iris-security-vertexai 0.1.0__tar.gz

iris_security_vertexai-0.1.0/PKG-INFO

@@ -0,0 +1,16 @@
+Metadata-Version: 2.4
+Name: iris-security-vertexai
+Version: 0.1.0
+Summary: IRIS governance for Vertex AI via google-cloud-aiplatform
+Author-email: IRIS Platform <sdk@iris.ai>
+License: Apache-2.0
+Project-URL: Homepage, https://github.com/gimartinb/iris-sdk
+Project-URL: Repository, https://github.com/gimartinb/iris-sdk
+Requires-Python: >=3.10
+Requires-Dist: iris-security-core>=0.1.0
+Requires-Dist: iris-security-sdk>=0.1.0
+Provides-Extra: vertexai
+Requires-Dist: google-cloud-aiplatform>=1.60; extra == "vertexai"
+Provides-Extra: dev
+Requires-Dist: pytest>=8.0; extra == "dev"
+Requires-Dist: ruff>=0.4; extra == "dev"

iris_security_vertexai-0.1.0/iris_security_vertexai.egg-info/PKG-INFO

@@ -0,0 +1,16 @@
+Metadata-Version: 2.4
+Name: iris-security-vertexai
+Version: 0.1.0
+Summary: IRIS governance for Vertex AI via google-cloud-aiplatform
+Author-email: IRIS Platform <sdk@iris.ai>
+License: Apache-2.0
+Project-URL: Homepage, https://github.com/gimartinb/iris-sdk
+Project-URL: Repository, https://github.com/gimartinb/iris-sdk
+Requires-Python: >=3.10
+Requires-Dist: iris-security-core>=0.1.0
+Requires-Dist: iris-security-sdk>=0.1.0
+Provides-Extra: vertexai
+Requires-Dist: google-cloud-aiplatform>=1.60; extra == "vertexai"
+Provides-Extra: dev
+Requires-Dist: pytest>=8.0; extra == "dev"
+Requires-Dist: ruff>=0.4; extra == "dev"

iris_security_vertexai-0.1.0/iris_security_vertexai.egg-info/SOURCES.txt

@@ -0,0 +1,11 @@
+pyproject.toml
+iris_security_vertexai.egg-info/PKG-INFO
+iris_security_vertexai.egg-info/SOURCES.txt
+iris_security_vertexai.egg-info/dependency_links.txt
+iris_security_vertexai.egg-info/requires.txt
+iris_security_vertexai.egg-info/top_level.txt
+iris_vertexai/__init__.py
+iris_vertexai/client.py
+iris_vertexai/fedramp.py
+iris_vertexai/init.py
+tests/test_vertexai_integration.py

iris_security_vertexai-0.1.0/iris_security_vertexai.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

iris_security_vertexai-0.1.0/iris_security_vertexai.egg-info/requires.txt

@@ -0,0 +1,9 @@
+iris-security-core>=0.1.0
+iris-security-sdk>=0.1.0
+
+[dev]
+pytest>=8.0
+ruff>=0.4
+
+[vertexai]
+google-cloud-aiplatform>=1.60

iris_security_vertexai-0.1.0/iris_security_vertexai.egg-info/top_level.txt

@@ -0,0 +1 @@
+iris_vertexai

iris_security_vertexai-0.1.0/iris_vertexai/__init__.py

@@ -0,0 +1,29 @@
+"""
+IRIS Vertex AI integration - governed wrapper for Vertex AI GenerativeModel.
+"""
+
+from __future__ import annotations
+
+from iris import IrisViolationError
+from iris_core.models.passport import (
+    AgentPassport,
+    ComplianceTag,
+    DataClassification,
+    Environment,
+)
+from iris_core.models.policy import Violation
+
+from iris_vertexai.client import IrisGenerativeModel, IrisVertexAI
+
+__version__ = "0.1.0"
+
+__all__ = [
+    "IrisVertexAI",
+    "IrisGenerativeModel",
+    "IrisViolationError",
+    "AgentPassport",
+    "ComplianceTag",
+    "DataClassification",
+    "Environment",
+    "Violation",
+]

