Gemini Enterprise

Customer Onboarding Guide — Google Gemini Enterprise Integration

Vertex AI Gemini is now called Gemini Enterprise. References to the Vertex AI API (aiplatform.googleapis.com) and Vertex AI IAM roles in this guide reflect the underlying Google Cloud service name, which remains unchanged.

TL;DR

What this does: Connects OneLens to your Google Cloud project to collect Gemini Enterprise cost, usage, and performance data — giving you model-level spend visibility, token consumption tracking, and AI cost optimization recommendations.
Time required: ~10 minutes if your GCP cloud integration is already connected; ~25 minutes for a fresh setup.
Who you need: A Google Cloud IAM administrator who can create service accounts and assign roles. One DevOps or platform engineer to run the setup.
What OneLens reads: Read-only access to Cloud Billing export data (BigQuery), Gemini Enterprise API metadata, Cloud Monitoring metrics, and Cloud Audit Logs (caller identity only). Your prompts, completions, and application data are never accessed.

What You'll Get Once Connected

Capability

What it does for you

Unified AI Cost Explorer

See Gemini spend broken down by model, token type (input/output), project, and region — all in one view.

Model-Level Cost Attribution

Track costs per model (Gemini 2.5 Pro, Gemini 2.5 Flash, Gemini 3 Pro, etc.) using BigQuery billing export line items with project and label breakdowns.

Token Usage Analytics

Monitor input and output token consumption by model ID via Cloud Monitoring metrics. Spot which models and workloads consume the most tokens.

Cost Anomaly Detection

Get alerted when Gemini Enterprise spend deviates from historical patterns — catch runaway agent loops, unexpected model switches, or traffic spikes early.

Budget Tracking

Set per-model or per-project budgets and track actuals against them, using billing labels and Google Cloud project-level attribution.

Per-User Attribution

Attribute Gemini usage to individual users or service accounts via caller identity metadata from Cloud Audit Logs.

Idle Resource Detection

Flag provisioned throughput commitments with low utilization so you can rightsize or release capacity.

Security at a Glance

Question

Answer

Does OneLens read my prompts or model responses?

No. OneLens reads only Cloud Monitoring metrics and BigQuery billing data. It has no access to Gemini request or response payloads.

Does OneLens see my application data?

No. OneLens accesses only Gemini Enterprise usage metadata, Cloud Monitoring metrics, and billing reports. It has no access to your application databases, Cloud Storage buckets, or any Vertex AI datasets.

Is access read-only?

Yes. The service account is granted viewer-level roles at both organisation level (Organisation Viewer, Cloud Asset Viewer, Browser, Billing Account Viewer) and project/folder level (Vertex AI Viewer, Monitoring Viewer, Logging Viewer, and other standard GCP integration roles). No create, update, delete, or invoke permissions are granted.

What authentication is used?

Google Cloud service account with impersonation. OneLens accesses your environment via its backend service account (onelens-customer-sa@astuto-prod-mum.iam.gserviceaccount.com) and external user (onelens.finops@astuto.ai), which are granted Service Account Token Creator on your service account. No long-lived JSON keys are downloaded.

How is data transmitted and stored?

TLS 1.2+ in transit. At rest, data is encrypted using GCP KMS in OneLens infrastructure with standard organizational policies meeting ISO 27001 and SOC 2 compliance.

Cost of the Integration

OneLens does not create any new infrastructure in your Google Cloud environment. The only cost is the BigQuery storage and query processing for the billing export dataset, which Google Cloud provides at no charge for standard billing export tables.

Item

What it is

Typical cost

BigQuery billing export

Standard billing export table (auto-populated by Google Cloud)

$0 (included in Cloud Billing)

BigQuery queries

OneLens queries the billing export table. First 1 TiB/month free under BigQuery on-demand pricing

$0 – $5/month (depends on query volume)

Cloud Monitoring API calls

Reads from monitoring.googleapis.com for Gemini Enterprise metrics

$0 (within free tier of 1M API calls/month)

Data egress

Metadata transferred to OneLens (~10–50 MB/day)

< $0.01/month

Cloud Audit Logs (optional)

Enables caller identity attribution. First 50 GB/month free (~25M API calls)

$0 for most customers; $25/month at 50M+ calls

Estimated total

Sum of above

$0 – $25/month

Queries beyond the free 1 TiB/month tier are billed at $6.25/TiB. For most organizations, OneLens billing queries stay well within the free tier.

