GCP Vertex AI Hardening

Create a dedicated, minimally-scoped service account for Vertex AI workloads. Do not use the default Compute Engine service account (PROJECT_NUMBER-compute@developer.gserviceaccount.com), which typically holds roles/editor at the project level — a blast-radius equivalent to running as root. Grant only roles/aiplatform.user (or a custom role with exactly the Vertex AI permissions the workload requires) to the Vertex AI service account. For GKE-based workloads, use Workload Identity Federation to avoid long-lived downloadable SA key files entirely. See gcp-iam-02 — no SA keys for the key avoidance pattern. Unit 42 April 2026 research on Vertex AI Agent Engine identity risks found that over-privileged service accounts are the primary lateral-movement path from a compromised Vertex AI workload to full GCP project takeover.

Remediation — gcloud CLI

# gcloud — audit Vertex AI service accounts and their granted roles

# Find service accounts named or tagged for Vertex AI usage
gcloud iam service-accounts list \
  --filter="displayName:vertex" \
  --format="value(email)"

# Audit all roles bound to a specific Vertex AI SA at the project level
SA_EMAIL="vertex-ai-workload@${PROJECT_ID}.iam.gserviceaccount.com"
gcloud projects get-iam-policy "${PROJECT_ID}" \
  --flatten="bindings" \
  --filter="bindings.members:${SA_EMAIL}" \
  --format="table(bindings.role)"

# Flag any binding to roles/editor or roles/owner — these must be removed
# Acceptable: roles/aiplatform.user or a custom role scoped to Vertex AI actions

Remediation — Terraform

# Terraform Google provider ~> 5.0
resource "google_service_account" "vertex_ai_workload" {
  project      = var.project_id
  account_id   = "vertex-ai-workload"
  display_name = "Vertex AI Workload SA — minimally scoped"
  description  = "Dedicated SA for Vertex AI inference workloads. Granted roles/aiplatform.user only."
}

# Bind only roles/aiplatform.user — NOT roles/aiplatform.admin or roles/editor
resource "google_project_iam_member" "vertex_ai_user" {
  project = var.project_id
  role    = "roles/aiplatform.user"
  member  = "serviceAccount:${google_service_account.vertex_ai_workload.email}"
}

# Do NOT grant roles/editor, roles/owner, or roles/aiplatform.admin.
# For GKE workloads, use Workload Identity Federation instead of a key file.

Remediation — Config Connector

apiVersion: iam.cnrm.cloud.google.com/v1beta1
kind: IAMServiceAccount
metadata:
  name: vertex-inference-sa
  namespace: config-control
spec:
  displayName: "Vertex AI inference (scoped)"
  description: "Single-purpose SA for Vertex AI Online Prediction"

Remediation — Pulumi (TypeScript)

import * as gcp from "@pulumi/gcp";

// Single-purpose service account for Vertex AI inference.
const vertexSa = new gcp.serviceaccount.Account("vertex-inference-sa", {
    accountId: "vertex-inference-sa",
    displayName: "Vertex AI inference (scoped)",
});

// Bind only the minimum Vertex AI runtime role.
const vertexUserBinding = new gcp.projects.IAMMember("vertex-sa-user", {
    project: projectId,
    role: "roles/aiplatform.user",
    member: vertexSa.email.apply(e => `serviceAccount:${e}`),
});

Compliance mapping

logName=~"projects/.*/logs/cloudaudit.googleapis.com%2Factivity"
          AND protoPayload.serviceName="aiplatform.googleapis.com"
          AND protoPayload.methodName="SetIamPolicy"
          AND protoPayload.serviceData.policyDelta.bindingDeltas.action="ADD"
          AND (protoPayload.serviceData.policyDelta.bindingDeltas.role="roles/aiplatform.user"
               OR protoPayload.serviceData.policyDelta.bindingDeltas.role="roles/aiplatform.admin")

Add aiplatform.googleapis.com to a VPC Service Controls (VPC-SC) perimeter to prevent data exfiltration from Vertex AI across project boundaries. VPC-SC wraps the Vertex AI API so that requests originating from outside the defined perimeter — another GCP project, an external IP, or an identity not included in the access policy — are denied at the API gateway layer, before any inference occurs. This is the GCP equivalent of combining AWS VPC endpoints with Service Control Policies for Bedrock. See gcp-iam-08 — VPC Service Controls perimeter setup for the base perimeter configuration pattern; this control adds aiplatform.googleapis.com to the restricted services list.