iris_security_vertexai-0.1.0/iris_vertexai/client.py

@@ -0,0 +1,314 @@
+"""Governed Vertex AI wrapper with IRIS policy enforcement."""
+
+from __future__ import annotations
+
+import importlib
+import json
+import os
+import uuid
+from datetime import datetime
+from typing import Any, Optional
+
+from iris import IrisViolationError
+from iris_core.dlp import DLPScanner
+from iris_core.dlp.enforcement import (
+    enforce_prompt_dlp,
+    extract_gemini_response_text,
+    handle_response_dlp,
+)
+from iris_core.engine.cedar import CedarEngine, EvaluationContext
+from iris_core.rbac.context import UserContext
+from iris_core.evidence.vault import EvidenceVault
+from iris_core.models.passport import AgentPassport
+from iris_core.models.policy import PolicyResult, Severity, Violation
+
+from iris_gemini.guardrails import _extract_text
+
+from iris_vertexai.fedramp import check_fedramp_location, check_fedramp_model
+
+
+def _lazy_vertexai():
+    try:
+        return importlib.import_module("vertexai")
+    except ModuleNotFoundError as exc:
+        raise ImportError(
+            "google-cloud-aiplatform is required for IrisVertexAI. "
+            "Install with: pip install google-cloud-aiplatform"
+        ) from exc
+
+
+def _lazy_vertexai_generative_models():
+    try:
+        return importlib.import_module("vertexai.generative_models")
+    except ModuleNotFoundError as exc:
+        raise ImportError(
+            "vertexai.generative_models is unavailable. "
+            "Install or upgrade: pip install google-cloud-aiplatform>=1.60"
+        ) from exc
+
+
+def _is_fedramp_enabled(passport: AgentPassport) -> bool:
+    for tag in passport.compliance_tags:
+        value = getattr(tag, "value", str(tag)).lower()
+        if value == "fedramp":
+            return True
+    return False
+
+
+def _load_passport_policy(engine: CedarEngine, passport: AgentPassport) -> None:
+    if not passport.policy_ref:
+        return
+    from pathlib import Path
+
+    policy_path = Path(passport.policy_ref)
+    if not policy_path.is_absolute():
+        policy_path = Path.cwd() / policy_path
+    if policy_path.exists():
+        engine.load_policy_file(passport.agent_id, policy_path)
+
+
+def _current_environment():
+    from iris_core.models.passport import Environment
+
+    return Environment(os.environ.get("IRIS_ENV", "dev"))
+
+
+def _enforce_result(result: PolicyResult) -> None:
+    if result.decision == "DENY":
+        raise IrisViolationError(result)
+
+
+class IrisVertexAI:
+    """Top-level Vertex AI client wrapper with governance-aware model creation."""
+
+    def __init__(
+        self,
+        passport: AgentPassport,
+        project: Optional[str] = None,
+        location: Optional[str] = None,
+        user_email: Optional[str] = None,
+        user_role: Optional[str] = None,
+        **kwargs: Any,
+    ):
+        from iris_core.dev_trust import print_dev_trust_message
+
+        print_dev_trust_message()
+        evidence_vault_dir = kwargs.pop("evidence_vault_dir", None)
+        vertexai = _lazy_vertexai()
+        vertexai.init(project=project, location=location, **kwargs)
+        self._passport = passport
+        self._project = project
+        self._location = location
+        self._user_email = user_email
+        self._user_role = user_role
+        self._engine = CedarEngine()
+        self._vault = EvidenceVault(agent_id=passport.agent_id, vault_dir=evidence_vault_dir)
+        self._dlp = DLPScanner(passport)
+        _load_passport_policy(self._engine, passport)
+
+    def get_model(self, model_name: str) -> "IrisGenerativeModel":
+        return IrisGenerativeModel(
+            model_name=model_name,
+            passport=self._passport,
+            location=self._location,
+            project=self._project,
+            engine=self._engine,
+            vault=self._vault,
+            dlp=self._dlp,
+            user_email=self._user_email,
+            user_role=self._user_role,
+        )
+
+
+class IrisGenerativeModel:
+    """Governed wrapper around vertexai.generative_models.GenerativeModel."""
+
+    def __init__(
+        self,
+        model_name: str,
+        passport: AgentPassport,
+        location: Optional[str] = None,
+        project: Optional[str] = None,
+        engine: Optional[CedarEngine] = None,
+        vault: Optional[EvidenceVault] = None,
+        dlp: Optional[DLPScanner] = None,
+        user_email: Optional[str] = None,
+        user_role: Optional[str] = None,
+    ):
+        generative_models = _lazy_vertexai_generative_models()
+        self._model_name = model_name
+        self._passport = passport
+        self._location = location
+        self._project = project
+        self._engine = engine or CedarEngine()
+        self._vault = vault or EvidenceVault(agent_id=passport.agent_id)
+        self._dlp = dlp or DLPScanner(passport)
+        self._user_email = user_email
+        self._user_role = user_role
+        self._model = generative_models.GenerativeModel(model_name)
+
+    def _record_with_metadata(
+        self, ctx: EvaluationContext, result: PolicyResult, location_violations: list[Violation]
+    ) -> None:
+        entry = {
+            "event_id": str(uuid.uuid4()),
+            "timestamp": datetime.utcnow().isoformat(),
+            "agent_id": self._passport.agent_id,
+            "action": ctx.action,
+            "resource": ctx.resource,
+            "environment": ctx.environment.value,
+            "decision": result.decision,
+            "gcp_project": self._project,
+            "gcp_location": self._location,
+            "additional": {
+                **ctx.additional,
+                "gcp_project": self._project,
+                "gcp_location": self._location,
+            },
+            "violations": [
+                {
+                    "rule_id": v.rule_id,
