英文:
Google Cloud Platform - AI Platform Instance Issue
问题
我试图在AI平台中启动一个笔记本实例，但出现了以下错误：
您至少缺少以下必需的权限：
项目
compute.instances.list
但是对于当前项目，根据项目所有者定义的角色，除了其他计算实例权限之外，已经授予了此权限。
但仍然出现权限错误。
提前感谢您的帮助。
英文:
I am trying to launch a notebook instance in AI platform but getting this error:
You are missing at least one of the following required permissions:
Project
compute.instances.list
But for the current project within the role as defined by project owner this permission has already been given apart from other compute instance permissions.
But still gives the permission error.
Thanks for help in advance
答案1
得分: 1
在Google AI平台创建笔记本实例所使用的服务帐户是默认的Compute Engine服务帐户，该服务帐户具有基本的 roles/editor 权限。
权限：Compute Engine默认服务帐户
Compute Engine默认服务帐户是使用Cloud IAM项目编辑器角色创建的，但您可以修改服务帐户的角色，以安全地限制该服务帐户可以访问哪些Google API。
您可以检查 roles/editor 是否包含 compute.instances.list 权限：
gcloud iam roles describe roles/editor | grep compute.instances.list
用于故障排除的检查步骤：
- 检查是否有默认的计算服务帐户：
gcloud iam service-accounts list | grep compute@developer.gserviceaccount.com
gcloud iam service-accounts describe your-project-number-compute@developer.gserviceaccount.com
- 检查默认计算服务帐户的角色：
gcloud projects get-iam-policy your-project --flatten="bindings[].members" --format='table(bindings.role)' --filter="bindings.members:your-project-number-compute@developer.gserviceaccount.com"
假设您是该项目的所有者，您应该能够使用默认的计算引擎服务帐户创建一个新的笔记本实例。
英文:
The service account used to create a notebook instance in Google AI platform is the default Compute Engine service account which has the primitive roles/editor.
> Permission: Compute Engine default service account
>
> The Compute Engine default service account is created with the Cloud
> IAM project editor role, but you can modify the service account's
> roles to securely limit which Google APIs the service account can
> access.
You can check that the roles/editor includes compute.instances.list :
gcloud iam roles describe roles/editor | grep compute.instances.list
For troubleshooting check:
-
If you have the default compute service account:
gcloud iam service-accounts list | grep compute@developer.gserviceaccount.com gcloud iam service-accounts describe your-project-number-compute@developer.gserviceaccount.com -
Check the roles of the default compute service account:
gcloud projects get-iam-policy your-project --flatten="bindings[].members" --format='table(bindings.role)' --filter="bindings.members:your-project-number-compute@developer.gserviceaccount.com"
Assuming you are the owner of the project, you should be able to create a new notebook instance with the default compute engine service account.
通过集体智慧和协作来改善编程学习和解决问题的方式。致力于成为全球开发者共同参与的知识库，让每个人都能够通过互相帮助和分享经验来进步。
评论