Vertex AI custom model training download denied from Artifact Registry Repo

Hi everyone,

I'm trying to deploy in europe-west8 location(same location artifact registry repo) a custom training job. However everytime i deploy a custom training job passing my Docker image path (both via python SDK and/or GCP console) and after 1 minut i get an "Permission "artifactregistry.repositories.downloadArtifacts" denied on resource ... < artifact repos > (or it may not exist)" error.

The path I think is correct, i also tried via UI of the console to deploy and i could perfectly select it.

I still i don't understand why, i tried almost everything, to grant Artifact Admin to the vertex AI created service agents, to give my email-account Artifact Admin , Aiplatform Admin ecc..., create a third SA with allo permissions and pass it as argument, but I still continue to have the same problem. I also tried to create a new repos and store there the image -> same error.

Does anyone understand why and how to fix this? 

Thank you

2 2 377
2 REPLIES 2

A little update.

Today i tried again to start a new custom job via UI with same parameters and the response error is a little different:

" Error response from daemon: Get "https://<location>-docker.pkg.dev/v2/<project_id>/<repo-id>/<image_name>/manifests/sha256:encrypted-code": denied: Unauthenticated request. Unauthenticated requests do not have permission "artifactregistry.repositories.downloadArtifacts" on resource "projects/<project-id>/locations/<location>/repositories/<repo-id>" (or it may not exist)"

Same problem form me using only the UI, i can't create a custom training with vertex ai 

Training pipeline failed with error message: Docker image 'XXX' could not be pulled. Details: Error response from daemon: Get "XXX": denied: Unauthenticated request. Unauthenticated requests do not have permission "artifactregistry.repositories.downloadArtifacts" on resource "projects/cagip-genai-sbox-2e5b/locations/europe-west9/repositories/train-model" (or it may not exist)