Remediation — gcloud CLI

# gcloud — create VPC Service Controls perimeter for Vertex AI
# Prerequisite: an Access Context Manager access policy must already exist for the org
gcloud access-context-manager perimeters create "vertex-ai-perimeter" \
  --title="Vertex AI Perimeter" \
  --resources="projects/${PROJECT_NUMBER}" \
  --restricted-services=aiplatform.googleapis.com \
  --policy="${ACCESS_POLICY_NAME}"

# Verify the perimeter was created and aiplatform.googleapis.com is listed
gcloud access-context-manager perimeters describe "vertex-ai-perimeter" \
  --policy="${ACCESS_POLICY_NAME}" \
  --format="json(status.restrictedServices)"

Remediation — Terraform

# Terraform Google provider ~> 5.0
resource "google_access_context_manager_access_policy" "org_policy" {
  parent = "organizations/${var.org_id}"
  title  = "Vertex AI org access policy"
}

resource "google_access_context_manager_service_perimeter" "vertex_ai" {
  parent = "accessPolicies/${google_access_context_manager_access_policy.org_policy.name}"
  name   = "accessPolicies/${google_access_context_manager_access_policy.org_policy.name}/servicePerimeters/vertexAiPerimeter"
  title  = "Vertex AI VPC-SC Perimeter"

  status {
    restricted_services = ["aiplatform.googleapis.com"]
    resources           = ["projects/${var.project_number}"]
  }
}

Remediation — Config Connector

apiVersion: accesscontextmanager.cnrm.cloud.google.com/v1beta1
kind: AccessContextManagerServicePerimeter
metadata:
  name: vertex-ai-perimeter
  namespace: config-control
spec:
  parent: "accessPolicies/POLICY_ID"
  title: "Vertex AI perimeter"
  status:
    resources:
    - "projects/PROJECT_NUMBER"
    restrictedServices:
    - "aiplatform.googleapis.com"
    - "storage.googleapis.com"

Compliance mapping

logName=~"organizations/.*/logs/cloudaudit.googleapis.com%2Factivity"
          AND protoPayload.serviceName="accesscontextmanager.googleapis.com"
          AND protoPayload.methodName=~".*ServicePerimeter.*"
          AND (protoPayload.request.servicePerimeter.spec.restrictedServices="aiplatform.googleapis.com"
               OR protoPayload.request.servicePerimeter.spec.egressPolicies.egressTo.operations.serviceName="aiplatform.googleapis.com")

Configure Gemini safety settings with BLOCK_MEDIUM_AND_ABOVE (or stricter) for all four harm categories: HARM_CATEGORY_HATE_SPEECH, HARM_CATEGORY_DANGEROUS_CONTENT, HARM_CATEGORY_HARASSMENT, and HARM_CATEGORY_SEXUALLY_EXPLICIT. Setting any category to BLOCK_NONE disables the safety filter entirely for that category — this is the BLOCK_NONE anti-pattern from general/genai.html#common-misconfigurations.

Critical infrastructure note — no Terraform resource: Gemini safety settings are configured at inference-time via the API request body (safety_settings parameter in GenerateContentRequest). No Terraform resource exists for this configuration. The Google Cloud provider (hashicorp/google ~> 5.0) does not include a google_vertex_ai_safety_filter resource — that resource name does not exist in the provider registry (confirmed 2026-05-24). Configure safety settings in your application code using the Vertex AI SDK or REST API. The related google_model_armor_* resources cover the separate Model Armor service, not Gemini in-line safety filters.

Remediation — Vertex AI Python SDK

# Vertex AI Python SDK — configure safety settings at inference time
# Install: pip install google-cloud-aiplatform>=1.38.0
import vertexai
from vertexai.generative_models import (
    GenerativeModel,
    SafetySetting,
    HarmCategory,
    HarmBlockThreshold,
)

vertexai.init(project=PROJECT_ID, location=REGION)

safety_settings = [
    SafetySetting(
        category=HarmCategory.HARM_CATEGORY_HATE_SPEECH,
        threshold=HarmBlockThreshold.BLOCK_MEDIUM_AND_ABOVE,
    ),
    SafetySetting(
        category=HarmCategory.HARM_CATEGORY_DANGEROUS_CONTENT,
        threshold=HarmBlockThreshold.BLOCK_MEDIUM_AND_ABOVE,
    ),
    SafetySetting(
        category=HarmCategory.HARM_CATEGORY_HARASSMENT,
        threshold=HarmBlockThreshold.BLOCK_MEDIUM_AND_ABOVE,
    ),
    SafetySetting(
        category=HarmCategory.HARM_CATEGORY_SEXUALLY_EXPLICIT,
        threshold=HarmBlockThreshold.BLOCK_MEDIUM_AND_ABOVE,
    ),
]

model = GenerativeModel("gemini-2.0-flash")
response = model.generate_content(
    "user prompt here",
    safety_settings=safety_settings,
)

