AI GCP Model Armor configuration
Configuration for enforcing content safety policies on LLM requests and responses using GCP Model Armor.
Environment variables
-
GCP_SERVICE_ACCOUNT_JSON: GCP service account credentials in JSON format -
GCP_PROJECT_ID: GCP project identifier -
GCP_LOCATION_ID: GCP location identifier -
GCP_TEMPLATE_ID: Guardrail template identifier
ai_gateway_policies:
- ref: configure-gcp-model-armor
ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
name: configure-gcp-model-armor
display_name: AI GCP Model Armor configuration
type: ai-gcp-model-armor
enabled: true
config:
project_id: !env GCP_PROJECT_ID
location_id: !env GCP_LOCATION_ID
template_id: !env GCP_TEMPLATE_ID
guarding_mode: BOTH
gcp_use_service_account: true
gcp_service_account_json: !env GCP_SERVICE_ACCOUNT_JSON
reveal_failure_categories: true
request_failure_message: Your request was blocked by content policies.
response_failure_message: The model's response was filtered for safety.
timeout: 15000
response_buffer_size: 4096
text_source: last_message
global: falseMake sure to replace the following placeholders with your own values:
-
AI_GATEWAY_ID: Theidof your AI Gateway. -
!env GCP_SERVICE_ACCOUNT_JSON: GCP service account credentials in JSON format -
!env GCP_PROJECT_ID: GCP project identifier -
!env GCP_LOCATION_ID: GCP location identifier -
!env GCP_TEMPLATE_ID: Guardrail template identifier
curl -X POST https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/policies \
--header "accept: application/json" \
--header "Content-Type: application/json" \
--header "Authorization: Bearer $KONNECT_TOKEN" \
--data '
{
"name": "configure-gcp-model-armor",
"display_name": "AI GCP Model Armor configuration",
"type": "ai-gcp-model-armor",
"enabled": true,
"config": {
"project_id": "'$GCP_PROJECT_ID'",
"location_id": "'$GCP_LOCATION_ID'",
"template_id": "'$GCP_TEMPLATE_ID'",
"guarding_mode": "BOTH",
"gcp_use_service_account": true,
"gcp_service_account_json": "'$GCP_SERVICE_ACCOUNT_JSON'",
"reveal_failure_categories": true,
"request_failure_message": "Your request was blocked by content policies.",
"response_failure_message": "The model's response was filtered for safety.",
"timeout": 15000,
"response_buffer_size": 4096,
"text_source": "last_message"
},
"global": false
}
'Make sure to replace the following placeholders with your own values:
-
region: Geographic region where your Kong Konnect is hosted and operates. -
KONNECT_TOKEN: Your Personal Access Token (PAT) associated with your Konnect account. -
AIGatewayId: Theidof the AI Gateway.
See the Konnect AI Gateway API reference to learn about region-specific URLs and personal access tokens.
Prerequisite: Configure your Personal Access Token
terraform {
required_providers {
konnect = {
source = "kong/konnect"
}
}
}
provider "konnect" {
personal_access_token = "$KONNECT_TOKEN"
server_url = "https://us.api.konghq.com/"
}Add the following to your Terraform configuration:
resource "konnect_ai_gateway_policy" "my_policy" {
name = "configure-gcp-model-armor"
display_name = "AI GCP Model Armor configuration"
type = "ai-gcp-model-armor"
enabled = true
global = false
config = jsonencode({
project_id = var.gcp_project_id
location_id = var.gcp_location_id
template_id = var.gcp_template_id
guarding_mode = "BOTH"
gcp_use_service_account = true
gcp_service_account_json = var.gcp_service_account_json
reveal_failure_categories = true
request_failure_message = "Your request was blocked by content policies."
response_failure_message = "The model's response was filtered for safety."
timeout = 15000
response_buffer_size = 4096
text_source = "last_message"
})
gateway_id = konnect_ai_gateway.my_ai_gateway.id
}This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.
