Amazon EC2からWorkload Identity連携を使用して、Google CloudのVertex AIのGeminiをセキュアに呼び出す

gcloud services enable \
  iamcredentials.googleapis.com \
  sts.googleapis.com \
  iam.googleapis.com \
  cloudresourcemanager.googleapis.com \
  aiplatform.googleapis.com

gcloud iam workload-identity-pools create aws-ec2-pool \
  --location="global" \
  --display-name="AWS EC2 Pool" \
  --description="Workload Identity Pool for AWS EC2 instances to access Vertex AI"

gcloud iam workload-identity-pools providers create-aws aws-ec2-provider \
  --location="global" \
  --workload-identity-pool="aws-ec2-pool" \
  --account-id="<AWS_ACCOUNT_ID>" \
  --display-name="AWS EC2 Provider" \
  --description="Workload Identity Provider for AWS EC2" \
  --attribute-mapping="google.subject=assertion.arn,attribute.aws_account=assertion.account,attribute.aws_role=assertion.arn.extract('assumed-role/{role}/')" \
  --attribute-condition="assertion.arn.startsWith('arn:aws:sts::<AWS_ACCOUNT_ID>:assumed-role/')"

gcloud iam service-accounts create vertex-ai-caller \
  --display-name="Vertex AI Access from AWS EC2" \
  --description="Service Account for AWS EC2 to access Vertex AI"

gcloud projects add-iam-policy-binding ${GOOGLE_CLOUD_PROJECT} \
  --member="serviceAccount:vertex-ai-caller@${GOOGLE_CLOUD_PROJECT}.iam.gserviceaccount.com" \
  --role="roles/aiplatform.user"

gcloud iam service-accounts add-iam-policy-binding \
  vertex-ai-caller@${GOOGLE_CLOUD_PROJECT}.iam.gserviceaccount.com \
  --role="roles/iam.workloadIdentityUser" \
  --member="principalSet://iam.googleapis.com/projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/aws-ec2-pool/attribute.aws_role/EC2-Vertex-AI-Role"

gcloud iam workload-identity-pools create-cred-config \
    projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/aws-ec2-pool/providers/aws-ec2-provider \
    --service-account=vertex-ai-caller@${GOOGLE_CLOUD_PROJECT}.iam.gserviceaccount.com \
    --aws \
    --enable-imdsv2 \
    --output-file=credentials-configuration-file.json

{
  "universe_domain": "googleapis.com",
  "type": "external_account",
  "audience": "//iam.googleapis.com/projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/aws-ec2-pool/providers/aws-ec2-provider",
  "subject_token_type": "urn:ietf:params:aws:token-type:aws4_request",
  "token_url": "https://sts.googleapis.com/v1/token",
  "credential_source": {
    "environment_id": "aws1",
    "region_url": "http://169.254.169.254/latest/meta-data/placement/availability-zone",
    "url": "http://169.254.169.254/latest/meta-data/iam/security-credentials",
    "regional_cred_verification_url": "https://sts.{region}.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15",
    "imdsv2_session_token_url": "http://169.254.169.254/latest/api/token"
  },
  "service_account_impersonation_url": "https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/vertex-ai-caller@${GOOGLE_CLOUD_PROJECT}.iam.gserviceaccount.com:generateAccessToken"
}

$ cat /etc/os-release
NAME="Amazon Linux"
VERSION="2023"
ID="amzn"
ID_LIKE="fedora"
VERSION_ID="2023"
PLATFORM_ID="platform:al2023"
PRETTY_NAME="Amazon Linux 2023.9.20251105"
ANSI_COLOR="0;33"
CPE_NAME="cpe:2.3:o:amazon:amazon_linux:2023"
HOME_URL="https://aws.amazon.com/linux/amazon-linux-2023/"
DOCUMENTATION_URL="https://docs.aws.amazon.com/linux/"
SUPPORT_URL="https://aws.amazon.com/premiumsupport/"
BUG_REPORT_URL="https://github.com/amazonlinux/amazon-linux-2023"
VENDOR_NAME="AWS"
VENDOR_URL="https://aws.amazon.com/"
SUPPORT_END="2029-06-30"

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": "ec2.amazonaws.com"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}

