title: How do I safely grant permission for Cloud Scheduler to create a Dataflow job?
body: <p>I have a Dataflow template that I can use for a Dataflow job running as a service account of my choosing. I've actually used one of Google's provided samples: <code>gs://dataflow-templates/latest/GCS_Text_to_BigQuery</code>.</p>
  <p>I now want to schedule this using Cloud Scheduler. I've set up my scheduler job like so:
  <a href="https://i.stack.imgur.com/EEfFg.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/EEfFg.png" alt="enter image description here" /></a></p>
  <p>When the scheduler job runs it errors with <code>PERMISSION_DENIED</code>:</p>
  <pre class="lang-json prettyprint-override"><code>{
    &quot;insertId&quot;: &quot;1kw7uaqg3tnzbqu&quot;,
    &quot;jsonPayload&quot;: {
      &quot;@type&quot;: &quot;type.googleapis.com/google.cloud.scheduler.logging.AttemptFinished&quot;,
      &quot;url&quot;: &quot;https://dataflow.googleapis.com/v1b3/projects/project-redacted/locations/europe-west2/templates:launch?gcsPath=gs%3A%2F%2Fdataflow-templates%2Flatest%2FGCS_Text_to_BigQuery&quot;,
      &quot;jobName&quot;: &quot;projects/project-redacted/locations/europe-west2/jobs/aaa-schedule-dataflow-job&quot;,
      &quot;status&quot;: &quot;PERMISSION_DENIED&quot;,
      &quot;targetType&quot;: &quot;HTTP&quot;
    },
    &quot;httpRequest&quot;: {
      &quot;status&quot;: 403
    },
    &quot;resource&quot;: {
      &quot;type&quot;: &quot;cloud_scheduler_job&quot;,
      &quot;labels&quot;: {
        &quot;job_id&quot;: &quot;aaa-schedule-dataflow-job&quot;,
        &quot;project_id&quot;: &quot;project-redacted&quot;,
        &quot;location&quot;: &quot;europe-west2&quot;
      }
    },
    &quot;timestamp&quot;: &quot;2021-12-16T16:41:17.349974291Z&quot;,
    &quot;severity&quot;: &quot;ERROR&quot;,
    &quot;logName&quot;: &quot;projects/project-redacted/logs/cloudscheduler.googleapis.com%2Fexecutions&quot;,
    &quot;receiveTimestamp&quot;: &quot;2021-12-16T16:41:17.349974291Z&quot;
  }
  </code></pre>
  <p>I have no idea what permission is missing or what I need to grant in order to make this work and am hoping someone here can help me.</p>
  <p>In order to reproduce the problem I have built a terraform configuration that creates the Dataflow job from the template along with all of its prerequisites and it executes successfully.</p>
  <p>In that same terraform configuration I have created a Cloud Scheduler job that purports to execute an identical Dataflow job and it is that which fails with the error given above.</p>
  <p>All this code is available at <a href="https://github.com/jamiet-msm/dataflow-scheduler-permission-problem/tree/6ef20824af0ec798634c146ee9073b4b40c965e0" rel="nofollow noreferrer">https://github.com/jamiet-msm/dataflow-scheduler-permission-problem/tree/6ef20824af0ec798634c146ee9073b4b40c965e0</a> and I have created a README that explains how to run it:</p>
  <p><a href="https://i.stack.imgur.com/ctpVD.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/ctpVD.png" alt="enter image description here" /></a></p>