+                    "severity": v.severity.value,
+                    "message": v.message,
+                    "compliance_refs": v.compliance_refs,
+                }
+                for v in (list(result.violations) + list(location_violations))
+            ],
+        }
+        with open(self._vault._log_file, "a") as handle:
+            handle.write(json.dumps(entry) + "\n")
+
+    def _govern(self, action: str, contents: Any = None) -> None:
+        env = _current_environment()
+        prompt_text = "\n".join(_extract_text(contents))
+        dlp_result = enforce_prompt_dlp(
+            self._dlp,
+            self._vault,
+            self._passport,
+            env,
+            prompt_text,
+            resource=f"vertexai/{self._model_name}",
+        )
+        violations: list[Violation] = []
+
+        if self._location:
+            if self._passport.allowed_regions and self._location not in self._passport.allowed_regions:
+                violations.append(
+                    Violation(
+                        rule_id="IRIS-REGION-001",
+                        severity=Severity.CRITICAL,
+                        message=(
+                            f"Location '{self._location}' is not in passport.allowed_regions."
+                        ),
+                        compliance_refs=["iris:region-policy"],
+                        remediation=(
+                            "Use an allowed location or update passport.allowed_regions "
+                            "with security approval."
+                        ),
+                    )
+                )
+            if self._location.startswith("us-gov-"):
+                violations.append(
+                    Violation(
+                        rule_id="IRIS-REGION-002",
+                        severity=Severity.HIGH,
+                        message=(
+                            f"Location '{self._location}' is a restricted government region."
+                        ),
+                        compliance_refs=["fedramp:high:region-review"],
+                        remediation=(
+                            "Ensure FedRAMP High authorization is documented for this location."
+                        ),
+                    )
+                )
+        else:
+            violations.append(
+                Violation(
+                    rule_id="IRIS-REGION-003",
+                    severity=Severity.CRITICAL,
+                    message="Vertex AI location is required but missing.",
+                    compliance_refs=["iris:region-policy"],
+                    remediation="Provide a valid Vertex AI location before calling the model.",
+                )
+            )
+
+        if _is_fedramp_enabled(self._passport):
+            fedramp_location_violation = check_fedramp_location(self._location or "")
+            if fedramp_location_violation:
+                violations.append(fedramp_location_violation)
+            fedramp_model_violation = check_fedramp_model(self._model_name)
+            if fedramp_model_violation:
+                violations.append(fedramp_model_violation)
+
+        user_ctx = UserContext.from_params(self._user_email, self._user_role)
+        ctx = EvaluationContext(
+            agent_id=self._passport.agent_id,
+            action=action,
+            resource=f"vertexai/{self._model_name}",
+            resource_type="api",
+            environment=env,
+            data_region=self._location,
+            data_classification=self._passport.data_classification.value,
+            dlp_prompt_findings=dlp_result.findings,
+            additional={
+                "model": self._model_name,
+                "gcp_project": self._project,
+                "gcp_location": self._location,
+            },
+            **user_ctx.evaluation_fields(),
+        )
+        result = self._engine.evaluate(self._passport, ctx)
+        if violations:
+            result = PolicyResult(
+                decision="DENY",
+                violations=list(result.violations) + violations,
+                agent_id=result.agent_id,
+                action=result.action,
+                resource=result.resource,
+                environment=result.environment,
+            )
+
+        self._record_with_metadata(ctx, result, [])
+        _enforce_result(result)
+
+    def _scan_response(self, response: Any) -> Any:
+        env = _current_environment()
+        response_text = extract_gemini_response_text(response)
+        blocked, _ = handle_response_dlp(
+            self._dlp,
+            self._vault,
+            self._passport,
+            env,
+            response_text,
+            response,
+            resource=f"vertexai/{self._model_name}",
+        )
+        return blocked
+
+    def generate_content(self, contents: Any, **kwargs: Any) -> Any:
+        self._govern(action="generate_content", contents=contents)
+        response = self._model.generate_content(contents, **kwargs)
+        return self._scan_response(response)
+
+    def generate_content_stream(self, **kwargs: Any) -> Any:
+        self._govern(action="generate_content_stream", contents=kwargs.get("contents"))
+        return self._model.generate_content_stream(**kwargs)
+
+    def start_chat(self) -> "IrisChatSession":
+        return IrisChatSession(
+            chat_session=self._model.start_chat(),
+            model=self,
+        )
+
+
+class IrisChatSession:
+    """Governed wrapper around Vertex AI chat sessions."""
+
+    def __init__(self, chat_session: Any, model: IrisGenerativeModel):
+        self._chat_session = chat_session
+        self._model = model
+
+    def send_message(self, content: Any, **kwargs: Any) -> Any:
+        self._model._govern(action="chat.send_message", contents=content)
+        response = self._chat_session.send_message(content, **kwargs)
+        return self._model._scan_response(response)

