CODEWITHSUNDEEP
google-cloud-platformgoogle-cloud-iam
Tjorriemorrie
Tjorriemorrie

Reputation: 17282

How to give service account access to two projects?

Using Google Cloud, there exists a BigQuery View table that queries two projects.

However, on the project where the view is located, we wish to run a query against it from Airflow/Composer. Currently it fails with a 403.

AFAIK it will use the default composer service account - however it doesn't have access to the 2nd project used in the sql of the view.

How do I give composer's service account access to the second project?

Upvotes: 1

Views: 1473

Answers (2)

guillaume blaquiere
guillaume blaquiere

Reputation: 75970

Think about a service account like a user account: you have a user email that you authorize on different project and component. Exactly the same thing with the service account email.

The service account belongs to a project. An user account belongs to a domain name/organisation. No real difference at the end.

So, you can use a service account email like any user accounts:

  • Grant authorization in any project
  • Add it in Google Groups
  • Even grant it viewer or editor role on GSuite document (Sheet, Docs, Slides,...) to allow it to access and to read/update these document!! Like any users!

EDIT

With Airflow, you can defined connexions and a default connexion. You can use this connexion in your DAG and thus use the service account that you want.

Upvotes: 2

maxtess
maxtess

Reputation: 91

I think you have to add the service account into project IAM.

Upvotes: 1

Related Questions