Authenticating BigQuery Remote Connections to Vertex AI

What BigQuery Cloud Resource Connections Are

A BigQuery Cloud resource connection (also referred to as a remote connection) is a managed Google Cloud resource that allows BigQuery to securely interact with external Google Cloud services, such as Vertex AI foundational large language models (LLMs) and Cloud Functions, directly within SQL queries.

How It Meets the Requirements

• Pretrained LLM Integration (✓): Creating a remote connection allows BigQuery ML to delegate text generation, summarization, and embedding generation to Vertex AI endpoints using the ML.GENERATE_TEXT or ML.PREDICT functions.
• Automated Credential Management (✓): When a Cloud resource connection is created, BigQuery automatically creates and assigns a dedicated system-managed service account specific to that connection.
• Least-Privilege Security (✓): By granting the Vertex AI User (roles/aiplatform.user) role specifically to the connection's service account in Identity and Access Management (IAM), BigQuery obtains delegated permissions to invoke the remote model without exposing user credentials or static API keys.

Key Advantages and Capabilities

• No Stored Secrets: Eliminates the need to store, distribute, or rotate static API tokens and database passwords within application code or SQL scripts.
• Seamless SQL Modeling: Enables data analysts to declare CREATE OR REPLACE MODEL ... REMOTE WITH CONNECTION directly in standard BigQuery SQL syntax.
• Centralized Auditing: All invocation requests routed through the service account are tracked and auditable through Google Cloud audit logs.
• Fine-Grained Access Control: Administrators can control which team members have access to execute queries through the connection using standard IAM policies.

Why This Is Optimal

Using a native Cloud resource connection with IAM service account delegation is the Google-recommended, zero-trust architecture pattern for extending BigQuery capabilities to Vertex AI foundational models.