iris_security_vertexai-0.1.0/iris_vertexai/fedramp.py

@@ -0,0 +1,89 @@
+"""FedRAMP-specific governance checks for Vertex AI integrations."""
+
+from __future__ import annotations
+
+from typing import Optional
+
+from iris_core.models.policy import Severity, Violation
+
+FEDRAMP_AUTHORIZED_VERTEX_REGIONS = {
+    "us-central1",
+    "us-east1",
+    "us-east4",
+    "us-west1",
+    "us-west2",
+    "us-west3",
+    "us-west4",
+    "us-south1",
+}
+
+FEDRAMP_AUTHORIZED_VERTEX_MODELS = {
+    "gemini-1.5-pro",
+    "gemini-1.5-flash",
+}
+
+
+def check_fedramp_location(location: str) -> Optional[Violation]:
+    """Return violation when Vertex AI location is not FedRAMP-authorized."""
+    normalized = (location or "").strip().lower()
+    if not normalized:
+        return Violation(
+            rule_id="FEDRAMP-001",
+            severity=Severity.CRITICAL,
+            message="FedRAMP location is missing for this Vertex AI request.",
+            compliance_refs=["fedramp:moderate:residency"],
+            remediation=(
+                "Set a FedRAMP-authorized Vertex AI region and retry the request."
+            ),
+        )
+
+    if normalized in FEDRAMP_AUTHORIZED_VERTEX_REGIONS:
+        return None
+
+    if normalized.startswith("us-gov-"):
+        return Violation(
+            rule_id="FEDRAMP-001",
+            severity=Severity.CRITICAL,
+            message=(
+                f"Location '{location}' requires additional FedRAMP High authorization."
+            ),
+            compliance_refs=["fedramp:high:authorization-boundary"],
+            remediation=(
+                "Obtain documented FedRAMP High authorization for this region "
+                "or use an authorized FedRAMP Moderate region."
+            ),
+        )
+
+    return Violation(
+        rule_id="FEDRAMP-001",
+        severity=Severity.CRITICAL,
+        message=(
+            f"Location '{location}' is not in the FedRAMP-authorized Vertex AI region list."
+        ),
+        compliance_refs=["fedramp:moderate:residency"],
+        remediation=(
+            "Use one of the authorized regions: "
+            + ", ".join(sorted(FEDRAMP_AUTHORIZED_VERTEX_REGIONS))
+            + "."
+        ),
+    )
+
+
+def check_fedramp_model(model_name: str) -> Optional[Violation]:
+    """Return violation when Vertex AI model authorization cannot be verified."""
+    normalized = (model_name or "").strip().lower()
+    if normalized in FEDRAMP_AUTHORIZED_VERTEX_MODELS:
+        return None
+
+    return Violation(
+        rule_id="FEDRAMP-002",
+        severity=Severity.HIGH,
+        message=(
+            f"Model '{model_name}' is not on the current FedRAMP-authorized Vertex AI list."
+        ),
+        compliance_refs=["fedramp:ai-workload:authorization"],
+        remediation=(
+            "Use a known authorized model (gemini-1.5-pro or gemini-1.5-flash) "
+            "or complete an authorization review for this model."
+        ),
+    )

