fix: perms for using MR in BQML (#634)

* feat: add example of import from dataframe

* feat: add example of import from dataframe

* update: change in required perms

* update: change in required perms
This commit is contained in:
Andrew Ferlitsch
2022-06-15 14:55:17 -07:00
committed by GitHub
parent 0443b05360
commit 7b8726af24
@@ -442,6 +442,54 @@
"! gsutil ls -al $BUCKET_URI"
]
},
{
"cell_type": "markdown",
"metadata": {
"id": "set_service_account"
},
"source": [
"#### Service Account\n",
"\n",
"You use a service account to create Vertex AI Pipeline jobs. If you do not want to use your project's Compute Engine service account, set `SERVICE_ACCOUNT` to another service account ID."
]
},
{
"cell_type": "code",
"execution_count": null,
"metadata": {
"id": "set_service_account"
},
"outputs": [],
"source": [
"SERVICE_ACCOUNT = \"[your-service-account]\" # @param {type:\"string\"}"
]
},
{
"cell_type": "code",
"execution_count": null,
"metadata": {
"id": "autoset_service_account"
},
"outputs": [],
"source": [
"if (\n",
" SERVICE_ACCOUNT == \"\"\n",
" or SERVICE_ACCOUNT is None\n",
" or SERVICE_ACCOUNT == \"[your-service-account]\"\n",
"):\n",
" # Get your service account from gcloud\n",
" if not IS_COLAB:\n",
" shell_output = !gcloud auth list 2>/dev/null\n",
" SERVICE_ACCOUNT = shell_output[2].replace(\"*\", \"\").strip()\n",
"\n",
" if IS_COLAB:\n",
" shell_output = ! gcloud projects describe $PROJECT_ID\n",
" project_number = shell_output[-1].split(\":\")[1].strip().replace(\"'\", \"\")\n",
" SERVICE_ACCOUNT = f\"{project_number}-compute@developer.gserviceaccount.com\"\n",
"\n",
" print(\"Service Account:\", SERVICE_ACCOUNT)"
]
},
{
"cell_type": "markdown",
"metadata": {
@@ -730,32 +778,6 @@
"print(\"{} created in {}\".format(tblname, job.ended - job.started))"
]
},
{
"cell_type": "code",
"execution_count": null,
"metadata": {
"id": "3b3aa4481cd7"
},
"outputs": [],
"source": [
"MODEL_QUERY = f\"\"\"\n",
"DROP MODEL `{BQ_DATASET_NAME}.{MODEL_NAME}`\n",
"\"\"\"\n",
"\n",
"job = bqclient.query(MODEL_QUERY)"
]
},
{
"cell_type": "code",
"execution_count": null,
"metadata": {
"id": "ef9e14b91475"
},
"outputs": [],
"source": [
"job"
]
},
{
"cell_type": "markdown",
"metadata": {
@@ -1185,24 +1207,21 @@
"\n",
"### Setting permissions to automatically register the model\n",
"\n",
"You need to set some additional IAM permissions for BigQuery ML to automatically upload and register the model after training. Depending on your service account, the setting of the permissions below may fail. In this case, we recommend executing the permissions in a Cloud Shell."
"You need to set some additional IAM permissions for BigQuery ML to automatically upload and register the model after training. Depending on your service account, the setting of the permissions below may fail. In this case, we recommend executing the permissions in a Cloud Shell.\n",
"\n",
"Learn more about [Setting permissions for Model Registry](https://cloud.devsite.corp.google.com/bigquery-ml/docs/managing-models-vertex\n"
]
},
{
"cell_type": "code",
"execution_count": null,
"metadata": {
"id": "0472e888105e"
"id": "29229f72d13d"
},
"outputs": [],
"source": [
"! gcloud projects add-iam-policy-binding $PROJECT_ID \\\n",
" --member='serviceAccount:cloud-dataengine@system.gserviceaccount.com' \\\n",
" --role='roles/aiplatform.admin'\n",
"\n",
"! gcloud projects add-iam-policy-binding $PROJECT_ID \\\n",
" --member='user:cloud-dataengine@prod.google.com' \\\n",
" --role='roles/aiplatform.admin'"
" --member=serviceAccount:$SERVICE_ACCOUNT --role=roles/aiplatform.admin --condition=None"
]
},
{
@@ -1283,6 +1302,20 @@
"print(model.gca_resource)"
]
},
{
"cell_type": "code",
"execution_count": null,
"metadata": {
"id": "48e6ef5d5ffa"
},
"outputs": [],
"source": [
"models = aiplatform.Model.list()\n",
"for model in models:\n",
" if model.gca_resource.display_name.startswith(\"bqml\"):\n",
" print(model.gca_resource.display_name)"
]
},
{
"cell_type": "markdown",
"metadata": {