GCP Tutorial — Vertex AI, Cloud Run, Firestore & Cloud Services for AI Agents

Core Concepts

Foundational Google Cloud concepts for AI agent infrastructure.

Projects & Organization

GCP organizes resources into Projects — each with its own billing, APIs, and IAM. Projects belong to an Organization for enterprise governance. Use folders to group projects by team or environment (dev/staging/prod).

IAM & Service Accounts

Google Cloud IAM uses roles (not policies) bound to members. Use Service Accounts for agent workloads — never user credentials. Apply least-privilege with predefined roles like roles/aiplatform.user.

Serverless First

GCP excels at serverless. Cloud Run: Any container, auto-scales to zero, pay per request. Cloud Functions: Event-driven, lightweight triggers. Firestore: Serverless NoSQL. No servers to manage.

VPC & Private Services

Use VPC Service Controls to create security perimeters around sensitive AI data. Private Google Access lets Cloud Run and GKE call Vertex AI without internet transit. Serverless VPC Connectors bridge Cloud Functions to private networks.

Gemini & Vertex AI

Google's AI platform offers Gemini models (Flash, Pro) for reasoning and tool use. Vertex AI provides managed endpoints, model fine-tuning, model garden, and grounding with Google Search — the most integrated AI stack in any cloud.

Event-Driven Architecture

Pub/Sub: Global messaging with at-least-once delivery. Eventarc: Routes Cloud Events from 90+ sources to any target. Cloud Tasks: Managed task queues with retries. Perfect for agent orchestration.

Key Services for AI Agents

The essential Google Cloud services powering modern AI agent architectures.

Service	Category	Description	AI Agent Use Case
Vertex AI / Gemini	AI/ML	Managed LLMs (Gemini Flash, Pro, Ultra)	Agent reasoning, tool calling, RAG, grounding
Cloud Run	Compute	Serverless containers, auto-scale to zero	Agent APIs, long-running agents, webhooks
Cloud Functions	Compute	Event-driven serverless functions (Gen 2)	Agent tool execution, Pub/Sub triggers
GKE	Compute	Managed Kubernetes with Autopilot mode	Multi-agent clusters, GPU workloads
Firestore	Database	Serverless NoSQL with real-time sync	Agent state, sessions, real-time collaboration
Pub/Sub	Messaging	Global messaging, at-least-once delivery	Agent communication, event-driven triggers
Cloud Storage	Storage	Object storage with lifecycle management	Document storage, RAG knowledge bases, logs
Secret Manager	Security	Managed secrets with versioning & rotation	API keys, DB credentials, LLM tokens
Cloud Monitoring	Observability	Metrics, logs, traces, dashboards, alerts	Agent monitoring, cost alerts, error tracking
BigQuery	Analytics	Serverless data warehouse, petabyte scale	Agent analytics, log analysis, ML features
Workflows	Orchestration	Serverless workflow engine with YAML/JSON	Multi-step agent pipelines, retries, branching

Setup Guide

Get your Google Cloud development environment ready.

gcloud CLI (Required)

                        # Install gcloud SDK (macOS)

                        brew install google-cloud-sdk

                        # Initialize & authenticate

                        gcloud init

                        gcloud auth login

                        # Set project

                        gcloud config set project \

                          my-agent-project

                        # Enable key APIs

                        gcloud services enable \

                          aiplatform.googleapis.com \

                          run.googleapis.com \

                          firestore.googleapis.com

                        # Verify

                        gcloud auth list

Python SDK (google-cloud)

                        # Install Vertex AI SDK

                        pip install google-cloud-aiplatform

                        # Install other SDKs

                        pip install google-cloud-firestore

                        pip install google-cloud-pubsub

                        pip install google-cloud-storage

                        # Application Default Credentials

                        gcloud auth application-default \

                          login

                        # Quick test

                        python3 -c "

                          import google.auth

                          creds, proj = google.auth.default()

                          print(f'Project: {proj}')

                        "

Service Account Setup

                        # Create service account

                        gcloud iam service-accounts create \

                          ai-agent-sa \

                          --display-name="AI Agent"

                        # Grant Vertex AI access

                        gcloud projects add-iam-policy-binding \

                          $PROJECT_ID \

                          --member="serviceAccount:\

                          ai-agent-sa@$PROJECT_ID\

                          .iam.gserviceaccount.com" \

                          --role="roles/aiplatform.user"

                        # Use Workload Identity (GKE)

                        # Never export JSON keys!

Usage Examples

Practical patterns for AI agent infrastructure on Google Cloud.

Vertex AI — Gemini Inference

                        # Invoke Gemini via Vertex AI

                        import vertexai

                        from vertexai.generative_models import \

                          GenerativeModel, Tool

                        vertexai.init(

                          project="my-agent-project",

                          location="us-central1"

                        )

                        model = GenerativeModel(

                          "gemini-2.5-flash"

                        )

                        response = model.generate_content(

                          "Plan an architecture for a"

                          " multi-agent research system"

                        )

                        print(response.text)

Firestore — Agent State

                        # Store and retrieve agent state

                        from google.cloud import firestore

                        from datetime import datetime

                        db = firestore.Client()

                        # Save agent session

                        db.collection("sessions")

                          .document("sess_abc123")

                          .set({

                            "agent_id": "research-agent",

                            "state": "reasoning",

                            "messages": [...],

                            "updated": datetime.now()

                          })

                        # Real-time listener

                        def on_snapshot(docs, changes, ts):

                          for doc in docs:

                            print(doc.to_dict())

Cloud Run — Agent API

                        # Dockerfile for agent service

                        FROM python:3.12-slim

                        WORKDIR /app

                        COPY . .

