python - 使用自定义容器从 AI Platform 训练作业访问 Google Secret Manager

Question

我正在尝试访问存储在 Google Secret Manager 中的 secret 来自在自定义容器中运行的 AI Platform Training 作业。我正在使用以下 Python 代码来检索 secret :

# Standard library imports
import os

# Import the Secret Manager client library.
from google.cloud import secretmanager


def access_secret_version(secret_id, version_id, project_id=os.environ.get("GCP_PROJECT")):
     # Create the Secret Manager client.
    client = secretmanager.SecretManagerServiceClient()

    # Build the resource name of the secret version.
    name = client.secret_version_path(project_id, secret_id, version_id)

    # Access the secret version.
    response = client.access_secret_version(name)

    # Return the secret payload.
    return response.payload.data.decode("UTF-8")

我已将 Secret Manager Secret Accessor 角色添加到默认 Cloud ML 服务帐户 (service-XXX@cloud-ml.google.com.iam.gserviceaccount.com)，但访问仍然被拒绝:

google.api_core.exceptions.PermissionDenied: 403 Request had insufficient authentication scopes.

我是否已将正确的角色授予正确的服务帐户，还是我遗漏了其他内容？

Answer 1

我们有一个 alpha 功能来支持您的用例。能否给我们发送电子邮件至 cloudml-feedback@google.com？