iris_security_vertexai-0.1.0/iris_vertexai/init.py

@@ -0,0 +1,5 @@
+"""Compatibility exports for requested init.py module."""
+
+from iris_vertexai.client import IrisGenerativeModel, IrisVertexAI
+
+__all__ = ["IrisVertexAI", "IrisGenerativeModel"]

iris_security_vertexai-0.1.0/pyproject.toml

@@ -0,0 +1,36 @@
+[build-system]
+requires = ["setuptools>=68", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "iris-security-vertexai"
+version = "0.1.0"
+description = "IRIS governance for Vertex AI via google-cloud-aiplatform"
+license = { text = "Apache-2.0" }
+requires-python = ">=3.10"
+authors = [{ name = "IRIS Platform", email = "sdk@iris.ai" }]
+dependencies = [
+  "iris-security-core>=0.1.0",
+  "iris-security-sdk>=0.1.0",
+]
+
+[project.optional-dependencies]
+vertexai = ["google-cloud-aiplatform>=1.60"]
+dev = [
+  "pytest>=8.0",
+  "ruff>=0.4",
+]
+
+[project.urls]
+Homepage = "https://github.com/gimartinb/iris-sdk"
+Repository = "https://github.com/gimartinb/iris-sdk"
+
+[tool.setuptools]
+packages = ["iris_vertexai"]
+
+[tool.ruff]
+line-length = 100
+target-version = "py310"
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]

