How to configure Dataflow Shared VPC permissions?

PDE By islever Editorial Last updated

Short answer

B Assign the compute.networkUser role to the service account that executes the Dataflow pipeline.

Question

You are designing the architecture to process your data from Cloud Storage to BigQuery by using Dataflow. The network team provided you with the Shared VPC network and subnetwork to be used by your pipelines. You need to enable the deployment of the pipeline on the Shared VPC network. What should you do?
  1. Assign the compute.networkUser role to the Dataflow service agent.
  2. Assign the compute.networkUser role to the service account that executes the Dataflow pipeline. Correct Answer
  3. Assign the dataflow.admin role to the Dataflow service agent.
  4. Assign the dataflow.admin role to the service account that executes the Dataflow pipeline.

Key Takeaways

The exam tests the distinction between the Google-managed Dataflow Service Agent and the user-managed service account executing the pipeline; the latter requires network permissions for worker instances.

To deploy a Dataflow pipeline on a Shared VPC, the compute.networkUser role must be granted to the service account executing the pipeline, not the Dataflow service agent.

Common mistake: Choosing the Dataflow Service Agent (Option A) based on outdated documentation, whereas the execution service account requires the role to attach workers to the subnet.

Expert Analysis

Why the Answer Is Correct

Option B is correct because the service account executing the pipeline (the worker service account) is the identity used to attach Compute Engine instances to the Shared VPC subnet. Granting compute.networkUser to this account in the host project allows the workers to access the network resources.

Why the Other Options Are Wrong

Option A is incorrect because, while the Dataflow Service Agent manages the job, it is not the identity that attaches worker instances to the subnet. Options C and D are incorrect because dataflow.admin grants management permissions for Dataflow jobs but does not provide the necessary network access rights for Shared VPC resources.

Community Comment Notes

There is a significant split in the community comments due to evolving Google Cloud documentation. Older comments (1, 2, 9, 10) support Option A, citing the Dataflow service account. However, newer comments (3, 5, 7, 8) argue for Option B, referencing updated Knowledge Base articles and the distinction between the service agent and the execution service account.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

Pay close attention to the specific service account mentioned in the question. If it refers to the account 'executing' or 'running' the pipeline, look for permissions related to worker resources (like compute.networkUser), not the backend service agent.

Community Votes

B
55%
A
45%

55% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 17 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 17

  1. raaad 👍 10 Answered A
    - Dataflow service agent is the one responsible for setting up and managing the network resources that Dataflow requires. - By granting the compute.networkUser role to this service agent, we are enabling it to provision the necessary network resources within the Shared VPC for your Dataflow job.
  2. saschak94 👍 5 Answered A
    All projects that have used the resource Dataflow Job have a Dataflow Service Account, also known as the Dataflow service agent. Make sure the Shared VPC subnetwork is shared with the Dataflow service account and has the Compute Network User role assigned on the specified subnet.
  3. extraego 👍 4 Answered B
    Dataflow service agent is a role that is assigned to a service account. So is compute.networkUser. https://cloud.google.com/dataflow/docs/concepts/access-control#example
  4. Preetmehta1234 👍 4 Answered B
    If you see in the comments, A was answer by people around 8 months ago but recent ones have answered B with the documentation. The GCP documentation evolves with time
  5. josech 👍 4 Answered B
    Option B https://cloud.google.com/knowledge/kb/dataflow-job-in-shared-vpc-xpn-permissions-000004261
Show 12 more comments
  1. task_7 👍 4 Answered B
    compute.networkUser to the service account that executes the Dataflow pipeline.
  2. Jeyaraj 👍 3
    The correct answer is B. Assign the compute.networkUser role to the service account that executes the Dataflow pipeline. Here's why: Shared VPC and Network Access: When using a Shared VPC, you need to grant specific permissions to service accounts in the service project (where your Dataflow pipeline runs) to access resources in the host project's network. compute.networkUser Role: This role grants the necessary permissions for a service account to use the network resources in the Shared VPC. This includes accessing subnets, creating instances, and communicating with other services within the network. Service Account for Pipeline Execution: The service account that executes your Dataflow pipeline is the one that needs these network permissions. This is because the Dataflow service uses this account to create and manage worker instances within the Shared VPC network.
  3. chrissamharris 👍 3 Answered B
    I believe the answer is B. All authentication documentation points to Service Accounts. https://cloud.google.com/dataflow/docs/concepts/authentication#on-gcp Dataflow service agent typically manages general interactions with the Dataflow service but does not execute the actual jobs.
  4. Matt_108 👍 3 Answered A
    Option A, I do agree with Raaad, it's the dataflow service agent that needs the networkUser role, because it's the one that provisions the network resources https://cloud.google.com/dataflow/docs/guides/specifying-networks#shared
  5. BIGQUERY_ALT_ALT 👍 2 Answered B
    Option B is Correct. Explanation: You need to give compute networkuser role to service account that is processing the pipeline as it will need to deploy nessesary worker nodes on the shared vpc project. Option A is incorrect as Dataflow Service Agent is Google MGS service account that will not responsible for running or deoplying workers in shared vpc. Option C and D is incorrect as dataflow.admin is elevated privlages to create and manage all of dataflow components not deploying resources in shared vpc.
  6. SamuelTsch 👍 2 Answered A
    From https://cloud.google.com/dataflow/docs/guides/specifying-networks, it says "Make sure the Shared VPC subnetwork is shared with the Dataflow service account and has the Compute Network User role assigned on the specified subnet. The Compute Network User role must be assigned to the Dataflow service account in the host project."
  7. GCP001 👍 2
    B. Assign the compute.networkUser role to the service account that executes the Dataflow pipeline. See the ref - https://cloud.google.com/dataflow/docs/guides/specifying-networks
  8. Preetmehta1234 👍 2 Answered B
    Assign the compute.networkUser role to the service account that executes the Dataflow pipeline
  9. Preetmehta1234 👍 2 Answered B
    service account that executes the Dataflow pipeline It's straight forward
  10. Pime13 👍 1 Answered B
    https://cloud.google.com/dataflow/docs/guides/specifying-networks https://cloud.google.com/dataflow/docs/guides/specifying-networks#shared Make sure the Shared VPC subnetwork is shared with the Dataflow service account and has the Compute Network User role assigned on the specified subnet. The Compute Network User role must be assigned to the Dataflow service account in the host project.
  11. desertlotus1211 👍 1
    Answer is B: The Dataflow service agent manages Dataflow internals, but does not launch pipeline worker VMs. So Answer A is incorrect
  12. loki82 👍 1 Answered A
    https://cloud.google.com/dataflow/docs/concepts/security-and-permissions#df-service-account

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

How to establish consistent BigQuery spend?

S-grade

Triggering Airflow DAGs Reactively in Private Cloud Composer

S-grade

How to resolve Cloud Composer 2 worker pod evictions and task failures?

S-grade

Which Google Cloud database for on-prem PostgreSQL with analytics?

S-grade

← Back to PDE Study Guide