<p>User-manager Service Accounts (SA) are identity that a GCP application can use to run API requests on your behalf.</p>
<p>If you created a <a href="https://cloud.google.com/vertex-ai/docs/general/custom-service-account" rel="nofollow noreferrer">custom SA</a> dedicated to the external application and share keys with it (<strong>SA keys never expire</strong>), it should be allowed to consume the Vertex AI endpoint.</p>
<p>Here is a 6-step process:</p>
<ol>
<li>Open a cloud shell console at the top-right <a href="https://i.sstatic.net/FJJEB.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/FJJEBl.png" alt="enter image description here" /></a> and create a user-managed SA with the following command (need <a href="https://cloud.google.com/sdk/gcloud/reference/iam/service-accounts/create" rel="nofollow noreferrer">iam.serviceAccounts.create</a> permission)</li>
</ol>
<pre><code>gcloud iam service-accounts create sa-name-app-b \
    --description &quot;Service account dedicated to the external application B to consume Vertex AI endpoint&quot; \
    --display-name &quot;Vertex AI consumption for app B&quot;
</code></pre>
<ol start="2">
<li>If it does not exist, create a custom role with a <em>aiplatform.endpoints.predict</em> permission (need <a href="https://cloud.google.com/sdk/gcloud/reference/iam/roles/create" rel="nofollow noreferrer">iam.roles.create</a> permission)</li>
</ol>
<pre><code>gcloud iam roles create vaeEndpointConsumer  \
    --project gcp-project-A \
    --title &quot;Vertex AI endpoint consumer&quot; \
    --description &quot;This role is allowed to consume Vertex AI endpoints&quot; \
    --permissions aiplatform.endpoints.predict
</code></pre>
<ol start="3">
<li>Attach this custom role to the created SA (need <a href="https://cloud.google.com/sdk/gcloud/reference/iam/service-accounts/add-iam-policy-binding" rel="nofollow noreferrer">iam.serviceAccounts.add-iam-policy-binding</a> permission)</li>
</ol>
<pre><code>gcloud iam service-accounts add-iam-policy-binding sa-name-app-b@gcp-project-A.iam.gserviceaccount.com \
  --member 'serviceAccount:sa-name-app-b@gcp-project-A.iam.gserviceaccount.com' \
  --role 'projects/gcp-project-A/roles/vaeEndpointConsumer'
</code></pre>
<ol start="4">
<li>Create a private key for the created SA (need <a href="https://cloud.google.com/sdk/gcloud/reference/iam/service-accounts/keys/create" rel="nofollow noreferrer">iam.serviceAccountKeys.create</a> permission). The resulting private key will be written in a file called <em>sa_private_key.json</em> in the gcloud console disk</li>
</ol>
<pre><code>gcloud iam service-accounts keys create sa_private_key.json \
    --iam-account sa-name-app-b@gcp-project-A.iam.gserviceaccount.com
</code></pre>
<ol start="5">
<li>Download key to your desktop and remove it from the gcloud console</li>
</ol>
<pre><code>cloudshell download sa_private_key.json
rm sa_private_key.json
</code></pre>
<ol start="6">
<li>Securely share <em>sa_private_key.json</em> to the <em>outside-gcp-app-B</em> owner and let it configure authentication with the protocol of its choice (<a href="https://developers.google.com/identity/protocols/oauth2/service-account" rel="nofollow noreferrer">OAuth 2.0</a> for example)</li>
</ol>

CC BY-SA 4.0
2024-01-12T19:59:47.897Z
Your answer is good partial answer but you do not show code that calls the Vertex endpoint or creates and uses the service account's OAuth tokens. Also, service account can have the lifetime limited [link](https://cloud.google.com/resource-manager/docs/organization-policy/restricting-service-accounts#limit_key_expiry).
John Hanley
CC BY-SA 4.0
2024-01-12T10:11:01.193Z
2024-01-12T10:11:01.193Z
Maxime Oriol
<p>A Vertex AI endpoint has been created in the Google Cloud Platform project <em>gcp-project-A</em>.</p>
<p>As a devops I want to authorize an external application <em>outside-gcp-app-B</em> to consume it. This application is outside GCP (example: <a href="https://www.postman.com/" rel="nofollow noreferrer">Postman</a>).</p>
<p>What is the best way to do it ?</p>

<google-cloud-platform><gcp><api><authentication>
How to allow an application outside GCP to consume a GCP Vertex AI endpoint?
Maxime Oriol
# How to allow an application outside GCP to consume a GCP Vertex AI endpoint?

(Asked by: username_0 on 2024-01-12)

A Vertex AI endpoint has been created in the Google Cloud Platform project *gcp-project-A*.

As a devops I want to authorize an external application *outside-gcp-app-B* to consume it. This application is outside GCP (example: [Postman](https://www.postman.com/)).

What is the best way to do it ?

**Tags:** google-cloud-platform, gcp, api, authentication


---

## 1 answers

### Answer by username_0 on 2024-01-12. Score: 1

User-manager Service Accounts (SA) are identity that a GCP application can use to run API requests on your behalf.
If you created a custom SA dedicated to the external application and share keys with it (SA keys never expire), it should be allowed to consume the Vertex AI endpoint.
Here is a 6-step process:

Open a cloud shell console at the top-right  and create a user-managed SA with the following command (need iam.serviceAccounts.create permission)

gcloud iam service-accounts create sa-name-app-b \
    --description "Service account dedicated to the external application B to consume Vertex AI endpoint" \
    --display-name "Vertex AI consumption for app B"


If it does not exist, create a custom role with a aiplatform.endpoints.predict permission (need iam.roles.create permission)

gcloud iam roles create vaeEndpointConsumer  \
    --project gcp-project-A \
    --title "Vertex AI endpoint consumer" \
    --description "This role is allowed to consume Vertex AI endpoints" \
    --permissions aiplatform.endpoints.predict


Attach this custom role to the created SA (need iam.serviceAccounts.add-iam-policy-binding permission)

gcloud iam service-accounts add-iam-policy-binding sa-name-app-b@gcp-project-A.iam.gserviceaccount.com \
  --member 'serviceAccount:sa-name-app-b@gcp-project-A.iam.gserviceaccount.com' \
  --role 'projects/gcp-project-A/roles/vaeEndpointConsumer'


Create a private key for the created SA (need iam.serviceAccountKeys.create permission). The resulting private key will be written in a file called sa_private_key.json in the gcloud console disk

gcloud iam service-accounts keys create sa_private_key.json \
    --iam-account sa-name-app-b@gcp-project-A.iam.gserviceaccount.com


Download key to your desktop and remove it from the gcloud console

cloudshell download sa_private_key.json
rm sa_private_key.json


Securely share sa_private_key.json to the outside-gcp-app-B owner and let it configure authentication with the protocol of its choice (OAuth 2.0 for example)

> **Comments:**
> **username_1**: Your answer is good partial answer but you do not show code that calls the Vertex endpoint or creates and uses the service account's OAuth tokens. Also, service account can have the lifetime limited [link](https://cloud.google.com/resource-manager/docs/organization-policy/restricting-service-accounts#limit_key_expiry).  

---

