> For the complete documentation index, see [llms.txt](https://docs.onelens.cloud/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.onelens.cloud/integrations/ai-integrations/gemini-enterprise.md).

# Gemini Enterprise

> Vertex AI Gemini is now called **Gemini Enterprise**. References to the Vertex AI API (`aiplatform.googleapis.com`) and Vertex AI IAM roles in this guide reflect the underlying Google Cloud service name, which remains unchanged.

### TL;DR

* **What this does**: Connects OneLens to your Google Cloud project to collect Gemini Enterprise cost, usage, and performance data — giving you model-level spend visibility, token consumption tracking, and AI cost optimization recommendations.
* **Time required**: \~10 minutes if your GCP cloud integration is already connected; \~25 minutes for a fresh setup.
* **Who you need**: A Google Cloud IAM administrator who can create service accounts and assign roles. One DevOps or platform engineer to run the setup.
* **What OneLens reads**: Read-only access to Cloud Billing export data (BigQuery), Gemini Enterprise API metadata, Cloud Monitoring metrics, and Cloud Audit Logs (caller identity only). Your prompts, completions, and application data are never accessed.

### What You'll Get Once Connected

| Capability                       | What it does for you                                                                                                                                        |
| -------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Unified AI Cost Explorer**     | See Gemini spend broken down by model, token type (input/output), project, and region — all in one view.                                                    |
| **Model-Level Cost Attribution** | Track costs per model (Gemini 2.5 Pro, Gemini 2.5 Flash, Gemini 3 Pro, etc.) using BigQuery billing export line items with project and label breakdowns.    |
| **Token Usage Analytics**        | Monitor input and output token consumption by model ID via Cloud Monitoring metrics. Spot which models and workloads consume the most tokens.               |
| **Cost Anomaly Detection**       | Get alerted when Gemini Enterprise spend deviates from historical patterns — catch runaway agent loops, unexpected model switches, or traffic spikes early. |
| **Budget Tracking**              | Set per-model or per-project budgets and track actuals against them, using billing labels and Google Cloud project-level attribution.                       |
| **Per-User Attribution**         | Attribute Gemini usage to individual users or service accounts via caller identity metadata from Cloud Audit Logs.                                          |
| **Idle Resource Detection**      | Flag provisioned throughput commitments with low utilization so you can rightsize or release capacity.                                                      |

### Security at a Glance

| Question                                         | Answer                                                                                                                                                                                                                                                                                                                                                                 |
| ------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Does OneLens read my prompts or model responses? | **No.** OneLens reads only Cloud Monitoring metrics and BigQuery billing data. It has no access to Gemini request or response payloads.                                                                                                                                                                                                                                |
| Does OneLens see my application data?            | **No.** OneLens accesses only Gemini Enterprise usage metadata, Cloud Monitoring metrics, and billing reports. It has no access to your application databases, Cloud Storage buckets, or any Vertex AI datasets.                                                                                                                                                       |
| Is access read-only?                             | **Yes.** The service account is granted viewer-level roles at both organisation level (`Organisation Viewer`, `Cloud Asset Viewer`, `Browser`, `Billing Account Viewer`) and project/folder level (`Vertex AI Viewer`, `Monitoring Viewer`, `Logging Viewer`, and other standard GCP integration roles). No create, update, delete, or invoke permissions are granted. |
| What authentication is used?                     | Google Cloud service account with impersonation. OneLens accesses your environment via its backend service account (`onelens-customer-sa@astuto-prod-mum.iam.gserviceaccount.com`) and external user (`onelens.finops@astuto.ai`), which are granted `Service Account Token Creator` on your service account. No long-lived JSON keys are downloaded.                  |
| How is data transmitted and stored?              | TLS 1.2+ in transit. At rest, data is encrypted using GCP KMS in OneLens infrastructure with standard organizational policies meeting ISO 27001 and SOC 2 compliance.                                                                                                                                                                                                  |

***

### Cost of the Integration

OneLens does not create any new infrastructure in your Google Cloud environment. The only cost is the BigQuery storage and query processing for the billing export dataset, which Google Cloud provides at no charge for standard billing export tables.

