Share your Cloud Storage Buckets with Developer Device Platform

Like many Google Cloud services, Developer Device Platform has a dedicated service agent. This page explains how the DDP service agent works, what it can do, and how you can share resources with it.

Permissions

When DDP is used for a project the first time, the system creates a service agent-type service account named: service-PROJECT_ID@gcp-sa-devicerun.

When you enable the Device Run API (devicerun.googleapis.com), Google Cloud automatically provisions the service agent and assigns it the roles/devicerun.serviceAgent role at the project level.

This service agent is granted permission to the Google Cloud project in which the Developer Device Platform is launched. The service agent uses its own credentials rather than yours to:

  • Read and write to Cloud Storage buckets and objects
  • Download Cloud Storage input files to the internal system
  • Upload files from the internal system to the Cloud Storage output bucket

This means it is possible you have access to a Cloud Storage bucket and file, but that bucket is owned by a different Google Cloud project than the one used in DDP. You could also have additional access controls on individual buckets.

Therefore, the Developer Device Platform service agent may not have access to these resources. Follow the instructions here to share access to specific buckets with the DDP service agent.

Sharing access

See Device Run for how to include files with your tests in the DDP-supported project. If your Cloud Storage bucket resides in a different Google Cloud project from your DDP project and you want Device Run to be able to read these files, you must grant roles/storage.objectViewer to the service agent of the project where the DDP request is initiated as described here.

Grant Storage Object Viewer to the service agent: Ensure the DDP Service Agent has the Storage Object Viewer (roles/storage.objectViewer) role on the Cloud Storage bucket containing the files:

gcloud storage buckets add-iam-policy-binding gs://BUCKET_NAME \
  --member="serviceAccount:service-PROJECT_ID@gcp-sa-devicerun." \  --role="roles/storage.objectViewer"

Validation

Now return to your workflow and ensure Device Run has access to the requisite files. If the service agent does not have access to the specified files, the test fails to start.

Supporting documentation