Which IAM role do Applane builders need?

Who

GCP admin

Time

2 minutes

Builders call Vertex AI with their own Google account. For that, each of them needs roles/aiplatform.user on the project. Grant it to the builders group. Add new builders to that group and ensure they are allowed a seat in Applane.

gcloud projects add-iam-policy-binding <GCP_PROJECT_ID> \
  --member=group:applane-builders@<YOUR_DOMAIN> \
  --role=roles/aiplatform.user

Group membership changes reach IAM within a few minutes. The group is created by the Workspace admin: Accounts and groups.

Builder identity and setup identity

Applane creates no service account, no key, and no other IAM binding. There is nothing for Applane to hold, because every call is made from the builder’s browser with the builder’s own token. If a security review asks what Applane can do in your project, the answer is: nothing; it has no identity there.

The only exception is Infrastructure Manager, which needs its own service account to run Terraform. That account is Google’s deployment runner, not Applane’s.

What roles/aiplatform.user allows

This predefined role includes more than model prediction: it also allows managing several Vertex AI resources. Review Google’s role permission list before granting it. The builder uses the signed-in person’s IAM permissions, including any other roles they already hold.

Context caching permissions

The builder keeps its system prompt in a Vertex AI context cache during a build turn instead of re-sending it every round, which is where most of the saving on model cost comes from. That needs four permissions on the project:

aiplatform.cachedContents.create
aiplatform.cachedContents.get
aiplatform.cachedContents.list
aiplatform.cachedContents.delete

roles/aiplatform.user already includes all four, so the grant above is enough. If your company grants a custom role instead, add those four plus aiplatform.endpoints.predict, which the model call itself needs.

Without them the builder still works. Every turn is then billed at the full input rate, and the Costs panel in the builder shows “Context cache: off”.

Verify

gcloud projects get-iam-policy <GCP_PROJECT_ID> \
  --flatten=bindings --filter='bindings.role=roles/aiplatform.user' \
  --format='value(bindings.members)'

Expect group:applane-builders@<YOUR_DOMAIN> in the output. The setup checker tests the same binding.