Google Cloud (GCP)

Connect Google Cloud to inventory every Vertex AI endpoint, Gemini API caller, Cloud Run agent service, and Cloud Function triggered by AI workloads. GCP connects with one-click Google OAuth — you click Connect, approve the consent screen with an account that can read your projects, and Trefur polls Cloud Audit Logs + Vertex on a 15-minute cadence.

What gets observed

Vertex AI — deployed models, endpoints, batch-prediction jobs, pipeline runs.
Gemini API usage — per-key request counts via Cloud Monitoring.
Cloud Run + Cloud Functions services tagged with AI workload labels.
Cloud Audit Logs — admin activity + data access on AI surfaces.
IAM bindings touching the aiplatform.* + generativeai.* services.

Vertex prompt + response bodies are not pulled from Cloud Audit Logs by default. For per-prompt fidelity, point the Vertex client at the collector LLM proxy or install the Python SDK in your Vertex workload.

Setup

# GCP connects with one-click Google OAuth — there is no service-account
# JSON key to create or paste.
#
# 1. In the Trefur dashboard, open Settings → Integrations → Google Cloud
#    and click Connect.
#
# 2. A Google consent screen opens. Sign in with an account that has read
#    access to the projects you want inventoried, and approve the requested
#    scopes (listed below). Tick the capabilities (telemetry / MCP) in the
#    connect dialog to control which scopes are requested.
#
# 3. Trefur completes the handshake on its own server-owned OAuth callback
#    and stores the refresh token in the credential vault. No redirect URI
#    configuration is required on your side.

Scopes requested (shown on the consent screen)

Scope	What it grants
`openid`, `email`, `profile`	Identify the connecting account.
`https://www.googleapis.com/auth/cloud-platform.read-only`	Read Vertex AI inventory + Cloud Audit Logs (requested for the telemetry capability).
`https://www.googleapis.com/auth/cloud-platform`	Full Cloud Platform access — only requested when you select the MCP capability in the connect dialog.

Multi-project orgs

Coverage follows the connected account's project access: Trefur enumerates every project that account can read and inventories Vertex + Cloud Run in each. For broad coverage, connect with an account that has read access granted at the folder or organisation level.

Troubleshooting

Symptom	Fix
403 on Vertex AI list calls / projects missing.	The connected Google account only sees projects it can read. Confirm that account has at least Viewer (or Vertex AI Viewer) on the projects — bound at the project, folder, or org level — then reconnect.
Audit logs empty.	Cloud Audit Logs "Data Access" logs are off by default for most services. Enable them under IAM & Admin → Audit Logs for `aiplatform.googleapis.com` and `generativeai.googleapis.com`.
Ingestion stops after a while.	The OAuth refresh token can be revoked if the connecting account's access is removed or its password changes. Click Connect again to re-run the consent flow; existing telemetry continues uninterrupted.

Back to all integrations.