Vertex AI Model Deployment IAM Permissions

Exhibit

Refer to the exhibit.

{
  "bindings": [
    {
      "role": "roles/aiplatform.user",
      "members": [
        "user:alice@example.com",
        "serviceAccount:sa-training@my-project.iam.gserviceaccount.com"
      ]
    }
  ]
}

This IAM policy is attached to a Vertex AI model resource. Alice can view the model but cannot deploy it to an endpoint. The service account can use the model for training.

Refer to the exhibit. An ML engineer in the team needs to deploy the model to an endpoint. The engineer is assigned the 'roles/aiplatform.user' role at the project level but still cannot deploy. What is the most likely reason?

Quick Answer

The answer is that the model’s resource-level IAM policy only grants the `roles/aiplatform.user` role, which lacks the `aiplatform.models.deploy` permission required for deployment. While the `roles/aiplatform.user` role at the project level allows using Vertex AI resources like viewing models or endpoints, it does not authorize the act of deploying a model to an endpoint—that action is governed by the model’s own resource-level IAM policy. On the Google Professional Machine Learning Engineer exam, this scenario tests your understanding that IAM permissions in Vertex AI are hierarchical: project-level roles grant broad access, but resource-level policies can override or restrict specific actions like deployment. A common trap is assuming the project-level `aiplatform.user` role is sufficient for all operations, when in fact deployment requires `roles/aiplatform.admin` or a custom role with the deploy permission. Memory tip: “User can view, Admin can deploy”—project-level User lets you see resources, but only resource-level Admin or a custom role with deploy can push a model live.

⚠ Common exam trap

Google Cloud often tests the distinction between project-level and resource-level IAM policies, where candidates assume that a project-level role automatically grants all permissions on child resources, ignoring that resource-level policies can be more restrictive.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The model's resource-level IAM policy only grants the 'roles/aiplatform.user' role, which does not include deploy permission.

The 'roles/aiplatform.user' role at the project level grants permissions to use AI Platform resources, but it does not include the 'aiplatform.models.deploy' permission required to deploy a model to an endpoint. Model deployment is controlled by resource-level IAM policies, and if the model's resource-level policy only grants 'roles/aiplatform.user', the deploy action is denied. The correct role for deployment is 'roles/aiplatform.admin' or a custom role with the deploy permission.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The service account 'sa-training' is using all the model's quota.
Why it's wrong here
Quota is not the issue; permissions are.
✗
Alice does not have any IAM role on the project.
Why it's wrong here
She has roles/aiplatform.user at project level, but the resource policy may be more restrictive.
✗
Alice needs to be granted the 'roles/aiplatform.admin' role at the project level.
Why it's wrong here
Even with project-level admin, the resource policy still denies deploy if not granted on the resource.
✓
The model's resource-level IAM policy only grants the 'roles/aiplatform.user' role, which does not include deploy permission.
Why this is correct
The resource policy overrides project-level roles and lacks deploy.

Go deeper

1 more way this is tested on PMLE

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. A team uses Vertex AI Pipelines. They need to ensure that only certain team members can deploy models to production. What is the best approach?

medium

A.Use Vertex AI Experiments to track models
B.Store model artifacts in a bucket with bucket-level permissions
✓ C.Use IAM roles with custom permissions on the Vertex AI Model Registry
D.Create separate projects for dev and prod

Why C: Vertex AI Model Registry supports IAM roles with custom permissions, allowing fine-grained access control over who can promote or deploy models to production. By assigning specific roles (e.g., `roles/aiplatform.modelDeployer`) to only authorized team members, you can restrict deployment actions while still permitting others to view or register models. This approach directly addresses the need to control production deployments without affecting other pipeline stages.

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This PMLE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PMLE exam.

Vertex AI Model Deployment IAM Permissions

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question

1 more way this is tested on PMLE