Setting up GCS from the command line

Using Google Document AI with daiR (or any other client library) requires the prior configuration of a Google Cloud Services account. This article describes how to achieve this using the command-line tool gcloud CLI. The procedure is equivalent to the GUI-based one described here and here, but it minimizes interaction with the Google Cloud Console and arguably provides more replicability.

1. Prepare a Google account

Your gcloud CLI installation will need to be connected to a Google account for billing and such. Decide which Google account you want to be connected with this project or create a new one if necessary. Have the login details for this account ready.

2. Set up billing in the Google Cloud Console

While logged in to your preferred Google account, go to Google Cloud Console and click “Try for free” and “Activate”. In step 1, choose your country, select the term that best describes your organization, and check the box to accept the terms of service. In step 2, verify your mobile number. In step 3, enter your payment information (including a credit card or Paypal information) and click “Start my free trial”. You will be taken to the two-factor authentication service associated with your credit card. Back on the Google website, press the blue “Proceed to verification” button. Here you may be asked to upload a photo of your credit card and a photo of an id document.

3. Prepare id variables

To facilitate the subsequent process, it is useful to create a project id and a service account id in advance and store them as environment variables. The ids need to be between 6 and 30 characters long. The strings need to be unique, so something like my-ocr will not work, whereas ocr-834963 might.

Open a terminal and type the following, replacing <a_project_id> and <a_service_account_id> with your preferred strings.

Linux and Mac

PROJ_ID="<project_id>" && SA_ID="<service_account_id>"

Windows

set PROJ_ID=<project_id>

set SA_ID=<service_account_id>

4. Download and install gcloud CLI

Follow the instructions for your operating system. Note that on Windows, the installer takes you straight to initialization (and hence login to Google). On Mac and Linux you install the CLI first and then launch the initialization with the command gcloud init.

After you have clicked “Allow” in the browser, return to the terminal.

On Linux, gcloud will now print something along the lines of “You are logged in as: []. This account has no projects. Would you like to create one? (Y/n)?” Here it is best to decline - type n then hit Enter.

On Windows, it will print something like “You are logged in as: []. Pick cloud project to use:”. Choose option 1 here and press Enter.

Now type:

Linux and Mac

gcloud projects create $PROJ_ID

followed by

gcloud config set project $PROJ_ID

Windows

gcloud projects create %PROJ_ID%

followed by

gcloud config set project %PROJ_ID%

5. Create a service account

Next, create a service account by typing the following in the terminal:

Linux and Mac

gcloud iam service-accounts create $SA_ID \
--description="RStudio" \
--display-name="RStudio"

Windows

gcloud iam service-accounts create %SA_ID% --description="RStudio" --display-name="RStudio"

6. Get key file

Now get a key file - you will need it to authenticate from within RStudio:

Linux and Mac

gcloud iam service-accounts keys create key.json \
--iam-account=$SA_ID@$PROJ_ID.iam.gserviceaccount.com

Windows

gcloud iam service-accounts keys create key.json --iam-account=%SA_ID%@%PROJ_ID%.iam.gserviceaccount.com

This will create and download a file titled key.json to your current location in the file system. Verify with dir (Windows) or ls (Mac or Linux). Move it to your preferred location and set the path as an environment variable GCS_AUTH_FILE in .Renviron (For example: GCS_AUTH_FILE=/home/user/keys/key.json).

7. Confer permissions

First give Google Cloud owner rights to this service account:

Linux & Mac

gcloud projects add-iam-policy-binding $PROJ_ID \
--member="serviceAccount:$SA_ID@$PROJ_ID.iam.gserviceaccount.com" \
--role="roles/owner"

Windows

gcloud projects add-iam-policy-binding %PROJ_ID% --member="serviceAccount:%SA_ID%@%PROJ_ID%.iam.gserviceaccount.com" --role="roles/owner"

Finally, enable the Document AI API:

gcloud services enable documentai.googleapis.com

You can now pick up from Step 8 in this vignette.