variable "gcp_service_account_json" {
type = string
}
variable "gcp_project_id" {
type = string
}
variable "gcp_location_id" {
type = string
}
variable "gcp_template_id" {
type = string
}ai_gateway_policies:
- ref: configure-gcp-model-armor
ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
name: configure-gcp-model-armor
display_name: AI GCP Model Armor configuration
type: ai-gcp-model-armor
enabled: true
config:
project_id: !env GCP_PROJECT_ID
location_id: !env GCP_LOCATION_ID
template_id: !env GCP_TEMPLATE_ID
guarding_mode: BOTH
gcp_use_service_account: true
gcp_service_account_json: !env GCP_SERVICE_ACCOUNT_JSON
reveal_failure_categories: true
request_failure_message: Your request was blocked by content policies.
response_failure_message: The model's response was filtered for safety.
timeout: 15000
response_buffer_size: 4096
text_source: last_message
global: falseMake sure to replace the following placeholders with your own values:
-
AI_GATEWAY_ID: Theidof your AI Gateway. -
!env GCP_SERVICE_ACCOUNT_JSON: GCP service account credentials in JSON format -
!env GCP_PROJECT_ID: GCP project identifier -
!env GCP_LOCATION_ID: GCP location identifier -
!env GCP_TEMPLATE_ID: Guardrail template identifier
curl -X POST https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/policies \
--header "accept: application/json" \
--header "Content-Type: application/json" \
--header "Authorization: Bearer $KONNECT_TOKEN" \
--data '
{
"name": "configure-gcp-model-armor",
"display_name": "AI GCP Model Armor configuration",
"type": "ai-gcp-model-armor",
"enabled": true,
"config": {
"project_id": "'$GCP_PROJECT_ID'",
"location_id": "'$GCP_LOCATION_ID'",
"template_id": "'$GCP_TEMPLATE_ID'",
"guarding_mode": "BOTH",
"gcp_use_service_account": true,
"gcp_service_account_json": "'$GCP_SERVICE_ACCOUNT_JSON'",
"reveal_failure_categories": true,
"request_failure_message": "Your request was blocked by content policies.",
"response_failure_message": "The model's response was filtered for safety.",
"timeout": 15000,
"response_buffer_size": 4096,
"text_source": "last_message"
},
"global": false
}
'Make sure to replace the following placeholders with your own values:
-
region: Geographic region where your Kong Konnect is hosted and operates. -
KONNECT_TOKEN: Your Personal Access Token (PAT) associated with your Konnect account. -
AIGatewayId: Theidof the AI Gateway.
See the Konnect AI Gateway API reference to learn about region-specific URLs and personal access tokens.
Prerequisite: Configure your Personal Access Token
terraform {
required_providers {
konnect = {
source = "kong/konnect"
}
}
}
provider "konnect" {
personal_access_token = "$KONNECT_TOKEN"
server_url = "https://us.api.konghq.com/"
}Add the following to your Terraform configuration:
resource "konnect_ai_gateway_policy" "my_policy" {
name = "configure-gcp-model-armor"
display_name = "AI GCP Model Armor configuration"
type = "ai-gcp-model-armor"
enabled = true
global = false
config = jsonencode({
project_id = var.gcp_project_id
location_id = var.gcp_location_id
template_id = var.gcp_template_id
guarding_mode = "BOTH"
gcp_use_service_account = true
gcp_service_account_json = var.gcp_service_account_json
reveal_failure_categories = true
request_failure_message = "Your request was blocked by content policies."
response_failure_message = "The model's response was filtered for safety."
timeout = 15000
response_buffer_size = 4096
text_source = "last_message"
})
gateway_id = konnect_ai_gateway.my_ai_gateway.id
}This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.
variable "gcp_service_account_json" {
type = string
}
variable "gcp_project_id" {
type = string
}
variable "gcp_location_id" {
type = string
}
variable "gcp_template_id" {
type = string
}ai_gateway_policies:
- ref: configure-gcp-model-armor
ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
name: configure-gcp-model-armor
display_name: AI GCP Model Armor configuration
type: ai-gcp-model-armor
enabled: true
config:
project_id: !env GCP_PROJECT_ID
location_id: !env GCP_LOCATION_ID
template_id: !env GCP_TEMPLATE_ID
guarding_mode: BOTH
gcp_use_service_account: true
gcp_service_account_json: !env GCP_SERVICE_ACCOUNT_JSON
reveal_failure_categories: true
request_failure_message: Your request was blocked by content policies.