                        RUN pip install -r requirements.txt

                        CMD ["uvicorn", "main:app",

                          "--host", "0.0.0.0",

                          "--port", "8080"]

                        # Deploy to Cloud Run

                        gcloud run deploy ai-agent \

                          --source . \

                          --region us-central1 \

                          --allow-unauthenticated \

                          --memory 1Gi \

                          --timeout 300

Pub/Sub — Agent Messaging

                        # Publish tasks for agents

                        from google.cloud import pubsub_v1

                        import json

                        publisher = pubsub_v1.PublisherClient()

                        topic = publisher.topic_path(

                          "my-project", "agent-tasks"

                        )

                        # Send task

                        publisher.publish(topic,

                          json.dumps({

                            "task": "analyze_document",

                            "gcs_uri": "gs://docs/report.pdf",

                            "priority": "high"

                          }).encode("utf-8")

                        )

                        # Worker pulls via subscription

                        # or push to Cloud Run endpoint

Best Practices

Production guidelines for GCP-based AI agent systems.

🔐 Security

• Use Service Accounts with Workload Identity, never JSON keys
• Store secrets in Secret Manager with versioning
• Enable Cloud Audit Logs for all API activity
• Use VPC Service Controls for Vertex AI data isolation
• Apply Organization Policies to restrict resource creation

💰 Cost Optimization

• Set Budget Alerts with Pub/Sub for auto-disable
• Use Cloud Run min-instances=0 to scale to zero
• Choose Gemini Flash for high-volume, low-complexity tasks
• Enable Firestore TTL to auto-expire old sessions
• Use Committed Use Discounts for predictable GKE workloads

📊 Observability

• Use Cloud Monitoring dashboards for Cloud Run & Vertex AI
• Enable Cloud Trace for distributed tracing across services
• Set alerts on Vertex AI quota usage and error rates
• Log agent decisions with structured logging to Cloud Logging
• Export metrics to BigQuery for long-term agent analytics

Frequently Asked Questions

What's the difference between Vertex AI and the Gemini API?▶

Gemini API (via AI Studio) is a simple REST API for prototyping — API key auth, limited enterprise features. Vertex AI is the full enterprise platform with IAM auth, VPC controls, fine-tuning, model evaluation, and managed endpoints. For production AI agents, use Vertex AI.

Should I use Cloud Run or Cloud Functions for my agent?▶

Cloud Run for agent APIs, long-running processes (up to 60 min), WebSocket connections, and custom containers. Cloud Functions for lightweight event-driven triggers (Pub/Sub, Firestore, Storage). Cloud Functions Gen 2 actually runs on Cloud Run under the hood.

How do I keep costs under control with Vertex AI?▶

Use Gemini Flash for high-volume tasks (10x cheaper than Pro). Set Budget Alerts with Pub/Sub triggers to auto-disable billing. Enable context caching for repeated system prompts. Use batch prediction for non-real-time workloads. Track token usage per request in Cloud Monitoring.

Firestore or Cloud SQL for agent memory?▶

Firestore for agent sessions, real-time state sync, and document-based memory — serverless, auto-scales, real-time listeners. Cloud SQL (PostgreSQL) for structured data, complex queries, and vector search with pgvector. Many agents use both: Firestore for hot state, Cloud SQL for analytical queries.

How do I deploy a multi-agent system on GCP?▶

Use Workflows for orchestrating multi-step agent pipelines with built-in retries and error handling. Each agent runs as a Cloud Run service. Use Pub/Sub for async communication, Firestore for shared state, and Eventarc for event-driven triggers. For complex systems, consider GKE Autopilot with the Agent Development Kit (ADK).

Which GCP region should I use for AI agents?▶

us-central1 (Iowa) has the broadest Vertex AI model availability and is Google's primary AI region. us-east1 and europe-west1 are good alternatives. Always check the Vertex AI regional availability page. For Firebase-based agents, deploy Functions in the same region as your Firestore database.

How do I set up a RAG pipeline on GCP?▶

Use Vertex AI RAG Engine — it handles document ingestion from Cloud Storage, automatic chunking, embedding with Gecko/Gemini embeddings, and vector storage. For custom pipelines: store documents in Cloud Storage, embed with text-embedding-005, store in AlloyDB with pgvector or Vector Search, and query via Vertex AI's grounding API.

What is Grounding and how does it work with agents?▶

Grounding connects Gemini to external data sources at inference time. Google Search grounding lets agents cite real-time web results. Vertex AI Search grounding connects to your own document stores. This reduces hallucinations and gives agents access to current information without maintaining a RAG pipeline.

GCP for AI Agents