I have trained imagen model in subject mode with instant when I tried to inference through the api call I am getting the permission issue.

Here is my code

from google.cloud import aiplatform

def generate_image(endpoint_id, project_id, location, prompt)

# Initialize the AI Platform client

aiplatform.init(project=project_id, location=location)

# Retrieve the endpoint

endpoint = aiplatform.Endpoint(endpoint_id)

# Prepare the instance

instances = \[{"prompt": prompt}\]

# Set parameters if needed

parameters = {"sampleCount": 2}

# Make the prediction

response = endpoint.predict(instances=instances, parameters=parameters)

return response

generate_image("endpoint_id", "project_id", "project_region", "prompt")"

error:

"grpc._channel._InactiveRpcError: <_InactiveRpcError of RPC that terminated with:

status = StatusCode.PERMISSION_DENIED

details = "Image generation failed with the following error: [email protected] does not have storage.objects.get access to the Google Cloud Storage object. Permission 'storage.objects.get' denied on resource (or it may not exist). [email protected] does not have storage.objects.get access to the Google Cloud Storage object. Permission 'storage.objects.get' denied on resource (or it may not exist)."

debug_error_string = "UNKNOWN:Error received from peer ipv4:142.250.206.138:443 {grpc_message:"Image generation failed with the following error: [email protected] does not have storage.objects.get access to the Google Cloud Storage object. Permission \'storage.objects.get\' denied on resource (or it may not exist). [email protected] does not have storage.objects.get access to the Google Cloud Storage object. Permission \'storage.objects.get\' denied on resource (or it may not exist).", grpc_status:7, created_time:"2025-02-06T10:40:40.662735554+05:30"}"

How can I resolve this issue?

Solutions I have tried:

Assigned the roles and permission in the IAM admin section

Assigned the roles and permissions on the bucket and projct level

Roles I have assigned to resolve this issue

roles/storage.admin

roles/storage.objectViewer

How to manage the permission on cloud managed service account or is there any other way to make inference through api call?