Claude on Vertex AI: Architecture and Model Access
Google Cloud Vertex AI Model Garden is the managed platform for accessing Claude within the GCP ecosystem. For enterprises already running workloads on GCP, Vertex AI provides the same operational benefits as AWS Bedrock for AWS shops: unified billing through GCP Cloud Billing, identity management through Google Cloud IAM, network isolation through VPC Service Controls, and observability through Cloud Logging and Cloud Monitoring.
Claude models available through Vertex AI include Claude Opus 4.6, Sonnet 4.6, and Haiku 4.5. Access is provisioned through the Model Garden marketplace — you select the model, accept terms of service, and gain access to the endpoint in your project. This is distinct from the Anthropic direct API, which requires a separate Anthropic account and API key. With Vertex AI, authentication uses GCP service accounts and Application Default Credentials (ADC), fitting directly into your existing GCP security infrastructure.
If you need architecture review or deployment support for Claude on Vertex AI, our Claude API integration service handles GCP deployments with the same methodology we apply across AWS and Azure.
Model Garden Setup and Project Configuration
Enabling Claude through Vertex AI Model Garden requires a few project-level configuration steps that must be completed before any code is written. First, ensure the Vertex AI API is enabled in your GCP project. Navigate to Model Garden in the Cloud Console, locate the Claude models, and click "Enable Access" — this initiates the terms of service acceptance workflow with Anthropic.
Regional Availability
Claude availability on Vertex AI is region-specific. Models are available in us-east5 (Columbus) and europe-west1 (Belgium) at time of writing, with additional regions being added. Verify current availability in the Vertex AI documentation before committing to a deployment architecture, and consider data residency requirements for regulated data when selecting a region.
Important for regulated industries: VPC Service Controls can restrict Vertex AI API calls to traffic originating within a specific VPC Service Control perimeter. Configure your perimeter to include the Vertex AI API and your application's project before going to production with sensitive data workloads.
SDK Setup for Python
Vertex AI's Python SDK provides the cleanest integration path for production applications:
from anthropic import AnthropicVertex
client = AnthropicVertex(
project_id="your-gcp-project-id",
region="us-east5"
)
message = client.messages.create(
model="claude-sonnet-4-6@20261001",
max_tokens=4096,
system="You are an enterprise assistant...",
messages=[
{"role": "user", "content": "Summarise this contract excerpt..."}
]
)
print(message.content[0].text)Authentication is handled via Application Default Credentials — the SDK automatically uses the service account associated with the running environment (Cloud Run, GKE workload identity, Compute Engine service account) without needing to manage API keys explicitly.
IAM Configuration and Least-Privilege Access
Service accounts invoking Claude through Vertex AI need the roles/aiplatform.user role at minimum. This grants permission to invoke models in Model Garden. Do not grant roles/aiplatform.admin to application service accounts — this grants unnecessary permissions to modify model deployments and endpoints.
Workload Identity for GKE
For applications running on Google Kubernetes Engine, use Workload Identity Federation to bind Kubernetes service accounts to GCP service accounts. This eliminates the need for service account key files entirely — the GKE pod assumes the GCP service account identity automatically through the metadata server, and credentials are rotated automatically by GCP.
# Bind KSA to GSA with Workload Identity
gcloud iam service-accounts add-iam-policy-binding \
claude-app@your-project.iam.gserviceaccount.com \
--role="roles/iam.workloadIdentityUser" \
--member="serviceAccount:your-project.svc.id.goog[your-namespace/your-ksa]"Project-Level vs Organisation-Level Governance
For enterprises with multiple GCP projects accessing Claude, consider managing Model Garden access at the organisation or folder level through Organisation Policy constraints. You can restrict which projects can enable Vertex AI AI APIs and which service accounts can access Claude, providing centralised governance across business units without per-project configuration overhead.
VPC Service Controls for Data Perimeter Security
VPC Service Controls create a security perimeter around your GCP resources that prevents data exfiltration to external networks — even from authenticated, authorised requests. For Claude deployments processing sensitive data, VPC Service Controls should be configured to include the Vertex AI API within your perimeter.
