Access control

AI Platform Pipelines depends on Identity and Access Management (IAM) roles to authorize users, groups, and services when machine learning (ML) pipelines access Google Cloud resources.

This document describes the roles required to:

Learn more about IAM concepts and how IAM works.

Roles required to set up AI Platform Pipelines

To deploy AI Platform Pipelines, you must be granted the Viewer (roles/viewer) and Kubernetes Engine Admin (roles/container.admin) roles on the project. The Viewer role provides read access to all resources within a project. The Kubernetes Engine Admin role provides full access to Kubernetes clusters and Kubernetes API objects.

To follow the principle of least privilege, set up your AI Platform Pipelines cluster to use granular access. To set up your cluster with granular access, you must also be granted the Service Account Admin (roles/iam.serviceAccountAdmin) role on the project. The Service Account Admin role provides access to create and configure IAM service accounts.

Learn more about granting access to IAM roles.

Role Title Description Permissions
roles/viewer Viewer Permissions for read-only actions that do not affect state, such as viewing (but not modifying) existing resources or data within a project.
roles/container.admin Kubernetes Engine Admin

Provides access to full management of clusters and their Kubernetes API objects.

To set a service account on nodes, you must also grant the Service Account User role (roles/iam.serviceAccountUser).

  • container.*
  • resourcemanager.projects.get
  • resourcemanager.projects.list
roles/iam.serviceAccountAdmin Service Account Admin Create and manage service accounts.
  • iam.serviceAccounts.create
  • iam.serviceAccounts.delete
  • iam.serviceAccounts.disable
  • iam.serviceAccounts.enable
  • iam.serviceAccounts.get
  • iam.serviceAccounts.getIamPolicy
  • iam.serviceAccounts.list
  • iam.serviceAccounts.setIamPolicy
  • iam.serviceAccounts.undelete
  • iam.serviceAccounts.update
  • resourcemanager.projects.get
  • resourcemanager.projects.list

Roles required to run AI Platform Pipelines with a user-managed service account

The Pods on a Google Kubernetes Engine (GKE) cluster authenticate to Google Cloud using the GKE cluster's service account. To make AI Platform Pipelines easier to set up and use, GKE clusters created by AI Platform Pipelines use the default Compute Engine service account with the https://www.googleapis.com/auth/cloud-platform access scope. This access scope provides full access to the Google Cloud resources and APIs that you have enabled in your project, which may provide the workloads on your cluster excessive access to Google Cloud.

To assign granular permissions to the workloads that run on your AI Platform Pipelines cluster, create a service account for your cluster and grant this service account access to the following roles on the project:

  • Monitoring Viewer: The Monitoring Viewer (roles/monitoring.viewer) role provides read access to monitoring data and configurations.
  • Monitoring Metric Writer: The Monitoring Metric Writer (roles/monitoring.metricWriter) role provides write access so your cluster can write metrics.
  • Logs Writer: The Logs Writer (roles/logging.logWriter) role lets your cluster write log entries.
  • Storage Object Viewer: If you plan to create custom container images for your pipelines that are stored in Container Registry, grant your AI Platform Pipelines cluster access to the Storage Object Viewer (roles/storage.objectViewer) role on the project.

You must also grant your service account access to any Google Cloud resources or APIs that your ML pipelines use.

