this example, we have the following set up in GCP:a primary empty-connectors@zenml-core.iam.gserviceaccount.com GCP service account with no permissions whatsoever aside from the "Service Account Token Creator" role that allows it to impersonate the secondary service account below. We also generate a service account key for this account.

a secondary zenml-bucket-sl@zenml-core.iam.gserviceaccount.com GCP service account that only has permissions to access the zenml-bucket-sl GCS bucket

First, let's show that the empty-connectors service account has no permissions to access any GCS buckets or any other resources for that matter. We'll register a regular GCP Service Connector that uses the service account key (long-lived credentials) directly:

zenml service-connector register gcp-empty-sa --type gcp --auth-method service-account --service_account_json=@empty-connectors@zenml-core.json --project_id=zenml-core

Example Command Output

Expanding argument value service_account_json to contents of file /home/stefan/aspyre/src/zenml/empty-connectors@zenml-core.json.

Successfully registered service connector `gcp-empty-sa` with access to the following resources:

┏━━━━━━━━━━━━━━━━━━━━━━━┯━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓

┃     RESOURCE TYPE     │ RESOURCE NAMES                                                                               ┃

┠───────────────────────┼──────────────────────────────────────────────────────────────────────────────────────────────┨

┃    🔵 gcp-generic     │ zenml-core                                                                                   ┃

┠───────────────────────┼──────────────────────────────────────────────────────────────────────────────────────────────┨

┃     📦 gcs-bucket     │ 💥 error: connector authorization failure: failed to list GCS buckets: 403 GET               ┃

┃                       │ https://storage.googleapis.com/storage/v1/b?project=zenml-core&projection=noAcl&prettyPrint= ┃