GCP: Policy update access denied., forbidden

Error: Request "Create IAM Members roles/logging.logWriter serviceAccount:tf-gke-rain-gke-1-xga7@hello-world-261715.iam.gserviceaccount.com for \"project \\\"hello-world-261715\\\"\"" returned error: Error applying IAM policy for project "hello-world-261715": Error setting IAM policy for project "hello-world-261715": googleapi: Error 403: Policy update access denied., forbidden

Solution:

Goto IAM -> Choose 924140772978-compute@developer.gserviceaccount.com, Edit by click the pencil at the end of the line.

In the Role Dropdown menu, choose project, then choose owner.