Role Title Description Permissions
roles/monitoring.viewer Monitoring Viewer Provides read-only access to get and list information about all monitoring data and configurations.
  • cloudnotifications.*
  • monitoring.alertPolicies.get
  • monitoring.alertPolicies.list
  • monitoring.dashboards.get
  • monitoring.dashboards.list
  • monitoring.groups.get
  • monitoring.groups.list
  • monitoring.metricDescriptors.get
  • monitoring.metricDescriptors.list
  • monitoring.monitoredResourceDescriptors.*
  • monitoring.notificationChannelDescriptors.*
  • monitoring.notificationChannels.get
  • monitoring.notificationChannels.list
  • monitoring.publicWidgets.get
  • monitoring.publicWidgets.list
  • monitoring.services.get
  • monitoring.services.list
  • monitoring.slos.get
  • monitoring.slos.list
  • monitoring.timeSeries.list
  • monitoring.uptimeCheckConfigs.get
  • monitoring.uptimeCheckConfigs.list
  • resourcemanager.projects.get
  • resourcemanager.projects.list
  • stackdriver.projects.get
roles/monitoring.metricWriter Monitoring Metric Writer Provides write-only access to metrics. This provides exactly the permissions needed by the Cloud Monitoring agent and other systems that send metrics.
  • monitoring.metricDescriptors.create
  • monitoring.metricDescriptors.get
  • monitoring.metricDescriptors.list
  • monitoring.monitoredResourceDescriptors.*
  • monitoring.timeSeries.create
roles/logging.logWriter Logs Writer Provides the permissions to write log entries.
  • logging.logEntries.create
roles/storage.objectViewer Storage Object Viewer Grants access to view objects and their metadata, excluding ACLs. Can also list the objects in a bucket.
  • resourcemanager.projects.get
  • resourcemanager.projects.list
  • storage.objects.get
  • storage.objects.list

Roles required to access AI Platform Pipelines as a user

To access an AI Platform Pipelines cluster, each user must be granted the Kubernetes Engine Cluster Viewer (roles/container.clusterViewer) role and the Service Account User Role for the Google Kubernetes Engine cluster's service account.

Role Title Description Permissions
roles/container.clusterViewer Kubernetes Engine Cluster Viewer Get and list access to GKE Clusters.
  • container.clusters.get
  • container.clusters.list
  • resourcemanager.projects.get
  • resourcemanager.projects.list

Continue to the next section to learn how to grant users access to the Kubernetes Engine Cluster Viewer role and the Service Account User Role.

Grant a user access to AI Platform Pipelines

Use the following instructions to grant a user account access to your AI Platform Pipelines cluster.

  1. Open AI Platform Pipelines in the Google Cloud Console.

    Go to AI Platform Pipelines

  2. Find your AI Platform Pipelines cluster. Take note of the Cluster and Zone for use in subsequent steps.

  3. Open a Cloud Shell session.

    Open Cloud Shell

    Cloud Shell opens in a frame at the bottom of the Google Cloud Console. Use Cloud Shell to complete the rest of this process.

  4. Run the following command to set the default Cloud project for this Cloud Shell session.

    gcloud config set project project-id
    

    Replace project-id with your Cloud project ID.

  5. Run the following command to find the service account that your GKE cluster uses.

    gcloud container clusters describe cluster-name --zone zone \
    --format="flattened(nodePools[].config.serviceAccount)"
    

    Replace the following:

    • cluster-name: The name of your GKE cluster.
    • zone: The zone that your cluster was created in.

    The response might indicate that your cluster uses a service account named default. This value refers to the default service account for Compute Engine. Run the following command to find the full name of this service account.

    gcloud iam service-accounts list \
    --filter "compute@developer.gserviceaccount.com"
    

    Learn more about the Compute Engine default service account.

  6. Grant your user account the Service Account User role on your GKE cluster's service account.

    gcloud iam service-accounts add-iam-policy-binding \
    service-account-name \
    --member=user:username \
    --role=roles/iam.serviceAccountUser
    

    Replace the following:

    • service-account-name: The name of your GKE cluster's service account, which you found in the previous step. Service account names are formatted like *@*.gserviceaccount.com.
    • username: Your username on Google Cloud.
  7. Grant your user account access to the GKE Cluster Viewer role on the project.

    gcloud projects add-iam-policy-binding project-id \
    --member user:username --role roles/container.clusterViewer
    

    Replace the following:

    • project-id: The ID of your Google Cloud project.
    • username: Your username on Google Cloud.