Set up Gemini Code Assist

Before you can use Gemini Code Assist, your team needs to perform the setup steps that are described in this document:

Purchase a subscription to Gemini Code Assist.
Assign licenses to individual users in your organization.
Enable the Gemini for Google Cloud API in a Google Cloud project.
Grant Identity and Access Management (IAM) roles in a Google Cloud project.
Your organization's users install the Gemini Code Assist plugin to use Gemini Code Assist in an IDE.

Purchase a Gemini Code Assist subscription

For a list of features available in each edition, see Supported features.

Gemini Code Assist Enterprise is available for $19 per month per user on a 12-month commitment until March 31, 2025. Connect with our sales team to take advantage of this promotional offer.

If you have existing contracts with Google Cloud, contact our sales team before purchasing a subscription.

Note: You must have the consumerprocurement.orders.place Identity and Access Management (IAM) permission to purchase a Gemini subscription. The consumerprocurement.orders.place permission is included in the roles/billing.admin IAM role or the roles/consumerprocurement.orderAdmin role. Alternatively, you can add the permission to a custom role.

Go to the Gemini for Google Cloud page.

Go to Gemini for Google Cloud

The Gemini for Google Cloud page opens.
Select Get Gemini Code Assist. If your project already has Gemini Code Assist, then this text displays Manage Gemini Code Assist.

The Get Gemini Code Assist subscription page opens.
In Select Gemini Code Assist subscription Edition, select a Gemini Code Assist edition. Select Compare Gemini Code Assist Editions to see a detailed list of features available to each edition.

Then, select Continue.
In Configure subscription, complete the fields to configure the subscription, including the following:
- Subscription name.
- Number of licenses in the subscription. Note that if you are purchasing Enterprise edition, then you must purchase at least 10 licences.
- Subscription period (monthly or yearly). With an annual subscription, you are given a discounted rate that is charged on a monthly basis rather than a one-time payment.
- Automatic renewal of your subscription after the commitment term (monthly or yearly) ends. Auto-renew keeps your subscription and licenses active. If the subscription doesn't auto-renew, it ends when the current term ends, and you need to go through the purchase process again and re-assign licenses.
To confirm subscription, select Continue.
If you agree to the terms, select I agree to the terms of this purchase, and then select Confirm subscription.
Select Next: Manage Gemini License Assignments.

The subscription is now purchased for Gemini Code Assist. You now need to manage Gemini license assignments in your organization.

Assign licenses

Before using Gemini Code Assist, each individual user in your organization needs a license.

Console

To assign Gemini licenses to individual users in the Google Cloud console, you must have the following permissions:

billing.accounts.get
consumerprocurement.orders.get
consumerprocurement.licensePools.get
consumerprocurement.licensePools.enumerateLicensedUsers
consumerprocurement.licensePools.assign

Go to the Admin for Gemini page.

Go to Admin for Gemini
Choose the subscription that you want to change, and then click Modify Subscription.
Click Assign Licenses. A user selection dialog appears. To search for specific users, enter their name in the search box.
Select one or more users from the list, and then click Next.
Choose the Gemini services you want to assign licenses for.
Click Assign Licenses.

API

To assign Gemini licenses with the API, you must have the consumerprocurement.licensePools.assign permission.

HTTP Method: POST

URL: https://cloudcommerceconsumerprocurement.googleapis.com/v1/billingAccounts/BILLING_ACCOUNT_ID/orders/ORDER_ID/licensePool:assign/

Replace the following:

BILLING_ACCOUNT_ID: the billing account ID
ORDER_ID: the IAM policy

Request body:

    {
        "usernames": [
                  "[email protected]",
                  "[email protected]"
        ]
    }

The output is similar to the following:

{}

The response is empty if the license is successfully assigned.

You now need to enable the Gemini for Google Cloud API in one or more projects that are associated with this billing account. Users won't see Gemini Code Assist until you activate it in at least one project.

Enable the Gemini for Google Cloud API in a Google Cloud project

This section describes the steps required to enable the Gemini for Google Cloud API in a Google Cloud project.

Console

To enable the Gemini for Google Cloud API, go to the Gemini for Google Cloud page.

Go to Gemini for Google Cloud
In the project selector, select a project.
Click Enable.

The page updates and shows a status of Enabled. Gemini is now available in the selected Google Cloud project to all users who have the required IAM roles.

gcloud

In the Google Cloud console, activate Cloud Shell.

Activate Cloud Shell
In the project selector menu, select a project.
Enable the Gemini for Google Cloud API for Gemini using the gcloud services enable command:
```
gcloud services enable cloudaicompanion.googleapis.com
```
If you want to enable the Gemini for Google Cloud API in a different Google Cloud project, add the --project parameter:
```
gcloud services enable cloudaicompanion.googleapis.com --project PROJECT_ID
```
Replace PROJECT_ID with your Google Cloud project ID.

The output is similar to the following:
```
Waiting for async operation operations/acf.2e2fcfce-8327-4984-9040-a67777082687 to complete...
Operation finished successfully.
```

Gemini for Google Cloud is now available in the specified Google Cloud project to all users who have the required IAM roles.