response_failure_message: The model's response was filtered for safety.
timeout: 15000
response_buffer_size: 4096
text_source: last_message
global: falseMake sure to replace the following placeholders with your own values:
-
AI_GATEWAY_ID: Theidof your AI Gateway. -
!env GCP_SERVICE_ACCOUNT_JSON: GCP service account credentials in JSON format -
!env GCP_PROJECT_ID: GCP project identifier -
!env GCP_LOCATION_ID: GCP location identifier -
!env GCP_TEMPLATE_ID: Guardrail template identifier
curl -X POST https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/policies \
--header "accept: application/json" \
--header "Content-Type: application/json" \
--header "Authorization: Bearer $KONNECT_TOKEN" \
--data '
{
"name": "configure-gcp-model-armor",
"display_name": "AI GCP Model Armor configuration",
"type": "ai-gcp-model-armor",
"enabled": true,
"config": {
"project_id": "'$GCP_PROJECT_ID'",
"location_id": "'$GCP_LOCATION_ID'",
"template_id": "'$GCP_TEMPLATE_ID'",
"guarding_mode": "BOTH",
"gcp_use_service_account": true,
"gcp_service_account_json": "'$GCP_SERVICE_ACCOUNT_JSON'",
"reveal_failure_categories": true,
"request_failure_message": "Your request was blocked by content policies.",
"response_failure_message": "The model's response was filtered for safety.",
"timeout": 15000,
"response_buffer_size": 4096,
"text_source": "last_message"
},
"global": false
}
'Make sure to replace the following placeholders with your own values:
-
region: Geographic region where your Kong Konnect is hosted and operates. -
KONNECT_TOKEN: Your Personal Access Token (PAT) associated with your Konnect account. -
AIGatewayId: Theidof the AI Gateway.
See the Konnect AI Gateway API reference to learn about region-specific URLs and personal access tokens.
Prerequisite: Configure your Personal Access Token
terraform {
required_providers {
konnect = {
source = "kong/konnect"
}
}
}
provider "konnect" {
personal_access_token = "$KONNECT_TOKEN"
server_url = "https://us.api.konghq.com/"
}Add the following to your Terraform configuration:
resource "konnect_ai_gateway_policy" "my_policy" {
name = "configure-gcp-model-armor"
display_name = "AI GCP Model Armor configuration"
type = "ai-gcp-model-armor"
enabled = true
global = false
config = jsonencode({
project_id = var.gcp_project_id
location_id = var.gcp_location_id
template_id = var.gcp_template_id
guarding_mode = "BOTH"
gcp_use_service_account = true
gcp_service_account_json = var.gcp_service_account_json
reveal_failure_categories = true
request_failure_message = "Your request was blocked by content policies."
response_failure_message = "The model's response was filtered for safety."
timeout = 15000
response_buffer_size = 4096
text_source = "last_message"
})
gateway_id = konnect_ai_gateway.my_ai_gateway.id
}This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.
variable "gcp_service_account_json" {
type = string
}
variable "gcp_project_id" {
type = string
}
variable "gcp_location_id" {
type = string
}
variable "gcp_template_id" {
type = string
}ai_gateway_policies:
- ref: configure-gcp-model-armor
ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
name: configure-gcp-model-armor
display_name: AI GCP Model Armor configuration
type: ai-gcp-model-armor
enabled: true
config:
project_id: !env GCP_PROJECT_ID
location_id: !env GCP_LOCATION_ID
template_id: !env GCP_TEMPLATE_ID
guarding_mode: BOTH
gcp_use_service_account: true
gcp_service_account_json: !env GCP_SERVICE_ACCOUNT_JSON
reveal_failure_categories: true
request_failure_message: Your request was blocked by content policies.
response_failure_message: The model's response was filtered for safety.
