Permission Denied using Google AiPlatform ModelServiceClient

Question

I am following a guide to get a Vertex AI pipeline working:

https://codelabs.developers.google.com/vertex-pipelines-intro#5

I have implemented the following custom component:

from google.cloud import aiplatform as aip
from google.oauth2 import service_account

project = "project-id"
region = "us-central1"
display_name = "lookalike_model_pipeline_1646929843"

model_name = f"projects/{project}/locations/{region}/models/{display_name}"
api_endpoint = "us-central1-aiplatform.googleapis.com" #europe-west2
model_resource_path = model_name
client_options = {"api_endpoint": api_endpoint}

# Initialize client that will be used to create and send requests.
client = aip.gapic.ModelServiceClient(credentials=service_account.Credentials.from_service_account_file('..\\service_accounts\\aiplatform_sa.json'), 
client_options=client_options)
#get model evaluation
response = client.list_model_evaluations(parent=model_name)

And I get following error:

(<class 'google.api_core.exceptions.PermissionDenied'>, PermissionDenied("Permission 'aiplatform.modelEvaluations.list' denied on resource '//aiplatform.googleapis.com/projects/project-id/locations/us-central1/models/lookalike_model_pipeline_1646929843' (or it may not exist)."), <traceback object at 0x000002414D06B9C0>)

The model definitely exists and has finished training. I have given myself admin rights in the aiplatform service account. In the guide, they do not use a service account, but uses only client_options instead. The client_option has the wrong type since it is a dict(str, str) when it should be: Optional['ClientOptions']. But this doesn't cause an error.

My main question is: how do I get around this permission issue?

My subquestions are:

1. How can I use my model_name variable in a URL to get to the model?
2. How can I create an Optional['ClientOptions'] object to pass as client_option
3. Is there another way I can list_model_evaluations from a model that is in VertexAI, trained using automl?

Thanks

Answer 1

I tried using your code and it did not also work for me and got a different error. As @DazWilkin mentioned it is recommended to use the Cloud Client.

I used aiplatform_v1 and it worked fine. One thing I noticed is that you should always define a value for client_options so it will point to the correct endpoint. Checking the code for ModelServiceClient, if I'm not mistaken the endpoint defaults to "aiplatform.googleapis.com" which don't have a location prepended. AFAIK the endpoint should prepend a location.

See code below. I used AutoML models and it returns their model evaluations.

from google.cloud import aiplatform_v1 as aiplatform
from typing import Optional

def get_model_eval(
        project_id: str,
        model_id: str,
        client_options: dict,
        location: str = 'us-central1',
        ):

    client_model = aiplatform.services.model_service.ModelServiceClient(client_options=client_options)

    model_name = f'projects/{project_id}/locations/{location}/models/{model_id}'
    list_eval_request = aiplatform.types.ListModelEvaluationsRequest(parent=model_name)
    list_eval = client_model.list_model_evaluations(request=list_eval_request)
    print(list_eval)



api_endpoint = 'us-central1-aiplatform.googleapis.com'
client_options = {"api_endpoint": api_endpoint} # api_endpoint is required for client_options
project_id = 'project-id'
location = 'us-central1'
model_id = '99999999999' # aiplatform_v1 uses the model_id

get_model_eval(
        client_options = client_options,
        project_id = project_id,
        location = location,
        model_id = model_id,
        )

This is an output snippet from my AutoML Text Classification: