esource-id zenml-bucket-sl

Example Command OutputError: Service connector 'gcp-empty-sa' verification failed: connector authorization failure: failed to fetch GCS bucket

zenml-bucket-sl: 403 GET https://storage.googleapis.com/storage/v1/b/zenml-bucket-sl?projection=noAcl&prettyPrint=false:

empty-connectors@zenml-core.iam.gserviceaccount.com does not have storage.buckets.get access to the Google Cloud Storage bucket.

Permission 'storage.buckets.get' denied on resource (or it may not exist).

Next, we'll register a GCP Service Connector that actually uses account impersonation to access the zenml-bucket-sl GCS bucket and verify that it can actually access the bucket:

zenml service-connector register gcp-impersonate-sa --type gcp --auth-method impersonation --service_account_json=@empty-connectors@zenml-core.json  --project_id=zenml-core --target_principal=zenml-bucket-sl@zenml-core.iam.gserviceaccount.com --resource-type gcs-bucket --resource-id gs://zenml-bucket-sl

Example Command Output

Expanding argument value service_account_json to contents of file /home/stefan/aspyre/src/zenml/empty-connectors@zenml-core.json.

Successfully registered service connector `gcp-impersonate-sa` with access to the following resources:

┏━━━━━━━━━━━━━━━┯━━━━━━━━━━━━━━━━━━━━━━┓

┃ RESOURCE TYPE │ RESOURCE NAMES       ┃

┠───────────────┼──────────────────────┨

┃ 📦 gcs-bucket │ gs://zenml-bucket-sl ┃

┗━━━━━━━━━━━━━━━┷━━━━━━━━━━━━━━━━━━━━━━┛

External Account (GCP Workload Identity)

Use GCP workload identity federation to authenticate to GCP services using AWS IAM credentials, Azure Active Directory credentials or generic OIDC tokens.