Google Cloud Composer添加Python包失败，需哪些必要权限？

First, let's clear up a common gotcha: Double-check that you're modifying the service account linked directly to your Composer environment (you can find this in your environment's "Configuration" tab under the "Service account" field). While it might be the same as the Compute Engine default account you used, confirming this ensures you're applying permissions to the right identity.

Here are the minimal, critical roles you need for successful PyPI package installation:

• Cloud Composer Worker (roles/composer.worker): This is the most often overlooked core role. It grants the service account permissions to execute package installation tasks, interact with your environment's dedicated GCS bucket, and run essential operations on Composer worker nodes.
• Storage Object Admin (roles/storage.objectAdmin): Required to read and write to your Composer environment's GCS bucket (e.g., gs://us-central1-[your-env-name]-[hash]-bucket/). The installation process needs to upload downloaded packages and read dependency metadata from this bucket.
• Service Account User (roles/iam.serviceAccountUser): Allows the Composer control plane to act as your environment's service account when triggering installation workflows. Without this, the control plane can't properly initiate worker-side tasks.

Optional Role (if applicable): #

• Artifact Registry Reader (roles/artifactregistry.reader): Only necessary if you're pulling packages from a private Artifact Registry repository instead of public PyPI.

Notes on your current setup: #

The broad roles you added (Editor, Composer Administrator) are overkill and don't target the granular permissions needed for package installs. Overly broad roles can sometimes lead to unexpected permission inheritance conflicts, so sticking to the minimal roles above is better practice.

Extra Troubleshooting Tips: #

1. Verify GCS Bucket ACLs: Even with correct IAM roles, check that your service account isn't explicitly denied access to the Composer bucket via bucket-level ACL settings.
2. Check Network Connectivity: If your Composer environment is in a private VPC, ensure worker nodes have outbound access to public PyPI (typically via Cloud NAT). A network timeout can mimic a permission error, so this is a common hidden issue.
3. Dig into Detailed Logs: Head to your Composer environment's "Logs" tab and search for keywords like PyPI or install—the specific error message will tell you if it's a permission denial, network issue, or even a package compatibility problem.

内容的提问来源于stack exchange，提问作者Orhun