Canary onboarding: SaaS use case: Add KCC/Gcloud deployment options limited roles around BigQuery/AutoML/DocumentAI

Code in the following branch/location
https://github.com/GoogleCloudPlatform/pubsec-declarative-toolkit/tree/canary/solutions/document-processing
Readme/Architecture
https://github.com/GoogleCloudPlatform/pubsec-declarative-toolkit/tree/canary/solutions/document-processing#readme

Details and automation around onboarding a BigQuery/AutoML/DocumentAI use case for serverless/SaaS
- manual gcloud for discovery
- target KCC yaml for on-demand deployment via OCI

Services
- region na, useast
- GCS
- BigQuery
- DocAI
- AutoML
- NLP API
- App Engine
- Cloud Run
- Healthcare NLP API - https://cloud.google.com/healthcare-api/docs/how-tos/nlp
- CSR (up from AR) (for cloud run)
Add
- SCC-Premium

IAM roles/permissions
- https://cloud.google.com/document-ai/docs/overview
- https://cloud.google.com/bigquery/docs
- https://cloud.google.com/bigquery/docs/quickstarts/load-data-bq
- https://cloud.google.com/vertex-ai/docs/beginner/beginners-guide
- https://cloud.google.com/vertex-ai/docs/start/cloud-environment
- https://cloud.google.com/vertex-ai/docs/general/access-control#predefined-roles

Reference for scripting
https://github.com/GoogleCloudPlatform/pubsec-declarative-toolkit/blob/dev/solutions/landing-zone/deployment.sh

Service Account permissions
- AutoML Editor
- BigQuery Data Editor
- BigQuery Job User
- BigQuery User
- Document AI Administrator
- Document AI Editor
- Storage Admin
- Vertex AI Custom Code Service Agent

bootstrap
```
export ORG_ID=$(gcloud projects get-ancestors $BOOT_PROJECT_ID --format='get(id)' | tail -1)
export EMAIL=$(gcloud config list --format json | jq .core.account | sed 's/"//g')
```
service enablement
- bigquery already enabled
```
michael@cloudshell:~ (minimal-dev-od)$ gcloud services list --enabled | grep NAME
NAME: bigquery.googleapis.com
NAME: bigquerymigration.googleapis.com
NAME: bigquerystorage.googleapis.com
NAME: cloudapis.googleapis.com
NAME: clouddebugger.googleapis.com
NAME: cloudtrace.googleapis.com
NAME: datastore.googleapis.com
NAME: logging.googleapis.com
NAME: monitoring.googleapis.com
NAME: servicemanagement.googleapis.com
NAME: serviceusage.googleapis.com
NAME: sql-component.googleapis.com
NAME: storage-api.googleapis.com
NAME: storage-component.googleapis.com
NAME: storage.googleapis.com

gcloud services enable cloudbilling.googleapis.com

```

predefined roles
```
gcloud organizations add-iam-policy-binding "${ORG_ID}" --member "user:${EMAIL}" --role roles/aiplatform.admin

```

Document AI Service Account
https://cloud.google.com/document-ai/docs/setup?continue=https%3A%2F%2Fdevelopers.google.com%2Flearn%2Ftopics%2Fdocumentai&utm_source=developers.google.com&utm_medium=referral
```
```

Systems
transport.g.z