vishalmore90 opened a new issue, #40442:
URL: https://github.com/apache/beam/issues/40442
### What happened?
## Description
In the Python SDK, `VertexAIFeatureStoreEnrichmentHandler` includes logic
during its initialization (`__init__`) to verify the existence of the specified
Vertex AI Feature Store. The code intends to gracefully handle cases where the
user has insufficient admin permissions to verify the feature store's existence
by catching the exception and logging a warning. However, the `try...except
Exception:` block incorrectly wraps only the instantiation of
`FeatureOnlineStoreAdminServiceClient`, while the actual API call that requires
permissions (`admin_client.get_feature_online_store`) is placed in the `else`
block.
Because `FeatureOnlineStoreAdminServiceClient` initialization performs no
RPCs and does not check permissions, the `except` block is almost never
triggered. Instead, the `PermissionDenied` exception is thrown downstream by
`get_feature_online_store`, crashing the pipeline unexpectedly and defeating
the intended fallback logic.
## Code Pointers / Steps to Reproduce
**File Location:**
`sdks/python/apache_beam/transforms/enrichment_handlers/vertex_ai_feature_store.py`
(Line 113)
```python
# check if the feature store exists
try:
# This instantiation does not make an RPC call or check permissions
admin_client = aiplatform.gapic.FeatureOnlineStoreAdminServiceClient(
**self.kwargs)
except Exception:
# This warning is never logged for permission errors
_LOGGER.warning('Due to insufficient admin permission...')
else:
location_path = admin_client.common_location_path(...)
feature_store_path = admin_client.feature_online_store_path(...)
# BUG: This call actually makes the RPC and checks permissions.
# Since it is in the `else` block, any PermissionDenied exception
# will bubble up and crash the application.
feature_store = admin_client.get_feature_online_store(
name=feature_store_path)
```
**Steps to Reproduce:**
1. Create a Beam pipeline utilizing the
`VertexAIFeatureStoreEnrichmentHandler`.
2. Execute the pipeline using a service account or credentials that have
read-access to the feature view but *lack* the `aiplatform.featurestoreAdmin`
(or similar) permission to read the store metadata.
3. The pipeline will immediately crash with a `PermissionDenied` exception
during DAG construction instead of logging the intended warning and proceeding.
## Impact
Users running in restricted environments with least-privilege IAM roles (who
only have data read access, not admin access) will be unable to run pipelines
using this enrichment handler, despite the code explicitly trying to support
this scenario with a warning fallback.
## Proposed Solution
Move the actual verification call (`get_feature_online_store`) inside the
`try` block so that the permission error is successfully caught and logged.
```python
try:
admin_client = aiplatform.gapic.FeatureOnlineStoreAdminServiceClient(
**self.kwargs)
location_path = admin_client.common_location_path(
project=self.project, location=self.location)
feature_store_path = admin_client.feature_online_store_path(
project=self.project,
location=self.location,
feature_online_store=self.feature_store_name)
# Now inside the try block
feature_store = admin_client.get_feature_online_store(
name=feature_store_path)
if not feature_store:
raise NotFound(
'Vertex AI Feature Store %s does not exists in %s' %
(self.feature_store_name, location_path))
except Exception:
_LOGGER.warning(
'Due to insufficient admin permission, could not verify '
'the existence of feature store...')
```
### Issue Priority
Priority: 2 (default / most bugs should be filed as P2)
### Issue Components
- [x] Component: Python SDK
- [ ] Component: Java SDK
- [ ] Component: Go SDK
- [ ] Component: Typescript SDK
- [ ] Component: IO connector
- [ ] Component: Beam YAML
- [ ] Component: Beam examples
- [ ] Component: Beam playground
- [ ] Component: Beam katas
- [ ] Component: Website
- [ ] Component: Infrastructure
- [ ] Component: Spark Runner
- [ ] Component: Flink Runner
- [ ] Component: Prism Runner
- [ ] Component: Twister2 Runner
- [ ] Component: Hazelcast Jet Runner
- [ ] Component: Google Cloud Dataflow Runner
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
