You are designing the architecture to process your data from Cloud Storage to BigQuery by using Dataflow. The network team provided you with the Shared VPC network and subnetwork to be used by your pi

Question

Options

• AAssign the compute.networkUser role to the Dataflow service agent.
• BAssign the compute.networkUser role to the service account that executes the Dataflow pipeline.
• CAssign the dataflow.admin role to the Dataflow service agent.
• DAssign the dataflow.admin role to the service account that executes the Dataflow pipeline.

• A
  14% (6)
• B
  77% (34)
• C
  7% (3)
• D
  2% (1)

Explanation

Option B is correct because when using a Shared VPC, the user-managed service account that runs the Dataflow pipeline needs compute.networkUser on the host project's network/subnetwork - this grants it permission to attach worker VMs to the shared network.

Why the distractors fail:

• A is wrong because the Dataflow service agent (the Google-managed service-<project-number>@dataflow-service-producer-prod.iam.gserviceaccount.com) handles internal Dataflow platform operations, not network attachment for your pipeline workers. Granting it compute.networkUser doesn't solve the problem.
• C & D are wrong because dataflow.admin controls who can manage Dataflow jobs (create, cancel, update), not who can use a VPC network - it's an unrelated permission to the Shared VPC problem.

Memory tip: Think of it as two separate identities in Dataflow - the service agent (Google's internal operator) vs. your service account (the pipeline runner). For Shared VPC, the question is "who needs network access?" - that's always your service account doing the work, and the role needed is networkUser because you're a user of someone else's (the host project's) network.

No community discussion yet for this question.