Google Vertex AI

google-cloud-aiplatform honours HTTPS_PROXY. Application Default Credentials are read from GOOGLE_APPLICATION_CREDENTIALS as usual.

1 · Environment

eval "$(aarmos env)"   # authenticated HTTPS_PROXY + HTTP_PROXY
export GOOGLE_APPLICATION_CREDENTIALS=$HOME/.gcp/sa.json
export GOOGLE_CLOUD_PROJECT=my-project
export GOOGLE_CLOUD_REGION=us-central1

2 · Policy

[[allow]]
verb = "communicate"
host = "*-aiplatform.googleapis.com"
ceiling.per_minute = 60

[[allow]]
verb = "communicate"
host = "oauth2.googleapis.com"    # SA token refresh

3 · Run

aarmos run -- python agent.py

Notes

  • The oauth2 rule is needed once per hour when the SA access token is refreshed.
  • Vertex Agent Builder and Gemini Live API share the *-aiplatform.googleapis.com host — one rule covers both.
  • Add `principal.gcp_project = "…"` on the allow rule to scope policy per project.

See all providers → recipes index.