timeout: 15000
response_buffer_size: 4096
text_source: last_message
global: trueMake sure to replace the following placeholders with your own values:
-
AI_GATEWAY_ID: Theidof your AI Gateway. -
!env GCP_SERVICE_ACCOUNT_JSON: GCP service account credentials in JSON format -
!env GCP_PROJECT_ID: GCP project identifier -
!env GCP_LOCATION_ID: GCP location identifier -
!env GCP_TEMPLATE_ID: Guardrail template identifier
curl -X POST https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/policies \
--header "accept: application/json" \
--header "Content-Type: application/json" \
--header "Authorization: Bearer $KONNECT_TOKEN" \
--data '
{
"name": "configure-gcp-model-armor",
"display_name": "AI GCP Model Armor configuration",
"type": "ai-gcp-model-armor",
"enabled": true,
"config": {
"project_id": "'$GCP_PROJECT_ID'",
"location_id": "'$GCP_LOCATION_ID'",
"template_id": "'$GCP_TEMPLATE_ID'",
"guarding_mode": "BOTH",
"gcp_use_service_account": true,
"gcp_service_account_json": "'$GCP_SERVICE_ACCOUNT_JSON'",
"reveal_failure_categories": true,
"request_failure_message": "Your request was blocked by content policies.",
"response_failure_message": "The model's response was filtered for safety.",
"timeout": 15000,
"response_buffer_size": 4096,
"text_source": "last_message"
},
"global": true
}
'Make sure to replace the following placeholders with your own values:
-
region: Geographic region where your Kong Konnect is hosted and operates. -
KONNECT_TOKEN: Your Personal Access Token (PAT) associated with your Konnect account. -
AIGatewayId: Theidof the AI Gateway.
See the Konnect AI Gateway API reference to learn about region-specific URLs and personal access tokens.
Prerequisite: Configure your Personal Access Token
terraform {
required_providers {
konnect = {
source = "kong/konnect"
}
}
}
provider "konnect" {
personal_access_token = "$KONNECT_TOKEN"
server_url = "https://us.api.konghq.com/"
}Add the following to your Terraform configuration:
resource "konnect_ai_gateway_policy" "my_policy" {
name = "configure-gcp-model-armor"
display_name = "AI GCP Model Armor configuration"
type = "ai-gcp-model-armor"
enabled = true
global = true
config = jsonencode({
project_id = var.gcp_project_id
location_id = var.gcp_location_id
template_id = var.gcp_template_id
guarding_mode = "BOTH"
gcp_use_service_account = true
gcp_service_account_json = var.gcp_service_account_json
reveal_failure_categories = true
request_failure_message = "Your request was blocked by content policies."
response_failure_message = "The model's response was filtered for safety."
timeout = 15000
response_buffer_size = 4096
text_source = "last_message"
})
gateway_id = konnect_ai_gateway.my_ai_gateway.id
}This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.
variable "gcp_service_account_json" {
type = string
}
variable "gcp_project_id" {
type = string
}
variable "gcp_location_id" {
type = string
}
variable "gcp_template_id" {
type = string
}After creating the policy, add configure-gcp-model-armor to the policies array of your AI Model. The tool examples update an existing AI Model with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Model.
ai_gateway_models:
- ref: my-gpt-4o
ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
display_name: my-gpt-4o
name: my-gpt-4o
type: model
capabilities:
- generate
formats:
- type: openai
targets:
- name: gpt-4o
provider: my-openai-account
config:
type: openai
config:
route:
paths:
- "/v1"
model:
body_param: model
values:
- my-gpt-4o
logging:
payloads: false
policies:
- !ref configure-gcp-model-armor#nameAfter creating the policy, add configure-gcp-model-armor to the policies array of your AI Model. The tool examples update an existing AI Model with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Model.
curl -X PUT https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/models/my-gpt-4o \
--header "accept: application/json" \
--header "Content-Type: application/json" \
--header "Authorization: Bearer $KONNECT_TOKEN" \
--data '
{
"display_name": "my-gpt-4o",
"name": "my-gpt-4o",
"type": "model",
"capabilities": [
"generate"
],
"formats": [
{
"type": "openai"
}
],
"policies": [
"configure-gcp-model-armor"
],
"targets": [
{
"name": "gpt-4o",
"provider": "my-openai-account",
"config": {
"type": "openai"
}
}
],
"config": {
"route": {
"paths": [
"/v1"
],
"model": {
"body_param": "model",
"values": [
"my-gpt-4o"
]
}
},
"logging": {
"payloads": false
}
}
}
'After creating the policy, add configure-gcp-model-armor to the policies array of your AI Model. The tool examples update an existing AI Model with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Model.
