GCP Vertex AI datasets do not use a Customer Manager Key (CMK) misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_GCP_92
Category - Subcategory	Storage - Encryption
Provider	GCP
Severity	LOW
Framework	Terraform

Impact

This rule identifies Vertex AI datasets which are encrypted with default KMS keys and not with Keys managed by Customer. It is a best practice to use customer managed KMS Keys to encrypt your Vertex AI datasets data. It gives you full control over the encrypted data.

How to Fix

Resource: google_vertex_ai_dataset

• Arguments: region.encryption_spec.kms_key_name [source,go]

---

resource "google_vertex_ai_dataset" "pass" { display_name = "terraform" metadata_schema_uri = "gs://google-cloud-aiplatform/schema/dataset/metadata/image_1.0.0.yaml" region = "us-central1" encryption_spec { kms_key_name=google_kms_crypto_key.example.name }

}