the gcloud auth application-default login command.By default, the GCP connector generates temporary OAuth 2.0 tokens from the user account credentials and distributes them to clients. The tokens have a limited lifetime of 1 hour. This behavior can be disabled by setting the generate_temporary_tokens configuration option to False, in which case, the connector will distribute the user account credentials JSON to clients instead (not recommended).

This method is preferred during development and testing due to its simplicity and ease of use. It is not recommended as a direct authentication method for production use cases because the clients are granted the full set of permissions of the GCP user account. For production, it is recommended to use the GCP Service Account or GCP Service Account Impersonation authentication methods.

A GCP project is required and the connector may only be used to access GCP resources in the specified project.

If you already have the local GCP CLI set up with these credentials, they will be automatically picked up when auto-configuration is used (see the example below).

The following assumes the local GCP CLI has been configured with GCP user account credentials by running the gcloud auth application-default login command:

zenml service-connector register gcp-user-account --type gcp --auth-method user-account --auto-configure

Example Command Output

Successfully registered service connector `gcp-user-account` with access to the following resources:

┏━━━━━━━━━━━━━━━━━━━━━━━┯━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓

┃     RESOURCE TYPE     │ RESOURCE NAMES                                  ┃

┠───────────────────────┼─────────────────────────────────────────────────┨

┃    🔵 gcp-generic     │ zenml-core                                      ┃

┠───────────────────────┼─────────────────────────────────────────────────┨

┃     📦 gcs-bucket     │ gs://zenml-bucket-sl                            ┃

┃                       │ gs://zenml-core.appspot.com                     ┃