How to configure Dataflow Shared VPC permissions?
You are designing the architecture to process your data from Cloud Storage to BigQuery by using Dataflow. The network team provided you with the Shared VPC network and subnetwork to be used by your pipelines. You need to enable the deployment of the pipeline on the Shared VPC network. What should you do?
Community Votes
55% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The exam tests the distinction between the Google-managed Dataflow Service Agent and the user-managed service account executing the pipeline; the latter requires network permissions for worker instances.
To deploy a Dataflow pipeline on a Shared VPC, the compute.networkUser role must be granted to the service account executing the pipeline, not the Dataflow service agent.
Choosing the Dataflow Service Agent (Option A) based on outdated documentation, whereas the execution service account requires the role to attach workers to the subnet.
Community Discussion (17 comments)
raaad
👍 10
Selected: A
- Dataflow service agent is the one responsible for setting up and managing the network resources that Dataflow requires. - By granting the compute.networkUser role to this service agent, we are enabling it to provision the necessary network resources within the Shared VPC for your Dataflow job.
saschak94
👍 5
Selected: A
All projects that have used the resource Dataflow Job have a Dataflow Service Account, also known as the Dataflow service agent. Make sure the Shared VPC subnetwork is shared with the Dataflow service account and has the Compute Network User role assigned on the specified subnet.
desertlotus1211
👍 1
Answer is B: The Dataflow service agent manages Dataflow internals, but does not launch pipeline worker VMs. So Answer A is incorrect
loki82
👍 1
Selected: A
https://cloud.google.com/dataflow/docs/concepts/security-and-permissions#df-service-account
Pime13
👍 1
Selected: B
https://cloud.google.com/dataflow/docs/guides/specifying-networks https://cloud.google.com/dataflow/docs/guides/specifying-networks#shared Make sure the Shared VPC subnetwork is shared with the Dataflow service account and has the Compute Network User role assigned on the specified subnet. The Compute Network User role must be assigned to the Dataflow service account in the host project.
SamuelTsch
👍 2
Selected: A
From https://cloud.google.com/dataflow/docs/guides/specifying-networks, it says "Make sure the Shared VPC subnetwork is shared with the Dataflow service account and has the Compute Network User role assigned on the specified subnet. The Compute Network User role must be assigned to the Dataflow service account in the host project."
Preetmehta1234
👍 4
Selected: B
If you see in the comments, A was answer by people around 8 months ago but recent ones have answered B with the documentation. The GCP documentation evolves with time
Preetmehta1234
👍 2
Selected: B
service account that executes the Dataflow pipeline It's straight forward
Preetmehta1234
👍 2
Selected: B
Assign the compute.networkUser role to the service account that executes the Dataflow pipeline
Jeyaraj
👍 3
The correct answer is B. Assign the compute.networkUser role to the service account that executes the Dataflow pipeline. Here's why: Shared VPC and Network Access: When using a Shared VPC, you need to grant specific permissions to service accounts in the service project (where your Dataflow pipeline runs) to access resources in the host project's network. compute.networkUser Role: This role grants the necessary permissions for a service account to use the network resources in the Shared VPC. This includes accessing subnets, creating instances, and communicating with other services within the network. Service Account for Pipeline Execution: The service account that executes your Dataflow pipeline is the one that needs these network permissions. This is because the Dataflow service uses this account to create and manage worker instances within the Shared VPC network.
extraego
👍 4
Selected: B
Dataflow service agent is a role that is assigned to a service account. So is compute.networkUser. https://cloud.google.com/dataflow/docs/concepts/access-control#example
josech
👍 4
Selected: B
Option B https://cloud.google.com/knowledge/kb/dataflow-job-in-shared-vpc-xpn-permissions-000004261
chrissamharris
👍 3
Selected: B
I believe the answer is B. All authentication documentation points to Service Accounts. https://cloud.google.com/dataflow/docs/concepts/authentication#on-gcp Dataflow service agent typically manages general interactions with the Dataflow service but does not execute the actual jobs.
Matt_108
👍 3
Selected: A
Option A, I do agree with Raaad, it's the dataflow service agent that needs the networkUser role, because it's the one that provisions the network resources https://cloud.google.com/dataflow/docs/guides/specifying-networks#shared
task_7
👍 4
Selected: B
compute.networkUser to the service account that executes the Dataflow pipeline.
BIGQUERY_ALT_ALT
👍 2
Selected: B
Option B is Correct. Explanation: You need to give compute networkuser role to service account that is processing the pipeline as it will need to deploy nessesary worker nodes on the shared vpc project. Option A is incorrect as Dataflow Service Agent is Google MGS service account that will not responsible for running or deoplying workers in shared vpc. Option C and D is incorrect as dataflow.admin is elevated privlages to create and manage all of dataflow components not deploying resources in shared vpc.
GCP001
👍 2
B. Assign the compute.networkUser role to the service account that executes the Dataflow pipeline. See the ref - https://cloud.google.com/dataflow/docs/guides/specifying-networks
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Option B is correct because the service account executing the pipeline (the worker service account) is the identity used to attach Compute Engine instances to the Shared VPC subnet. Granting compute.networkUser to this account in the host project allows the workers to access the network resources.Why the Other Options Are Wrong
Option A is incorrect because, while the Dataflow Service Agent manages the job, it is not the identity that attaches worker instances to the subnet. Options C and D are incorrect because dataflow.admin grants management permissions for Dataflow jobs but does not provide the necessary network access rights for Shared VPC resources.Community Comment Notes
There is a significant split in the community comments due to evolving Google Cloud documentation. Older comments (1, 2, 9, 10) support Option A, citing the Dataflow service account. However, newer comments (3, 5, 7, 8) argue for Option B, referencing updated Knowledge Base articles and the distinction between the service agent and the execution service account.Official Reference
Exam Strategy
Pay close attention to the specific service account mentioned in the question. If it refers to the account 'executing' or 'running' the pipeline, look for permissions related to worker resources (like compute.networkUser), not the backend service agent.