Vertex AI Workbench

[Neel19]

I"m trying to provision Vertex AI workbench using the already existing service account using terraforming script, but during terraforming apply it's in provisioning for ever, seems it's creating a separate or using a default service account, any recommendations on how to use the existing service account to workbench instances ? i am using resource block "google_workbench_instance"

[MarvinLlamas]

Hi @Neel19,

Welcome to Google Cloud Community!

It looks like you are facing an issue where your Terraform script intended to provision a Vertex AI Workbench instance is stuck in an indefinite provisioning state. it appears that the instance is either attempting to create a new service account or defaulting to the Compute Engine service account, which most likely does not have the required IAM permissions to complete the provisioning process.

Here are the potential ways that might help with your use case:

• Explicitly Specify the Service Account: In the google_workbench_instance resource, within your gce_setup block, you must set the service_account attribute to the full email address of your existing service account. This forces your instance to use the specified account.
• Verify Service Account Existence and Email: Double-check that your service account exists in your GCP project and that the email address you provided is correct.
• Grant necessary IAM permission: Make sure your existing service account must have the required IAM roles to manage your resources. At a minimum, you should grant roles such as roles/storage.objectViewer, roles/compute.instanceAdmin.v1, roles/aiplatform.user, and roles/iam.serviceAccountUser.
• Network Configuration: Ensure your Workbench instance has proper network access (firewall rules, subnet with Private Google Access if needed) to reach required services and the internet.

Was this helpful? If so, please accept this answer as “Solution”. If you need additional assistance, reply here within 2 business days and I’ll be happy to help.