iris_security_vertexai-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

iris_security_vertexai-0.1.0/tests/test_vertexai_integration.py

@@ -0,0 +1,167 @@
+"""Integration tests for iris-vertexai with mocked Vertex AI SDK."""
+
+from __future__ import annotations
+
+import json
+import types
+from pathlib import Path
+from unittest.mock import MagicMock, patch
+
+import pytest
+
+from iris import IrisViolationError
+from iris_core.engine.cedar import CedarEngine
+from iris_core.models.passport import AgentPassport, ComplianceTag, DataClassification, Environment
+from iris_vertexai import IrisVertexAI
+from iris_vertexai.fedramp import check_fedramp_location, check_fedramp_model
+
+
+def _mock_vertex_modules():
+    vertexai_module = types.ModuleType("vertexai")
+    vertexai_module.init = MagicMock()
+
+    gm_module = types.ModuleType("vertexai.generative_models")
+    response = MagicMock()
+    response.text = "Vertex response"
+    chat_response = MagicMock()
+    chat_response.text = "chat response"
+    chat_session = MagicMock()
+    chat_session.send_message.return_value = chat_response
+
+    model_instance = MagicMock()
+    model_instance.generate_content.return_value = response
+    model_instance.generate_content_stream.return_value = iter([response])
+    model_instance.start_chat.return_value = chat_session
+
+    gm_module.GenerativeModel = MagicMock(return_value=model_instance)
+    return vertexai_module, gm_module, model_instance, chat_session
+
+
+class _FedrampTag:
+    value = "fedramp"
+
+
+@pytest.fixture
+def passport():
+    return AgentPassport(
+        name="vertex-agent",
+        owner="team@gov-agency.gov",
+        data_classification=DataClassification.INTERNAL,
+        compliance_tags=[ComplianceTag.COLORADO_AI_ACT],
+        environments=[Environment.DEV, Environment.PRODUCTION],
+        allowed_regions=["us-central1", "us-east1"],
+    )
+
+
+def _permit_engine(passport: AgentPassport) -> CedarEngine:
+    engine = CedarEngine()
+    engine.load_policy(passport.agent_id, "permit(principal, action, resource);")
+    return engine
+
+
+def test_authorized_location_permitted(passport, tmp_path, monkeypatch):
+    monkeypatch.setenv("IRIS_ENV", "dev")
+    vertexai_module, gm_module, model_instance, _ = _mock_vertex_modules()
+
+    with patch.dict(
+        "sys.modules",
+        {"vertexai": vertexai_module, "vertexai.generative_models": gm_module},
+    ):
+        client = IrisVertexAI(
+            passport=passport,
+            project="proj-1",
+            location="us-central1",
+            evidence_vault_dir=tmp_path,
+        )
+        client._engine = _permit_engine(passport)
+        model = client.get_model("gemini-1.5-pro")
+        result = model.generate_content("hello")
+
+    assert result.text == "Vertex response"
+    model_instance.generate_content.assert_called_once()
+
+
+def test_unauthorized_location_blocked(passport, tmp_path, monkeypatch):
+    monkeypatch.setenv("IRIS_ENV", "production")
+    vertexai_module, gm_module, model_instance, _ = _mock_vertex_modules()
+
+    with patch.dict(
+        "sys.modules",
+        {"vertexai": vertexai_module, "vertexai.generative_models": gm_module},
+    ):
+        client = IrisVertexAI(
+            passport=passport,
+            project="proj-1",
+            location="europe-west1",
+            evidence_vault_dir=tmp_path,
+        )
+        client._engine = _permit_engine(passport)
+        model = client.get_model("gemini-1.5-pro")
+        with pytest.raises(IrisViolationError):
+            model.generate_content("hello")
+
+    model_instance.generate_content.assert_not_called()
+
+
+def test_fedramp_location_check():
+    assert check_fedramp_location("us-central1") is None
+    violation = check_fedramp_location("europe-west1")
+    assert violation is not None
+    assert violation.rule_id == "FEDRAMP-001"
+
+
+def test_fedramp_model_check():
+    assert check_fedramp_model("gemini-1.5-pro") is None
+    violation = check_fedramp_model("gemini-2.0-flash")
+    assert violation is not None
+    assert violation.rule_id == "FEDRAMP-002"
+
+
+def test_chat_session_intercept(passport, tmp_path, monkeypatch):
+    monkeypatch.setenv("IRIS_ENV", "dev")
+    vertexai_module, gm_module, _, chat_session = _mock_vertex_modules()
+
+    with patch.dict(
+        "sys.modules",
+        {"vertexai": vertexai_module, "vertexai.generative_models": gm_module},
+    ):
+        client = IrisVertexAI(
+            passport=passport,
+            project="proj-1",
+            location="us-central1",
+            evidence_vault_dir=tmp_path,
+        )
+        client._engine = _permit_engine(passport)
+        model = client.get_model("gemini-1.5-pro")
+        chat = model.start_chat()
+        chat.send_message("hello")
+
+    chat_session.send_message.assert_called_once()
+
+
+def test_evidence_vault_includes_gcp_metadata(passport, tmp_path, monkeypatch):
+    monkeypatch.setenv("IRIS_ENV", "dev")
+    vertexai_module, gm_module, _, _ = _mock_vertex_modules()
+    passport.compliance_tags = [ComplianceTag.COLORADO_AI_ACT, _FedrampTag()]
+
+    with patch.dict(
+        "sys.modules",
+        {"vertexai": vertexai_module, "vertexai.generative_models": gm_module},
+    ):
+        client = IrisVertexAI(
+            passport=passport,
+            project="proj-1",
+            location="us-central1",
+            evidence_vault_dir=tmp_path,
+        )
+        client._engine = _permit_engine(passport)
+        model = client.get_model("gemini-1.5-pro")
+        model.generate_content("hello")
+
+    events_file = Path(tmp_path) / passport.agent_id / "events.jsonl"
+    lines = events_file.read_text().strip().splitlines()
+    event = json.loads(lines[-1])
+    assert event["gcp_project"] == "proj-1"
+    assert event["gcp_location"] == "us-central1"
+    assert event["additional"]["gcp_project"] == "proj-1"
+    assert event["additional"]["gcp_location"] == "us-central1"