Access Management: IAM and Least Privilege
Secure your AI infrastructure. Learn to use Google Cloud IAM (Identity and Access Management) to restrict who can call models or view tuning data.
Access Management
Who has the keys to the castle?
Service Accounts
For production code (running on a server), DO NOT use your personal @gmail API Key.
- Create a Service Account in GCP.
- Grant it the role:
Vertex AI UserorGenerative AI User. - Have your server authenticate as this account.
API Key Restrictions
If you MUST use an API Key (e.g., mobile app):
- Application Restriction: Limit to your Android Package Name or iOS Bundle ID.
- API Restriction: Limit to only the Gemini API.
Least Privilege
Don't give the "Editor" role to everyone.
- Developers: Need access to
Create PromptandRun Tuning. - Production App: Needs access to
Predict(Generate Content) ONLY. It should not be allowed to delete models or create new ones.
Summary
Treat AI access like Database access. Lock it down.
In the next lesson, we discuss Model Output Governance.