Google Cloud package v1.1.0

Store an OAuth 2.0 access token for a dedicated, minimally privileged Google Cloud service account in the client's secret manager. The stored value is the complete Authorization header: 'Bearer <token>'. customer_vault is the supported production custody model; identity_federation and customer_broker are refused at startup, and inline is lab-only.

Token issuance runs outside the executor. An external process holds the service account's RSA private key and signs an RS256 JWT with these fields: iss is the service-account email; scope is https://www.googleapis.com/auth/cloud-platform.read-only plus https://www.googleapis.com/auth/cloud-billing.readonly; aud is https://oauth2.googleapis.com/token; iat and exp bound the assertion to at most one hour. billingAccounts.list accepts cloud-platform, cloud-billing, and cloud-billing.readonly scopes; cloud-platform.read-only alone does not authorize that operation.

The process sends the assertion to https://oauth2.googleapis.com/token using grant_type urn:ietf:params:oauth:grant-type:jwt-bearer and stores the returned token as the complete header value. The documented response has expires_in 3600. Renew before expiry by repeating the grant; the executor injects the stored value unchanged and performs no token lifecycle.

Disabling or deleting the service-account key or account blocks future token minting. Google documents invalid_grant on JWT exchanges when the signing key is deleted, disabled, or expired. This does not revoke an issued access token: it remains valid until expiry, with no documented per-token revocation. Treat its 3600-second lifetime as the exposure window.

Grant roles/browser, or a custom role containing exactly resourcemanager.projects.get, resourcemanager.projects.list, and resourcemanager.projects.getIamPolicy, at the reviewed parent. Add billing.viewer only on billing accounts in scope; grant nothing broader.

Keep the value only in executor memory for a call, never in logs, traces, diagnostics, or crash dumps. Do not enable the pack if the deployment cannot meet those requirements.

Every endpoint here is on shared Google API hosts — cloudresourcemanager.googleapis.com and cloudbilling.googleapis.com — which stay real: they are the documented authorities for these APIs, not tenant placeholders. PROJECT_ID and PARENT_RESOURCE are placeholders the deployment binds before enabling: PARENT_RESOURCE takes the documented form folders/FOLDER_ID or organizations/ORG_ID (projects.list lists direct children of the named parent, and the caller needs resourcemanager.projects.list on that parent), PROJECT_ID a concrete project id or number.

The token-minting host oauth2.googleapis.com is likewise a real shared host, but minting is the external process's call, not a capability: the executor injects the minted value and never calls the token endpoint itself, so no capability allowlists it.

Approval classification: all four capabilities sit at R0, the read floor. projects.getIamPolicy is a POST by HTTP shape (a gRPC-transcoding custom action with a body carrying only GetPolicyOptions) but a read by effect — it returns the IAM policy bound to the project and changes nothing; it is registered as read with the POST shape stated plainly in the description.

The returned policy reveals which principals hold which roles on the project — security configuration that includes human principals' email addresses, so it registers at the pii class — and the exact input a later setIamPolicy (not registered) would rewrite.

Billing account list is financial at the read floor — a lower bound: an R0 financial read can still be a serious confidentiality risk.

Documented exclusions: this pack does not register projects create/delete/undelete/patch/move, setIamPolicy on any resource, testIamPermissions, organizations or folders listing (projects.list with an organization parent covers the projects directly parented by the organization — projects beneath folders are not returned — and the organizations.search and folders.list methods are not registered), billing account updates (projects.updateBillingInfo, which links or unlinks billing and is a money-relevant write), or the Cloud Billing Budgets and Cloud Asset Inventory APIs.

The two list reads describe collection reads only; projects.get is a record read and is registered as one.

Vertex AI administration (added in 1.1.0): nine capabilities cover Vertex AI endpoints (list, get, create, deploy a model, undeploy a model, delete), one Model Garden catalog read, and Vertex AI quotas through the Cloud Quotas API (list quotas, request a new value). The endpoint capabilities use the regional host us-central1-aiplatform.googleapis.com with locations/us-central1 in the path. For another region, substitute both the host and the location, and the egress allowlist with them. PROJECT_ID, ENDPOINT_ID, PUBLISHER and MODEL are placeholders. The Model Garden read uses the global host aiplatform.googleapis.com and the quota capabilities cloudquotas.googleapis.com with locations/global.

These nine capabilities name a separate reference, secret-ref-gcp-vertex-admin-token. Google's discovery documents list only the aiplatform or cloud-platform scopes for the Vertex AI methods, and only cloud-platform for Cloud Quotas, so the read-only token above cannot call them. Mint the admin token for a second service account by the same JWT process, with scope https://www.googleapis.com/auth/cloud-platform, and limit that account with IAM to the aiplatform.endpoints.* and cloudquotas.quotas.* permissions the enabled capabilities need.

Tiers sit at the floor of the declared actions. Deploying a model declares pay because deployed models bill by node hour until undeployed. Undeploying and deleting are R3. A quota request is R2 by the action floor. Model Garden enablement is not registered: Google documents enabling a partner model as a Console step that needs the Consumer Procurement Entitlement Manager role and the Cloud Commerce Consumer Procurement API, and the retrieved references publish no REST operation for it that this review could check. Every other method of the Vertex AI and Cloud Quotas APIs is excluded, among them the prediction and generateContent calls, endpoints.patch, endpoints.update and mutateDeployedModel, model upload, the Model Garden deploy method, tuning and batch prediction jobs, quotaInfos.get, quotaPreferences get, list and patch, and the quota adjuster settings.