Google Distributed Cloud (GDC) air-gapped appliance provides predefined Identity and Access Management (IAM) roles and permissions for Vertex AI services. IAM enforces least-privilege access to appliance resources by granting granular permissions to users, user groups, and service accounts.
To grant permissions or receive role access to resources, see Grant and revoke access.
Predefined roles at the organization level
Request the appropriate permissions from your Organization IAM Admin to set up Vertex AI in an organization and manage the lifecycle of a project that uses AI services.
The following table provides details about the permissions assigned to each predefined role:
| Role name | Kubernetes resource name | Permission description | Type |
|---|---|---|---|
| AI Platform Admin | ai-platform-admin |
Grant permissions to manage pre-trained services. | ClusterRole |
| Project Creator | project-creator |
Create new projects. | ClusterRole |
Predefined roles at the project level
Request the appropriate permissions from your Project IAM Admin to use Vertex AI services in a project. All Vertex AI roles must bind to the project namespace where you are using the service.
The following table provides details about the permissions assigned to each predefined role:
| Vertex AI service | Role name | Kubernetes resource name | Permission description | Type |
|---|---|---|---|---|
| N/A | Project IAM Admin | project-iam-admin |
Manage the IAM allow policies of projects and create service accounts. | Role |
| Optical Character Recognition (OCR) | AI OCR Developer | ai-ocr-developer |
Access the OCR service to detect text in images. | Role |
| Speech-to-Text | AI Speech Developer | ai-speech-developer |
Access the Speech-to-Text service to recognize speech and transcribe audio. | Role |
| Vertex AI Translation | AI Translation Developer | ai-translation-developer |
Access the Vertex AI Translation service to translate text. | Role |