How It Works

Gemini Enterprise (formerly Vertex AI Gemini) provides access to Gemini models through a managed Google Cloud API. All usage — tokens consumed, latency, model ID, and caller identity — is captured via Cloud Monitoring metrics and Cloud Audit Logs. Cost data flows into BigQuery through Cloud Billing export, which Google auto-populates with line-item detail including SKU, project, labels, and pricing.

OneLens collects data from 3 sources:

BigQuery Billing Export — Line-item cost and usage data per SKU, model, project, and label.
Cloud Monitoring Metrics — Token counts, request counts, and latency by model and region (aiplatform.googleapis.com/prediction metrics).
Cloud Audit Logs — Caller identity (user or service account) from Gemini Enterprise aiplatform.googleapis.com Data Access logs, used for per-user attribution.

Integration Steps

Prerequisites

A Google Cloud project with the Vertex AI API enabled (aiplatform.googleapis.com).
The user performing the integration must have Owner on the projects/folders to be onboarded and Organisation Administrator on the organisation.

Already have the GCP Cloud & Cost integration connected? If you have already completed the Manual GCP Integration, the billing project, service account, billing export, and most IAM roles are already in place. Skip to Verify Gemini-Specific Requirements below.

What OneLens Will Access

bigquery.tables.getData on the billing export dataset — cost and usage line items
monitoring.timeSeries.list — Gemini Enterprise prediction metrics (token counts, latency, request counts)
aiplatform.models.list, aiplatform.endpoints.list — model and endpoint metadata
logging.entries.list — caller identity from Gemini Enterprise audit logs (per-user attribution)
resourcemanager.projects.get — project metadata for labeling

What OneLens Will NOT Access

❌ Gemini prompt or completion content
❌ Gemini Enterprise datasets, training data, or fine-tuned model weights
❌ Cloud Storage buckets or application databases
❌ Any write, invoke, or delete operations on Gemini Enterprise resources
❌ Secrets Manager, KMS keys, or IAM policy modifications

Path A: Fresh Setup (No Existing GCP Integration)

If you have not yet connected your GCP environment to OneLens, follow the full Manual GCP Integration guide. That guide covers:

Creating the billing project and enabling cost export to BigQuery
Creating the OneLens Reader service account with BigQuery roles on the billing project
Granting Service Account Token Creator to OneLens principals (onelens-customer-sa@astuto-prod-mum.iam.gserviceaccount.com and onelens.finops@astuto.ai)
Assigning organisation-level roles (Organisation Viewer, Cloud Asset Viewer, Browser, Billing Account Viewer)
Assigning project/folder-level roles (including Vertex AI Viewer and Monitoring Viewer)

Once the GCP integration is complete, the Vertex AI Viewer role is already in place. However, the standard GCP integration does not include Logging Viewer — you will need to grant this additional role for Gemini per-user attribution. Proceed to Verify Gemini-Specific Requirements.

Path B: Existing GCP Integration

If your GCP cloud & cost integration is already connected, verify the following Gemini-specific requirements.

Verify Gemini-Specific Requirements

1. Confirm the Vertex AI API is enabled on each project using Gemini.

# Check if the Vertex AI API is enabled
gcloud services list --enabled --project=YOUR_PROJECT_ID \
  --filter="config.name=aiplatform.googleapis.com"

# If not listed, enable it
gcloud services enable aiplatform.googleapis.com --project=YOUR_PROJECT_ID

2. Confirm Vertex AI Viewer is assigned to the OneLens Reader service account.

The Manual GCP Integration already grants this role at the project/folder level (Step 5). Verify it is in place:

# Check IAM bindings for the service account
gcloud projects get-iam-policy YOUR_PROJECT_ID \
  --flatten="bindings[].members" \
  --filter="bindings.members:YOUR_ONELENS_SA_EMAIL AND bindings.role:roles/aiplatform.viewer" \
  --format="table(bindings.role, bindings.members)"

If the role is missing, add it:

gcloud projects add-iam-policy-binding YOUR_PROJECT_ID \
  --member="serviceAccount:YOUR_ONELENS_SA_EMAIL" \
  --role="roles/aiplatform.viewer"

