> ## Documentation Index
> Fetch the complete documentation index at: https://docs.forge.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Google Cloud

> Connect Vertex AI, Gemini Enterprise, Agent Engine, workloads, and Google Cloud evidence.

Forge inventories Google-hosted AI resources across explicitly selected
projects. Organization or folder discovery can be used to identify projects,
but the saved connection records the projects and locations Forge polls.

## Coverage

| Surface           | Forge collects                                                                             |
| ----------------- | ------------------------------------------------------------------------------------------ |
| Vertex AI         | Models, endpoints, deployments, pipelines, and provider configuration                      |
| Gemini Enterprise | Collections, apps, agents, and data-connector metadata exposed by the tenant               |
| Agent Engine      | Agent resources, runtime metadata, and supported callback evidence                         |
| Model Armor       | Template and posture evidence where enabled                                                |
| Workloads         | Cloud Run, GKE, Cloud Functions, Artifact Registry, service accounts, and route indicators |
| Observability     | Cloud Logging, Audit Logs, Trace, and Monitoring evidence available to the connection      |

Workload metadata can identify likely AI applications and destinations. It does
not by itself prove prompts, responses, or tool execution.

## Access

The connection accepts one or more project IDs, selected locations, and either
a service-account credential or an approved impersonation/workload-identity
path.

The generated setup enables the required service APIs and grants these
read-only roles in every selected project:

```text theme={"system"}
roles/aiplatform.viewer
roles/artifactregistry.reader
roles/browser
roles/cloudasset.viewer
roles/discoveryengine.viewer
roles/logging.viewer
roles/logging.privateLogViewer
roles/container.viewer
roles/run.viewer
roles/cloudfunctions.viewer
roles/modelarmor.viewer
roles/iam.securityReviewer
roles/iam.workloadIdentityPoolViewer
roles/serviceusage.serviceUsageViewer
```

The corresponding APIs are Vertex AI, Discovery Engine, Cloud Logging, GKE,
Cloud Run, Cloud Functions, and Model Armor. Use a custom role only if it
provides the same reads that Forge reports during Test and Sync.

## Setup

1. Open **Settings → Integrations → Google Cloud Platform** and enter the
   project IDs and locations.
2. Open **Guided setup** and choose gcloud, Terraform, or the generated setup
   script.
3. Apply the artifact to every selected project. Protect the generated service
   account key or Terraform state.
4. Paste the service-account email and credential JSON into Forge, then select
   **Save** and **Test**.
5. Select **Sync** and confirm each expected project and location contributes
   records.
6. Configure an ADK, Agent Engine, Agent Gateway, or customer-runtime callback
   only if inline Forge policy is required.

When no projects are entered, the generated gcloud artifact contains an
organization-project discovery command that must be reviewed and scoped before
running. For a production connection, explicitly list the projects Forge
should poll.

## Operator access and artifact scanning

Native NHI containment, identity rightsizing, and Agent access use a separate,
keyless operator connection. Guided setup creates a dedicated service account,
workload identity pool and provider, exact custom role, and conditional
bindings. Forge reads those objects back before enabling mutation or credential
issuance.

Artifact Registry image scanning uses `roles/artifactregistry.reader`.
Filesystem snapshot scanning is opt-in and requires the generated custom create
and cleanup roles, at least one exact scanner network, deny-all scanner ingress,
and an approved source project. See
[Cloud artifact scanning](/observe/cloud-artifact-scanning).

## Runtime

| Path                            | Result                                                                         |
| ------------------------------- | ------------------------------------------------------------------------------ |
| Cloud Logging or Audit Logs     | Detective provider evidence after delivery                                     |
| Gemini Enterprise observability | Hosted assistant usage evidence where the tenant emits supported logs          |
| ADK / Agent Engine callback     | Forge can evaluate before a tool operation                                     |
| Direct Gemini SDK call          | Not universally blockable without a gateway or runtime callback                |
| Model Armor                     | Native safety posture and decisions; not automatically a Forge inline decision |

## Verification

Run the generated validation commands and confirm:

* Every configured project can be enumerated.
* Vertex AI, Agent Engine, Gemini Enterprise, and workload APIs return the
  expected resources or a healthy empty result.
* A known provider event appears in the configured logging project.
* A callback canary records the Forge policy decision before tool execution.

A healthy connection can still have an empty capability lane. Forge reports
missing APIs, roles, regions, and log sources separately so an unavailable
optional surface does not invalidate base inventory.