Use GCP Endpoints as reverse proxy for Vertex Ai Endpoint

[Redlom]

I am using GCP Endpoints to work as a reverse proxy to a Vertex Ai Endpoint. I can authenticate to GCP Endpoints with api keys, service account... but I get the following error code. Yet, am able to get a successful response from Vertex Ai Endpoint directly.

# Error code when requesting to GCP Endpoints (API is authenticated)

{
  "error": {
    "code": 401,
    "message": "Request had invalid authentication credentials. Expected OAuth 2 access token, login cookie or other valid authentication credential. See https://developers.google.com/identity/sign-in/web/devconsole-project.",
    "status": "UNAUTHENTICATED"
  }
}

Even using the flag "--allow-unauthenticated" when setting up ESPv2 still fails.

The request

curl -X POST -H "content-type:application/json" "${HOST}?key=${API_KEY}" -vL -d "@${DATA_FILE}"

openapi.json (host and address removed for privacy)

swagger: '2.0'
info:
  title: Cloud Endpoints + Cloud Run
  description: Sample API on Cloud Endpoints with a Cloud Run backend
  version: 1.0.0
host: HOST
schemes:
  - https
consumes:
  - application/json
  - multipart/form-data
produces:
  - application/json
x-google-backend:
  address: VERTEX_AI_ENDPOINT
  protocol: h2
securityDefinitions:
  # This section configures basic authentication with an API key.
  api_key:
    type: "apiKey"
    name: "key"
    in: "query"
paths:
  /:
    post:
      summary: Greet a user
      security:
        - api_key: []
      operationId: hello
      responses:
        '200':
          description: A successful response
          schema:
            type: string

Any help would be greatly appreciated

[Oubi]

Hi,

Could be for different reasons:

• For testing purposes, grant the service account the ‘owner’ role as advice in [1] document, and see if you still get the error. 
• If everything was working fine before, please try to generate another <access_token> for your service account as mentioned in [2].
• Make sure you followed all the steps form document [3]

Thank you

[1]: https://cloud.google.com/vertex-ai/docs/tutorials/image-recognition-automl#before_you_begin

[2] https://developers.google.com/identity/protocols/oauth2#5.-refresh-the-access-token,-if-necessary.

[3]: https://cloud.google.com/vertex-ai/docs/general/custom-service-account