3. Confirm Monitoring Viewer is assigned (also part of the standard GCP integration, Step 5).

gcloud projects get-iam-policy YOUR_PROJECT_ID \
  --flatten="bindings[].members" \
  --filter="bindings.members:YOUR_ONELENS_SA_EMAIL AND bindings.role:roles/monitoring.viewer" \
  --format="table(bindings.role, bindings.members)"

4. Grant Logging Viewer (Gemini-specific — not part of the standard GCP integration).

This role is required for per-user attribution. It allows OneLens to read caller identity from Gemini Enterprise Data Access audit logs.

gcloud projects add-iam-policy-binding YOUR_PROJECT_ID \
  --member="serviceAccount:YOUR_ONELENS_SA_EMAIL" \
  --role="roles/logging.viewer"

roles/logging.viewer is not included in the standard GCP Cloud & Cost Integration. It must be granted explicitly for the Gemini integration.

Connect to OneLens

Share the following information with the OneLens team (via email to support@astuto.ai or through the OneLens dashboard):

Field

Where to find it

Google Cloud Project ID(s)

Google Cloud Console → Project selector (top bar) — list each project using Gemini

Service Account email

IAM & Admin → Service Accounts → the OneLens Reader SA email

Billing Project ID

The project containing the BigQuery billing export dataset

BigQuery Dataset ID

Cloud Billing → Billing export → Dataset name (e.g., billing_export)

Verification: After OneLens confirms the connection (typically within 24 hours), check the OneLens dashboard for:
Gemini model cost data appearing in the AI Cost Explorer
Token usage metrics populating per model
Project and label attribution visible in cost breakdowns

Data Refresh Schedule

Billing data (BigQuery): Refreshed daily. Google Cloud billing export has an inherent delay of 12–24 hours, so polling more frequently does not surface fresher data.
Cloud Monitoring metrics: Refreshed every 6 hours. Gemini Enterprise metrics are available with ~5 minute delay in Cloud Monitoring.
Cloud Audit Logs: Refreshed every 6 hours. Used for per-user attribution of Gemini API calls.

Current-period cost figures may shift until the billing period closes, as Google Cloud applies credits, sustained-use discounts, and committed-use discount adjustments retroactively.

Data Privacy & Security

✅ Read-only access — OneLens cannot invoke models, create resources, or modify any configuration in your Google Cloud project.
✅ No prompt/completion access — OneLens never reads the content of your Gemini requests or responses.
✅ Scoped IAM roles — Only viewer-level roles are granted. No admin or editor roles.
✅ No long-lived keys — OneLens uses service account impersonation via Service Account Token Creator. No JSON keys are downloaded or stored.
✅ TLS 1.2+ in transit — All data transfers between Google Cloud and OneLens use TLS encryption.
✅ Encrypted at rest — Collected data is encrypted using GCP KMS in OneLens infrastructure.
✅ VPC Service Controls compatible — You can restrict the service account's access using VPC Service Controls perimeters and organization policies.
✅ Revocable at any time — Remove the Service Account Token Creator grant or delete the service account to immediately revoke OneLens access.

Troubleshooting

`PERMISSION_DENIED` when OneLens queries BigQuery

Cause: Service account lacks BigQuery Data Viewer on the billing export dataset.

Fix: Grant BigQuery Data Viewer at the dataset or project level. See the Manual GCP Integration Step 2.

No billing data after 48 hours

Cause: Cloud Billing export to BigQuery is not enabled, or the dataset is in a different project.

Fix: Verify export is enabled: Cloud Billing → Billing export. Confirm the dataset project matches what was shared with OneLens.

`INVALID_ARGUMENT` or `NOT_FOUND` on Cloud Monitoring calls

Cause: Gemini Enterprise API is not enabled in the project.

Fix: Enable the API:

gcloud services enable aiplatform.googleapis.com --project=YOUR_PROJECT_ID

Token metrics show zero values

Cause: No Gemini API calls have been made in the monitored project/region.

Fix: Confirm Gemini is being called in the project and region configured for OneLens.

`403 Forbidden` on service account impersonation

Cause: Service Account Token Creator not granted to OneLens principals on the service account.

