How do I access AIP_STORAGE_URI in Vertex AI?

user_6516069 0
Viewed 742

I uploaded a model with

gcloud beta ai models upload --artifact-uri

And in the docker I access AIP_STORAGE_URI. I see that AIP_STORAGE_URI is another Google Storage location so I try to download the files using storage.Client() but then it says that I don't have access:

google.api_core.exceptions.Forbidden: 403 GET https://storage.googleapis.com/storage/v1/b/caip-tenant-***-***-*-*-***?projection=noAcl&prettyPrint=false: custom-online-prediction@**.iam.gserviceaccount.com does not have storage.buckets.get access to the Google Cloud Storage bucket

I am running this endpoint with the default service account.

https://cloud.google.com/vertex-ai/docs/predictions/custom-container-requirements#artifacts

According to the above link: The service account that your container uses by default has permission to read from this URI.

What am I doing wrong?

google-cloud-vertex-ai google-cloud-platform
1 Answers

The reason behind the error being, the default service account that Vertex AI uses has the “Storage Object Viewer” role which excludes the storage.buckets.get permission. At the same time, the storage.Client() part of the code makes a storage.buckets.get request to the Vertex AI managed bucket for which the default service account does not have permission to.

To resolve the issue, I would suggest you to follow the below steps -

  1. Make changes in the custom code to access the bucket with the model artifacts in your project instead of using the environment variable AIP_STORAGE_URI which points to the model location in the Vertex AI managed bucket.

  2. Create your own service account and grant the service account with all the permissions needed by the custom code. For this specific error, a role with the storage.buckets.get permission, eg. Storage Admin ("roles/storage.admin") has to be granted to the service account.

  3. Provide the newly created service account in the "Service Account" field when deploying the model.

user_157458840
Related