• A service account can be used by one or more users, who are accessing the platform. For more information on service accounts, see https://cloud.google.com/compute/docs/access/service-accounts.
• For more information on the service accounts used by 

  D s dataflow

   to manage security and permissions while running 

  D s product
  product gdp

   jobs, see https://cloud.google.com/dataflow/docs/concepts/security-and-permissions#security_and_permissions_for_pipelines_on_google_cloud_platform.

• D s dataflow

   is a cloud-based data processing service for both batch and real-time data streaming applications. You can use it to set up processing pipelines for integrating, preparing and analyzing large data sets, such as those found in Web analytics or big data analytics applications. For more information, see https://cloud.google.com/dataflow.

Project Service Accounts

Compute Engine Service Account

The Compute Engine service account is the default account for all project users to run jobs on

This service account has the following name:

<project-number>-compute@developer.gserviceaccount.com

where:

• <project-number> - identifier for the the project using the compute service account.

Service Account Permissions

A service account must have the following permissions.

Required 

D s dataflow

 permissions

For the list of minimum required permissions for access 

Canceling jobs

To enable users to cancel 

dataflow.jobs.cancel

actAs permission

To run

• When not using companion service account: User must have iam.serviceAccounts.actAs permission specified at the project level or in the default compute engine service account.
  
• When using companion service account: User must have iam.serviceAccounts.actAs permission on companion service account or granted explicitly to the user.
  • IAM disabled: If you are not using IAM roles and have enabled companion service accounts, the Dataprep Service account role, which is assigned to the default service account has the actAs permission for the project. 

• Project owners require no additional permissions on the projects that they own.

For more information, see https://cloud.google.com/dataflow/docs/concepts/security-and-permissions#security_and_permissions_for_pipelines_on_google_cloud_platform.

Data connectivity permissions

For more information on

Cross-Project Access to Data

If users are permitted to access data in 

• For more information, see Access Cross-Project Cloud Storage Buckets.
• For more information, see Access Cross-Project BigQuery Datasets.

Using Service Accounts

The service account that is used for a job is determined based on the following priority level, highest to lowest:

Project service accounts

At the project level, all users are assigned the Compute Engine service account by default. See above.

Companion Service Account:

Optionally, project owners can require that service accounts be assigned to individual users. When enabled, companion service accounts can be assigned by the project owner or by the individual user.

See "Companion Service Accounts" below.

User preferences

Users can specify the service account to use for all of their jobs. For example, if a user is invited into multiple projects, that user may be required to submit jobs in all projects using the same service account. 

For more information, see Execution Settings Page.

A user's service account can be assigned by the user or, if companion service accounts is enabled, by the project owner, or both. See "Companion Service Accounts" below.

Job overrides

For individual jobs, a user can select the service account to use. This value overrides user preferences and project owner selections. For more information, see Run Job Page.

Custom Service Accounts

Any custom service accounts must be created through the Google IAM console. 

• These accounts must have the required permissions for the user or users that will use them. 
• For more information on creating IAM roles, see https://console.cloud.google.com/iam-admin/iam.
• For more information on service accounts, see https://cloud.google.com/compute/docs/access/service-accounts.
  • For more information on creating service accounts, see https://cloud.google.com/iam/docs/creating-managing-service-accounts#iam-service-accounts-create-console.

Custom service account requirements

Any custom service account or companion service account must meet the following requirements:

1. Service account must be defined in IAM console.
   
   1. The minimum set of permissions to access 

      D s product

       and any related datastores must be included in the custom service account. See "Service Account Permissions" above.
   2. Permissions in each user's IAM role must be reflected in any custom service account applied to the user's account. Changes in one must be reflected in the other.
2. Service account must be applied to the project in IAM console.

Companion Service Accounts

This service account must be specified in the Google IAM console and contain all of the permissions required to access a user's data and run jobs on 

When companion service accounts are enabled:

• Companion service accounts must be specified for individual users of the project, instead of all users relying on the default Compute Engine service account in the project.
  • Project owners can apply them for each user. 
  • Individual users can apply their own.
• The default Compute Engine service account is no longer available for use. 
• Companion service accounts can be overridden for individual jobs when defining the job to execute.
• Previously created scheduled jobs automatically inherit and use the companion service account specified for the user. 

Create companion service accounts

Like any custom service account, companion service accounts must be created in the IAM console and applied to the project. See "Custom Service Accounts" above. 

Manage companion service accounts

After these service accounts have been created, you can assign a companion service account to each user of the project. For more information, see Service Accounts Page.

Enable companion service accounts

A project owner must enable the use of companion service accounts.

For more information, see Dataprep Project Settings Page.