Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

docs: Document minimum IAM requirement #416

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We鈥檒l occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Mar 7, 2024
Merged

docs: Document minimum IAM requirement #416

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
d87eef8
docs: Document minimum IAM requirement
shobsi Mar 5, 2024
5a35b59
Merge branch 'main' into shobs-min-iam
shobsi Mar 7, 2024
6c17eb4
Merge branch 'main' into shobs-min-iam
shobsi Mar 7, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
49 changes: 31 additions & 18 deletions 49 README.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,6 +34,11 @@ Prerequisites
`install and initialize the gcloud CLI <https://cloud.google.com/sdk/docs/install>`_,
and then generate the application default credentials by doing
`gcloud auth application-default login <https://cloud.google.com/sdk/gcloud/reference/auth/application-default/login>`_.
* The user must have
`BigQuery Job User <https://cloud.google.com/bigquery/docs/access-control#bigquery.jobUser>`_ and
`BigQuery Read Session User <https://cloud.google.com/bigquery/docs/access-control#bigquery.readSessionUser>`_
roles for the minimum usage. Additional IAM requirements apply for using remote
functions and ML.

Code sample
^^^^^^^^^^^
Expand Down Expand Up @@ -215,6 +220,30 @@ steps and an estimator together.
to create a pipeline of transforms with a final estimator.


ML remote models
----------------

**Requirements**

To use BigQuery DataFrames ML remote models (`bigframes.ml.remote` or `bigframes.ml.llm`),
you must enable the following APIs:

* The BigQuery API (bigquery.googleapis.com)
* The BigQuery Connection API (bigqueryconnection.googleapis.com)
* The Vertex AI API (aiplatform.googleapis.com)

and you must be granted the following IAM roles:

* BigQuery Data Editor (roles/bigquery.dataEditor)
* BigQuery Connection Admin (roles/bigquery.connectionAdmin)
* Service Account User (roles/iam.serviceAccountUser) on the
`service account <https://cloud.google.com/functions/docs/reference/iam/roles#additional-configuration>`__
``PROJECT_NUMBER-compute@developer.gserviceaccount.com``
* Vertex AI User (roles/aiplatform.user)
* Project IAM Admin (roles/resourcemanager.projectIamAdmin) if using default
BigQuery connection, or Browser (roles/browser) if using a pre-created connection


ML locations
------------

Expand Down Expand Up @@ -311,24 +340,8 @@ following IAM roles:
`service account <https://cloud.google.com/functions/docs/reference/iam/roles#additional-configuration>`__
``PROJECT_NUMBER-compute@developer.gserviceaccount.com``
* Storage Object Viewer (roles/storage.objectViewer)
* Project IAM Admin (roles/resourcemanager.projectIamAdmin)

To use BigQuery DataFrames ML remote models(bigframes.ml.remote or bigframes.ml.llm), you must enable the following APIs:

* The BigQuery API (bigquery.googleapis.com)
* The BigQuery Connection API (bigqueryconnection.googleapis.com)
* The Vertex AI API (aiplatform.googleapis.com)

To use BigQuery DataFrames ML remote models(bigframes.ml.remote or bigframes.ml.llm), you must be granted the
following IAM roles:

* BigQuery Data Editor (roles/bigquery.dataEditor)
* BigQuery Connection Admin (roles/bigquery.connectionAdmin)
* Service Account User (roles/iam.serviceAccountUser) on the
`service account <https://cloud.google.com/functions/docs/reference/iam/roles#additional-configuration>`__
``PROJECT_NUMBER-compute@developer.gserviceaccount.com``
* Vertex AI User (roles/aiplatform.user)
* Project IAM Admin (roles/resourcemanager.projectIamAdmin)
* Project IAM Admin (roles/resourcemanager.projectIamAdmin) if using default
BigQuery connection, or Browser (roles/browser) if using a pre-created connection

**Limitations**

Expand Down
Morty Proxy This is a proxified and sanitized view of the page, visit original site.