resource "konnect_ai_gateway_model" "my_model" {
display_name = "my-gpt-4o"
name = "my-gpt-4o"
type = "model"
capabilities = ["generate"]
formats = [
{
type = "openai"
} ]
targets = [
{
name = "gpt-4o"
provider = "my-openai-account"
config = {
type = "openai"
}
} ]
config = jsonencode({
route = {
paths = ["/v1"]
model = {
body_param = "model"
values = ["my-gpt-4o"]
}
}
logging = {
payloads = false
}
})
policies = [konnect_ai_gateway_policy.my_policy.name]
gateway_id = konnect_ai_gateway.my_ai_gateway.id
}This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.
variable "gcp_service_account_json" {
type = string
}
variable "gcp_project_id" {
type = string
}
variable "gcp_location_id" {
type = string
}
variable "gcp_template_id" {
type = string
}After creating the policy, add configure-gcp-model-armor to the policies array of your AI Consumer. The tool examples update an existing AI Consumer with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Consumer.
ai_gateway_consumers:
- ref: mobile-app-production
ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
display_name: Mobile App - Production
name: mobile-app-production
type: api-key
policies:
- !ref configure-gcp-model-armor#nameAfter creating the policy, add configure-gcp-model-armor to the policies array of your AI Consumer. The tool examples update an existing AI Consumer with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Consumer.
curl -X PUT https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/consumers/mobile-app-production \
--header "accept: application/json" \
--header "Content-Type: application/json" \
--header "Authorization: Bearer $KONNECT_TOKEN" \
--data '
{
"display_name": "Mobile App - Production",
"name": "mobile-app-production",
"type": "api-key",
"policies": [
"configure-gcp-model-armor"
]
}
'After creating the policy, add configure-gcp-model-armor to the policies array of your AI Consumer. The tool examples update an existing AI Consumer with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Consumer.
resource "konnect_ai_gateway_consumer" "my_consumer" {
display_name = "Mobile App - Production"
name = "mobile-app-production"
type = "api-key"
policies = [konnect_ai_gateway_policy.my_policy.name]
gateway_id = konnect_ai_gateway.my_ai_gateway.id
}This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.
variable "gcp_service_account_json" {
type = string
}
variable "gcp_project_id" {
type = string
}
variable "gcp_location_id" {
type = string
}
variable "gcp_template_id" {
type = string
}After creating the policy, add configure-gcp-model-armor to the policies array of your AI Consumer Group. The tool examples update an existing AI Consumer Group with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Consumer Group.
ai_gateway_consumer_groups:
- ref: internal-teams
ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
display_name: Internal Teams
name: internal-teams
policies:
- !ref configure-gcp-model-armor#nameAfter creating the policy, add configure-gcp-model-armor to the policies array of your AI Consumer Group. The tool examples update an existing AI Consumer Group with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Consumer Group.
curl -X PUT https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/consumer-groups/internal-teams \
--header "accept: application/json" \
--header "Content-Type: application/json" \
--header "Authorization: Bearer $KONNECT_TOKEN" \
--data '
{
"display_name": "Internal Teams",
"name": "internal-teams",
"policies": [
"configure-gcp-model-armor"
]
}
'After creating the policy, add configure-gcp-model-armor to the policies array of your AI Consumer Group. The tool examples update an existing AI Consumer Group with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Consumer Group.
resource "konnect_ai_gateway_consumer_group" "my_consumer_group" {
display_name = "Internal Teams"
name = "internal-teams"
policies = [konnect_ai_gateway_policy.my_policy.name]
gateway_id = konnect_ai_gateway.my_ai_gateway.id
}This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.
variable "gcp_service_account_json" {
type = string
}
variable "gcp_project_id" {
type = string
}
variable "gcp_location_id" {
type = string
}
variable "gcp_template_id" {
type = string
}