Issue with calling Vertex AI API on Cloud Function

Google Cloud Serverless Applications
1

Hello, I’m trying to call the Vertex AI API with Cloud Function to get some response from text-bison and ran into this issue:

google.api_core.exceptions.PermissionDenied: 403 Your application is authenticating by using local Application Default Credentials. The aiplatform.googleapis.com API requires a quota project, which is not set by default. To learn how to set your quota project, see https://cloud.google.com/docs/authentication/adc-troubleshooting/user-creds . [reason: “SERVICE_DISABLED”
domain: “googleapis.com”

I’ve tried to set my current project to the quota project based on the link above but it doesn’t seem to rectify the issue. In addition, I tried calling other APIs like Big Query and didn’t run into this problem.

Also, the Cloud Function was ran in the GCP console so technically the credentials are pre-authorised…Anyone have run into a similar problem before?

3 Likes
2

I have the same problem.

3

Did anyone solve this?

4

Same problem

5

Hi. Is your Cloud Function using python?

If so, you could be affected by https://github.com/googleapis/python-aiplatform/issues/2620 - try modifying your requirements.txt to set:

google-cloud-aiplatform>=1.36.0

This will make sure your aiplatform client gets the fix from https://github.com/googleapis/python-aiplatform/commit/eb6071fe567ef80ba5490b9eaae0cedd6958aac5

If there’s some incompatibility, you could try pinning the dependency to 1.32.0, too - but I’d recommend trying to fix forward to 1.36.0 or newer first.

6

I managed to solve it. Anything which would require OAuth won’t work because Cloud Functions is on the back-end side and OAuth at some point would try to popup a browser for authentication.

You need to setup a service account, see https://cloud.google.com/docs/authentication#auth-decision-tree and https://cloud.google.com/docs/authentication/application-default-credentials

7

Anything which would require some type of OAuth mechanics would fail because Cloud Functions is on the back-end and the system would want to popup a browser to ask for credentials and complete the OAuth auth flow.

This is even true when you are experimenting with iPython notebooks with code what you want to use in the Cloud Function: it gonna open a browser (for example at the vertexai.init step, see https://github.com/CsabaConsulting/NextGenAI/blob/main/ImagenTest.ipynb).

So you need to establish a service account and go through some configuration. See also https://cloud.google.com/docs/authentication#auth-decision-tree and https://cloud.google.com/docs/authentication/application-default-credentials

authn-tree.png
authn-tree.png1031×819 87.1 KB

8

Unfortunately this didn’t work for me.

9

You need to say details how did it not work, what code did you try and what errors you got

10

After some trial and error I was able to resolve this issue. For context, my function is gen2 , triggered via http request, and is written in python.

Where I was getting tripped up here was in the “test function” feature in the console. My function never executed properly pre-deployment, so I recommend following the troubleshooting steps surfaced in the error message (https://cloud.google.com/docs/authentication/troubleshoot-adc#user-creds-client-based), deploy your function and then test either from CLI or the ‘Testing’ tab in the console.

  1. What I think fixed the issue for me was running this from the terminal
gcloud auth application-default set-quota-project YOUR_PROJECT
  • Also, if your function is also trigger through an incoming request, be sure to set the x-goog-user-project in the POST request header
  1. if that doesn’t solve your issue, you can also try adding your service account creds to the Secret Manager and then adding them as an env variable + adding an env variable to set the project. (https://cloud.google.com/functions/docs/configuring/secrets#console)
11

On Cloud Run we just launched an integration to automate the process of wiring up Vertex’s generative APIs to your Cloud Run services: https://cloud.google.com/run/docs/integrate/vertex-ai

If you’re using Functions v2, you can configure this on the underlying Cloud Run service. Once configured, using any of the client libraries should ‘just work’ using the workload identity of the service, no additional configuration required.

12

I’ve followed the page to get a NodeJS service working locally and it calls Vertex AI fine. But when I deploy to Cloud Run I get a 403. How do I “configure this on the underlying Cloud Run service”? Thanks.