| Item                            | What it is                                                                                        | Typical cost                                       |
| ------------------------------- | ------------------------------------------------------------------------------------------------- | -------------------------------------------------- |
| **BigQuery billing export**     | Standard billing export table (auto-populated by Google Cloud)                                    | $0 (included in Cloud Billing)                     |
| **BigQuery queries**            | OneLens queries the billing export table. First 1 TiB/month free under BigQuery on-demand pricing | $0 – $5/month (depends on query volume)            |
| **Cloud Monitoring API calls**  | Reads from `monitoring.googleapis.com` for Gemini Enterprise metrics                              | $0 (within free tier of 1M API calls/month)        |
| **Data egress**                 | Metadata transferred to OneLens (\~10–50 MB/day)                                                  | < $0.01/month                                      |
| **Cloud Audit Logs (optional)** | **Enables caller identity attribution. First 50 GB/month free (\~25M API calls)**                 | **$0 for most customers; $25/month at 50M+ calls** |
| **Estimated total**             | Sum of above                                                                                      | **$0 – $25/month**                                 |

> Queries beyond the free 1 TiB/month tier are billed at $6.25/TiB. For most organizations, OneLens billing queries stay well within the free tier.

***

### How It Works

Gemini Enterprise (formerly Vertex AI Gemini) provides access to Gemini models through a managed Google Cloud API. All usage — tokens consumed, latency, model ID, and caller identity — is captured via Cloud Monitoring metrics and Cloud Audit Logs. Cost data flows into BigQuery through Cloud Billing export, which Google auto-populates with line-item detail including SKU, project, labels, and pricing.

OneLens collects data from 3 sources:

1. **BigQuery Billing Export** — Line-item cost and usage data per SKU, model, project, and label.
2. **Cloud Monitoring Metrics** — Token counts, request counts, and latency by model and region (`aiplatform.googleapis.com/prediction` metrics).
3. **Cloud Audit Logs** — Caller identity (user or service account) from Gemini Enterprise `aiplatform.googleapis.com` Data Access logs, used for per-user attribution.

***

### Integration Steps

#### Prerequisites

* A Google Cloud project with the **Vertex AI API** enabled (`aiplatform.googleapis.com`).
* The user performing the integration must have **Owner** on the projects/folders to be onboarded and **Organisation Administrator** on the organisation.

> **Already have the GCP Cloud & Cost integration connected?** If you have already completed the [Manual GCP Integration](https://docs.onelens.cloud/integrations/cloud-and-cost-sources/connecting-to-gcp/manual), the billing project, service account, billing export, and most IAM roles are already in place. Skip to [Verify Gemini-Specific Requirements](#verify-gemini-specific-requirements) below.

#### What OneLens Will Access

* `bigquery.tables.getData` on the billing export dataset — cost and usage line items
* `monitoring.timeSeries.list` — Gemini Enterprise prediction metrics (token counts, latency, request counts)
* `aiplatform.models.list`, `aiplatform.endpoints.list` — model and endpoint metadata
* `logging.entries.list` — caller identity from Gemini Enterprise audit logs (per-user attribution)
* `resourcemanager.projects.get` — project metadata for labeling

#### What OneLens Will NOT Access

* ❌ Gemini prompt or completion content
* ❌ Gemini Enterprise datasets, training data, or fine-tuned model weights
* ❌ Cloud Storage buckets or application databases
* ❌ Any write, invoke, or delete operations on Gemini Enterprise resources
* ❌ Secrets Manager, KMS keys, or IAM policy modifications

***

#### Path A: Fresh Setup (No Existing GCP Integration)

If you have not yet connected your GCP environment to OneLens, follow the full [Manual GCP Integration guide](https://docs.onelens.cloud/integrations/cloud-and-cost-sources/connecting-to-gcp/manual). That guide covers:

1. Creating the billing project and enabling cost export to BigQuery
2. Creating the OneLens Reader service account with BigQuery roles on the billing project
3. Granting `Service Account Token Creator` to OneLens principals (`onelens-customer-sa@astuto-prod-mum.iam.gserviceaccount.com` and `onelens.finops@astuto.ai`)
4. Assigning organisation-level roles (`Organisation Viewer`, `Cloud Asset Viewer`, `Browser`, `Billing Account Viewer`)
5. Assigning project/folder-level roles (including `Vertex AI Viewer` and `Monitoring Viewer`)

Once the GCP integration is complete, the `Vertex AI Viewer` role is already in place. However, the standard GCP integration does **not** include `Logging Viewer` — you will need to grant this additional role for Gemini per-user attribution. Proceed to [Verify Gemini-Specific Requirements.](#verify-gemini-specific-requirements)

***

#### Path B: Existing GCP Integration

If your GCP cloud & cost integration is already connected, verify the following Gemini-specific requirements.

