本页介绍了安全 AI 预定义折叠状态的 v1.0 版中扩展的预防性和检测政策。此安全状况包含两个政策集：
一个政策集，其中包含适用于 Vertex AI 工作负载的组织政策。
一个政策集，其中包含适用于 Vertex AI 工作负载的自定义 Security Health Analytics 检测器。
您可以使用此预定义状况来配置有助于保护 Gemini 和 Vertex AI 资源的安全状况。如果要部署此预定义状态，您必须自定义某些政策，使其应用于您的环境。
组织政策限制条件
下表介绍了此安全状况中包含的组织政策。
| 政策 | 说明 | 合规性标准 |
|---|---|---|
ainotebooks.accessMode |
此限制条件定义了可以访问 Vertex AI Workbench 笔记本和实例的访问模式。 采用此预定义折叠状态时，您必须配置此值。 |
NIST SP 800-53 对照组：AC-3(3) 和 AC-6(1) |
ainotebooks.disableFileDownloads |
此限制条件阻止在启用文件下载选项的情况下创建 Vertex AI Workbench 实例。默认情况下，可以在任何 Vertex AI Workbench 实例上启用文件下载选项。 值为 |
NIST SP 800-53 对照组：AC-3(1) |
ainotebooks.disableRootAccess |
此限制条件可防止新创建的 Vertex AI Workbench 用户管理的笔记本和实例启用 root 访问权限。默认情况下，Vertex AI Workbench 用户管理的笔记本和实例可以启用 root 访问权限。 值为 |
NIST SP 800-53 对照组：AC-3 和 AC-6(2) |
ainotebooks.disableTerminal |
此限制条件可防止在启用终端的情况下创建 Vertex AI Workbench 实例。默认情况下，可以在 Vertex AI Workbench 实例上启用终端。 值为 |
NIST SP 800-53 对照组：AC-3、AC-6 和 CM-2 |
ainotebooks.environmentOptions |
此限制条件定义了用户在创建新的 Vertex AI Workbench 笔记本和实例（其中会强制执行此限制条件）时可以选择的虚拟机和容器映像选项。必须明确列出要允许或拒绝的选项。 具体值如下：
policy_rules:
- values:
allowed_values:
- is:ainotebooks-vm/deeplearning-platform-release/image-family/tf-1-15-cpu
- is:ainotebooks-vm/deeplearning-platform-release/image-family/tf-2-1-cpu
- is:ainotebooks-vm/deeplearning-platform-release/image-family/tf-1-15-gpu
- is:ainotebooks-vm/deeplearning-platform-release/image-family/tf-2-1-gpu
- is:ainotebooks-vm/deeplearning-platform-release/image-family/caffe1-latest-cpu-experimental
- is:ainotebooks-vm/deeplearning-platform-release/image-name/r-3-6-cpu-experimental-20200617
- is:ainotebooks-vm/deeplearning-platform-release/image-name/tf2-ent-2-1-cpu-20200613
- is:ainotebooks-vm/deeplearning-platform-release/image-name/tf2-2-2-cu101-20200616
- is:ainotebooks-vm/deeplearning-platform-release/image-name/tf-1-15-cu100-20200615
- is:ainotebooks-vm/deeplearning-platform-release/image-name/pytorch-latest-cpu-20200615
- is:ainotebooks-container/gcr.io/deeplearning-platform-release/tf-gpu.1-15
- is:ainotebooks-container/gcr.io/deeplearning-platform-release/tf-cpu.1-15:latest
- is:ainotebooks-container/gcr.io/deeplearning-platform-release/tf-cpu.1-15:m48
- is:ainotebooks-container/gcr.io/deeplearning-platform-release/tf-cpu.1-15:m46
- is:ainotebooks-container/custom-container:latest
|
NIST SP 800-53 对照组：AC-3、AC-6 和 CM-2 |
ainotebooks.requireAutoUpgradeSchedule |
此限制条件要求新创建的 Vertex AI Workbench 用户管理的笔记本和实例设置了自动升级时间表。 值为 |
NIST SP 800-53 对照组：AU-9、CM-2 和 CM-6 |
ainotebooks.restrictPublicIp |
此限制条件会限制对新创建的 Vertex AI Workbench 笔记本和实例的公共 IP 访问权限。默认情况下，公共 IP 可以访问 Vertex AI Workbench 笔记本和实例。 值为 |
NIST SP 800-53 控件：AC-3、AC-4 和 SC-7 |
ainotebooks.restrictVpcNetworks |
此列表定义了在创建强制执行此限制条件的新 Vertex AI Workbench 实例时，用户可以选择的 VPC 网络。 采用此预定义折叠状态时，您必须配置此值。 |
