Deployment Fails for Data Science Agent with Reasoning Engine Error

[hector-est-52]

Command run:

cd deployment/
python3 deploy.py --create

Observed error:

An unexpected error occurred: 400 Reasoning Engine instance [REDACTED_INSTANCE_ID] failed to start and cannot serve traffic. 
Please refer to:
https://cloud.google.com/vertex-ai/generative-ai/docs/reasoning-engine/troubleshooting/deploy
https://cloud.google.com/vertex-ai/generative-ai/docs/agent-engine/troubleshooting/deploy
...
Traceback (most recent call last):
  File ".../deploy.py", line 256, in main
    create(env_vars)
  File ".../deploy.py", line 137, in create
    remote_agent = agent_engines.create(...)
  ...
  raise self._exception

Logs Explorer output:

PermissionDenied: 403 Permission 'aiplatform.extensions.get' denied on resource '//aiplatform.googleapis.com/projects/[REDACTED_PROJECT_ID]/locations/us-central1/extensions/[REDACTED_RESOURCE_ID]'
(reason: "IAM_PERMISSION_DENIED", permission: "aiplatform.extensions.get")

I tried assigning the aiplatform.extensions.get permission to my user account, but the error still occurs. Does this permission need to be granted to a service account instead?

If so:

• Which service account should it be?
• Is there any specific role or policy I should apply?

Environment
OS: macOS
Python: 3.12.10
google-cloud-aiplatform version: 1.93.0
Region: us-central1

[5Y5TEM]

@hector-est-52 you need to grant the permissions to the Reasoning Engine Service Account:

"service-${GOOGLE_CLOUD_PROJECT_NUMBER}@gcp-sa-aiplatform-re.iam.gserviceaccount.com"

Can you try that and let me know if that fixes the issue? Thanks!

[hector-est-52]

Thanks a lot, @5Y5TEM that was the solution!

Just to add some additional info: in some cases, the service account is not automatically created by Google, and you may need to create it manually. For anyone in the same situation, here’s the official documentation on how to create service agents.

[VipRaw001]

hi @5Y5TEM ,
I also encountered the same error, 400 Reasoning Engine resource [REDACTED_INSTANCE_ID]] failed to start and cannot serve traffic. Please refer to our documentation (https://cloud.google.com/vertex-ai/generative-ai/docs/agent-engine/troubleshooting/deploy) for checking logs and other troubleshooting tips.

could you specify the permissions for "service-${GOOGLE_CLOUD_PROJECT_NUMBER}@gcp-sa-aiplatform-re.iam.gserviceaccount.com". I tired but still same error, also in logs I can't find any logs related to access.