Fix: Grant the role to onelens-customer-sa@astuto-prod-mum.iam.gserviceaccount.com and onelens.finops@astuto.ai on the service account.

Per-user attribution not showing

Cause: Logging Viewer role is not granted, or Data Access audit logs are not enabled for aiplatform.googleapis.com.

Fix: Grant roles/logging.viewer to the OneLens service account (see Step 4 above). Verify Data Access logging is enabled for the Gemini Enterprise API in your project's audit log configuration (IAM & Admin → Audit Logs → aiplatform.googleapis.com → enable Data Read).

VPC Service Controls blocking OneLens access

Cause: The service perimeter does not include the OneLens egress IP.

Fix: Add OneLens egress IPs (provided during onboarding) to the VPC Service Controls access level ingress policy.

Connected but cost data looks incomplete

Cause: Billing export only includes data from the date export was enabled — it does not backfill.

Fix: Expected behavior. Historical data will accumulate from the export start date. Use the recommended dataset setup (US multi-region) to get retroactive data from the start of the previous month.

Frequently Asked Questions

Can OneLens see our prompts, completions, or application data? No. OneLens reads only billing data (via BigQuery), Cloud Monitoring metrics (token counts, latency, request counts), and caller identity from Cloud Audit Logs. It never accesses the content of Gemini API requests or responses.

Can OneLens modify our Gemini Enterprise configuration? No. The service account has only viewer-level roles. It cannot invoke models, create endpoints, modify quotas, or change any Google Cloud resource.

Will this impact our Gemini Enterprise performance? No. OneLens reads asynchronous data sources (BigQuery billing export, Cloud Monitoring, Cloud Audit Logs). It does not intercept or proxy Gemini API calls. There is zero impact on API latency or throughput.

Can I connect multiple Google Cloud projects? Yes. Ensure the OneLens Reader service account has the required roles on each project (or grant roles at the organisation/folder level). Share each project ID with OneLens.

How do I disconnect OneLens? Remove the Service Account Token Creator grant from the OneLens principals on your service account. This immediately revokes all OneLens access. Alternatively, delete the service account entirely.

# Option 1: Revoke impersonation access
gcloud iam service-accounts remove-iam-policy-binding \
  YOUR_ONELENS_SA_EMAIL \
  --member="serviceAccount:onelens-customer-sa@astuto-prod-mum.iam.gserviceaccount.com" \
  --role="roles/iam.serviceAccountTokenCreator"

# Option 2: Delete the service account entirely
gcloud iam service-accounts delete YOUR_ONELENS_SA_EMAIL \
  --project=YOUR_PROJECT_ID

Does OneLens support Gemini models accessed via AI Studio (not Gemini Enterprise)? OneLens integrates with Gemini Enterprise (Google Cloud's enterprise API). If you use the Gemini Developer API via AI Studio, usage does not appear in Cloud Billing export or Cloud Monitoring under the aiplatform.googleapis.com service. Contact OneLens support for guidance on consolidating visibility across both access paths.

What happens if Google changes Gemini Enterprise billing SKUs? OneLens continuously updates its SKU mapping as Google Cloud releases new models and pricing tiers. If a new SKU appears, it will be categorized within 48 hours. No action is required on your side.

Can I limit OneLens access to specific models or regions? Yes. Use IAM Conditions to restrict the Vertex AI Viewer role to specific regions. For BigQuery, grant access at the dataset level rather than the project level to scope billing data access.

Why does OneLens need Logging Viewer? This role enables per-user attribution by reading caller identity (user or service account) from Gemini Enterprise Data Access audit logs. It is not part of the standard GCP integration — it is a Gemini-specific addition. The role grants read-only access to log entries; it cannot modify logs or any other resource.

Why does OneLens need Vertex AI Viewer? This role allows OneLens to list available models and endpoints in your project, which enables accurate model-level cost and usage attribution. It does not grant permission to invoke models or read training data. This is the same role already granted as part of the standard GCP Cloud & Cost Integration.

Need Help?

Google Cloud Documentation:

OneLens Support: support@astuto.ai

Reference sources: Gemini Enterprise API Overview · Cloud Billing Export to BigQuery · Vertex AI IAM Roles · Cloud Monitoring Metrics · Manual GCP Integration

PreviousClaude Enterprise Integration NextLiteLLM Integration

Last updated 16 days ago