Answers: <p>User-manager Service Accounts (SA) are identity that a GCP application can use to run API requests on your behalf.</p>
  <p>If you created a <a href="https://cloud.google.com/vertex-ai/docs/general/custom-service-account" rel="nofollow noreferrer">custom SA</a> dedicated to the external application and share keys with it (<strong>SA keys never expire</strong>), it should be allowed to consume the Vertex AI endpoint.</p>
  <p>Here is a 6-step process:</p>
  <ol>
  <li>Open a cloud shell console at the top-right <a href="https://i.sstatic.net/FJJEB.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/FJJEBl.png" alt="enter image description here" /></a> and create a user-managed SA with the following command (need <a href="https://cloud.google.com/sdk/gcloud/reference/iam/service-accounts/create" rel="nofollow noreferrer">iam.serviceAccounts.create</a> permission)</li>
  </ol>
  <pre><code>gcloud iam service-accounts create sa-name-app-b \
      --description &quot;Service account dedicated to the external application B to consume Vertex AI endpoint&quot; \
      --display-name &quot;Vertex AI consumption for app B&quot;
  </code></pre>
  <ol start="2">
  <li>If it does not exist, create a custom role with a <em>aiplatform.endpoints.predict</em> permission (need <a href="https://cloud.google.com/sdk/gcloud/reference/iam/roles/create" rel="nofollow noreferrer">iam.roles.create</a> permission)</li>
  </ol>
  <pre><code>gcloud iam roles create vaeEndpointConsumer  \
      --project gcp-project-A \
      --title &quot;Vertex AI endpoint consumer&quot; \
      --description &quot;This role is allowed to consume Vertex AI endpoints&quot; \
      --permissions aiplatform.endpoints.predict
  </code></pre>
  <ol start="3">
  <li>Attach this custom role to the created SA (need <a href="https://cloud.google.com/sdk/gcloud/reference/iam/service-accounts/add-iam-policy-binding" rel="nofollow noreferrer">iam.serviceAccounts.add-iam-policy-binding</a> permission)</li>
  </ol>
  <pre><code>gcloud iam service-accounts add-iam-policy-binding sa-name-app-b@gcp-project-A.iam.gserviceaccount.com \
    --member 'serviceAccount:sa-name-app-b@gcp-project-A.iam.gserviceaccount.com' \
    --role 'projects/gcp-project-A/roles/vaeEndpointConsumer'
  </code></pre>
  <ol start="4">
  <li>Create a private key for the created SA (need <a href="https://cloud.google.com/sdk/gcloud/reference/iam/service-accounts/keys/create" rel="nofollow noreferrer">iam.serviceAccountKeys.create</a> permission). The resulting private key will be written in a file called <em>sa_private_key.json</em> in the gcloud console disk</li>
  </ol>
  <pre><code>gcloud iam service-accounts keys create sa_private_key.json \
      --iam-account sa-name-app-b@gcp-project-A.iam.gserviceaccount.com
  </code></pre>
  <ol start="5">
  <li>Download key to your desktop and remove it from the gcloud console</li>
  </ol>
  <pre><code>cloudshell download sa_private_key.json
  rm sa_private_key.json
  </code></pre>
  <ol start="6">
  <li>Securely share <em>sa_private_key.json</em> to the <em>outside-gcp-app-B</em> owner and let it configure authentication with the protocol of its choice (<a href="https://developers.google.com/identity/protocols/oauth2/service-account" rel="nofollow noreferrer">OAuth 2.0</a> for example)</li>
  </ol>
  
Answers: CC BY-SA 4.0
Answers: 2024-01-12T19:59:47.897Z
Answers: Your answer is good partial answer but you do not show code that calls the Vertex endpoint or creates and uses the service account's OAuth tokens. Also, service account can have the lifetime limited [link](https://cloud.google.com/resource-manager/docs/organization-policy/restricting-service-accounts#limit_key_expiry).
Answers: John Hanley
Answers: CC BY-SA 4.0
Answers: 2024-01-12T10:11:01.193Z
Answers: 2024-01-12T10:11:01.193Z
Answers: Maxime Oriol
Body: <p>A Vertex AI endpoint has been created in the Google Cloud Platform project <em>gcp-project-A</em>.</p>
  <p>As a devops I want to authorize an external application <em>outside-gcp-app-B</em> to consume it. This application is outside GCP (example: <a href="https://www.postman.com/" rel="nofollow noreferrer">Postman</a>).</p>
  <p>What is the best way to do it ?</p>
  
Tags: <google-cloud-platform><gcp><api><authentication>
Title: How to allow an application outside GCP to consume a GCP Vertex AI endpoint?
UserDisplayName: Maxime Oriol
ThreadText: # How to allow an application outside GCP to consume a GCP Vertex AI endpoint?
  
