Vertex AI runtime is not encrypted with a Customer Managed Key (CMK) misconfiguration detected in co

Rule Details

Cortex AppSec Rule ID	APPSEC2_GCP_35
Category - Subcategory	Storage - Encryption
Provider	GCP
Severity	MEDIUM
Framework	Terraform, Terraform Plan

Impact

This rule's function is to assure that the runtime for Vertex AI, a Google Cloud service focused on machine learning, is encrypted using a Customer Managed Key, or CMK, rather than a default or auto-generated key.

The lack of such encryption could expose data to security threats. A CMK offers an additional protection layer, since the customer fully manages the key's rotation, revocation, and audit logging. If one doesn't use a CMK, control over these elements is lost, increasing the risk of unauthorized access or data breaches.

How to Fix

Resource: google_notebooks_runtime

• Arguments: virtual_machine.virtual_machine_config.encryption_config.kms_key

To fix this issue, you need to ensure that the Vertex AI runtime is set to be encrypted with a customer-managed key (CMK).

In general, managing keys on your own adds an extra layer of security to your applications. It also gives you more control over how and when those keys are used and retired. [source,go]

resource "google_notebooks_runtime" "example" { ... virtual_machine { virtual_machine_config { encryption_config { kms_key = "an-actual-key" } ... } } }