Vertex AIでClaudeモデルを使おう！GCPからの設定ガイド完全版

gcloud services enable \
  iam.googleapis.com \
  sts.googleapis.com \
  iamcredentials.googleapis.com \
  aiplatform.googleapis.com

brew install --cask google-cloud-sdk

sudo apt-get update
sudo apt-get install -y apt-transport-https ca-certificates gnupg curl
curl https://packages.cloud.google.com/apt/doc/apt-key.gpg | \
  sudo gpg --dearmor -o /usr/share/keyrings/cloud.google.gpg
echo "deb [signed-by=/usr/share/keyrings/cloud.google.gpg] https://packages.cloud.google.com/apt cloud-sdk main" | \
  sudo tee -a /etc/apt/sources.list.d/google-cloud-sdk.list
sudo apt-get update && sudo apt-get install -y google-cloud-cli

gcloud auth application-default login

gcloud iam workload-identity-pools create "azure-pool" \
    --location="global" \
    --display-name="Azure Pool"

gcloud iam workload-identity-pools providers create-oidc "azure-provider" \
    --location="global" \
    --workload-identity-pool="azure-pool" \
    --display-name="Azure Provider" \
    --issuer-uri="https://sts.windows.net/<AZURE_TENANT_ID>/" \
    --allowed-audiences="<SERVICE_PRINCIPAL_APPLICATION_ID>" \
    --attribute-mapping="google.subject=assertion.sub,attribute.tid=assertion.tid,attribute.oid=assertion.oid" \
    --attribute-condition="attribute.tid == '<AZURE_TENANT_ID>' && attribute.oid == '<MANAGED_IDENTITY_OBJECT_ID>'"

    --attribute-condition="assertion.tid == '<AZURE_TENANT_ID>' && assertion.oid in ['<MANAGED_IDENTITY_OBJECT_ID_1>', '<MANAGED_IDENTITY_OBJECT_ID_2>']"

az ad app update \
    --id "<SERVICE_PRINCIPAL_APPLICATION_ID>" \
    --sign-in-audience AzureADMultipleOrgs

# サービスアカウントの作成
gcloud iam service-accounts create vertex-ai-workload \
    --display-name="Vertex AI for Azure Workload"

# Vertex AI利用権限の付与
gcloud projects add-iam-policy-binding YOUR_GCP_PROJECT_ID \
    --member="serviceAccount:vertex-ai-workload@YOUR_GCP_PROJECT_ID.iam.gserviceaccount.com" \
    --role="roles/aiplatform.user"

gcloud iam service-accounts add-iam-policy-binding \
    "vertex-ai-workload@YOUR_GCP_PROJECT_ID.iam.gserviceaccount.com" \
    --role="roles/iam.workloadIdentityUser" \
    --member="principalSet://iam.googleapis.com/projects/YOUR_PROJECT_NUMBER/locations/global/workloadIdentityPools/azure-pool/attribute.oid/MANAGED_IDENTITY_OBJECT_ID"

import os

from google.auth import load_credentials_from_dict
from google.auth.credentials import Credentials
from anthropic import AnthropicVertex


class AzureFunctionsWIFCredentials:
    """Azure Functions の Managed Identity を使った Workload Identity Federation 認証"""

    def __init__(
        self,
        service_principal_app_id: str,
        project_number: str,
        pool_id: str,
        provider_id: str,
        service_account_email: str,
    ) -> None:
        self.service_principal_app_id = service_principal_app_id
        self.project_number = project_number
        self.pool_id = pool_id
        self.provider_id = provider_id
        self.service_account_email = service_account_email

    def get_credentials(self) -> Credentials:
        identity_endpoint = os.environ["IDENTITY_ENDPOINT"]
        identity_header = os.environ["IDENTITY_HEADER"]

        credential_config = {
            "type": "external_account",
            "audience": (
                f"//iam.googleapis.com/projects/{self.project_number}/locations/global/"
                f"workloadIdentityPools/{self.pool_id}/providers/{self.provider_id}"
            ),
            "subject_token_type": "urn:ietf:params:oauth:token-type:jwt",
            "token_url": "https://sts.googleapis.com/v1/token",
            "credential_source": {
                "url": f"{identity_endpoint}?resource={self.service_principal_app_id}&api-version=2019-08-01",
                "headers": {"X-IDENTITY-HEADER": identity_header},
                "format": {"type": "json", "subject_token_field_name": "access_token"},
            },
            "service_account_impersonation_url": (
                f"https://iamcredentials.googleapis.com/v1/projects/"
                f"-/serviceAccounts/{self.service_account_email}:generateAccessToken"
            ),
        }