  (Asked by: username_0 on 2024-01-12)
  
  A Vertex AI endpoint has been created in the Google Cloud Platform project *gcp-project-A*.
  
  As a devops I want to authorize an external application *outside-gcp-app-B* to consume it. This application is outside GCP (example: [Postman](https://www.postman.com/)).
  
  What is the best way to do it ?
  
  **Tags:** google-cloud-platform, gcp, api, authentication
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_0 on 2024-01-12. Score: 1
  
  User-manager Service Accounts (SA) are identity that a GCP application can use to run API requests on your behalf.
  
  If you created a [custom SA](https://cloud.google.com/vertex-ai/docs/general/custom-service-account) dedicated to the external application and share keys with it (**SA keys never expire**), it should be allowed to consume the Vertex AI endpoint.
  
  Here is a 6-step process:
  
  1. Open a cloud shell console at the top-right [![enter image description here](https://i.sstatic.net/FJJEBl.png)](https://i.sstatic.net/FJJEB.png) and create a user-managed SA with the following command (need [iam.serviceAccounts.create](https://cloud.google.com/sdk/gcloud/reference/iam/service-accounts/create) permission)
  
  ```
  gcloud iam service-accounts create sa-name-app-b \
      --description "Service account dedicated to the external application B to consume Vertex AI endpoint" \
      --display-name "Vertex AI consumption for app B"
  
  ```
  
  2. If it does not exist, create a custom role with a *aiplatform.endpoints.predict* permission (need [iam.roles.create](https://cloud.google.com/sdk/gcloud/reference/iam/roles/create) permission)
  
  ```
  gcloud iam roles create vaeEndpointConsumer  \
      --project gcp-project-A \
      --title "Vertex AI endpoint consumer" \
      --description "This role is allowed to consume Vertex AI endpoints" \
      --permissions aiplatform.endpoints.predict
  
  ```
  
  3. Attach this custom role to the created SA (need [iam.serviceAccounts.add-iam-policy-binding](https://cloud.google.com/sdk/gcloud/reference/iam/service-accounts/add-iam-policy-binding) permission)
  
  ```
  gcloud iam service-accounts add-iam-policy-binding sa-name-app-b@gcp-project-A.iam.gserviceaccount.com \
    --member 'serviceAccount:sa-name-app-b@gcp-project-A.iam.gserviceaccount.com' \
    --role 'projects/gcp-project-A/roles/vaeEndpointConsumer'
  
  ```
  
  4. Create a private key for the created SA (need [iam.serviceAccountKeys.create](https://cloud.google.com/sdk/gcloud/reference/iam/service-accounts/keys/create) permission). The resulting private key will be written in a file called *sa\_private\_key.json* in the gcloud console disk
  
  ```
  gcloud iam service-accounts keys create sa_private_key.json \
      --iam-account sa-name-app-b@gcp-project-A.iam.gserviceaccount.com
  
  ```
  
  5. Download key to your desktop and remove it from the gcloud console
  
  ```
  cloudshell download sa_private_key.json
  rm sa_private_key.json
  
  ```
  
  6. Securely share *sa\_private\_key.json* to the *outside-gcp-app-B* owner and let it configure authentication with the protocol of its choice ([OAuth 2.0](https://developers.google.com/identity/protocols/oauth2/service-account) for example)
  
  > **Comments:**
  > **username_1**: Your answer is good partial answer but you do not show code that calls the Vertex endpoint or creates and uses the service account's OAuth tokens. Also, service account can have the lifetime limited [link](https://cloud.google.com/resource-manager/docs/organization-policy/restricting-service-accounts#limit_key_expiry).  
  
  ---
  
  