developer communities, Pulumi wants to meet you there. If you want to meet other Pulumi users to share use-cases and best practices, contribute code or documentation, see us at an event, or just tell a story about something cool you did with Pulumi, you are part of our community.

Pulumi Community

looks like I should do this:

<https://www.pulumi.com/registry/packages/gcp/service-account/>

Hey <@U05R62VEMS8> ! 
Couple of quick questions. Are you running Pulumi CLI? Is it being run locally?

If so you need to use the gcloud cli to determine which account is active on your machine. 

The Pulumi provider for GCP will use the logged in credentials to execute the Pulumi up commands. This could mean that it’s logged in as your personal account. 

Additionally. Google recommends to not use the Default Service account for the provisioning of IaC for anything more than a PoC. It’s always better to create service accounts. Provide permissions to the service account and then grant the service account user role to yourself to use that service account for IaC in development. 

I believe you will find your issue is that the gcloud cli authenticated account is not the default service account and therefore Pulumi is not using that account when your execute Pulumi up. 

Yes I am using the CLI locally; will check that, thanks.

Understood on using default service; will create a specific one.

Sweet! Let us know how you go with this! 

Still getting the issue :disappointed:

I have confirmed:
1. I'm logged in using <mailto:jmajor-cntr@soteria.io|jmajor-cntr@soteria.io> 
    a.  _gcloud auth application-default login_
2. Active Google project using _gcloud config get-value project_
3. The default compute SA has:
    a. Secret Manager Admin
    b. Secret Manager Secret Accessor
    c. Secret Manager Secret Version Adder
4. My account has "Editor" and "Service Account User" role assigned 
5. ran the config set cmd:
    a. pulumi config set gcp:project your-gcp-project-id

ok the problem was as follows:

code returns a 403:
```secret = secretmanager.Secret("opensearch-password",
    project = project.name,```
code returns a 404:
```secret = secretmanager.Secret("my-password",
    project = project.id,```
code that works:
```secret = secretmanager.Secret("opensearch-password",
    project = project.project_id,```


that took a while but got there in the end :joy: