Hi @kkaspszak,
Welcome to Google Cloud Community!
This is an important security concern, and it’s great that you're addressing it before going into production. You’re right to be cautious about a situation where your Document AI models are run with a Google service account that has excessive privileges. This is a valid concern that needs to be clarified, as it could pose a major security risk and violate the principle of least privilege.
Document AI is designed to use the credentials of the caller who initiated the document processing, which should be an end user or a service account specifically for your application.
Here’s a breakdown of possible approaches to ensure you’re not operating with excessive privileges:
Specific Identity Configuration:
- Check Service Account: Ensure you are using a service account (or user) for Document AI API calls in your application that has the least privilege necessary.
Monitor Permissions:
- IAM Roles: Thoroughly review the IAM roles granted to the service accounts and users you are using. You can also refer to the best practices when using IAM.
Test:
- Controlled Environments: Create a new service account with minimal permissions and verify if you can process a document using only this account. Set up isolated testing environments to ensure that only the least privilege is being used.
Contact Support:
- Clarification: If you're still unsure, contact Google Cloud Support for clarification and assistance with configuration. Provide details about your setup and any findings from your security review.
Was this helpful? If so, please accept this answer as “Solution”. If you need additional assistance, reply here within 2 business days and I’ll be happy to help.
LinkedIn
Twitter