NIST SP 800-53 对照组：AC-3、AC-4 和 CM-2 |
Security Health Analytics 检测器
下表介绍了预定义状态中包含的 Security Health Analytics 自定义模块。
| 检测器名称 | 适用的资源 | 说明 | 合规性标准 |
|---|---|---|---|
| vertexAIDataSetCMEKDisabled | aiplatform.googleapis.com/Dataset |
此检测器会检查是否任何数据集未使用客户管理的加密密钥 (CMEK) 进行加密。 如需解决此发现结果，请确认您创建了密钥和密钥环、设置了权限，以及在创建数据集时提供了密钥。有关说明，请参阅为您的资源配置 CMEK。 |
NIST SP 800-53 对照组：SC12 和 SC13 |
| vertexAIModelCMEKDisabled | aiplatform.googleapis.com/Model |
此检测器会检查模型是否未使用 CMEK 加密。 如需解决此发现结果，请验证您是否创建了密钥和密钥环、设置了权限，以及在创建模型时提供了密钥。有关说明，请参阅为您的资源配置 CMEK。 |
NIST SP 800-53 对照组：SC12 和 SC13 |
| vertexAIEndpointCMEKDisabled | aiplatform.googleapis.com/Endpoint |
此检测器会检查端点是否未使用 CMEK 加密。 如需解决此发现结果，请验证您是否创建了密钥和密钥环、设置了权限，以及在创建端点时是否提供了密钥。有关说明，请参阅为您的资源配置 CMEK。 |
NIST SP 800-53 对照组：SC12 和 SC13 |
| vertexAITrainingPipelineCMEKDisabled | aiplatform.googleapis.com/TrainingPipeline |
此检测器会检查训练流水线是否未使用 CMEK 进行加密。 如需解决此发现结果，请确认您创建了密钥和密钥环、设置了权限，以及在创建训练流水线时提供了密钥。有关说明，请参阅为您的资源配置 CMEK。 |
NIST SP 800-53 对照组：SC12 和 SC13 |
| vertexAIDataLabelingJobCMEKDisabled | aiplatform.googleapis.com/DataLabelingJob |
此检测器会检查数据标签是否未使用 CMEK 加密。 如需解决此发现结果，请验证您是否创建了密钥和密钥环，设置了权限，以及在创建数据标签时提供了密钥。有关说明，请参阅为您的资源配置 CMEK。 |
NIST SP 800-53 对照组：SC12 和 SC13 |
| vertexAICustomJobCMEKDisabled | aiplatform.googleapis.com/CustomJob |
此检测器会检查运行自定义工作负载的作业是否未使用 CMEK 进行加密。 如需解决此发现结果，请验证您在创建自定义作业时是否创建了密钥和密钥环、设置了权限，以及是否提供了该密钥。有关说明，请参阅为您的资源配置 CMEK。 |
NIST SP 800-53 对照组：SC12 和 SC13 |
| vertexAIDataLabelingJobHyperparameterTuningJobCMEKDisabled | aiplatform.googleapis.com/HyperparameterTuningJob |
此检测器会检查超参数调优作业是否未使用 CMEK 进行加密。 如需解决此发现结果，请验证您是否创建了密钥和密钥环、设置了权限，以及在创建超参数调节作业时是否提供了该密钥。有关说明，请参阅为您的资源配置 CMEK。 |
NIST SP 800-53 对照组：SC12 和 SC13 |
YAML 定义
以下是安全 AI 预定义状态的 YAML 定义。
name: organizations/123/locations/global/postureTemplates/secure_ai_extended
description: Posture Template to make your AI workload secure.
revision_id: v.1.0
state: ACTIVE
policy_sets:
- policy_set_id: Secure-AI policy_set
description: 8 org policies that new customers can automatically enable.
policies:
- policy_id: Define access mode for Vertex AI Workbench notebooks and instances
compliance_standards:
- standard: NIST SP 800-53
control: AC-3(3)
- standard: NIST SP 800-53
control: AC-6(1)
constraint:
org_policy_constraint:
canned_constraint_id: ainotebooks.accessMode
policy_rules:
- values:
allowed_values:
- is:service-account
- is:single-user
description: This list constraint defines the modes of access allowed to Vertex AI Workbench notebooks and instances where enforced. The allow or deny list can specify multiple users with the service-account mode or single-user access with the single-user mode. The access mode to be allowed or denied must be listed explicitly.