#### **Verify Gemini-Specific Requirements**

**1. Confirm the Vertex AI API is enabled on each project using Gemini.**

```bash
# Check if the Vertex AI API is enabled
gcloud services list --enabled --project=YOUR_PROJECT_ID \
  --filter="config.name=aiplatform.googleapis.com"

# If not listed, enable it
gcloud services enable aiplatform.googleapis.com --project=YOUR_PROJECT_ID
```

**2. Confirm `Vertex AI Viewer` is assigned to the OneLens Reader service account.**

The [Manual GCP Integration](https://docs.onelens.cloud/integrations/cloud-and-cost-sources/connecting-to-gcp/manual) already grants this role at the project/folder level (Step 5). Verify it is in place:

```bash
# Check IAM bindings for the service account
gcloud projects get-iam-policy YOUR_PROJECT_ID \
  --flatten="bindings[].members" \
  --filter="bindings.members:YOUR_ONELENS_SA_EMAIL AND bindings.role:roles/aiplatform.viewer" \
  --format="table(bindings.role, bindings.members)"
```

If the role is missing, add it:

```bash
gcloud projects add-iam-policy-binding YOUR_PROJECT_ID \
  --member="serviceAccount:YOUR_ONELENS_SA_EMAIL" \
  --role="roles/aiplatform.viewer"
```

**3. Confirm `Monitoring Viewer` is assigned** (also part of the standard GCP integration, Step 5).

```bash
gcloud projects get-iam-policy YOUR_PROJECT_ID \
  --flatten="bindings[].members" \
  --filter="bindings.members:YOUR_ONELENS_SA_EMAIL AND bindings.role:roles/monitoring.viewer" \
  --format="table(bindings.role, bindings.members)"
```

**4. Grant `Logging Viewer` (Gemini-specific — not part of the standard GCP integration).**

This role is required for per-user attribution. It allows OneLens to read caller identity from Gemini Enterprise Data Access audit logs.

```bash
gcloud projects add-iam-policy-binding YOUR_PROJECT_ID \
  --member="serviceAccount:YOUR_ONELENS_SA_EMAIL" \
  --role="roles/logging.viewer"
```

> `roles/logging.viewer` is **not** included in the standard [GCP Cloud & Cost Integration](https://docs.onelens.cloud/integrations/cloud-and-cost-sources/connecting-to-gcp/manual). It must be granted explicitly for the Gemini integration.

***

#### Connect to OneLens

Share the following information with the OneLens team (via email to <support@astuto.ai> or through the OneLens dashboard):

| Field                          | Where to find it                                                                   |
| ------------------------------ | ---------------------------------------------------------------------------------- |
| **Google Cloud Project ID(s)** | Google Cloud Console → Project selector (top bar) — list each project using Gemini |
| **Service Account email**      | IAM & Admin → Service Accounts → the OneLens Reader SA email                       |
| **Billing Project ID**         | The project containing the BigQuery billing export dataset                         |
| **BigQuery Dataset ID**        | Cloud Billing → Billing export → Dataset name (e.g., `billing_export`)             |

> **Verification**: After OneLens confirms the connection (typically within 24 hours), check the OneLens dashboard for:
>
> * Gemini model cost data appearing in the AI Cost Explorer
> * Token usage metrics populating per model
> * Project and label attribution visible in cost breakdowns

***

### Data Refresh Schedule

* **Billing data (BigQuery)**: Refreshed daily. Google Cloud billing export has an inherent delay of 12–24 hours, so polling more frequently does not surface fresher data.
* **Cloud Monitoring metrics**: Refreshed every 6 hours. Gemini Enterprise metrics are available with \~5 minute delay in Cloud Monitoring.
* **Cloud Audit Logs**: Refreshed every 6 hours. Used for per-user attribution of Gemini API calls.

