Google Vertex AI

What it does

Safeguard reads an inventory of the AI assets you run in Google Vertex AI (including Model Garden): the models in the Model Registry with their versions and source, and the endpoints with the models deployed on them, in every project the connection reads and every location Vertex AI offers each project. For each one it records where the model came from (Model Garden, your own training or upload, or unknown), whether each deployment is fixed to one model version, whether the endpoint is served on the public Vertex AI API or only over private networking, customer-managed encryption keys, and how broad each deployed model's service account is. The results appear as AI asset inventory entries and continuous tests (asset inventory, public access, network isolation, customer-managed keys, least-privilege service accounts, pinned model versions, licence risk and model provenance). Find the Google Vertex AI card under Integrations on the Project/Product tab (the AI Model filter shows only AI model cards). Safeguard never sends a prediction request, and no customer data goes to third-party LLMs.

This is a separate connection from the Google Cloud compliance connection; the Google Cloud compliance tests never run on it.

Public vs private

Supported auth methods

Permissions required

Safeguard only reads. The least-privilege choice is the custom role safeguardMlInventory from the setup steps, which holds only the permissions below. The predefined roles/aiplatform.viewer works too, but it also grants aiplatform.endpoints.explain and aiplatform.locations.evaluateInstances, which Safeguard never calls.

Service account key

The custom role safeguardMlInventory:

Or the predefined roles instead of the custom role:

Least privilege: the custom role safeguardMlInventory granted on each project to inventory, without resourcemanager.projects.getIamPolicy if you do not need the service-account test.

Token types

Expiry: rotate the key at least every 90 days, or sooner if your organization enforces a key expiry policy. When a key is deleted or expires, Check access fails with a sign-in error.

What we never need: aiplatform.endpoints.predict, aiplatform.endpoints.explain, any write permission, storage.objects.get (unless the artifact scan is turned on later), Owner, Editor or Vertex AI Administrator. A model's containerSpec.env can hold secrets: Safeguard drops it unread and never stores it.

Step-by-step setup

Create the credential in Google Vertex AI

1. In the Google Cloud console, open IAM & Admin > Service accounts in the project that will hold the account and create safeguard-ml-inventory.
2. Open IAM & Admin > Roles > Create role, give it the ID safeguardMlInventory and add the permissions in the custom role table.
3. Open IAM & Admin > IAM > Grant access, and grant the service account the custom role on each project to inventory.
4. Open the service account > Keys > Add key > Create new key > JSON. The file downloads once. Treat it as a secret: paste it into Safeguard, then delete it.

Or with the gcloud CLI

The connect dialog's Setup steps show these commands with your project filled in:

# 1. A service account for Safeguard, in the project that will hold it
gcloud iam service-accounts create safeguard-ml-inventory \
  --project=<PROJECT_ID> --display-name="Safeguard ML inventory (read-only)"

# 2. A custom role with exactly the reads Safeguard makes (recommended)
gcloud iam roles create safeguardMlInventory --project=<PROJECT_ID> \
  --title="Safeguard ML inventory" --stage=GA \
  --permissions=aiplatform.locations.list,aiplatform.endpoints.list,aiplatform.models.list,serviceusage.services.get,resourcemanager.projects.get,resourcemanager.projects.list,resourcemanager.projects.getIamPolicy

gcloud projects add-iam-policy-binding <PROJECT_ID> \
  --member="serviceAccount:safeguard-ml-inventory@<PROJECT_ID>.iam.gserviceaccount.com" \
  --role="projects/<PROJECT_ID>/roles/safeguardMlInventory"

# 2b. Or the predefined roles instead of the custom role (roles/aiplatform.viewer also grants
#     aiplatform.endpoints.explain, which Safeguard never calls)
# gcloud projects add-iam-policy-binding <PROJECT_ID> --member="serviceAccount:safeguard-ml-inventory@<PROJECT_ID>.iam.gserviceaccount.com" --role="roles/aiplatform.viewer"
# gcloud projects add-iam-policy-binding <PROJECT_ID> --member="serviceAccount:safeguard-ml-inventory@<PROJECT_ID>.iam.gserviceaccount.com" --role="roles/serviceusage.serviceUsageViewer"
# gcloud projects add-iam-policy-binding <PROJECT_ID> --member="serviceAccount:safeguard-ml-inventory@<PROJECT_ID>.iam.gserviceaccount.com" --role="roles/iam.securityReviewer"

# 3. A key for the connection. Treat the file as a secret: paste it into Safeguard, then delete it.
gcloud iam service-accounts keys create safeguard-ml-inventory.json --iam-account=safeguard-ml-inventory@<PROJECT_ID>.iam.gserviceaccount.com