Required APIs for users behind firewalls

In addition to enabling the Gemini for Google Cloud API, users behind firewalls may also need to enable the following APIs:

oauth2.googleapis.com: used to sign in to Google Cloud.
serviceusage.googleapis.com: used for checking that the user's Gemini Code Assist project is properly configured.
cloudaicompanion.googleapis.com: the primary Gemini for Google Cloud API endpoint.
cloudcode-pa.googleapis.com: an internal API that provides IDE-related features.
cloudresourcemanager.googleapis.com: used in the IDEs for project pickers. The Resource Manager API may not be necessary if the projects are explicitly configured in your settings.json file.
people.googleapis.com: provides access to information about profiles and contacts.
firebaselogging-pa.googleapis.com: an internal API used for sending product telemetry including events as to whether suggestions were accepted.
feedback-pa.googleapis.com: an internal API used for in-IDE feedback submission.
apihub.googleapis.com: used by the Cloud Code API Browser feature.

Optional: Configure VPC Service Controls

If your organization has a service perimeter, then you must add the following resources to your perimeter:

Gemini for Google Cloud API
Gemini Code Assist API

If you are using Gemini Code Assist from outside of your service perimeter, then you also need to modify the ingress policy to allow access to those services.

For more information, see Configure VPC Service Controls for Gemini.

Grant IAM roles in a Google Cloud project

This section describes the steps required to grant the Gemini for Google Cloud User and Service Usage Consumer IAM roles to users.

Console

To grant the IAM roles that are required to use Gemini, go to the IAM & Admin page.

Go to IAM & Admin
In the Principal column, find a principal for which you want to give access to Gemini, and then click Edit principal in that row.
In the Edit access pane, click Add another role.
In Select a role, select Gemini for Google Cloud User.
Click Add another role and select Service Usage Consumer.
Click Save.

gcloud

In the Google Cloud console, activate Cloud Shell.

Activate Cloud Shell
In the project selector menu, select a project.
Grant the Gemini for Google Cloud User role:
```
gcloud projects add-iam-policy-binding  PROJECT_ID \
    --member=PRINCIPAL --role=roles/cloudaicompanion.user
```
Replace PRINCIPAL with the identifier for the principal. The identifier takes the form user|group|serviceAccount:email or domain:domain—for example, user:[email protected], group:[email protected], serviceAccount:[email protected], or domain:example.domain.com.

The output is a list of policy bindings that includes the following:
```
- members:
  - user:PRINCIPAL
  role: roles/cloudaicompanion.user
```

Grant the Service Usage Consumer role:

gcloud projects add-iam-policy-binding  PROJECT_ID \
    --member=PRINCIPAL --role=roles/serviceusage.serviceUsageConsumer

The output is a list of policy bindings that includes the following:

- members:
  - user:PRINCIPAL
  role: roles/serviceusage.serviceUsageConsumer

For more information, see Grant a single role and gcloud projects add-iam-policy-binding.

All of the users who have been granted these roles can access Gemini for Google Cloud features in the Google Cloud console within the specified project. For more information, see Gemini for Google Cloud overview.

Install the Gemini Code Assist plugin in an IDE

Your organization's users install Gemini Code Assist in their preferred IDE. For more information, see the following:

Cloud Workstations: Code with Gemini Code Assist
Cloud Shell Editor: Code with Gemini Code Assist
VS Code: Code with Gemini Code Assist
IntelliJ and other JetBrains IDEs: Code with Gemini Code Assist

Advanced setup tasks

Instead of using the Google Cloud console or the gcloud CLI to grant predefined IAM roles, you can do any of the following:

Use IAM REST APIs or IAM client libraries to grant roles.

If you use these interfaces, use the fully qualified role names:
- roles/cloudaicompanion.user
- roles/serviceusage.serviceUsageConsumer
For more information about granting roles, see Manage access to projects, folders, and organizations.
Create and grant custom roles.

Any custom roles that you create need the following permissions for you to access Gemini Code Assist:
- cloudaicompanion.companions.generateChat
- cloudaicompanion.companions.generateCode
- cloudaicompanion.instances.completeCode
- cloudaicompanion.instances.completeTask
- cloudaicompanion.instances.generateCode
- cloudaicompanion.instances.generateText
- serviceusage.services.enable
Assign and manage licenses.

Any custom roles that you create need the following permissions for you to access Gemini Code Assist:
- consumerprocurement.orders.get
- consumerprocurement.orders.licensePools..*
- consumerprocurement.orders.licensePools.update
- consumerprocurement.orders.licensePools.get
- consumerprocurement.orders.licensePools.assign
- consumerprocurement.orders.licensePools.unassign
- consumerprocurement.orders.licensePools.enumerateLicensedUsers

Also note that for any of the preceding permission to work, the Gemini for Google Cloud API needs to be enabled in the same Google Cloud project where you've assigned each permission.

What's next

Learn more about the types of generative AI assistance available in Gemini for Google Cloud.
Learn how Gemini for Google Cloud uses your data.
Learn how to access and manage Gemini Code Assist administrator controls.
Learn how to configure code customization.
Configure VPC Service Controls for Gemini.