gcloud-vertexai-auto-upgrades: Automatic Upgrades Not Enabled for Vertex AI Notebooks

id: gcloud-vertexai-auto-upgrades

info:
  name: Automatic Upgrades Not Enabled for Vertex AI Notebooks
  author: princechaddha
  severity: medium
  description: |
    Ensure that automatic upgrades for Vertex AI Workbench notebook instances are enabled to get the latest features, performance improvements, and security updates without manual intervention. Once auto-upgrades are enabled, Vertex AI Workbench will check, during a recurring time period that you specify, whether your notebook instances can be upgraded, and if so, the service will upgrade your instances.
  impact: |
    Without automatic upgrades enabled, notebook instances may miss critical security updates, performance improvements, and new features. Manual upgrades require additional operational overhead and can lead to inconsistent environments.
  remediation: |
    Enable automatic upgrades for Vertex AI notebook instances using the 'gcloud workbench instances update' command with metadata parameter 'notebook-upgrade-schedule'. Example: --metadata 'notebook-upgrade-schedule=3 12 * * SUN' for weekly Sunday upgrades.
  reference:
    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/VertexAI/enable-auto-upgrades.html
    - https://cloud.google.com/vertex-ai/docs/workbench/user-managed/manage-instance
  tags: cloud,devops,gcp,gcloud,vertexai,security,upgrades,gcp-cloud-config

flow: |
  code(1)
  for(let projectId of iterate(template.projectIds)){
    set("projectId", projectId)
    code(2)
  }

self-contained: true

code:
  - engine:
      - sh
      - bash
    source: |
      gcloud projects list --format="json(projectId)"

    extractors:
      - type: json
        name: projectIds
        internal: true
        json:
          - '.[].projectId'

  - engine:
      - sh
      - bash
    source: |
      gcloud workbench instances describe tm-vertex-ai-notebook-instance --location=us-central1-a --project=$projectId --format="yaml(gceSetup.metadata.notebook-upgrade-schedule)"

    matchers:
      - type: word
        words:
          - "null"

    extractors:
      - type: dsl
        dsl:
          - '"Project " + projectId + " has Vertex AI notebook instances without automatic upgrades enabled"'
# digest: 4a0a0047304502204c9dcab870b9d74ffc92b4d124ae2c552cd7adc3c063df1c893eee8f1da63578022100d799039657b5ec98b9345069d8f38f00b0516c96be22e7a24057c45d767ac9e7:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.