A Vertex AI endpoint has been created in the Google Cloud Platform project gcp-project-A.

As a devops I want to authorize an external application outside-gcp-app-B to consume it. This application is outside GCP (example: Postman).

What is the best way to do it ?

1 Answer 1


User-manager Service Accounts (SA) are identity that a GCP application can use to run API requests on your behalf.

If you created a custom SA dedicated to the external application and share keys with it (SA keys never expire), it should be allowed to consume the Vertex AI endpoint.

Here is a 6-step process:

  1. Open a cloud shell console at the top-right enter image description here and create a user-managed SA with the following command (need iam.serviceAccounts.create permission)
gcloud iam service-accounts create sa-name-app-b \
    --description "Service account dedicated to the external application B to consume Vertex AI endpoint" \
    --display-name "Vertex AI consumption for app B"
  1. If it does not exist, create a custom role with a aiplatform.endpoints.predict permission (need iam.roles.create permission)
gcloud iam roles create vaeEndpointConsumer  \
    --project gcp-project-A \
    --title "Vertex AI endpoint consumer" \
    --description "This role is allowed to consume Vertex AI endpoints" \
    --permissions aiplatform.endpoints.predict
  1. Attach this custom role to the created SA (need iam.serviceAccounts.add-iam-policy-binding permission)
gcloud iam service-accounts add-iam-policy-binding [email protected] \
  --member 'serviceAccount:[email protected]' \
  --role 'projects/gcp-project-A/roles/vaeEndpointConsumer'
  1. Create a private key for the created SA (need iam.serviceAccountKeys.create permission). The resulting private key will be written in a file called sa_private_key.json in the gcloud console disk
gcloud iam service-accounts keys create sa_private_key.json \
    --iam-account [email protected]
  1. Download key to your desktop and remove it from the gcloud console
cloudshell download sa_private_key.json
rm sa_private_key.json
  1. Securely share sa_private_key.json to the outside-gcp-app-B owner and let it configure authentication with the protocol of its choice (OAuth 2.0 for example)
  • Your answer is good partial answer but you do not show code that calls the Vertex endpoint or creates and uses the service account's OAuth tokens. Also, service account can have the lifetime limited link. Jan 12 at 19:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.