Cross project bucket access from transcoder api

Question

Can we access the buckets through transcoder api, buckets are in the different project in GCP. While Transcoder Api is running from the different project.

Answer 1

Short answer is YES, transcoder API can load data from another GCP project's storage bucket. You need to grant the transcoder API service agent the permission to download and upload files. The tricky part is getting the service agent. By default, the Transcoder API has access to all of your project's Cloud Storage buckets (same project). When you create your first job, the Transcoder API creates a service account using the following naming convention:

[email protected]

You can read more in the official document.

Here is the step I set up cross-project storage access.

1. Create a GCS storage bucket in another project. project1-demo-bucket

2. In another GCP project (project2). Create a transcoder job.

    gcloud transcoder jobs create \
    --input-uri="gs://project1-demo-bucket/ChromeCast.mp4" \
    --location=us-central1 \
    --output-uri="gs://project1-demo-bucket/output/"
   

You can follow this quickstart for detail.

It will fail with permission error, you can check the job:

gcloud transcoder jobs describe job_id --location=us-central1

because you haven't granted the transcoder service agent GCS bucket permission. This step is to create the service agent.

3. Grant transcoder service agent target GCS bucket permission (in project1).

gcloud storage buckets add-iam-policy-binding gs://project1-demo-bucket --member="serviceAccount:[email protected] --role="roles/storage.admin"

You can do this using GCP console, recommend only grant at bucket level instead of project level.

4. Rerun the same job at step2, you should see it completes successfully.