Skip to main content

Gemini Enterprise Agent Platform Integration

The Ledger Gemini Enterprise Agent Platform integration inventories AI agent resources and credential metadata in Gemini Enterprise Agent Platform. It discovers Agent Engine applications, the identities associated with agents and their integrations, and secrets that may need remediation.

Setup is a one-time, keyless configuration using a generated Terraform template and Google Cloud Workload Identity Federation. Each integration scans one Google Cloud project.

What Data is Collected?​

  1. Applications - Agent Engine applications, including their Google Cloud project, region, service account, framework, and creation time.
  2. Identities - Google Cloud projects, agents, IAM connector authentication providers, and Agent Registry MCP servers and bindings.
  3. Secrets - Cloud API keys restricted to aiplatform.googleapis.com, environment-variable names, Secret Manager resource paths, and OAuth client-secret metadata. Inline environment-variable values are read transiently to detect Anthropic API keys and derive redacted hints, but raw values are not persisted or transmitted in scan results. Secret Manager values are never read.

Supported Remediations​

  • Migrations: Eligible inline Anthropic API keys can be replaced with a Defakto-issued workload identity through Anthropic Workload Identity Federation when an Anthropic integration is configured and the agent is enrolled in a Defakto trust domain with a matching serverless SVID issuance policy. See the Anthropic federation tutorial.

All other discovered credentials are discovery-only at this time. Secret Manager-backed Anthropic API keys cannot be correlated or migrated because their values are never read.

Integration Permissions​

The integration requires the following permissions in your project. Defakto authenticates through Workload Identity Federation, so no service account key is created, and the roles/iam.workloadIdentityUser binding is limited to the federation subject for this integration.

Gemini EAP Integration IAM Roles

The generated Terraform template assigns the integration service account the following predefined Google Cloud roles:

  • roles/serviceusage.serviceUsageConsumer
  • roles/resourcemanager.projectIamAdmin
  • roles/aiplatform.viewer
  • roles/serviceusage.apiKeysViewer
  • roles/monitoring.viewer

The template also creates two custom viewer roles:

  • IAM Connectors viewer
    • iamconnectors.connectors.list
    • iamconnectors.connectors.queryWorkloads
    • iamconnectors.locations.list
  • Agent Registry viewer
    • agentregistry.mcpServers.list
    • agentregistry.bindings.list
    • agentregistry.locations.list

Installation​

No applications are required to be installed in the target environment. You configure Google Cloud Workload Identity Federation and project permissions, and Defakto uses those to scan resources remotely without a service account key.

Prerequisites​

An operator should be able to create the following resources in the target Google Cloud project:

  1. Workload Identity Pool and Provider
  2. Service Account
  3. Project IAM bindings and custom roles

Configuration of these resources is automated through the Terraform template provided during setup. You should have Terraform or OpenTofu version 1.5 or later installed. For production environments, you should use a shared or managed Terraform state backend.

Steps​

  1. Visit the "Integrations" page in the Defakto Console and click "Create Integration".
  2. Select "Gemini EAP" from the list of available integrations under "Mind". Configure the following fields, then click "Create integration":
    • GCP project: The Google Cloud project ID to scan. (required)
    • Integration Name: A unique name for this integration. This will be used to identify the integration in the Console and CLI. (required)
  3. Follow the on-screen instructions to download the generated Terraform template. Inspect the template and ensure you understand the resources and permissions that it will create.
  4. From the downloaded template directory, initialize Terraform and apply the configuration: 
    terraform init
    terraform apply
  5. Retrieve the Workload Identity Federation audience and service account from the Terraform outputs: 
    terraform output -raw audience
    terraform output -raw service_account
  6. Paste the audience into "Workload Identity Pool Provider audience" and the service account into "Integration service account email". Then click "Save and continue".
  7. If the creation was successful, you'll be directed to the integration details page. The integration will automatically start scanning for resources in the connected project. Use the "Run Now" button to trigger an immediate scan and refresh the inventory from this integration at any time.

Caveats​

  1. Each integration scans one Google Cloud project. Configure a separate integration for each additional project.
  2. Cloud API key discovery is limited to keys restricted to aiplatform.googleapis.com.
  3. Last-used enrichment for Cloud API keys uses six months of daily request counts from Cloud Monitoring. The query can fail when the Cloud Monitoring API is disabled in the project or the integration's service account is missing roles/monitoring.viewer. In that case the scan still completes, but no key in that scan receives a last-used timestamp; Ledger prefers no usage data over partial data that would silently regress timestamps.
  4. IAM connector and Agent Registry discovery are optional enrichments. If the IAM connectors API is unavailable in the project, authentication providers and their agent bindings are not discovered; if the Agent Registry API is unavailable, MCP servers and their bindings are not discovered. The rest of the scan continues in both cases.
  5. Anthropic credential correlation is available only for inline keys with sufficient redacted hints. Fingerprints are derived internally from those redacted inline-key hints. Secret Manager-backed Anthropic keys cannot be correlated or migrated.