Google Vertex AI

Access

Kind

Sign in on the vendor's page; nothing typed here

What to give

Read-only service account

Why that one

A service account with BigQuery Job User on the project and BigQuery Data Viewer on the billing dataset. Valistry runs one query over your billing export and nothing else. The key is tested, then stored encrypted; you see its last four characters.

What it attributes on its own

From the source

day; model; project; the SKU as Google billed it; what Google charged

Needs a rule or a trace

tokens — Vertex reports them through Cloud Monitoring, which this connector does not read yet; team, workflow and agent — unless your project labels carry them; outcome

The addresses it calls

• https://oauth2.googleapis.com/token
• https://accounts.google.com/o/oauth2/v2/auth
• https://bigquery.googleapis.com/bigquery/v2/projects

Valistry calls only these addresses. It blocks any other call and logs every call.

Connecting it

1. Turn on the BigQuery billing export. Pick your billing account → BigQuery export. Already on? Note its project and dataset. Open ↗
2. Create a key. Create service account. Then Keys → Add key → Create new key → JSON. Open ↗
3. Share the billing dataset. BigQuery → your project → billing dataset → Sharing → Permissions → Add principal. Open ↗

Where your projects carry labels for team or service, they can be read into attribution later; the billing export carries them on every row.

Settings worth turning on in Google Cloud

1. Export billing to BigQuery. Google writes every cost row to BigQuery. Valistry reads this export.
2. One project per team. Cost then splits by project with no rule. Valistry reads it.
3. Label each API call. Add a team label to each call. Billing reports split by label.
4. Set a budget. Google emails you at each threshold. It does not cap spend.

Questions about Google Vertex AI