composer/WARN/2022_001
Composer Service Agent permissions for Composer 2.x
Product: Cloud Composer
Rule class: WARN - Something that is possibly wrong
Description
Cloud Composer 2 uses Workload Identity and requires additional permissions in
order to successfully create an environment. Those permissions are provided by
composer.ServiceAgentV2Ext role and must be granted manually.
Remediation
Ensure that you’ve the following binding in the IAM policy for the project:
- Principal:
service-PROJECT_NUMBER@cloudcomposer-accounts.iam.gserviceaccount.com - Role:
roles/composer.ServiceAgentV2Ext