# Use service account to access data in AnVIL\_GTEx\_V8\_hg38 workspace **URL:** \ **Category:** Data Access\ **Tags:** terra, datamanagement\ **Created:** [July 4, 2024, 9:03am UTC](https://help.anvilproject.org/t/use-service-account-to-access-data-in-anvil-gtex-v8-hg38-workspace/202 "2024-07-04T09:03:54Z")\ **Posts on this page:** 16\ **Page:** 1
**Author:** ![Roderic\_Guigo](https://yyz1.discourse-cdn.com/flex027/user_avatar/help.anvilproject.org/roderic_guigo/32/139_2.png) [@Roderic\_Guigo](https://help.anvilproject.org/u/Roderic_Guigo)\ **Post date:** [July 4, 2024, 9:03am UTC](https://help.anvilproject.org/t/use-service-account-to-access-data-in-anvil-gtex-v8-hg38-workspace/202/1 "2024-07-04T09:03:54Z")
Hi all, we are planning to perform some analyses on GCP using the BAM files from the AnVIL\_GTEx\_V8\_hg38 workspace (terra-6c7f2bca). We have access to the files with our gmail account linked to Terra (the same I am using here) but we would like to use a service account on GCP. I read in the Terra documentation that the best approach would be to use a group for this. So, we created a group in Terra called [guigolab@firecloud.org](mailto:guigolab@firecloud.org) and added the service account to it. Now, I guess we need this group to have permission to access the data in the workspace. Could anybody please help us with this? Many thanks. Best ---
**Author:** ![avahoffman](https://yyz1.discourse-cdn.com/flex027/user_avatar/help.anvilproject.org/avahoffman/32/38_2.png) [@avahoffman](https://help.anvilproject.org/u/avahoffman)\ **Post date:** [July 5, 2024, 3:26pm UTC](https://help.anvilproject.org/t/use-service-account-to-access-data-in-anvil-gtex-v8-hg38-workspace/202/2 "2024-07-05T15:26:51Z")
Thanks for your question! You’re right that Groups are a good way to organize members and accounts. Service accounts are a bit trickier than regular Terra accounts. It sounds like you were able to create the service account successfully, but still might need to register it. Can you let us know if following [these steps in this post](https://support.terra.bio/hc/en-us/articles/7448594459931-How-to-use-a-service-account-in-Terra) allows you to access the files? ---
**Author:** ![Roderic\_Guigo](https://yyz1.discourse-cdn.com/flex027/user_avatar/help.anvilproject.org/roderic_guigo/32/139_2.png) [@Roderic\_Guigo](https://help.anvilproject.org/u/Roderic_Guigo)\ **Post date:** [July 5, 2024, 3:39pm UTC](https://help.anvilproject.org/t/use-service-account-to-access-data-in-anvil-gtex-v8-hg38-workspace/202/3 "2024-07-05T15:39:23Z")
Hi Ava, thanks for your reply. I actually already registered the service account but cannot access the files. What are the next steps? Best ---
**Author:** ![avahoffman](https://yyz1.discourse-cdn.com/flex027/user_avatar/help.anvilproject.org/avahoffman/32/38_2.png) [@avahoffman](https://help.anvilproject.org/u/avahoffman)\ **Post date:** [July 5, 2024, 3:43pm UTC](https://help.anvilproject.org/t/use-service-account-to-access-data-in-anvil-gtex-v8-hg38-workspace/202/4 "2024-07-05T15:43:24Z")
Great! And you have shared the workspace with the [guigolab@firecloud.org](mailto:guigolab@firecloud.org) group? ---
**Author:** ![Roderic\_Guigo](https://yyz1.discourse-cdn.com/flex027/user_avatar/help.anvilproject.org/roderic_guigo/32/139_2.png) [@Roderic\_Guigo](https://help.anvilproject.org/u/Roderic_Guigo)\ **Post date:** [July 5, 2024, 3:58pm UTC](https://help.anvilproject.org/t/use-service-account-to-access-data-in-anvil-gtex-v8-hg38-workspace/202/5 "2024-07-05T15:58:23Z")
That’s the issue. I don’t have permissions to share the workspace with the group. I guess I need a workspace admin to take care of that… ---