        credentials, _ = load_credentials_from_dict(
            credential_config, scopes=["https://www.googleapis.com/auth/cloud-platform"]
        )
        return credentials


class VertexAIClaudeClient:
    """Vertex AI Claude クライアント"""

    def __init__(self, project_id: str, region: str, credentials: Credentials) -> None:
        self._client = AnthropicVertex(
            region=region,
            project_id=project_id,
            credentials=credentials,
        )

    def generate(self, prompt: str, model: str = "claude-sonnet-4-5@20250929") -> str:
        message = self._client.messages.create(
            model=model,
            max_tokens=1024,
            messages=[{"role": "user", "content": prompt}],
        )
        return message.content[0].text


import azure.functions as func

app = func.FunctionApp()

# クライアントはコールドスタートのコストを避けるためモジュールレベルで初期化
_wif = AzureFunctionsWIFCredentials(
    service_principal_app_id="<SERVICE_PRINCIPAL_APPLICATION_ID>",
    project_number="<YOUR_PROJECT_NUMBER>",
    pool_id="azure-pool",
    provider_id="azure-provider",
    service_account_email="vertex-ai-workload@<YOUR_GCP_PROJECT_ID>.iam.gserviceaccount.com",
)
_client = VertexAIClaudeClient(
    project_id="<YOUR_GCP_PROJECT_ID>",
    region="us-east5",
    credentials=_wif.get_credentials(),
)


@app.route(route="generate", methods=["POST"])
def generate(req: func.HttpRequest) -> func.HttpResponse:
    prompt = req.get_json().get("prompt", "")
    if not prompt:
        return func.HttpResponse("prompt is required", status_code=400)

    result = _client.generate(prompt)
    return func.HttpResponse(result, mimetype="text/plain")

RUN apt-get update && apt-get install -y apt-transport-https ca-certificates gnupg curl \
  && curl https://packages.cloud.google.com/apt/doc/apt-key.gpg | \
     gpg --dearmor -o /usr/share/keyrings/cloud.google.gpg \
  && echo "deb [signed-by=/usr/share/keyrings/cloud.google.gpg] https://packages.cloud.google.com/apt cloud-sdk main" \
     > /etc/apt/sources.list.d/google-cloud-sdk.list \
  && apt-get update && apt-get install -y google-cloud-cli \
  && apt-get clean && rm -rf /var/lib/apt/lists/*

gcloud iam service-accounts add-iam-policy-binding \
    SERVICE_ACCOUNT_EMAIL \
    --member="user:YOUR_EMAIL_ADDRESS" \
    --role="roles/iam.serviceAccountTokenCreator"

gcloud auth application-default login \
    --impersonate-service-account=SERVICE_ACCOUNT_ID@PROJECT_ID.iam.gserviceaccount.com

gcloud auth application-default login --no-launch-browser

# Globalエンドポイント
client = AnthropicVertex(region="global", project_id="your-project-id")

# Regionalエンドポイント（例: 東京に近いリージョン）
client = AnthropicVertex(region="asia-southeast1", project_id="your-project-id")

pip install -U google-cloud-aiplatform google-auth "anthropic[vertex]"

from anthropic import AnthropicVertex

# クライアントの初期化
client = AnthropicVertex(
    region="us-east5",
    project_id="your-gcp-project-id",
)

# メッセージの送信
message = client.messages.create(
    model="claude-sonnet-4-5@20250929",
    max_tokens=1024,
    messages=[
        {"role": "user", "content": "Vertex AIとは何ですか？簡潔に教えてください。"}
    ],
)

print(message.content[0].text)

from anthropic import AnthropicVertex

client = AnthropicVertex(
    region="us-east5",
    project_id="your-gcp-project-id",
)

# ストリーミングでメッセージを送信
with client.messages.stream(
    model="claude-sonnet-4-5@20250929",
    max_tokens=1024,
    messages=[
        {"role": "user", "content": "Pythonで簡単なWebサーバーを作る方法を教えてください。"}
    ],
) as stream:
    for text in stream.text_stream:
        print(text, end="", flush=True)

print()  # 最後に改行

google.api_core.exceptions.PermissionDenied: 403 Permission denied on resource project

anthropic.NotFoundError: 404 Model not found

google.auth.exceptions.DefaultCredentialsError: Could not automatically determine credentials.

anthropic.RateLimitError: 429 Rate limit exceeded