Vertex 403

使用应用默认凭证 (ADC) 解决 Google Cloud Vertex AI API 403 权限问题

在使用 Google Cloud Vertex AI 进行模型预测时，可能会遇到 PermissionDeniedError 错误，特别是当你尝试调用 aiplatform.endpoints.predict 权限时。这篇博客将详细记录如何通过配置应用默认凭证 (Application Default Credentials, ADC) 解决这个问题，并成功调用 Vertex AI API。

错误描述

在尝试使用 AnthropicVertex 客户端调用 Vertex AI 模型时，我遇到了以下错误：

PermissionDeniedError: Error code: 403 - {'error': {'code': 403, 'message': "Permission 'aiplatform.endpoints.predict' denied on resource '//aiplatform.googleapis.com/projects/alien-climber-432313-r9/locations/us-east5/publishers/anthropic/models/claude-3-5-sonnet@20240620' (or it may not exist).", 'status': 'PERMISSION_DENIED', 'details': [{'@type': 'type.googleapis.com/google.rpc.ErrorInfo', 'reason': 'IAM_PERMISSION_DENIED', 'domain': 'aiplatform.googleapis.com', 'metadata': {'resource': 'projects/alien-climber-432313-r9/locations/us-east5/publishers/anthropic/models/claude-3-5-sonnet@20240620', 'permission': 'aiplatform.endpoints.predict'}}]}}

尽管我的账户是项目的拥有者，理论上应该具备所有必要的权限，但依然收到403权限被拒绝的错误。

问题排查与解决

这个问题通常是由于使用的凭证不具备足够的权限来访问 Vertex AI 模型。在 Google Cloud 中，使用正确的凭证至关重要，尤其是应用默认凭证 (ADC)。下面是详细的解决步骤：

步骤 1: 设置 Google Cloud CLI 并选择账户

首先，确保你的 Google Cloud CLI (gcloud) 已经安装并配置。

  1. 初始化 gcloud 并选择合适的配置：

    gcloud init

  2. 在初始化过程中，选择需要使用的账户。确保选择的是与 Vertex AI 项目关联的账户。

  3. 配置默认项目和区域：

    gcloud config set project alien-climber-432313-r9
gcloud config set compute/region us-east5  # 或 europe-west1
gcloud config set compute/zone us-east5-b  # 可选

步骤 2: 使用应用默认凭证 (ADC) 登录

为了确保你调用 Vertex AI API 时使用的是正确的凭证，使用 gcloud auth application-default login 配置应用默认凭证。

  1. 运行以下命令登录并生成 ADC：

    gcloud auth application-default login

  2. 这将打开一个浏览器窗口，要求你登录 Google 账户。请使用与你的项目关联的账户登录。

  3. 登录成功后，凭证会保存在本地文件中（通常在 ~/.config/gcloud/application_default_credentials.json）。

步骤 3: 使用 ADC 调用 Vertex AI API

在成功配置 ADC 后，接下来就可以使用 AnthropicVertex 客户端来调用 Vertex AI 模型了。

from anthropic import AnthropicVertex
​
# 设置区域和项目 ID
LOCATION = "us-east5"  # 或 europe-west1
PROJECT_ID = "alien-climber-432313-r9"
​
# 初始化 AnthropicVertex 客户端
client = AnthropicVertex(region=LOCATION, project_id=PROJECT_ID)
​
# 创建并发送消息
message = client.messages.create(
    max_tokens=1024,
    messages=[
        {
            "role": "user",
            "content": "Send me a recipe for banana bread.",
        }
    ],
    model="claude-3-5-sonnet@20240620",
)
​
# 打印返回结果
print(message.model_dump_json(indent=2))

步骤 4: 验证结果

执行以上代码后，应该能够成功调用 Vertex AI API，并获得模型的预测结果。如果仍然遇到权限问题，可以通过以下步骤进行进一步排查：

  1. 检查 IAM 权限：确保你所使用的账户拥有 Vertex AI User 或 Vertex AI Admin 角色。

  2. 确认模型和区域：确保你在请求中使用的模型 ID 和区域是正确的，并且模型确实存在。

总结

通过正确配置应用默认凭证 (ADC)，可以有效解决在调用 Vertex AI API 时遇到的 403 权限被拒绝问题。Google Cloud 的凭证管理非常重要，确保使用正确的凭证可以避免很多不必要的错误。希望这篇博客能够帮助你顺利配置和使用 Google Cloud 的 Vertex AI 服务。

操作记录

(base) ubuntu@VM-0-17-ubuntu:~$ gcloud init
Welcome! This command will take you through the configuration of gcloud.

