Configure delegated access for GCP Vertex AI

Overview

For Vertex AI, delegated access is typically implemented with a Google service account and short-lived OAuth access tokens generated through secure identity flows.

In production, prefer Workload Identity Federation or managed identity paths over long-lived JSON key files.

When to use this

• Production systems where static service-account keys are discouraged.

• Centralized IAM/security operations with scoped permissions.

• Environments requiring frequent credential rotation and strong audit trails.

Prerequisites

• GCP project with Vertex AI enabled.

• Permissions to create/manage service accounts and IAM roles.

• A service account dedicated to Flashgate AI provider access.

• Flashgate AI LLM setup path: Configure an AI LLM.

Step-by-step (provider side)

1

Create a service account with least privilege

Create a service account for Vertex AI calls and assign only required permissions.

Use minimum roles required for your use case (for example, prediction/invocation capabilities instead of broad project admin roles).

2

Prefer short-lived credentials

Use Workload Identity / token exchange flows to obtain short-lived OAuth access tokens.

Avoid storing long-lived JSON private keys in production when possible.

3

Generate and refresh access tokens

Implement a secure token refresh mechanism (for example in a trusted backend service) that obtains fresh OAuth access tokens before expiry.

If your architecture needs a stable upstream interface, expose a small proxy that handles token acquisition and forwards requests to Vertex AI.

Configure in Flashgate

Use Configure an AI LLM with existing fields:

• Choose the appropriate AI LLM Type for your Vertex integration.

• Set API Endpoint to Vertex AI endpoint (or your proxy endpoint).

• Set API Secret to the token/credential expected by that endpoint.

• Set API Key only if your integration endpoint requires an additional key.

If your provider flow cannot be mapped directly to endpoint + secret/token, place the identity logic in a controlled proxy and configure Flashgate to call that proxy.