> Current-period cost figures may shift until the billing period closes, as Google Cloud applies credits, sustained-use discounts, and committed-use discount adjustments retroactively.

***

### Data Privacy & Security

* ✅ **Read-only access** — OneLens cannot invoke models, create resources, or modify any configuration in your Google Cloud project.
* ✅ **No prompt/completion access** — OneLens never reads the content of your Gemini requests or responses.
* ✅ **Scoped IAM roles** — Only viewer-level roles are granted. No admin or editor roles.
* ✅ **No long-lived keys** — OneLens uses service account impersonation via `Service Account Token Creator`. No JSON keys are downloaded or stored.
* ✅ **TLS 1.2+ in transit** — All data transfers between Google Cloud and OneLens use TLS encryption.
* ✅ **Encrypted at rest** — Collected data is encrypted using GCP KMS in OneLens infrastructure.
* ✅ **VPC Service Controls compatible** — You can restrict the service account's access using VPC Service Controls perimeters and organization policies.
* ✅ **Revocable at any time** — Remove the `Service Account Token Creator` grant or delete the service account to immediately revoke OneLens access.

***

### Troubleshooting

#### `PERMISSION_DENIED` when OneLens queries BigQuery

**Cause:** Service account lacks `BigQuery Data Viewer` on the billing export dataset.

**Fix:** Grant `BigQuery Data Viewer` at the dataset or project level. See the [Manual GCP Integration](https://docs.onelens.cloud/integrations/cloud-and-cost-sources/connecting-to-gcp/manual) Step 2.

***

#### No billing data after 48 hours

**Cause:** Cloud Billing export to BigQuery is not enabled, or the dataset is in a different project.

**Fix:** Verify export is enabled: Cloud Billing → Billing export. Confirm the dataset project matches what was shared with OneLens.

***

#### `INVALID_ARGUMENT` or `NOT_FOUND` on Cloud Monitoring calls

**Cause:** Gemini Enterprise API is not enabled in the project.

**Fix:** Enable the API:

```bash
gcloud services enable aiplatform.googleapis.com --project=YOUR_PROJECT_ID
```

***

#### Token metrics show zero values

**Cause:** No Gemini API calls have been made in the monitored project/region.

**Fix:** Confirm Gemini is being called in the project and region configured for OneLens.

***

#### `403 Forbidden` on service account impersonation

**Cause:** `Service Account Token Creator` not granted to OneLens principals on the service account.

**Fix:** Grant the role to `onelens-customer-sa@astuto-prod-mum.iam.gserviceaccount.com` and `onelens.finops@astuto.ai` on the service account.

***

#### Per-user attribution not showing

**Cause:** `Logging Viewer` role is not granted, or Data Access audit logs are not enabled for `aiplatform.googleapis.com`.

**Fix:** Grant `roles/logging.viewer` to the OneLens service account (see Step 4 above). Verify Data Access logging is enabled for the Gemini Enterprise API in your project's audit log configuration (IAM & Admin → Audit Logs → `aiplatform.googleapis.com` → enable Data Read).

***

#### VPC Service Controls blocking OneLens access

**Cause:** The service perimeter does not include the OneLens egress IP.

**Fix:** Add OneLens egress IPs (provided during onboarding) to the VPC Service Controls access level ingress policy.

***

#### Connected but cost data looks incomplete

**Cause:** Billing export only includes data from the date export was enabled — it does not backfill.

**Fix:** Expected behavior. Historical data will accumulate from the export start date. Use the [recommended dataset setup](https://docs.onelens.cloud/integrations/cloud-and-cost-sources/connecting-to-gcp/manual) (US multi-region) to get retroactive data from the start of the previous month.

***

### Frequently Asked Questions

**Can OneLens see our prompts, completions, or application data?** No. OneLens reads only billing data (via BigQuery), Cloud Monitoring metrics (token counts, latency, request counts), and caller identity from Cloud Audit Logs. It never accesses the content of Gemini API requests or responses.