- policy_id: Disable file downloads on new Vertex AI Workbench instances
compliance_standards:
- standard: NIST SP 800-53
control: AC-3(1)
constraint:
org_policy_constraint:
canned_constraint_id: ainotebooks.disableFileDownloads
policy_rules:
- enforce: true
description: This boolean constraint, when enforced, prevents the creation of Vertex AI Workbench instances with the file download option enabled. By default, the file download option can be enabled on any Vertex AI Workbench instance.
- policy_id: Disable root access on new Vertex AI Workbench user-managed notebooks and instances
compliance_standards:
- standard: NIST SP 800-53
control: AC-3
- standard: NIST SP 800-53
control: AC-6(2)
constraint:
org_policy_constraint:
canned_constraint_id: ainotebooks.disableRootAccess
policy_rules:
- enforce: true
description: This boolean constraint, when enforced, prevents newly created Vertex AI Workbench user-managed notebooks and instances from enabling root access. By default, Vertex AI Workbench user-managed notebooks and instances can have root access enabled.
- policy_id: Disable terminal on new Vertex AI Workbench instances
compliance_standards:
- standard: NIST SP 800-53
control: AC-3
- standard: NIST SP 800-53
control: AC-6
- standard: NIST SP 800-53
control: CM-2
constraint:
org_policy_constraint:
canned_constraint_id: ainotebooks.disableTerminal
policy_rules:
- enforce: true
description: This boolean constraint, when enforced, prevents the creation of Vertex AI Workbench instances with the terminal enabled. By default, the terminal can be enabled on Vertex AI Workbench instances.
- policy_id: Restrict environment options on new Vertex AI Workbench notebooks and instances
compliance_standards:
- standard: NIST SP 800-53
control: AC-3
- standard: NIST SP 800-53
control: AC-6
- standard: NIST SP 800-53
control: CM-2
constraint:
org_policy_constraint:
canned_constraint_id: ainotebooks.environmentOptions
policy_rules:
- values:
allowed_values:
- is:ainotebooks-vm/deeplearning-platform-release/image-family/tf-1-15-cpu
- is:ainotebooks-vm/deeplearning-platform-release/image-family/tf-2-1-cpu
- is:ainotebooks-vm/deeplearning-platform-release/image-family/tf-1-15-gpu
- is:ainotebooks-vm/deeplearning-platform-release/image-family/tf-2-1-gpu
- is:ainotebooks-vm/deeplearning-platform-release/image-family/caffe1-latest-cpu-experimental
- is:ainotebooks-vm/deeplearning-platform-release/image-name/r-3-6-cpu-experimental-20200617
- is:ainotebooks-vm/deeplearning-platform-release/image-name/tf2-ent-2-1-cpu-20200613
- is:ainotebooks-vm/deeplearning-platform-release/image-name/tf2-2-2-cu101-20200616
- is:ainotebooks-vm/deeplearning-platform-release/image-name/tf-1-15-cu100-20200615
- is:ainotebooks-vm/deeplearning-platform-release/image-name/pytorch-latest-cpu-20200615
- is:ainotebooks-container/gcr.io/deeplearning-platform-release/tf-gpu.1-15
- is:ainotebooks-container/gcr.io/deeplearning-platform-release/tf-cpu.1-15:latest
- is:ainotebooks-container/gcr.io/deeplearning-platform-release/tf-cpu.1-15:m48
- is:ainotebooks-container/gcr.io/deeplearning-platform-release/tf-cpu.1-15:m46
- is:ainotebooks-container/custom-container:latest
description: "This list constraint defines the VM and container image options a user can select when creating new Vertex AI Workbench notebooks and instances where this constraint is enforced. The options to be allowed or denied must be listed explicitly. \n
The expected format for VM instances is ainotebooks-vm/PROJECT_ID/IMAGE_TYPE/CONSTRAINED_VALUE. Replace IMAGE_TYPE with image-family or image-name. Examples: ainotebooks-vm/deeplearning-platform-release/image-family/pytorch-1-4-cpu, ainotebooks-vm/deeplearning-platform-release/image-name/pytorch-latest-cpu-20200615. \n
The expected format for container images will be ainotebooks-container/CONTAINER_REPOSITORY:TAG. Examples: ainotebooks-container/gcr.io/deeplearning-platform-release/tf-gpu.1-15:latest, ainotebooks-container/gcr.io/deeplearning-platform-release/tf-gpu.1-15:m48."
