Skip to main content
Forge inventories Google-hosted AI resources across explicitly selected projects. Organization or folder discovery can be used to identify projects, but the saved connection records the projects and locations Forge polls.

​
Coverage

Workload metadata can identify likely AI applications and destinations. It does not by itself prove prompts, responses, or tool execution.

​
Access

The connection accepts one or more project IDs, selected locations, and either a service-account credential or an approved impersonation/workload-identity path. The generated setup enables the required service APIs and grants these read-only roles in every selected project:
The corresponding APIs are Vertex AI, Discovery Engine, Cloud Logging, GKE, Cloud Run, Cloud Functions, and Model Armor. Use a custom role only if it provides the same reads that Forge reports during Test and Sync.

​
Setup

  1. Open Settings → Integrations → Google Cloud Platform and enter the project IDs and locations.
  2. Open Guided setup and choose gcloud, Terraform, or the generated setup script.
  3. Apply the artifact to every selected project. Protect the generated service account key or Terraform state.
  4. Paste the service-account email and credential JSON into Forge, then select Save and Test.
  5. Select Sync and confirm each expected project and location contributes records.
  6. Configure an ADK, Agent Engine, Agent Gateway, or customer-runtime callback only if inline Forge policy is required.
When no projects are entered, the generated gcloud artifact contains an organization-project discovery command that must be reviewed and scoped before running. For a production connection, explicitly list the projects Forge should poll.

​
Operator access and artifact scanning

Native NHI containment, identity rightsizing, and Agent access use a separate, keyless operator connection. Guided setup creates a dedicated service account, workload identity pool and provider, exact custom role, and conditional bindings. Forge reads those objects back before enabling mutation or credential issuance. Artifact Registry image scanning uses roles/artifactregistry.reader. Filesystem snapshot scanning is opt-in and requires the generated custom create and cleanup roles, at least one exact scanner network, deny-all scanner ingress, and an approved source project. See Cloud artifact scanning.

​
Runtime

​
Verification

Run the generated validation commands and confirm:
  • Every configured project can be enumerated.
  • Vertex AI, Agent Engine, Gemini Enterprise, and workload APIs return the expected resources or a healthy empty result.
  • A known provider event appears in the configured logging project.
  • A callback canary records the Forge policy decision before tool execution.
A healthy connection can still have an empty capability lane. Forge reports missing APIs, roles, regions, and log sources separately so an unavailable optional surface does not invalidate base inventory.