When you want Project Y (where your data fusion is in) to use resources from Project X (where the DLP is in) is to add the data fusion and compute engine service accounts of Project Y to Project X.
Notes:
- Data Fusion service account: service-xxxxxxx@gcp-sa-datafusion.iam.gserviceaccount.com
- Default compute engine service account: xxxxx-compute@developer.gserviceaccount.com
Project Y:
- Go to IAM & Admin -> IAM
- Click View by: "Members"
- Tick checkbox "Include Google-provided role grants"
- Look for service-(project number of Project Y)@gcp-sa-datafusion.iam.gserviceaccount.com and (project number of Project Y)-compute@developer.gserviceaccount.com
- Add role "DLP Administrator" for service-(project number of Project Y)@gcp-sa-datafusion.iam.gserviceaccount.com
Project X:
- Go to IAM & Admin -> IAM
- Click Add
- Under New Members, put service-(project number of Project Y)@gcp-sa-datafusion.iam.gserviceaccount.com
- Grant role of "DLP Admininistrator"
- Repeat step 2 to step 4 but this time put in (project number of Project Y)-compute@developer.gserviceaccount.com
Now that you are able to set the permissions, Go back to Project Y and update your Redact to point to Project X.
- Go to Data Fusion -> Studio
- Click Redact-> Properties
- Put the template ID you created in Project X, in my sample it is "test_template"
- Under Project ID, put the Project ID of Project X
- Run your Data Fusion pipeline
They didn't say they got a permission error, they got an error from data fusion. Datafusion is expecting template in location projects/Y/inspectTemplates/projects/DLPTest. This sounds like a bug, I'll check in with them on it.
@JordannaChord Yes it is not a permission error, I just posted the steps if ever they somewhat missed this. Also if "Project ID" is set to auto-detect it will be pointed to Project Y by default, changing the value to Project X should point to location projects/X/inspectTemplates/projects/DLPTest.
As mentioned by Ricco, it was more to do with the project permission and setup. Steps provided solved the issue. Additionally DLP needs enabled for project hosting datafusion, i.e. Project Y as well. I did have issues with regional DLP template(though all resources in same region), but global DLP template worked fine.