id: gcloud-vertexai-auto-upgrades

info:
  name: Automatic Upgrades Not Enabled for Vertex AI Notebooks
  author: princechaddha
  severity: medium
  description: |
    Ensure that automatic upgrades for Vertex AI Workbench notebook instances are enabled to get the latest features, performance improvements, and security updates without manual intervention. Once auto-upgrades are enabled, Vertex AI Workbench will check, during a recurring time period that you specify, whether your notebook instances can be upgraded, and if so, the service will upgrade your instances.
  impact: |
    Without automatic upgrades enabled, notebook instances may miss critical security updates, performance improvements, and new features. Manual upgrades require additional operational overhead and can lead to inconsistent environments.
  remediation: |
    Enable automatic upgrades for Vertex AI notebook instances using the 'gcloud workbench instances update' command with metadata parameter 'notebook-upgrade-schedule'. Example: --metadata 'notebook-upgrade-schedule=3 12 * * SUN' for weekly Sunday upgrades.
  reference:
    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/VertexAI/enable-auto-upgrades.html
    - https://cloud.google.com/vertex-ai/docs/workbench/user-managed/manage-instance
  tags: cloud,devops,gcp,gcloud,vertexai,security,upgrades,gcp-cloud-config,ai

flow: |
  code(1)
  for(let projectId of iterate(template.projectIds)){
    set("projectId", projectId)
    code(2)
  }

self-contained: true

code:
  - engine:
      - sh
      - bash
    source: |
      gcloud projects list --format="json(projectId)"

    extractors:
      - type: json
        name: projectIds
        internal: true
        json:
          - '.[].projectId'

  - engine:
      - sh
      - bash
    source: |
      gcloud workbench instances describe tm-vertex-ai-notebook-instance --location=us-central1-a --project=$projectId --format="yaml(gceSetup.metadata.notebook-upgrade-schedule)"

    matchers:
      - type: word
        words:
          - "null"

    extractors:
      - type: dsl
        dsl:
          - '"Project " + projectId + " has Vertex AI notebook instances without automatic upgrades enabled"'
# digest: 4a0a00473045022020ecc91c5e20e5b7a7e8c81a75e6f0841c2a8e6f6e10db7cd8c37cc485b65da8022100893a110acd719ebeb5da50f7aa6a9898afdc77259277fe618ce3312d34e5a494:922c64590222798bb761d5b6d8e72950