Accessing Cross-Project Cloud Storage Buckets

By default, Cloud Dataprep can access data within the Google Cloud Platform project from which Cloud Dataprep is run. To give your Cloud Dataprep project access to a Cloud Storage bucket owned by a different Google Cloud console project, you must make the bucket accessible to the service accounts in your Cloud Dataprep project, and then manually enter that Cloud Storage location in the UI.

If you grant Cloud Dataprep access to a bucket in another project, disabling Cloud Dataprep will not remove these permissions. The permissions must be manually removed to fully revoke Trifacta access to buckets in other projects.

Finding your project's service accounts

Here are the Cloud Dataprep-related services accounts that you will find listed on the Google Cloud console IAM & Admin→Permissions page of your Cloud Dataprep project:

• Google Compute Engine:
  [e-mail]
• Cloud Dataprep:
  [e-mail]

Granting service account access to a bucket

You can run Google Cloud CLI gsutil commands to grant your project's service accounts ownership (read/write permission) to both the bucket and its contents.

To grant your Cloud Dataprep project's service accounts access to new objects created in a Cloud Storage bucket in another project, use the following gsutil defacl commands in your shell or terminal window.

gsutil defacl ch -u \
    [e-mail]:OWNER \
    gs://bucket
gsutil defacl ch -u \
    [e-mail]:OWNER \
    gs://bucket

To grant your Cloud Dataprep project's service accounts access to a Cloud Storage bucket and the current contents of the bucket in another project, use the following gsutil acl commands in your shell or terminal window:

gsutil acl ch -u \
    [e-mail]:OWNER \
    gs://bucket
gsutil -m acl ch -r -u \
    [e-mail]:OWNER \
    gs://bucket
gsutil acl ch -u \
    [e-mail]:OWNER \
    gs://bucket
gsutil -m acl ch -r -u \
    [e-mail]:OWNER \
    gs://bucket

Note: The -m option runs the command in parallel for quicker processing; the -r option runs the command recursively on resources within the bucket.

To grant your Cloud Dataprep project's service accounts access to both current and new objects in a Cloud Storage bucket in another project, run both sets of commands listed above.

Entering the bucket path in the Cloud Dataprep UI

You can access a bucket in the Cloud Dataprep UI by manually entering the Google Cloud Storage path. The UI will not allow you to enter the Cloud Storage path If you have not given the Cloud Dataprep service account access to the bucket (see Granting service account access to a bucket).

Removing service account access to a bucket

If you have granted service account access to a bucket, you can run the following Google Cloud CLI gsutil acl commands to remove your project's service accounts ownership (read/write permission) to the bucket and its contents.

gsutil defacl ch -d \
    [e-mail]:OWNER \
    gs://bucket
gsutil defacl ch -d \
    [e-mail]:OWNER \
    gs://bucket
gsutil acl ch -d \
    [e-mail] \
    gs://bucket
gsutil -m acl ch -r -d \
    [e-mail] \
    gs://bucket
gsutil acl ch -d \
    [e-mail] \
    gs://bucket
gsutil -m acl ch -r -d \
    [e-mail] \
    gs://bucket

Note: The -m option runs the command in parallel for quicker processing; the -r option runs the command recursively on resources within the bucket.