Dataproc Serverless service account

Note: Security requirement: You are required to have service account ActAs permission to execute Dataproc Serverless workloads. The Service Account User role contains this permission. See Roles for service account authentication for detailed information about service account permissions.

A Dataproc Serverless for Spark batch workload or interactive session runs as the Compute Engine default service account unless you specify a custom service account when you submit a batch workload, create a session, or create a session runtime template.

Required Dataproc Worker role

The Dataproc Serverless workload service account must have the Identity and Access Management Dataproc Worker role. The Compute Engine default service account ([e-mail]) that Dataproc Serverless uses has this role by default. If you specify your own service account for your batch workload, session, or session template, you must grant the Dataproc Worker role to your service account. Additional roles may be necessary to for other operations, such as reading and writing data to BigQuery.

Note: In some projects, the workload service account may have been automatically granted the project Editor role, which includes the Dataproc Worker role permissions plus additional permissions not needed by Dataproc Serverless. To follow the security best practice principle of least privilege, replace the workload service account Editor role with the Dataproc Worker role.

View and manage IAM service account roles

To view and manage the roles granted to the Dataproc Serverless workload service account, do the following:

1. In the Google Cloud console, go to the IAM page.

   Go to IAM

2. Click Include Google-provided role grants.

3. View the roles listed for the workload service account. The following image shows the required Dataproc Worker role listed for the Compute Engine default service account ([e-mail]) that Dataproc Serverless uses by default as the workload service account.

   

4. You can click the pencil icon displayed on the service account row to grant or remove service account roles.