**Author:** ![Roderic\_Guigo](https://yyz1.discourse-cdn.com/flex027/user_avatar/help.anvilproject.org/roderic_guigo/32/139_2.png) [@Roderic\_Guigo](https://help.anvilproject.org/u/Roderic_Guigo)\ **Post date:** [July 16, 2024, 8:44pm UTC](https://help.anvilproject.org/t/use-service-account-to-access-data-in-anvil-gtex-v8-hg38-workspace/202/6 "2024-07-16T20:44:26Z")
Dear all, I haven’t received any more feedback. Could anybody please help us with this? Many thanks! Best regards ---
**Author:** ![Javier-CP](https://yyz1.discourse-cdn.com/flex027/user_avatar/help.anvilproject.org/javier-cp/32/168_2.png) [@Javier-CP](https://help.anvilproject.org/u/Javier-CP)\ **Post date:** [July 16, 2024, 11:22pm UTC](https://help.anvilproject.org/t/use-service-account-to-access-data-in-anvil-gtex-v8-hg38-workspace/202/7 "2024-07-16T23:22:28Z")
Hi Roderic, Can you confirm first if you are able to access public data ([Terra](https://anvil.terra.bio/#workspaces/anvil-datastorage/AnVIL_GTEx_public_data)) using a service account? It is unclear whether service accounts are compatible with Authorization Domains but as a first step you can test if the service account can access the public data. ---
**Author:** ![Roderic\_Guigo](https://yyz1.discourse-cdn.com/flex027/user_avatar/help.anvilproject.org/roderic_guigo/32/139_2.png) [@Roderic\_Guigo](https://help.anvilproject.org/u/Roderic_Guigo)\ **Post date:** [July 18, 2024, 3:08pm UTC](https://help.anvilproject.org/t/use-service-account-to-access-data-in-anvil-gtex-v8-hg38-workspace/202/8 "2024-07-18T15:08:00Z")
Hi Javier, many thanks for you reply. We just checked if we can list the contents of the public bucket with this command: ```auto gcloud storage --billing-project guigolab-352014 ls gs://fc-ed391d18-3c0a-4499-a292-35ca51ebf381 ``` It works running it with our gmail account but we get the following error using the service account:: ```auto ERROR: (gcloud.storage.ls) User [nf-service-account@guigolab-352014.iam.gserviceaccount.com] does not have permission to access b instance [fc-ed391d18-3c0a-4499-a292-35ca51ebf381] (or it may not exist): nf-service-account@guigolab-352014.iam.gserviceaccount.com does not have storage.objects.list access to the Google Cloud Storage bucket. Permission 'storage.objects.list' denied on resource (or it may not exist). ``` Best regards ---
**Author:** ![Javier-CP](https://yyz1.discourse-cdn.com/flex027/user_avatar/help.anvilproject.org/javier-cp/32/168_2.png) [@Javier-CP](https://help.anvilproject.org/u/Javier-CP)\ **Post date:** [July 18, 2024, 5:23pm UTC](https://help.anvilproject.org/t/use-service-account-to-access-data-in-anvil-gtex-v8-hg38-workspace/202/9 "2024-07-18T17:23:41Z")
Started a ticket with Terra Support: > Your request (320772) has been received and is being reviewed by our support staff. ---
**Author:** ![Javier-CP](https://yyz1.discourse-cdn.com/flex027/user_avatar/help.anvilproject.org/javier-cp/32/168_2.png) [@Javier-CP](https://help.anvilproject.org/u/Javier-CP)\ **Post date:** [July 23, 2024, 6:11pm UTC](https://help.anvilproject.org/t/use-service-account-to-access-data-in-anvil-gtex-v8-hg38-workspace/202/10 "2024-07-23T18:11:38Z")
From Terra Support 13:00 EDT > It looks like there was an issue with the registered service account on Terra. We’ve resolved this issue so the user should now be able to access the public workspace bucket with the SA. Roderic, can you try again? ---