Settings from your current configuration [vertex-kalynda] are:
core:
  disable_usage_reporting: 'True'

Pick configuration to use:
 [1] Re-initialize this configuration [vertex-kalynda] with new settings
 [2] Create a new configuration
 [3] Switch to and re-initialize existing configuration: [default]
Please enter your numeric choice:  2

Enter configuration name. Names start with a lower case letter and contain only lower case letters a-z, digits 0-9, and hyphens '-':  vertex-g
Your current configuration has been set to: [vertex-g]

You can skip diagnostics next time by using the following flag:
  gcloud init --skip-diagnostics

Network diagnostic detects and fixes local network connection issues.
Checking network connection...done.
Reachability Check passed.
Network diagnostic passed (1/1 checks passed).

Choose the account you want to use for this configuration.
To use a federated user account, exit this command and sign in to the gcloud CLI with your login configuration file, then run this command again.

Select an account:
 [1] [email protected]
 [2] Sign in with a new Google Account
 [3] Skip this step
Please enter your numeric choice:  2

Your browser has been opened to visit:

    https://accounts.google.com/o/oauth2/auth?response_type=code&client_id=32555940559.apps.googleusercontent.com&redirect_uri=http%3A%2F%2Flocalhost%3A8085%2F&scope=openid+https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fuserinfo.email+https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fcloud-platform+https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fappengine.admin+https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fsqlservice.login+https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fcompute+https%3A%2F%2Fwww.googleapis.com%2Fauth%2Faccounts.reauth&state=DmXDlSa6yFdLOvrnMgZ8kLIDqXHRk2&access_type=offline&code_challenge=WrsRezJoNkxAvAhtMIhmH4ID_vEnVYtMCVjQj9EReRk&code_challenge_method=S256



To take a quick anonymous survey, run:
  $ gcloud survey

You are signed in as: [[email protected]].

Pick cloud project to use:
 [1] alien-climber-432313-r9
 [2] Enter a project ID
 [3] Create a new project
Please enter numeric choice or text value (must exactly match list item):  1

Your current project has been set to: [alien-climber-432313-r9].

Do you want to configure a default Compute Region and Zone? (Y/n)?  y

Which Google Compute Engine zone would you like to use as project default?
If you do not specify a zone via a command line flag while working with Compute Engine resources, the default is assumed.
 [1] us-east1-b
 [2] us-east1-c
 [3] us-east1-d
 [4] us-east4-c
 [5] us-east4-b
 [6] us-east4-a
 [7] us-central1-c
 [8] us-central1-a
 [9] us-central1-f
 [10] us-central1-b
 [11] us-west1-b
 [12] us-west1-c
 [13] us-west1-a
 [14] europe-west4-a
 [15] europe-west4-b
 [16] europe-west4-c
 [17] europe-west1-b
 [18] europe-west1-d
 [19] europe-west1-c
 [20] europe-west3-c
 [21] europe-west3-a
 [22] europe-west3-b
 [23] europe-west2-c
 [24] europe-west2-b
 [25] europe-west2-a
 [26] asia-east1-b
 [27] asia-east1-a
 [28] asia-east1-c
 [29] asia-southeast1-b
 [30] asia-southeast1-a
 [31] asia-southeast1-c
 [32] asia-northeast1-b
 [33] asia-northeast1-c
 [34] asia-northeast1-a
 [35] asia-south1-c
 [36] asia-south1-b
 [37] asia-south1-a
 [38] australia-southeast1-b
 [39] australia-southeast1-c
 [40] australia-southeast1-a
 [41] southamerica-east1-b
 [42] southamerica-east1-c
 [43] southamerica-east1-a
 [44] africa-south1-a
 [45] africa-south1-b
 [46] africa-south1-c
 [47] asia-east2-a
 [48] asia-east2-b
 [49] asia-east2-c
 [50] asia-northeast2-a
Did not print [72] options.
Too many options [122]. Enter "list" at prompt to print choices fully.
Please enter numeric choice or text value (must exactly match list item):  [1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20]
Please enter a value between 1 and 122, or a value present in the list:  17

Your project default Compute Engine zone has been set to [europe-west1-b].
You can change it by running [gcloud config set compute/zone NAME].

Your project default Compute Engine region has been set to [europe-west1].
You can change it by running [gcloud config set compute/region NAME].

The Google Cloud CLI is configured and ready to use!

* Commands that require authentication will use [email protected] by default
* Commands will reference project `alien-climber-432313-r9` by default
* Compute Engine commands will use region `europe-west1` by default
* Compute Engine commands will use zone `europe-west1-b` by default

Run `gcloud help config` to learn how to change individual settings

This gcloud configuration is called [vertex-g]. You can create additional configurations if you work with multiple accounts and/or projects.
Run `gcloud topic configurations` to learn more.

