This page describes how to grant service account user permission to the Cloud Data Fusion. When the Cloud Data Fusion provisions a Dataproc cluster, a user managed service account can be specified. That service account will be used in the virtual machines in that Dataproc cluster. If the user doesn’t specify any service account, the default Google-managed Compute Engine service account will be used. Regardless of what service account being used in the Dataproc cluster, the Cloud Data Fusion needs to have permission to use that service account.
Before you begin
Please read the Dataproc service accounts documentation if you want to provide a user managed service account in the compute profile in Cloud Data Fusion.
Copy the Cloud Data Fusion service account
In the GCP Console, go to the IAM page.
From the project selector at the top of the page, choose the project, folder, or organization on which the Cloud Data Fusion instance belongs to.
Find and copy the Cloud Data Fusion service account. It is in the format of
service-[project-number]@gcp-sa-datafusion.iam.gserviceaccount.com.
Granting Service Account User Permission
In the GCP Console, go to the Service Accounts page.
Click Select a project, choose a project where the service account you want to use for the Dataproc cluster is located, and click Open.
Select the service account to be used in the Dataproc cluster.
By default, the default compute engine service account will be used. It is in the format of
[project-number]-compute@developer.gserviceaccount.com.
If the info panel is not already visible, click Show info panel. The panel displays a list of roles that have been granted on the service account.
Click Add Member.
Paste the Cloud Data Fusion service account copied previously in to the New members box.
Select the Service Account User role.
Click Save.