**Can OneLens modify our Gemini Enterprise configuration?** No. The service account has only viewer-level roles. It cannot invoke models, create endpoints, modify quotas, or change any Google Cloud resource.

**Will this impact our Gemini Enterprise performance?** No. OneLens reads asynchronous data sources (BigQuery billing export, Cloud Monitoring, Cloud Audit Logs). It does not intercept or proxy Gemini API calls. There is zero impact on API latency or throughput.

**Can I connect multiple Google Cloud projects?** Yes. Ensure the OneLens Reader service account has the required roles on each project (or grant roles at the organisation/folder level). Share each project ID with OneLens.

**How do I disconnect OneLens?** Remove the `Service Account Token Creator` grant from the OneLens principals on your service account. This immediately revokes all OneLens access. Alternatively, delete the service account entirely.

```bash
# Option 1: Revoke impersonation access
gcloud iam service-accounts remove-iam-policy-binding \
  YOUR_ONELENS_SA_EMAIL \
  --member="serviceAccount:onelens-customer-sa@astuto-prod-mum.iam.gserviceaccount.com" \
  --role="roles/iam.serviceAccountTokenCreator"

# Option 2: Delete the service account entirely
gcloud iam service-accounts delete YOUR_ONELENS_SA_EMAIL \
  --project=YOUR_PROJECT_ID
```

**Does OneLens support Gemini models accessed via AI Studio (not Gemini Enterprise)?** OneLens integrates with Gemini Enterprise (Google Cloud's enterprise API). If you use the Gemini Developer API via AI Studio, usage does not appear in Cloud Billing export or Cloud Monitoring under the `aiplatform.googleapis.com` service. Contact OneLens support for guidance on consolidating visibility across both access paths.

**What happens if Google changes Gemini Enterprise billing SKUs?** OneLens continuously updates its SKU mapping as Google Cloud releases new models and pricing tiers. If a new SKU appears, it will be categorized within 48 hours. No action is required on your side.

**Can I limit OneLens access to specific models or regions?** Yes. Use IAM Conditions to restrict the `Vertex AI Viewer` role to specific regions. For BigQuery, grant access at the dataset level rather than the project level to scope billing data access.

**Why does OneLens need `Logging Viewer`?** This role enables per-user attribution by reading caller identity (user or service account) from Gemini Enterprise Data Access audit logs. It is **not** part of the standard GCP integration — it is a Gemini-specific addition. The role grants read-only access to log entries; it cannot modify logs or any other resource.

**Why does OneLens need `Vertex AI Viewer`?** This role allows OneLens to list available models and endpoints in your project, which enables accurate model-level cost and usage attribution. It does not grant permission to invoke models or read training data. This is the same role already granted as part of the standard [GCP Cloud & Cost Integration](https://docs.onelens.cloud/integrations/cloud-and-cost-sources/connecting-to-gcp/manual).

***

### Need Help?

**Google Cloud Documentation**:

* [Gemini Enterprise API Overview](https://cloud.google.com/vertex-ai/generative-ai/docs/overview)
* [Export Cloud Billing Data to BigQuery](https://cloud.google.com/billing/docs/how-to/export-data-bigquery)
* [Cloud Monitoring Metrics for Vertex AI](https://cloud.google.com/monitoring/api/metrics_vertex)
* [Creating Service Accounts](https://cloud.google.com/iam/docs/service-accounts-create)

**OneLens Support**: <support@astuto.ai>

***

*Reference sources:* [*Gemini Enterprise API Overview*](https://cloud.google.com/vertex-ai/generative-ai/docs/overview) *·* [*Cloud Billing Export to BigQuery*](https://cloud.google.com/billing/docs/how-to/export-data-bigquery) *·* [*Vertex AI IAM Roles*](https://cloud.google.com/vertex-ai/docs/general/access-control) *·* [*Cloud Monitoring Metrics*](https://cloud.google.com/monitoring/api/metrics_vertex) *·* [*Manual GCP Integration*](https://docs.onelens.cloud/integrations/cloud-and-cost-sources/connecting-to-gcp/manual)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.onelens.cloud/integrations/ai-integrations/gemini-enterprise.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.