Google Cloud (GCP)
Connect Google Cloud to see Vertex AI and Gemini activity from your Cloud Audit Logs. GCP connects with one-click Google OAuth — you enter the project to observe, click Connect, and approve a single read-only permission on Google's consent screen. Trefur changes nothing in Google Cloud.
What gets observed
- Vertex AI — model calls recorded in Cloud Audit Logs for the project (GenerateContent, StreamGenerateContent, CountTokens, Predict and similar), and the admin activity on Vertex AI resources.
- Gemini safety logs, where you have turned on that logging in the project.
Vertex prompt + response bodies are not pulled from Cloud Audit Logs by default. For per-prompt fidelity, send your application's OpenTelemetry traces to Trefur (see the quickstart).
Setup
# GCP connects with one-click Google OAuth — there is no service-account
# JSON key to create or paste.
#
# 1. In the Trefur dashboard, open Sources → Connections → Google Cloud
# and click Connect.
#
# 2. A Google consent screen opens. Sign in with an account that has read
# read access to the Cloud Logging entries of the project you want
# observed, and approve the one requested permission (listed below).
#
# 3. Trefur completes the handshake on its own server-owned OAuth callback
# and stores the refresh token in the credential vault. No redirect URI
# configuration is required on your side.Permission requested (shown on the consent screen)
| Scope | What it grants |
|---|---|
https://www.googleapis.com/auth/logging.read | Read Cloud Logging entries, including Cloud Audit Logs, for the project you connect. Read-only. This is the only permission the Google Cloud connector requests; it does not ask for sign-in, profile or email permissions, and there is no write or tool (MCP) capability for Google Cloud. |
The Google Cloud connector uses its own Google connection, separate from the Google Workspace one, and never reads Google Workspace data.
Which project
You enter the project ID when you connect, and Trefur reads that project only; it does not enumerate other projects the account can see. To observe several projects, add one connector per project. The connecting account needs permission to read logs in that project (for example Logs Viewer).
Troubleshooting
| Symptom | Fix |
|---|---|
| 403 when reading logs. | The connected Google account cannot read the project's logs. Confirm it has at least Logs Viewer on the project you entered — bound at the project, folder, or org level — then reconnect. |
| Audit logs empty. | Cloud Audit Logs "Data Access" logs are off by default for most services. Enable them under IAM & Admin → Audit Logs for aiplatform.googleapis.com and generativeai.googleapis.com. |
| Ingestion stops after a while. | The OAuth refresh token can be revoked if the connecting account's access is removed or its password changes. Click Connect again to re-run the consent flow; existing telemetry continues uninterrupted. |
Back to all integrations.