Vertex AI

1. 015 calls were denied by IAM. People are trying to reach Vertex AI; grant it through a reviewed role or add an organization policy restricting the service so the attempts stop.
2. 02Tuned models or custom training jobs exist. Confirm what data trained them, that the source bucket is classified, and that model artifacts are not shared across projects.
3. 03Notebook instances or runtimes exist. Check that they run without external IPs and inside a VPC Service Controls perimeter so datasets loaded into them cannot leave.
4. 04Vertex AI is active in 6 projects. Consolidate AI work into a small set of governed projects with an owner, or use organization policies to restrict which projects may enable it.

Identifiers come from device telemetry and proxy logs, so they may be account names rather than full directory entries.

1. audit_activity · Sep 13, 2026
   Google Cloud (demo): Vertex AI, 55 audit entries by 7 principals, 3 write, 47 invocations, 5 denied, 4 resources, API enabled in 6 projects in 30 days across 6 projects
   Detail

   {
     "scopes": [
       "organizations/123456789012"
     ],
     "services": [
       "aiplatform.googleapis.com"
     ],
     "topMethods": [
       {
         "name": "PredictionService.GenerateContent",
         "count": 41
       },
       {
         "name": "PredictionService.Predict",
         "count": 10
       },
       {
         "name": "EndpointService.DeployModel",
         "count": 1
       },
       {
         "name": "GenAiTuningService.CreateTuningJob",
         "count": 1
       },
       {
         "name": "NotebookService.CreateNotebookRuntime",
         "count": 1
       },
       {
         "name": "ModelService.UploadModel",
         "count": 1
       }
     ],
     "dataAccessLogging": true
   }

2. permission_denied · Sep 11, 2026
   [email protected] was denied GenerateContent in contoso-ml-prod
   Detail

   {
     "method": "google.cloud.aiplatform.v1.PredictionService.GenerateContent",
     "project": "contoso-ml-prod"
   }

3. permission_denied · Sep 10, 2026
   [email protected] was denied GenerateContent in contoso-ml-prod
   Detail

   {
     "method": "google.cloud.aiplatform.v1.PredictionService.GenerateContent",
     "project": "contoso-ml-prod"
   }

4. permission_denied · Sep 9, 2026
   [email protected] was denied GenerateContent in contoso-ml-prod
   Detail

   {
     "method": "google.cloud.aiplatform.v1.PredictionService.GenerateContent",
     "project": "contoso-ml-prod"
   }

5. permission_denied · Sep 8, 2026
   [email protected] was denied GenerateContent in contoso-ml-prod
   Detail

   {
     "method": "google.cloud.aiplatform.v1.PredictionService.GenerateContent",
     "project": "contoso-ml-prod"
   }

6. permission_denied · Sep 10, 2026
   [email protected] was denied UploadModel in contoso-sandbox
   Detail

   {
     "method": "google.cloud.aiplatform.v1.ModelService.UploadModel",
     "project": "contoso-sandbox"
   }

7. endpoint
   Endpoint 'churn-endpoint' in contoso-ml-prod (us-central1)
   Detail

   {
     "name": "//aiplatform.googleapis.com/projects/contoso-ml-prod/locations/us-central1/endpoints/1234",
     "state": null
   }

8. model
   Model 'gemini-hr-tuned' in contoso-ml-prod (us-central1)
   Detail

   {
     "name": "//aiplatform.googleapis.com/projects/contoso-ml-prod/locations/us-central1/models/5678",
     "tuned": true,
     "baseModel": "gemini-1.5-flash"
   }

9. tuningjob
   TuningJob 'hr-policy-tuning' in contoso-ml-prod (us-central1)
   Detail

   {
     "name": "//aiplatform.googleapis.com/projects/contoso-ml-prod/locations/us-central1/tuningJobs/9012",
     "state": "JOB_STATE_SUCCEEDED"
   }

10. notebookruntime
    NotebookRuntime 'dave-colab' in contoso-sandbox (us-central1)
    Detail

    {
      "name": "//aiplatform.googleapis.com/projects/contoso-sandbox/locations/us-central1/notebookRuntimes/3456",
      "state": "RUNNING"
    }

11. api_enabled
    aiplatform.googleapis.com enabled in contoso-ml-prod
    Detail

    {
      "project": "contoso-ml-prod"
    }

12. api_enabled
    aiplatform.googleapis.com enabled in contoso-app-dev
    Detail

    {
      "project": "contoso-app-dev"
    }

13. api_enabled
    aiplatform.googleapis.com enabled in contoso-sandbox
    Detail

    {
      "project": "contoso-sandbox"
    }

14. api_enabled
    aiplatform.googleapis.com enabled in contoso-marketing
    Detail

    {
      "project": "contoso-marketing"
    }

15. api_enabled
    aiplatform.googleapis.com enabled in contoso-data-lake
    Detail

    {
      "project": "contoso-data-lake"
    }

16. api_enabled
    aiplatform.googleapis.com enabled in contoso-legacy-crm
    Detail

    {
      "project": "contoso-legacy-crm"
    }