For a connection that reads an organization, the setup steps add the same role at organization level and project discovery:

# Organization mode: the same role at organization level, plus project discovery
gcloud iam roles create safeguardMlInventory --organization=<ORG_ID> --title="Safeguard ML inventory" --stage=GA --permissions=aiplatform.locations.list,aiplatform.endpoints.list,aiplatform.models.list,serviceusage.services.get,resourcemanager.projects.get,resourcemanager.projects.list,resourcemanager.projects.getIamPolicy
gcloud organizations add-iam-policy-binding <ORG_ID> --member="serviceAccount:safeguard-ml-inventory@<PROJECT_ID>.iam.gserviceaccount.com" --role="organizations/<ORG_ID>/roles/safeguardMlInventory"
gcloud organizations add-iam-policy-binding <ORG_ID> --member="serviceAccount:safeguard-ml-inventory@<PROJECT_ID>.iam.gserviceaccount.com" --role="roles/browser"

Or with Terraform

resource "google_service_account" "safeguard_ml_inventory" {
  project      = "<PROJECT_ID>"
  account_id   = "safeguard-ml-inventory"
  display_name = "Safeguard ML inventory (read-only)"
}

resource "google_project_iam_custom_role" "safeguard_ml_inventory" {
  project     = "<PROJECT_ID>"
  role_id     = "safeguardMlInventory"
  title       = "Safeguard ML inventory"
  permissions = ["aiplatform.locations.list", "aiplatform.endpoints.list", "aiplatform.models.list", "serviceusage.services.get", "resourcemanager.projects.get", "resourcemanager.projects.list", "resourcemanager.projects.getIamPolicy"]
}

resource "google_project_iam_member" "safeguard_ml_inventory" {
  project = "<PROJECT_ID>"
  role    = google_project_iam_custom_role.safeguard_ml_inventory.id
  member  = "serviceAccount:${google_service_account.safeguard_ml_inventory.email}"
}

# Create the key outside Terraform state if you can (gcloud step 3): a google_service_account_key resource
# stores the private key in the state file.

Connect it in Safeguard

1. Open Integrations and choose the Project/Product tab (optionally the AI Model filter).
2. Click Connect on the Google Vertex AI card.
3. Give the connection a name and paste the whole service account JSON key. Optionally list the projects to read; leave it empty to read every project the service account can see.
4. The Setup steps section shows the gcloud commands, the Terraform and the custom role's permission list, each with a copy button.
5. Save, then click Check access. Safeguard signs in, lists the projects, and asks Google Cloud whether the first project grants aiplatform.locations.list, aiplatform.endpoints.list, aiplatform.models.list and serviceusage.services.get. Success reads Read <n> project(s); <project> grants every Vertex AI read the inventory needs. A failure names each missing permission.

Webhooks and triggers

This integration has no webhooks. The inventory is read each time the connection's tests run, on their schedule or when you run them by hand.

What we read and store

• Read: whether Vertex AI is enabled in each project, the locations it offers, each location's endpoints and models, the public Model Garden catalog entries those models name, and (with the optional permission) the project IAM policy.
• Stored: the inventory (names, resource names, locations, versions and aliases, image URIs, artifact URIs, machine types, network, encryption and service-account findings) in the AI asset inventory, and the test results. An asset that disappears is marked inactive, not deleted. The service account key is encrypted at rest and never shown again after you save it.
• Not stored or read: predictions, explanations, dataset items, model artifacts and the containers' env variables.
• No customer data from this integration is sent to third-party LLMs.

Troubleshooting

Rotation and disconnect

• Rotate: create a new key (gcloud iam service-accounts keys create safeguard-ml-inventory.json --iam-account=safeguard-ml-inventory@<PROJECT_ID>.iam.gserviceaccount.com), paste it into the connection and save, then delete the old key (gcloud iam service-accounts keys delete <OLD_KEY_ID> --iam-account=safeguard-ml-inventory@<PROJECT_ID>.iam.gserviceaccount.com).
• Disconnect: delete the connection in Safeguard, then delete the service account's keys or the service account itself, and remove its role bindings.

Vendor references

• Vertex AI API v1 discovery document, checked 2026-10-16.
• projects.locations.list, checked 2026-10-16.
• projects.locations.endpoints.list, checked 2026-10-16.
• projects.locations.models.list, checked 2026-10-16.
• publishers.models.get, checked 2026-10-16.
• projects.getIamPolicy, checked 2026-10-16.
• Service Usage services.get, checked 2026-10-16.
• Vertex AI roles and permissions, checked 2026-10-16.
• Vertex AI customer-managed encryption keys, checked 2026-10-16.
• Understanding IAM custom roles, checked 2026-10-16.