- policy_id: Require automatic scheduled upgrades on new Vertex AI Workbench user-managed notebooks and instances
compliance_standards:
- standard: NIST SP 800-53
control: AU-9
- standard: NIST SP 800-53
control: CM-2
- standard: NIST SP 800-53
control: CM-6
constraint:
org_policy_constraint:
canned_constraint_id: ainotebooks.requireAutoUpgradeSchedule
policy_rules:
- enforce: true
description: This boolean constraint, when enforced, requires that newly created Vertex AI Workbench user-managed notebooks and instances have an automatic upgrade schedule set. The automatic upgrade schedule can be defined by using the `notebook-upgrade-schedule` metadata flag to specify a cron schedule for the automatic upgrades.
- policy_id: Restrict public IP access on new Vertex AI Workbench notebooks and instances
compliance_standards:
- standard: NIST SP 800-53
control: AC-3
- standard: NIST SP 800-53
control: AC-4
- standard: NIST SP 800-53
control: SC-7
constraint:
org_policy_constraint:
canned_constraint_id: ainotebooks.restrictPublicIp
policy_rules:
- enforce: true
description: This boolean constraint, when enforced, restricts public IP access to newly created Vertex AI Workbench notebooks and instances. By default, public IPs can access Vertex AI Workbench notebooks and instances.
- policy_id: Restrict VPC networks on new Vertex AI Workbench instances
compliance_standards:
- standard: NIST SP 800-53
control: AC-3
- standard: NIST SP 800-53
control: AC-4
- standard: NIST SP 800-53
control: CM-2
constraint:
org_policy_constraint:
canned_constraint_id: ainotebooks.restrictVpcNetworks
policy_rules:
- values:
allowed_values:
- is:organizations/ORGANIZATION_ID
- is:folders/FOLDER_ID
- is:projects/PROJECT_ID
- is:projects/PROJECT_ID/global/networks/NETWORK_NAME
description: This list constraint defines the VPC networks a user can select when creating new Vertex AI Workbench instances where this constraint is enforced. By default, a Vertex AI Workbench instance can be created with any VPC networks. The allowed or denied list of networks must be identified in the form.
- policy_set_id: Secure-AI SHA_policy_set
description: 5 custome SHA modules that new customers can automatically enable.
policies:
- policy_id: CMEK key is use for Vertex AI DataSet
compliance_standards:
- standard: NIST SP 800-53
control: SC-12
- standard: NIST SP 800-53
control: SC-13
constraint:
security_health_analytics_custom_module:
display_name: "vertexAIDataSetCMEKDisabled"
config:
customOutput: {}
predicate:
expression: "!has(resource.encryptionSpec)"
resource_selector:
resource_types:
- aiplatform.googleapis.com/Dataset
severity: CRITICAL
description: "When enforced, this detector finds if any Data Set is not encrypted using CMEK. CMEKs, managed via Cloud KMS, offer advanced control over key operations."
recommendation: "Restore SHA module- Reset the SHA module to its intended state. Consult documentation- Refer to the comprehensive guidance provided at
https://cloud.google.com/security-command-center/docs/custom-modules-sha-overview"
module_enablement_state: ENABLED
- policy_id: CMEK key is use for Vertex AI Model
compliance_standards:
- standard: NIST SP 800-53
control: SC-12
- standard: NIST SP 800-53
control: SC-13
constraint:
security_health_analytics_custom_module:
display_name: "vertexAIModelCMEKDisabled"
config:
customOutput: {}
predicate:
expression: "!has(resource.encryptionSpec)"
resource_selector:
resource_types:
- aiplatform.googleapis.com/Model
severity: CRITICAL
description: "When enforced, this detector finds if any Data Set is not encrypted using CMEK. CMEKs, managed via Cloud KMS, offer advanced control over key operations."
