AI Security

Zero‑Trust Document Protection for AI Summarization with Google Vertex AI and Cloud Storage

Published 2026-08-24 by AISecAll Editorial

TL;DR: Store raw documents in a locked Cloud Storage bucket, encrypt them with Customer‑Managed Encryption Keys (CMEK), grant Vertex AI read‑only access via a short‑lived service account, process summaries in a private VPC, and log every read/write with Cloud Audit Logs. Rotate keys weekly and delete temporary files automatically.

What are the main attack surfaces in an AI‑driven summarization pipeline?

When you feed customer files to a large language model, three vectors can expose sensitive data:

• Data at rest: Unencrypted files stored in a bucket can be read by any service with storage permissions.
• Data in transit: Plain‑text uploads to Vertex AI or downstream services can be intercepted.
• Processing leakage: The model may retain excerpts in its cache, or a mis‑configured service account could allow the model to write to an uncontrolled location.

Zero‑trust means you assume every component could be compromised and enforce the least privilege, encryption, and continuous monitoring.

How to set up a zero‑trust storage layer with Google Cloud Storage

1. Create a dedicated bucket for raw documents, e.g., gs://my‑biz‑raw‑docs. Set the bucket policy to private and disable Uniform bucket-level access only if you need fine‑grained object ACLs.

2. Enable Customer‑Managed Encryption Keys (CMEK) using Cloud KMS. Generate a key ring and a symmetric key, then bind the bucket to the key:

gsutil kms encryption -k projects/PROJECT_ID/locations/global/keyRings/my‑ring/cryptoKeys/my‑key gs://my‑biz‑raw‑docs

3. Restrict access with IAM. Grant a short‑lived service account (created in step 4) the role roles/storage.objectViewer on the bucket. Do NOT grant roles/storage.objectAdmin to the Vertex AI service account.

How to provision a least‑privilege Vertex AI service account

Vertex AI runs under a Google-managed service account by default. For zero‑trust you should create a custom service account that only has the permissions you explicitly need:

1. Run gcloud iam service-accounts create vertex‑summarizer --display-name "Vertex Summarizer".
2. Assign the role roles/aiplatform.user (allows model invocation) and roles/iam.serviceAccountTokenCreator (enables short‑lived token generation).
3. Bind the bucket viewer role from the previous section to this service account.

When you start a summarization job, generate an OAuth 2.0 access token that expires in 15 minutes and pass it to the Vertex AI endpoint. This limits the window an attacker could misuse the token.

How to keep processing isolated in a private VPC

Vertex AI can be configured to run in a private endpoint that lives inside a VPC. This prevents the model from reaching the public internet and stops data exfiltration.

• Create a VPC with a subnet dedicated to AI workloads.
• Enable Vertex AI private endpoints and attach the subnet.
• Deploy the summarization model (e.g., PaLM‑2) in this private network. All traffic between Cloud Storage and Vertex AI stays on Google’s internal backbone.

Combine this with VPC Service Controls to define a security perimeter that includes the bucket and the Vertex AI project.

How to audit every document access and enforce retention

Google Cloud Audit Logs automatically record READ and WRITE events for Cloud Storage and Vertex AI. Configure a sink to export logs to BigQuery for analysis:

gcloud logging sinks create vertex‑audit-sink bigquery.googleapis.com/projects/PROJECT_ID/datasets/audit_logs --log-filter="resource.type=("gcs_bucket" OR "aiplatform_endpoint")"

Set up a scheduled query that flags any read event without a matching short‑lived token, and alert the security team via Cloud Monitoring.

After a summarization job finishes, delete the temporary copy of the source file (if you made one) and the generated summary after a configurable retention period (e.g., 30 days). Use Object Lifecycle Management rules to automate deletion.

What operational practices keep the pipeline secure over time?

• Rotate CMEK keys weekly and re‑encrypt existing objects using gcloud kms keys rotate.

• Rotate service‑account keys every 30 days; store them in Secret Manager with versioning.

• Run a quarterly penetration test focused on the VPC perimeter and token‑reuse scenarios.

• Document the data‑flow diagram and store it in a version‑controlled repository. AISecAll can help you formalize this documentation and run regular compliance checks.

FAQ

• Can I use a pre‑built Vertex AI model for summarization? Yes. Choose a model that supports the text‑summarization task, but always invoke it with a short‑lived token tied to the least‑privilege service account.
• Do I need to encrypt the summary output? Treat the summary as sensitive data. Store it in a separate bucket encrypted with a different CMEK and grant read access only to the downstream application.
• What if a user uploads a malicious PDF? Enable Cloud Functions to scan uploads with Google Cloud Security Scanner before they reach the bucket. Reject files that contain executable payloads.
• How do I prove compliance to auditors? Export the audit‑log sink to BigQuery, then generate a report that shows every document ID, the service account used, and the timestamp of each read/write operation.
• Is this approach affordable for a solo founder? Using CMEK and VPC Service Controls adds modest cost (KMS usage and VPC egress). For low‑volume workloads the monthly bill stays under $50.