**Author:** ![Roderic\_Guigo](https://yyz1.discourse-cdn.com/flex027/user_avatar/help.anvilproject.org/roderic_guigo/32/139_2.png) [@Roderic\_Guigo](https://help.anvilproject.org/u/Roderic_Guigo)\ **Post date:** [July 24, 2024, 7:09am UTC](https://help.anvilproject.org/t/use-service-account-to-access-data-in-anvil-gtex-v8-hg38-workspace/202/11 "2024-07-24T07:09:25Z")
Thanks a lot Javier! I had to add the `Service Usage Consumer` role to the service account for the project and eventually it worked with the public bucket. I then tried with the `AnVIL_GTEx_V8_hg38` workspace bucket but I still get `Permission 'storage.objects.list' denied on resource` (while it works with my main account). ---
**Author:** ![Javier-CP](https://yyz1.discourse-cdn.com/flex027/user_avatar/help.anvilproject.org/javier-cp/32/168_2.png) [@Javier-CP](https://help.anvilproject.org/u/Javier-CP)\ **Post date:** [July 24, 2024, 2:16pm UTC](https://help.anvilproject.org/t/use-service-account-to-access-data-in-anvil-gtex-v8-hg38-workspace/202/12 "2024-07-24T14:16:16Z")
Checking into this with Terra Support. We’ll keep you updated. ---
**Author:** ![Javier-CP](https://yyz1.discourse-cdn.com/flex027/user_avatar/help.anvilproject.org/javier-cp/32/168_2.png) [@Javier-CP](https://help.anvilproject.org/u/Javier-CP)\ **Post date:** [July 26, 2024, 7:13pm UTC](https://help.anvilproject.org/t/use-service-account-to-access-data-in-anvil-gtex-v8-hg38-workspace/202/13 "2024-07-26T19:13:49Z")
From Terra Support: > Our engineers indicate that the Service Account will not be able to gain access to controlled-access GTEx workspaces. Due to security reasons, they would need to be logged into the Terra UI to do the account linking mentioned in the instructions because the NIH Auth requires a redirect back to [app.terra.bio](http://app.terra.bio/). And since you can’t login via Google with a service account, this is unfortunately, not possible. Roderic, Is there something in particular that you can practically only do via a service account? ---
**Author:** ![Roderic\_Guigo](https://yyz1.discourse-cdn.com/flex027/user_avatar/help.anvilproject.org/roderic_guigo/32/139_2.png) [@Roderic\_Guigo](https://help.anvilproject.org/u/Roderic_Guigo)\ **Post date:** [July 29, 2024, 7:51am UTC](https://help.anvilproject.org/t/use-service-account-to-access-data-in-anvil-gtex-v8-hg38-workspace/202/14 "2024-07-29T07:51:49Z")
Hi Javier, thanks a lot for your help. While technically we can do all we need with our standard gmail account, it is strongly recommended to use service accounts when, for example, running a long computational workflow with Nextflow (which is one of the tasks we want to accomplish here). If the use of a service account is not possible, we will move forward using our gmail account. Although, I think that this is something Terra engineers should have a look at. Many thanks again for your help! Best ---
**Author:** ![Javier-CP](https://yyz1.discourse-cdn.com/flex027/user_avatar/help.anvilproject.org/javier-cp/32/168_2.png) [@Javier-CP](https://help.anvilproject.org/u/Javier-CP)\ **Post date:** [August 2, 2024, 2:54pm UTC](https://help.anvilproject.org/t/use-service-account-to-access-data-in-anvil-gtex-v8-hg38-workspace/202/15 "2024-08-02T14:54:05Z")
Definitely something to consider! Thank you for your patience, Roderic. ---
**Author:** ![Javier-CP](https://yyz1.discourse-cdn.com/flex027/user_avatar/help.anvilproject.org/javier-cp/32/168_2.png) [@Javier-CP](https://help.anvilproject.org/u/Javier-CP)\ **Post date:** [August 2, 2024, 3:18pm UTC](https://help.anvilproject.org/t/use-service-account-to-access-data-in-anvil-gtex-v8-hg38-workspace/202/16 "2024-08-02T15:18:40Z")