recommendation: "Restore SHA module- Reset the SHA module to its intended state. Consult documentation- Refer to the comprehensive guidance provided at
https://cloud.google.com/security-command-center/docs/custom-modules-sha-overview"
module_enablement_state: ENABLED
- policy_id: CMEK key is use for Vertex AI Endpoint
compliance_standards:
- standard: NIST SP 800-53
control: SC-12
- standard: NIST SP 800-53
control: SC-13
constraint:
security_health_analytics_custom_module:
display_name: "vertexAIEndpointCMEKDisabled"
config:
customOutput: {}
predicate:
expression: "!has(resource.encryptionSpec)"
resource_selector:
resource_types:
- aiplatform.googleapis.com/Endpoint
severity: CRITICAL
description: "When enforced, this detector finds if any Data Set is not encrypted using CMEK. CMEKs, managed via Cloud KMS, offer advanced control over key operations."
recommendation: "Restore SHA module- Reset the SHA module to its intended state. Consult documentation- Refer to the comprehensive guidance provided at
https://cloud.google.com/security-command-center/docs/custom-modules-sha-overview"
module_enablement_state: ENABLED
- policy_id: CMEK key is use for Vertex AI TrainingPipeline
compliance_standards:
- standard: NIST SP 800-53
control: SC-12
- standard: NIST SP 800-53
control: SC-13
constraint:
security_health_analytics_custom_module:
display_name: "vertexAITrainingPipelineCMEKDisabled"
config:
customOutput: {}
predicate:
expression: "!has(resource.encryptionSpec)"
resource_selector:
resource_types:
- aiplatform.googleapis.com/TrainingPipeline
severity: CRITICAL
description: "When enforced, this detector finds if any Data Set is not encrypted using CMEK. CMEKs, managed via Cloud KMS, offer advanced control over key operations."
recommendation: "Restore SHA module- Reset the SHA module to its intended state. Consult documentation- Refer to the comprehensive guidance provided at
https://cloud.google.com/security-command-center/docs/custom-modules-sha-overview"
module_enablement_state: ENABLED
- policy_id: CMEK key is use for Vertex AI DataLabelingJob
compliance_standards:
- standard: NIST SP 800-53
control: SC-12
- standard: NIST SP 800-53
control: SC-13
constraint:
security_health_analytics_custom_module:
display_name: "vertexAIDataLabelingJobCMEKDisabled"
config:
customOutput: {}
predicate:
expression: "!has(resource.encryptionSpec)"
resource_selector:
resource_types:
- aiplatform.googleapis.com/DataLabelingJob
severity: CRITICAL
description: "When enforced, this detector finds if any Data Set is not encrypted using CMEK. CMEKs, managed via Cloud KMS, offer advanced control over key operations."
recommendation: "Restore SHA module- Reset the SHA module to its intended state. Consult documentation- Refer to the comprehensive guidance provided at
https://cloud.google.com/security-command-center/docs/custom-modules-sha-overview"
module_enablement_state: ENABLED
- policy_id: CMEK key is use for Vertex AI CustomJob
compliance_standards:
- standard: NIST SP 800-53
control: SC-12
- standard: NIST SP 800-53
control: SC-13
constraint:
security_health_analytics_custom_module:
display_name: "vertexAICustomJobCMEKDisabled"
config:
customOutput: {}
predicate:
expression: "!has(resource.encryptionSpec)"
resource_selector:
resource_types:
- aiplatform.googleapis.com/CustomJob
severity: CRITICAL
description: "When enforced, this detector finds if any Data Set is not encrypted using CMEK. CMEKs, managed via Cloud KMS, offer advanced control over key operations."
recommendation: "Restore SHA module- Reset the SHA module to its intended state. Consult documentation- Refer to the comprehensive guidance provided at
https://cloud.google.com/security-command-center/docs/custom-modules-sha-overview"
module_enablement_state: ENABLED
- policy_id: CMEK key is use for Vertex AI HyperparameterTuningJob
compliance_standards:
- standard: NIST SP 800-53
control: SC-12
- standard: NIST SP 800-53
control: SC-13
constraint:
security_health_analytics_custom_module:
display_name: "vertexAIDataLabelingJobHyperparameterTuningJobCMEKDisabled"
config:
customOutput: {}
predicate:
expression: "!has(resource.encryptionSpec)"
resource_selector:
resource_types:
- aiplatform.googleapis.com/HyperparameterTuningJob
severity: CRITICAL
description: "When enforced, this detector finds if any Data Set is not encrypted using CMEK. CMEKs, managed via Cloud KMS, offer advanced control over key operations."
recommendation: "Restore SHA module- Reset the SHA module to its intended state. Consult documentation- Refer to the comprehensive guidance provided at
https://cloud.google.com/security-command-center/docs/custom-modules-sha-overview"
module_enablement_state: ENABLED