Remediation — Infrastructure Manager

Compliance mapping

logName=~"projects/.*/logs/cloudaudit.googleapis.com%2Fdata_access"
          AND protoPayload.serviceName="aiplatform.googleapis.com"
          AND protoPayload.methodName=~".*Endpoint.predict"
          AND protoPayload.request.safetySettings.threshold="BLOCK_NONE"

Enable Cloud Audit Logs Data Access logging for aiplatform.googleapis.com. Data Access audit logs for aiplatform.googleapis.com are disabled by default and must be explicitly enabled via IAM Audit Configuration at the project or organisation level. Without this configuration, Vertex AI API calls — model inferences, endpoint invocations, dataset operations, RAG corpus queries — are not captured in Cloud Audit Logs. This means there is zero visibility into who called which model, when, from which identity, and with what parameters. Both DATA_READ and DATA_WRITE log types should be enabled; DATA_READ covers inference calls (reading model outputs) and DATA_WRITE covers resource mutations (creating endpoints, updating datasets).

Remediation — gcloud CLI

# gcloud — enable Data Access audit logs for aiplatform.googleapis.com
# DATA ACCESS LOGS ARE DISABLED BY DEFAULT — this enablement is the hardening action

# Step 1: Export current IAM policy to a local file
gcloud projects get-iam-policy "${PROJECT_ID}" \
  --format=json > /tmp/policy.json

# Step 2: Add the following auditLogConfigs block to policy.json under "auditConfigs":
# {
#   "service": "aiplatform.googleapis.com",
#   "auditLogConfigs": [
#     { "logType": "DATA_READ" },
#     { "logType": "DATA_WRITE" }
#   ]
# }

# Step 3: Apply the updated policy
gcloud projects set-iam-policy "${PROJECT_ID}" /tmp/policy.json

# Verify the audit config was applied
gcloud projects get-iam-policy "${PROJECT_ID}" \
  --format="json(auditConfigs)" | \
  python3 -c "import json,sys; configs=json.load(sys.stdin); \
    [print(c) for c in configs.get('auditConfigs',[]) if c.get('service')=='aiplatform.googleapis.com']"

Remediation — Terraform

# Terraform Google provider ~> 5.0
resource "google_project_iam_audit_config" "vertex_ai_data_access" {
  project = var.project_id
  service = "aiplatform.googleapis.com"

  audit_log_config {
    log_type = "DATA_READ"
  }

  audit_log_config {
    log_type = "DATA_WRITE"
  }
}

# Optional: route audit logs to Cloud Storage for long-term retention
resource "google_logging_project_sink" "vertex_ai_audit_sink" {
  name                   = "vertex-ai-audit-logs-sink"
  project                = var.project_id
  destination            = "storage.googleapis.com/${var.audit_log_bucket}"
  filter                 = "logName:\"projects/${var.project_id}/logs/cloudaudit.googleapis.com\" AND resource.type=\"audited_resource\" AND protoPayload.serviceName=\"aiplatform.googleapis.com\""
  unique_writer_identity = true
}

Remediation — Infrastructure Manager

Compliance mapping

logName=~"projects/.*/logs/cloudaudit.googleapis.com%2Factivity"
          AND protoPayload.methodName="SetIamPolicy"
          AND protoPayload.serviceData.policyDelta.auditConfigDeltas.service="aiplatform.googleapis.com"
          AND protoPayload.serviceData.policyDelta.auditConfigDeltas.action="REMOVE"

Secure Vertex AI RAG Engine grounding sources by enforcing IAM scoping and provenance validation on every corpus. Three specific controls are required: (1) IAM corpus restriction — only the designated Vertex AI service account should hold roles/aiplatform.user on the corpus resource; binding allUsers or allAuthenticatedUsers to corpus-level IAM is forbidden; (2) per-source document metadata filtering — configure retrieval filters to prevent embedding lookup returning documents outside the authorised scope for the calling identity; (3) source document provenance validation — validate that GCS buckets and BigQuery tables used as RAG sources are owned by the expected project and not writable by unauthenticated identities before ingestion. Each grounding corpus should use a dedicated, corpus-scoped Vertex AI service account with the minimum permissions needed for retrieval operations.