A VPC Service Control perimeter that includes aiplatform.googleapis.com means that even if an attacker compromises a service account credential, they cannot invoke the Vertex AI API from outside the perimeter (e.g., from their own laptop or a different GCP project). All API calls must originate from within the perimeter — your organisation's VPC or approved access levels.
Access Policies for Developer Access
Developers who need to test Claude through the Cloud Console or from their local machines need an Access Level configured in your VPC Service Control policy — typically a combination of a corporate IP range and a device certificate requirement. Define these access levels before enforcing the perimeter in production to avoid locking out legitimate users.
Vertex AI Pipelines for Batch Processing
For batch document processing, research summarisation, or any workload that processes large volumes at scheduled intervals, Vertex AI Pipelines provides a managed orchestration environment that integrates naturally with Claude on Vertex AI. You define pipeline components as containerised steps, configure the pipeline DAG, and let Vertex AI handle job scheduling, retry logic, and output storage.
A typical enterprise Claude batch pipeline on Vertex AI runs: document retrieval from Cloud Storage → chunking and preprocessing → Claude inference via Vertex AI → output storage back to Cloud Storage → BigQuery for analytics. Every step is logged to Cloud Logging, costs are tracked per pipeline run, and retry behaviour is configurable per step.
This architecture is significantly cleaner than running batch jobs on VMs or Cloud Run — Vertex AI Pipelines handles the orchestration, and you benefit from native cost tracking and monitoring without building custom infrastructure. Our AI agent development team designs Vertex AI pipeline architectures for enterprise clients across financial services and legal.
GCP Architecture Review for Claude Deployments
Our certified team reviews your Vertex AI Claude architecture for IAM gaps, VPC Service Control configuration, cost optimisation, and compliance readiness. Most reviews take two hours and surface actionable improvements.
Book an Architecture Review →Cloud Logging and Monitoring for Compliance
Vertex AI API calls are automatically logged to Cloud Audit Logs — Admin Activity and Data Access logs capture every invocation with the caller identity, project, timestamp, and request metadata. For organisations with AI governance requirements, these logs satisfy the audit trail requirement without any additional instrumentation.
Export audit logs to Cloud Storage for long-term retention (typically 7 years for regulated industries) using a log sink. Route logs to BigQuery for analysis — you can query which service accounts invoked Claude most frequently, which models were used, and aggregate costs by team or project using BigQuery's analytical capabilities.
Custom Metrics and Alerting
Create custom Cloud Monitoring metrics for: Claude inference latency per application, token costs per business unit (using resource tags), and error rate per endpoint. Set alerting policies to notify on-call teams when latency exceeds SLA thresholds or error rates spike — this is the production operations foundation for any enterprise Claude deployment.
Cost Governance and Budget Controls
Google Cloud Billing provides several mechanisms for governing Claude inference costs. Label all Vertex AI resources with cost allocation labels that map to department and application. This allows you to generate cost reports broken down by team in the Cloud Billing export in BigQuery.
Set budget alerts through Google Cloud Budgets for Vertex AI spending per project. For development and test projects, configure a budget with 80% and 100% alert thresholds — and consider configuring a budget action that disables billing for the project if the budget is exceeded, preventing runaway costs in non-production environments. For production, alert-only policies are more appropriate than hard cuts.
Compare cost patterns between Claude on Vertex AI and direct Anthropic API as your volume grows. At very high volume, Vertex AI committed use discounts and Google's enterprise pricing may provide cost advantages over on-demand API pricing. Our Claude strategy team models cost scenarios for clients making infrastructure commitment decisions.
Vertex AI vs AWS Bedrock vs Azure: Which for Your Organisation
The right platform is determined almost entirely by where your other workloads run. GCP-native organisations with data already in BigQuery, pipelines running on Dataflow, and teams using GKE should use Vertex AI — the integration overhead is minimal and the operational tooling is already familiar. AWS-native organisations should use AWS Bedrock. Azure-first organisations, especially those using M365 and Azure OpenAI infrastructure, should evaluate Claude on Azure.
Multi-cloud organisations building Claude applications that need to run across environments should consider the direct Anthropic API as the abstraction layer — it provides consistent access to the latest Claude models regardless of which cloud your application runs on, with a single authentication mechanism. Our Claude consulting team designs multi-cloud architectures that abstract the provider layer cleanly.