project=zenml-core&projection=noAcl&prettyPrint= ┃┃                       │ false: empty-connectors@zenml-core.iam.gserviceaccount.com does not have                     ┃

┃                       │ storage.buckets.list access to the Google Cloud project. Permission 'storage.buckets.list'   ┃

┃                       │ denied on resource (or it may not exist).                                                    ┃

┠───────────────────────┼──────────────────────────────────────────────────────────────────────────────────────────────┨

┃ 🌀 kubernetes-cluster │ 💥 error: connector authorization failure: Failed to list GKE clusters: 403 Required         ┃

┃                       │ "container.clusters.list" permission(s) for "projects/20219041791". [request_id:             ┃

┃                       │ "0xcb7086235111968a"                                                                         ┃

┃                       │ ]                                                                                            ┃

┠───────────────────────┼──────────────────────────────────────────────────────────────────────────────────────────────┨

┃  🐳 docker-registry   │ gcr.io/zenml-core                                                                            ┃

┗━━━━━━━━━━━━━━━━━━━━━━━┷━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┛

Next, we'll register a GCP Service Connector that actually uses account impersonation to access the zenml-bucket-sl GCS bucket and verify that it can actually access the bucket:

zenml service-connector register gcp-impersonate-sa --type gcp --auth-method impersonation --service_account_json=@empty-connectors@zenml-core.json  --project_id=zenml-core --target_principal=zenml-bucket-sl@zenml-core.iam.gserviceaccount.com --resource-type gcs-bucket --resource-id gs://zenml-bucket-sl

Example Command Output

Expanding argument value service_account_json to contents of file /home/stefan/aspyre/src/zenml/empty-connectors@zenml-core.json.