Some things to try next:

* Run `gcloud --help` to see the Cloud Platform services you can interact with. And run `gcloud help COMMAND` to get help on any gcloud command.
* Run `gcloud topic --help` to learn about advanced features of the CLI like arg files and output formatting
* Run `gcloud cheat-sheet` to see a roster of go-to `gcloud` commands.
(base) ubuntu@VM-0-17-ubuntu:~$ gcloud config list
[compute]
region = europe-west1
zone = europe-west1-b
[core]
account = [email protected]
disable_usage_reporting = True
project = alien-climber-432313-r9

Your active configuration is: [vertex-g]
(base) ubuntu@VM-0-17-ubuntu:~$ gcloud auth list
          Credentialed Accounts
ACTIVE  ACCOUNT
*       [email protected]
        [email protected]

To set the active account, run:
    $ gcloud config set account `ACCOUNT`

(base) ubuntu@VM-0-17-ubuntu:~$ cat ~/.config/gcloud/application_default_credentials.json
{
  "account": "",
  "client_id": "764086051850-6qr4p6gpi6hn506pt8ejuq83di341hur.apps.googleusercontent.com",
  "client_secret": "d-FL95Q19q7MQmFpd7hHD0Ty",
  "quota_project_id": "gen-lang-client-0047696867",
  "refresh_token": "1//06uGGEd2UZx4fCgYIARAAGAYSNwF-L9IrG2gKh2U4o-aWRJVJjx-mQ-zkON5mwcC9elEwkA9swtMH0s5kjrlTI8CLqkVjbTxPsgM",
  "type": "authorized_user",
  "universe_domain": "googleapis.com"
}(base) ubuntu@VM-0-17-ubuntu:~$gcloud ai endpoints predict \\
  --model=projects/alien-climber-432313-r9/locations/us-east5/publishers/anthropic/models/claude-3-5-sonnet@20240620 \
  --region=us-east5 \
  --json-request=your_request.json
ERROR: (gcloud.ai.endpoints.predict) unrecognized arguments: --model=projects/alien-climber-432313-r9/locations/us-east5/publishers/anthropic/models/claude-3-5-sonnet@20240620 (did you mean '--help'?)

To search the help text of gcloud commands, run:
  gcloud help -- SEARCH_TERMS
(base) ubuntu@VM-0-17-ubuntu:~$ gcloud auth application-default login
Your browser has been opened to visit:

    https://accounts.google.com/o/oauth2/auth?response_type=code&client_id=764086051850-6qr4p6gpi6hn506pt8ejuq83di341hur.apps.googleusercontent.com&redirect_uri=http%3A%2F%2Flocalhost%3A8085%2F&scope=openid+https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fuserinfo.email+https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fcloud-platform+https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fsqlservice.login&state=Dz1o4HOUO4u4KNJAhYBxTLhh8ecQu8&access_type=offline&code_challenge=cb0WIWlBzNMy5CocQOQKv6ueD2VQLW_t_aF7KzPBwcY&code_challenge_method=S256


Credentials saved to file: [/home/ubuntu/.config/gcloud/application_default_credentials.json]

These credentials will be used by any library that requests Application Default Credentials (ADC).

Quota project "alien-climber-432313-r9" was added to ADC which can be used by Google client libraries for billing and quota. Note that some services may still bill the project owning the resource.
(base) ubuntu@VM-0-17-ubuntu:~$ cat ~/.config/gcloud/application_default_credentials.json
{
  "account": "",
  "client_id": "764086051850-6qr4p6gpi6hn506pt8ejuq83di341hur.apps.googleusercontent.com",
  "client_secret": "d-FL95Q19q7MQmFpd7hHD0Ty",
  "quota_project_id": "alien-climber-432313-r9",
  "refresh_token": "1//06OS07f7WAsqeCgYIARAAGAYSNwF-L9IraBjAicwoytvg5oELlKPxLhZWLcQouu0gEv7rjkif2bJq7aSFVMsL0v0CHsMLD450W3E",
  "type": "authorized_user",
  "universe_domain": "googleapis.com"
}(base) ubuntu@VM-0-17-ubuntu:~$ python
Python 3.10.9 (main, Mar  1 2023, 18:23:06) [GCC 11.2.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> from anthropic import AnthropicVertex
LOCATION="europe-west1" # or "us-east5"

client = AnthropicVertex(region=LOCATION, project_id="PROJECT_ID")

