使用 Google AiPlatform ModelServiceClient 的权限被拒绝

Question

我正在按照指南使 Vertex AI 管道正常工作：

https://codelabs.developers.google.com/vertex-pipelines-intro#5

我实现了以下自定义组件：

from google.cloud import aiplatform as aip
from google.oauth2 import service_account

project = "project-id"
region = "us-central1"
display_name = "lookalike_model_pipeline_1646929843"

model_name = f"projects/{project}/locations/{region}/models/{display_name}"
api_endpoint = "us-central1-aiplatform.googleapis.com" #europe-west2
model_resource_path = model_name
client_options = {"api_endpoint": api_endpoint}

# Initialize client that will be used to create and send requests.
client = aip.gapic.ModelServiceClient(credentials=service_account.Credentials.from_service_account_file('..\service_accounts\aiplatform_sa.json'), 
client_options=client_options)
#get model evaluation
response = client.list_model_evaluations(parent=model_name)

我收到以下错误：

(<class 'google.api_core.exceptions.PermissionDenied'>, PermissionDenied("Permission 'aiplatform.modelEvaluations.list' denied on resource '//aiplatform.googleapis.com/projects/project-id/locations/us-central1/models/lookalike_model_pipeline_1646929843' (or it may not exist)."), <traceback object at 0x000002414D06B9C0>)

模型肯定存在并且已经完成训练。我已在 aiplatform 服务帐户中授予自己管理员权限。在指南中，他们不使用服务帐户，而是仅使用 client_options。 client_option 的类型错误，因为它是一个 dict(str, str) 而它应该是：Optional['ClientOptions']。但这不会导致错误。

我的主要问题是：如何解决此权限问题？

我的子问题是：

如何在 URL 中使用我的 model_name 变量来访问模型？
如何创建一个 Optional['ClientOptions'] 对象作为 client_option
还有其他方法可以让我从 VertexAI 中使用 automl 训练的模型中 list_model_evaluations 吗？

谢谢

Answer 1

在我的评论中需要注意的是，虽然我熟悉 GCP，但我对 AI|ML 的东西不太熟悉。以下应该有效。我没有要部署的模型来测试它。

BILLING=[[YOUR-BILLING]]

export PROJECT=[[YOUR-PROJECT]]
export LOCATION="us-central1"
export MODEL=[[YOUR-MODEL]]

ACCOUNT="tester"

gcloud projects create ${PROJECT}

gcloud beta billing projects link ${PROJECT} \
--billing-account=${BILLING}

# Unsure whether ML is needed
for SERVICE in "aiplatform" "ml"
do
  gcloud services enable ${SERVICE}.googleapis.com \
  --project=${PROJECT}
done

gcloud iam service-accounts create ${ACCOUNT} \
--project=${PROJECT}

EMAIL=${ACCOUNT}@${PROJECT}.iam.gserviceaccount.com

gcloud projects add-iam-policy-binding ${PROJECT} \
--role=roles/aiplatform.admin \
--member=serviceAccount:${EMAIL}

gcloud iam service-accounts keys create ${PWD}/${ACCOUNT}.json \
--iam-account=${EMAIL} \
--project=${PROJECT}

export GOOGLE_APPLICATION_CREDENTIALS=${PWD}/${ACCOUNT}.json

python3 -m venv venv
source venv/bin/activate
python3 -m pip install google-cloud-aiplatform
python3 main.py

main.py:

import os

from google.cloud import aiplatform

project = os.getenv("PROJECT")
location = os.getenv("LOCATION")
model = os.getenv("MODEL")

aiplatform.init(
    project=project,
    location=location,
    experiment="test",
)

parent = f"projects/{project}/locations/{location}/models/{model}"
model = aiplatform.Model(parent)

Answer 2

我尝试使用您的代码，但它对我也不起作用，并且出现了不同的错误。正如@DazWilkin 提到的，建议使用云客户端。

我用了 aiplatform_v1，效果很好。我注意到的一件事是，您应该始终为 client_options 定义一个值，以便它指向正确的端点。检查 ModelServiceClient, if I'm not mistaken the endpoint defaults to "aiplatform.googleapis.com" which don't have a location prepended. AFAIK the endpoint should prepend a location.

的代码

见下面的代码。我使用了 AutoML 模型，它 returns 他们的模型评估。

from google.cloud import aiplatform_v1 as aiplatform
from typing import Optional

def get_model_eval(
        project_id: str,
        model_id: str,
        client_options: dict,
        location: str = 'us-central1',
        ):

    client_model = aiplatform.services.model_service.ModelServiceClient(client_options=client_options)

    model_name = f'projects/{project_id}/locations/{location}/models/{model_id}'
    list_eval_request = aiplatform.types.ListModelEvaluationsRequest(parent=model_name)
    list_eval = client_model.list_model_evaluations(request=list_eval_request)
    print(list_eval)



api_endpoint = 'us-central1-aiplatform.googleapis.com'
client_options = {"api_endpoint": api_endpoint} # api_endpoint is required for client_options
project_id = 'project-id'
location = 'us-central1'
model_id = '99999999999' # aiplatform_v1 uses the model_id

get_model_eval(
        client_options = client_options,
        project_id = project_id,
        location = location,
        model_id = model_id,
        )

这是我的 AutoML 文本分类的输出片段：

使用 Google AiPlatform ModelServiceClient 的权限被拒绝

Permission Denied using Google AiPlatform ModelServiceClient

python

model

google-cloud-platform

google-ai-platform

google-cloud-vertex-ai