$ ls -ltr
total 4
-rw-r--r--. 1 ssm-user ssm-user 948 Nov  6 02:03 credentials-configuration-file.json

export GOOGLE_APPLICATION_CREDENTIALS=credentials-configuration-file.json
export GCP_PROJECT_ID=PROJECT_ID

sudo dnf install python3.11 -y
python3.11 -m venv venv
source venv/bin/activate
pip install google-genai google-auth

import os
import json
from google.auth import aws
from google.cloud import aiplatform
from google.auth.transport.requests import Request
from google import genai
from google.genai import types

def initialize_vertex_ai_with_workload_identity():
    """
    Workload Identity連携を使用してVertex AIクライアントを初期化する
    """
    # 環境変数から認証情報構成ファイルのパスを取得
    credentials_file = os.environ.get("GOOGLE_APPLICATION_CREDENTIALS")

    if not credentials_file:
        raise ValueError(
            "環境変数 GOOGLE_APPLICATION_CREDENTIALS が設定されていません。"
            "認証情報構成ファイルのパスを設定してください。"
        )

    if not os.path.exists(credentials_file):
        raise FileNotFoundError(
            f"認証情報構成ファイルが見つかりません: {credentials_file}"
        )

    # 環境変数からGoogle Cloudプロジェクト設定を取得
    project_id = os.environ.get("GCP_PROJECT_ID")
    location = os.environ.get("GCP_LOCATION", "asia-northeast1")

    if not project_id:
        raise ValueError(
            "環境変数 GCP_PROJECT_ID が設定されていません。"
            "Google CloudのプロジェクトIDを設定してください。"
        )

    # 認証情報の構成ファイルからAWS外部アカウントの認証情報を作成
    with open(credentials_file, 'r') as f:
        credentials_info = json.load(f)

    credentials = aws.Credentials.from_info(
        credentials_info,
        scopes=['https://www.googleapis.com/auth/cloud-platform']
    )

    # 認証情報をリフレッシュ(トークン取得)
    print("Refreshing credentials...")
    credentials.refresh(Request())

    print(f"✓ Credentials refreshed successfully")
    print(f"✓ Project: {project_id}")
    print(f"✓ Location: {location}")

    return credentials, project_id, location

def call_vertex_ai_text_generation(credentials, project_id: str, location: str, prompt_text: str):
    """
    新しいGoogle GenAI SDKを使用してテキスト生成を実行する
    """
    # GenAI クライアントの初期化
    client = genai.Client(
        vertexai=True,
        project=project_id,
        location=location,
        credentials=credentials
    )

    # テキスト生成
    response = client.models.generate_content(
        model='gemini-2.5-flash',
        contents=prompt_text
    )

    return response.text

def main():
    """
    メイン実行関数
    """
    try:
        # 1. Workload Identity連携で認証
        print("Step 1: Authenticating with Workload Identity Federation...")
        credentials, project_id, location = initialize_vertex_ai_with_workload_identity()

        # 2. Google GenAI SDKでテキスト生成
        print("\nStep 2: Calling Vertex AI Generative AI...")
        prompt = "Google Cloudとは何ですか?簡潔に説明してください。"
        result = call_vertex_ai_text_generation(credentials, project_id, location, prompt)
        print(f"\nGenerated text:\n{result}")

        print("\n✓ All operations completed successfully!")

    except Exception as e:
        print(f"✗ Error occurred: {str(e)}")
        import traceback
        traceback.print_exc()
        raise

if __name__ == "__main__":
    main()

# スクリプトの実行
$ python3 vertex_ai_client.py

Step 1: Authenticating with Workload Identity Federation...
Refreshing credentials...
✓ Credentials refreshed successfully
✓ Project: xxxxxxxxxxxxxx
✓ Location: asia-northeast1

Step 2: Calling Vertex AI Generative AI...

Generated text:
**Google Cloud（Google Cloud Platform / GCP）** とは、Googleが提供する「クラウドコンピューティングサービス」の総称です。

簡潔に言うと：

*   企業や開発者が、自前でサーバーやデータセンターを持つことなく、**インターネット経由でコンピューティングリソース**（サーバー、ストレージ、データベース、AI、機械学習など多様なサービス）を利用できるようにするものです。*   必要な分だけ利用し、**使った分だけ料金を支払う従量課金制**が特徴です。

これにより、インフラの管理コストを削減し、ビジネスの迅速な展開や大規模なデータ処理、AI活用などを可能にします。

✓ All operations completed successfully!