使用Vertex AI PredictionServiceClient遇403 CONSUMER_INVALID权限错误求助

错误详情 #

google.api_core.exceptions.PermissionDenied: 403 Permission denied on resource project YOUR_PROJECT_ID. [links {
 description: "Google developers console"
 url: "https://console.developers.google.com"
}
, reason: "CONSUMER_INVALID"
domain: "googleapis.com"
metadata {
 key: "consumer"
 value: "projects/YOUR_PROJECT_ID"
}
metadata {
 key: "service"
 value: "aiplatform.googleapis.com"
}
]

代码片段 #

project_id = "positive-tempo-405405"
model_id = "textembedding-gecko@latest"  # 或其他模型ID
location = "us-central1"
instance_id = 'YOUR_INSTANCE_ID'
database_id = 'YOUR_DATABASE_ID'

def create_vector_represenation(text):  
    # 初始化客户端           
    text_to_text_client = vertex_ai.gapic.PredictionServiceClient(client_options={"api_endpoint": "us-central1-aiplatform.googleapis.com"})
    # 创建模型端点
    endpoint = f"projects/{project_id}/locations/{location}/models/{model_id}"
    # 构造请求 payload
    instances = [{"content": text}]
    # 发起预测请求
    response = text_to_text_client.predict(endpoint=endpoint, instances=instances)
    # 从响应中提取向量表示
    vector_representation = response.predictions[0]["embeddings"]["values"]
    st.write('vector_representation: ', vector_representation)
    return vector_representation

已排查的内容 #

• 已添加所需IAM策略：

{
  "bindings": [
    {
      "members": [
        "serviceAccount:630332944972-compute@developer.gserviceaccount.com",
        "user:***@gmail.com"
      ],
      "role": "roles/aiplatform.admin"
    },
    {
      "members": [
        "serviceAccount:service-630332944972@compute-system.iam.gserviceaccount.com"
      ],
      "role": "roles/compute.serviceAgent"
    },
    {
      "members": [
        "serviceAccount:service-630332944972@dataflow-service-producer-prod.iam.gserviceaccount.com"
      ],
      "role": "roles/dataflow.serviceAgent"
    },
    {
      "members": [
        "serviceAccount:630332944972-compute@developer.gserviceaccount.com",
        "serviceAccount:630332944972@cloudservices.gserviceaccount.com"
      ],
      "role": "roles/editor"
    },
    {
      "members": [
        "serviceAccount:630332944972-compute@developer.gserviceaccount.com",
        "user:***@gmail.com"
      ],
      "role": "roles/ml.admin"
    },
    {
      "members": [
        "serviceAccount:630332944972-compute@developer.gserviceaccount.com",
        "user:***@gmail.com"
      ],
      "role": "roles/ml.developer"
    },
    {
      "members": [
        "serviceAccount:service-630332944972@gcp-sa-notebooks.iam.gserviceaccount.com"
      ],
      "role": "roles/notebooks.serviceAgent"
    },
    {
      "members": [
        "user:***@gmail.com"
      ],
      "role": "roles/owner"
    }
  ],
  "etag": "BwYKdso-i10=",
  "version": 1
}

• 已将application_default_credentials.json路径设置为GOOGLE_APPLICATION_CREDENTIALS环境变量
• 已确认项目ID正确：

Project info
-------------
Project name: RAG-Vertex-AI-Chatbot
Project number: 630332944972
Project ID: positive-tempo-405405

解决方法 #

1. 检查Vertex AI API是否启用
   登录GCP控制台，找到项目对应的Vertex AI API，确认状态为“已启用”。若未启用，手动开启该API，等待几分钟让配置生效后重试。

2. 验证凭证有效性

   • 确认GOOGLE_APPLICATION_CREDENTIALS指向的JSON文件是当前项目的有效服务账号密钥，而非其他项目的。
   • 执行命令gcloud auth application-default print-access-token，检查返回的令牌是否有效，若报错则重新生成服务账号密钥并更新环境变量。

3. 确认客户端端点配置正确
   代码中使用的api_endpoint需与模型所在区域匹配，当前使用的us-central1-aiplatform.googleapis.com对应us-central1区域，若模型部署在其他区域需同步修改端点地址。

4. 检查IAM角色的即时生效性
   IAM权限变更可能存在延迟，若刚添加完权限，等待5-10分钟后再测试。同时确认当前运行代码的身份（用户或服务账号）确实拥有roles/aiplatform.user或更高级别的权限（已有aiplatform.admin应该足够，但可直接添加aiplatform.user确保覆盖预测权限）。

5. 排查项目关联问题
   确认当前使用的凭证所属项目与代码中的project_id一致，避免跨项目调用导致的权限问题。可通过gcloud config get project命令检查当前CLI配置的项目ID是否匹配。

内容的提问来源于stack exchange，提问作者Saikat Mukherjee