Remediation — gcloud CLI

# gcloud — enumerate Vertex AI endpoints and audit corpus IAM bindings

# List all Vertex AI endpoints in the region
gcloud ai index-endpoints list \
  --region="${REGION}" \
  --format="table(name, displayName, publicEndpointDomainName)"

# Audit all Vertex AI IAM bindings at the project level
gcloud projects get-iam-policy "${PROJECT_ID}" \
  --flatten="bindings" \
  --filter="bindings.role:roles/aiplatform" \
  --format="table(bindings.role, bindings.members)"

# Check GCS source bucket IAM — ensure no allUsers or allAuthenticatedUsers bindings
gsutil iam get "gs://${RAG_SOURCE_BUCKET}" | \
  python3 -c "import json,sys; policy=json.load(sys.stdin); \
    [print('WARNING: public binding found:', b) for b in policy.get('bindings',[]) \
     if 'allUsers' in b.get('members',[]) or 'allAuthenticatedUsers' in b.get('members',[])]"

Remediation — Terraform

# Terraform Google provider ~> 5.0
resource "google_service_account" "rag_corpus_sa" {
  project      = var.project_id
  account_id   = "vertex-rag-corpus"
  display_name = "Vertex AI RAG Corpus SA — corpus-scoped access only"
}

# Grant corpus SA access to Vertex AI for retrieval operations
resource "google_project_iam_member" "rag_corpus_vertex_user" {
  project = var.project_id
  role    = "roles/aiplatform.user"
  member  = "serviceAccount:${google_service_account.rag_corpus_sa.email}"
}

# Restrict GCS source bucket to corpus SA only — no allUsers, no allAuthenticatedUsers
resource "google_storage_bucket_iam_member" "rag_source_bucket_access" {
  bucket = var.rag_source_bucket
  role   = "roles/storage.objectViewer"
  member = "serviceAccount:${google_service_account.rag_corpus_sa.email}"
}

# Vertex AI index and endpoint for the RAG corpus
resource "google_vertex_ai_index" "rag_corpus_index" {
  project      = var.project_id
  region       = var.region
  display_name = "rag-corpus-index"
  description  = "RAG grounding corpus index — corpus-scoped SA access only"

  metadata {
    contents_delta_uri = "gs://${var.rag_source_bucket}/embeddings/"
    config {
      dimensions                  = 768
      approximate_neighbors_count = 150
    }
  }
}

resource "google_vertex_ai_index_endpoint" "rag_endpoint" {
  project      = var.project_id
  region       = var.region
  display_name = "rag-corpus-endpoint"
  network      = var.vpc_network
}

Remediation — Config Connector

apiVersion: iam.cnrm.cloud.google.com/v1beta1
kind: IAMPolicyMember
metadata:
  name: rag-bucket-reader
  namespace: config-control
spec:
  resourceRef:
    apiVersion: storage.cnrm.cloud.google.com/v1beta1
    kind: StorageBucket
    name: rag-grounding-corpus
  role: roles/storage.objectViewer
  member: "serviceAccount:vertex-inference-sa@PROJECT_ID.iam.gserviceaccount.com"

Compliance mapping

logName=~"projects/.*/logs/cloudaudit.googleapis.com%2Factivity"
          AND ((protoPayload.serviceName="discoveryengine.googleapis.com"
                AND protoPayload.methodName=~".*DataStore.(delete|setIamPolicy)")
               OR (protoPayload.serviceName="storage.googleapis.com"
                   AND protoPayload.methodName="storage.setIamPermissions"
                   AND protoPayload.resourceName=~".*rag-corpus.*"
                   AND protoPayload.serviceData.policyDelta.bindingDeltas.member="allUsers"))

Configure Customer-Managed Encryption Keys (CMEK) via Cloud KMS for Vertex AI model artifacts, training datasets, and tuned model storage on Vertex AI Endpoints. CMEK enables full encryption key lifecycle control: key rotation on schedule, immediate revocation (by disabling or destroying the key version), and enforcement that all data at rest is encrypted under a key managed in your own Cloud KMS key ring rather than a Google-managed key. CMEK is configured via encryption_spec.kms_key_name on Vertex AI endpoint and dataset resources. Note that not all Vertex AI resource types support CMEK in all regions — verify support for your specific resource types and regions at configuration time in the Vertex AI CMEK documentation.

