Vertex AI index endpoint is public misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC2_GCP_34
Category - Subcategory	Public Exposure - APIs
Provider	GCP
Severity	MEDIUM
Framework	Terraform, Terraform Plan

Impact

This rule evaluates whether the Vertex AI index endpoint is set to private in Google Cloud Platform. If it is not private, it means that the endpoint could be exposed to the public, potentially disclosing sensitive information and opening up avenues for undesired changes to be made. This could lead to security vulnerabilities, such as data breaches or unauthorized access. Thus, ensuring that the Vertex AI index endpoint is private enhances the security of the system.

How to Fix

Resource: google_vertex_ai_index_endpoint

• Arguments: public_endpoint_enabled

To fix this issue, set public_endpoint_enabled to false or do not include this parameter. [source,go]

resource "google_vertex_ai_index_endpoint" "default" { ...

• public_endpoint_enabled = true }

---