message = client.messages.create(
  max_tokens=1024,
  messages=[
    {
      "role": "user",
      "content": "Send me a recipe for banana bread.",
    }
  ],
  model="claude-3-5-sonnet@20240620",
)
print(message.model_dump_json(indent=2))>>>
>>> LOCATION="europe-west1" # or "us-east5"
>>>
>>> client = AnthropicVertex(region=LOCATION, project_id="PROJECT_ID")
>>>
>>> message = client.messages.create(
...   max_tokens=1024,
...   messages=[
...     {
...       "role": "user",
...       "content": "Send me a recipe for banana bread.",
...     }
...   ],
...   model="claude-3-5-sonnet@20240620",
... )
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/home/ubuntu/anaconda3/lib/python3.10/site-packages/anthropic/_utils/_utils.py", line 277, in wrapper
    return func(*args, **kwargs)
  File "/home/ubuntu/anaconda3/lib/python3.10/site-packages/anthropic/resources/messages.py", line 904, in create
    return self._post(
  File "/home/ubuntu/anaconda3/lib/python3.10/site-packages/anthropic/_base_client.py", line 1249, in post
    return cast(ResponseT, self.request(cast_to, opts, stream=stream, stream_cls=stream_cls))
  File "/home/ubuntu/anaconda3/lib/python3.10/site-packages/anthropic/_base_client.py", line 931, in request
    return self._request(
  File "/home/ubuntu/anaconda3/lib/python3.10/site-packages/anthropic/_base_client.py", line 1029, in _request
    raise self._make_status_error_from_response(err.response) from None
anthropic.PermissionDeniedError: Error code: 403 - {'error': {'code': 403, 'message': 'Permission denied on resource project PROJECT_ID.', 'status': 'PERMISSION_DENIED', 'details': [{'@type': 'type.googleapis.com/google.rpc.Help', 'links': [{'description': 'Google developers console', 'url': 'https://console.developers.google.com'}]}, {'@type': 'type.googleapis.com/google.rpc.ErrorInfo', 'reason': 'CONSUMER_INVALID', 'domain': 'googleapis.com', 'metadata': {'consumer': 'projects/PROJECT_ID', 'service': 'aiplatform.googleapis.com'}}]}}
>>> print(message.model_dump_json(indent=2))
KeyboardInterrupt
>>> from anthropic import AnthropicVertex
>>>
>>> # 设置区域和项目 ID
            "role": "user",
            "content": "Send me a recipe for banana bread.",
        }
    ],
    model="claude-3-5-sonnet@20240620",
)

# 打印返回结果
print(message.model_dump_json(indent=2))
>>> LOCATION = "us-east5"  # 或 "europe-west1"
>>> PROJECT_ID = "alien-climber-432313-r9"
>>>
>>> # 初始化 AnthropicVertex 客户端
>>> client = AnthropicVertex(region=LOCATION, project_id=PROJECT_ID)
>>>
>>> # 创建并发送消息
>>> message = client.messages.create(
...     max_tokens=1024,
...     messages=[
...         {
...             "role": "user",
...             "content": "Send me a recipe for banana bread.",
...         }
...     ],
...     model="claude-3-5-sonnet@20240620",
... )

>>>
>>> # 打印返回结果
>>> print(message.model_dump_json(indent=2))
{
  "id": "msg_vrtx_01HBaSyWLR2Vr9Ufrdh87okJ",
  "content": [
    {
      "text": "Here's a simple recipe for delicious banana bread:\n\nIngredients:\n- 2-3 ripe bananas, mashed\n- 1/3 cup melted butter\n- 1/2 cup sugar\n- 1 egg\n- 1 teaspoon vanilla extract\n- 1 teaspoon baking soda\n- 1/4 teaspoon salt\n- 1 1/2 cups all-purpose flour\n- Optional: 1/2 cup chopped nuts or chocolate chips\n\nInstructions:\n\n1. Preheat oven to 350°F (175°C). Grease a 4x8-inch loaf pan.\n\n2. In a large bowl, mix mashed bananas with melted butter.\n\n3. Stir in sugar, egg, and vanilla extract.\n\n4. Sprinkle baking soda and salt over the mixture and stir in.\n\n5. Add flour and mix until just combined. Don't overmix.\n\n6. Fold in optional nuts or chocolate chips if using.\n\n7. Pour batter into the prepared loaf pan.\n\n8. Bake for 50-60 minutes, or until a toothpick inserted into the center comes out clean.\n\n9. Let cool in the pan for a few minutes, then remove and cool completely on a wire rack.\n\nEnjoy your homemade banana bread!",
      "type": "text"
    }
  ],
  "model": "claude-3-5-sonnet-20240620",
  "role": "assistant",
  "stop_reason": "end_turn",
  "stop_sequence": null,
  "type": "message",
  "usage": {
    "input_tokens": 15,
    "output_tokens": 316
  }
}
>>>
>>> exit();

PreviousBlogNextJupyter lab

Last updated