Remediation — gcloud CLI

# gcloud — check CMEK configuration on existing Vertex AI endpoints
gcloud ai endpoints list \
  --region="${REGION}" \
  --format="json(name, displayName, encryptionSpec)"

# Create a new endpoint with CMEK
gcloud ai endpoints create \
  --region="${REGION}" \
  --display-name="cmek-protected-endpoint" \
  --kms-key-name="projects/${PROJECT_ID}/locations/${REGION}/keyRings/${KEY_RING}/cryptoKeys/${KEY_NAME}"

Remediation — Terraform

# Terraform Google provider ~> 5.0
resource "google_kms_key_ring" "vertex_ai_keyring" {
  project  = var.project_id
  name     = "vertex-ai-keyring"
  location = var.region
}

resource "google_kms_crypto_key" "vertex_ai_key" {
  name     = "vertex-ai-cmek"
  key_ring = google_kms_key_ring.vertex_ai_keyring.id

  rotation_period = "7776000s" # 90 days

  lifecycle {
    prevent_destroy = true
  }
}

# Grant Vertex AI service agent access to the KMS key
resource "google_kms_crypto_key_iam_member" "vertex_ai_kms_access" {
  crypto_key_id = google_kms_crypto_key.vertex_ai_key.id
  role          = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
  member        = "serviceAccount:service-${var.project_number}@gcp-sa-aiplatform.iam.gserviceaccount.com"
}

resource "google_vertex_ai_endpoint" "cmek_endpoint" {
  project      = var.project_id
  region       = var.region
  display_name = "cmek-protected-endpoint"

  encryption_spec {
    kms_key_name = google_kms_crypto_key.vertex_ai_key.id
  }

  depends_on = [google_kms_crypto_key_iam_member.vertex_ai_kms_access]
}

Remediation — Config Connector

apiVersion: kms.cnrm.cloud.google.com/v1beta1
kind: KMSCryptoKey
metadata:
  name: vertex-cmek
  namespace: config-control
spec:
  keyRingRef:
    name: vertex-kr
  purpose: ENCRYPT_DECRYPT
  rotationPeriod: "7776000s"
  versionTemplate:
    algorithm: GOOGLE_SYMMETRIC_ENCRYPTION
    protectionLevel: SOFTWARE

Compliance mapping

logName=~"projects/.*/logs/cloudaudit.googleapis.com%2Factivity"
          AND protoPayload.serviceName="aiplatform.googleapis.com"
          AND protoPayload.methodName=~".*(Dataset|Model|Endpoint|TrainingPipeline).(create|update)"
          AND NOT protoPayload.request.encryptionSpec.kmsKeyName=~".*"

Enforce data residency for Vertex AI resources via the constraints/gcp.resourceLocations organization policy constraint. This constraint restricts which GCP regions Vertex AI endpoints, datasets, and models can be created in, preventing developers from provisioning Vertex AI resources in unapproved regions where data localisation requirements (GDPR, national data sovereignty laws) cannot be guaranteed. Combine with constraints/gcp.restrictServiceUsage to prevent users from enabling the Vertex AI API in projects outside the approved region boundary. For the general organisation policy pattern, see gcp/iam.html.

Remediation — gcloud CLI

# gcloud — check and enforce resource location constraints for Vertex AI

# Inspect the current resourceLocations policy at the project level
gcloud resource-manager org-policies describe constraints/gcp.resourceLocations \
  --project="${PROJECT_ID}"

# List all org policies at the project level
gcloud resource-manager org-policies list \
  --project="${PROJECT_ID}"

# Set the resourceLocations policy to restrict to approved EU regions only
# (adjust allowedValues to match your data-residency requirements)
cat > /tmp/resource-locations-policy.yaml <<EOF
constraint: constraints/gcp.resourceLocations
listPolicy:
  allowedValues:
    - "in:eu-locations"
EOF

gcloud resource-manager org-policies set-policy /tmp/resource-locations-policy.yaml \
  --project="${PROJECT_ID}"

