Automatic Upgrades Not Enabled for Vertex AI Notebooks

ID: gcloud-vertexai-auto-upgrades

Severity: medium

Author: princechaddha

Tags: cloud,devops,gcp,gcloud,vertexai,security,upgrades,gcp-cloud-config

Description

Ensure that automatic upgrades for Vertex AI Workbench notebook instances are enabled to get the latest features, performance improvements, and security updates without manual intervention. Once auto-upgrades are enabled, Vertex AI Workbench will check, during a recurring time period that you specify, whether your notebook instances can be upgraded, and if so, the service will upgrade your instances.

YAML Source

id: gcloud-vertexai-auto-upgrades

info:
  name: Automatic Upgrades Not Enabled for Vertex AI Notebooks
  author: princechaddha
  severity: medium
  description: |
    Ensure that automatic upgrades for Vertex AI Workbench notebook instances are enabled to get the latest features, performance improvements, and security updates without manual intervention. Once auto-upgrades are enabled, Vertex AI Workbench will check, during a recurring time period that you specify, whether your notebook instances can be upgraded, and if so, the service will upgrade your instances.
  impact: |
    Without automatic upgrades enabled, notebook instances may miss critical security updates, performance improvements, and new features. Manual upgrades require additional operational overhead and can lead to inconsistent environments.
  remediation: |
    Enable automatic upgrades for Vertex AI notebook instances using the 'gcloud workbench instances update' command with metadata parameter 'notebook-upgrade-schedule'. Example: --metadata 'notebook-upgrade-schedule=3 12 * * SUN' for weekly Sunday upgrades.
  reference:
    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/VertexAI/enable-auto-upgrades.html
    - https://cloud.google.com/vertex-ai/docs/workbench/user-managed/manage-instance
  tags: cloud,devops,gcp,gcloud,vertexai,security,upgrades,gcp-cloud-config

flow: |
  code(1)
  for(let projectId of iterate(template.projectIds)){
    set("projectId", projectId)
    code(2)
  }

self-contained: true

code:
  - engine:
      - sh
      - bash
    source: |
      gcloud projects list --format="json(projectId)"

    extractors:
      - type: json
        name: projectIds
        internal: true
        json:
          - '.[].projectId'

  - engine:
      - sh
      - bash
    source: |
      gcloud workbench instances describe tm-vertex-ai-notebook-instance --location=us-central1-a --project=$projectId --format="yaml(gceSetup.metadata.notebook-upgrade-schedule)"

    matchers:
      - type: word
        words:
          - "null"

    extractors:
      - type: dsl
        dsl:
          - '"Project " + projectId + " has Vertex AI notebook instances without automatic upgrades enabled"'
# digest: 4a0a0047304502204c9dcab870b9d74ffc92b4d124ae2c552cd7adc3c063df1c893eee8f1da63578022100d799039657b5ec98b9345069d8f38f00b0516c96be22e7a24057c45d767ac9e7:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "cloud/gcp/vertexai/gcloud-vertexai-auto-upgrades.yaml"

View on Github