Versions Compared

Old Version 2

changes.mady.by.user Terence Yim (Unlicensed)

Saved on

compared with

New Version 3

changes.mady.by.user Robin Rielley

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

This page describes how to grant service account user permission to the Cloud Data Fusion. When the Cloud Data Fusion provisions a Dataproc cluster, a user managed service account can be specified. That service account will be used in the virtual machines in that Dataproc cluster. If the user doesn’t specify any service account, the default Google-managed Compute Engine service account will be used. Regardless of what service account is being used in the Dataproc cluster, the Cloud Data Fusion needs to have permission to use that service account.

Info

Without the service account user permission, Cloud Data Fusion cannot provision a Dataproc cluster, resulting in the following error when trying to execute a data pipeline:

PROVISION task failed in REQUESTING_CREATE state for program run [pipeline-name] due to Dataproc operation failure: INVALID_ARGUMENT: User not authorized to act as service account '[service-account-name]'

...

  1. In the GCP Console, go to the Service Accounts page.

    Go to the Service Accounts page

  2. Click Select a project, choose a project where the service account you want to use for the Dataproc cluster is located, and click Open.

  3. Select the service account to be used in the Dataproc cluster.

    1. By default, the default compute engine service account will be used. It is in the format of [project-number]-compute@developer.gserviceaccount.com.

  4. If the info panel is not already visible, click Show info panel. The panel displays a list of roles that have been granted on the service account.

  5. Click Add Member.

  6. Paste the Cloud Data Fusion service account copied previously in to the New members box.

  7. Select the Service Account User role.

  8. Click Save.

...