Remediation — Terraform

# Terraform Google provider ~> 5.0
resource "google_organization_policy" "vertex_ai_resource_locations" {
  org_id     = var.org_id
  constraint = "constraints/gcp.resourceLocations"

  list_policy {
    allow {
      values = [
        "in:eu-locations",        # EU locations group (includes europe-west3, europe-west4, etc.)
        # "europe-west3",         # Frankfurt — uncomment for specific region restriction
        # "europe-west4",         # Netherlands
      ]
    }
  }
}

Remediation — Config Connector

apiVersion: orgpolicy.cnrm.cloud.google.com/v1beta1
kind: OrgPolicyPolicy
metadata:
  name: vertex-data-residency
  namespace: config-control
spec:
  resourceRef:
    apiVersion: resourcemanager.cnrm.cloud.google.com/v1beta1
    kind: Organization
    external: "organizations/ORG_ID"
  spec:
    rules:
    - values:
        allowedValues:
        - "in:us-locations"
        - "in:eu-locations"
  name: "organizations/ORG_ID/policies/gcp.resourceLocations"

Compliance mapping

logName=~"projects/.*/logs/cloudaudit.googleapis.com%2Factivity"
          AND protoPayload.serviceName="aiplatform.googleapis.com"
          AND protoPayload.methodName=~".*(Endpoint.create|Model.(upload|copy))"
          AND NOT protoPayload.resourceName=~"projects/[^/]+/locations/(europe-west1|europe-west4)/.*"

Restrict which Model Garden models can be deployed and invoked in your organisation using the constraints/vertexai.allowedModels org policy constraint. This GA constraint — moved from the aiplatform.* preview namespace to the vertexai.* GA namespace — allows you to define an explicit allow-list of model publisher and model name combinations that can be invoked in Vertex AI. Developers and pipelines that request a model not on the allow-list receive a policy violation error at the API gateway before any inference occurs.

Constraint name (verified 2026-05-24): constraints/vertexai.allowedModels — this is the GA name. The former preview name constraints/aiplatform.allowedModels is deprecated and will not resolve correctly in current Google Cloud environments. Any reference to constraints/aiplatform.allowedModels in your org policy configuration is incorrect and must be updated to constraints/vertexai.allowedModels.

Remediation — gcloud CLI

# gcloud — apply constraints/vertexai.allowedModels org policy
# Constraint name: vertexai.allowedModels (GA name, verified 2026-05-24)
# The former preview name constraints/aiplatform.allowedModels is deprecated.

gcloud resource-manager org-policies set-policy policy.yaml \
  --organization="${ORG_ID}"

# Verify the policy was applied
gcloud resource-manager org-policies describe constraints/vertexai.allowedModels \
  --organization="${ORG_ID}"

policy.yaml

# policy.yaml — constraints/vertexai.allowedModels
# Restricts Model Garden to approved Google-published models only.
# Adjust allowedValues to match your security-reviewed model list.
name: organizations/${ORG_ID}/policies/vertexai.allowedModels
spec:
  rules:
  - values:
      allowedValues:
      - publishers/google/models/gemini-2.0-flash:predict
      - publishers/google/models/gemini-1.5-pro:predict

Remediation — Terraform

# Terraform Google provider ~> 5.0
# Constraint name: constraints/vertexai.allowedModels (GA — NOT constraints/aiplatform.allowedModels)
resource "google_organization_policy" "vertex_ai_allowed_models" {
  org_id     = var.org_id
  constraint = "constraints/vertexai.allowedModels"

  list_policy {
    allow {
      values = [
        "publishers/google/models/gemini-2.0-flash:predict",
        "publishers/google/models/gemini-1.5-pro:predict",
      ]
    }
  }
}

Remediation — Config Connector

apiVersion: iam.cnrm.cloud.google.com/v1beta1
kind: IAMPolicyMember
metadata:
  name: model-garden-curated-access
  namespace: config-control
spec:
  resourceRef:
    apiVersion: resourcemanager.cnrm.cloud.google.com/v1beta1
    kind: Project
    external: "projects/PROJECT_ID"
  role: roles/aiplatform.modelGardenUser
  member: "group:gcp-genai-curators@example.com"

Compliance mapping

logName=~"projects/.*/logs/cloudaudit.googleapis.com%2Factivity"
          AND protoPayload.serviceName="aiplatform.googleapis.com"
          AND (protoPayload.methodName=~".*PublisherModel.deploy"
               OR (protoPayload.methodName=~".*Model.upload"
                   AND NOT protoPayload.request.model.artifactUri=~"gs://approved-model-artifacts/.*"))