> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Ensure that Private Service Connect endpoints are configured for your Vertex AI resources

### More Info:

Ensure that Private Service Connect endpoints are configured for your Vertex AI resources

### Risk Level

Medium

### Address

Security

### Compliance Standards

* CIS GCP

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        Below are step‑by‑step instructions to configure Private Service Connect (PSC) endpoints for Vertex AI using the Google Cloud Console.

        ***

        ## 1. Prerequisites

        1. Make sure the following APIs are enabled in your project:
           * Vertex AI API (`aiplatform.googleapis.com`)
           * Compute Engine API (`compute.googleapis.com`)
           * Service Networking API (`servicenetworking.googleapis.com`)
        2. You must have:
           * A VPC network and subnet in the region where your Vertex AI workloads run.
           * Permissions: `compute.admin` or equivalent, and DNS admin if you manage Cloud DNS.

        ***

        ## 2. Create a PSC endpoint for Google APIs (Vertex AI)

        1. In the console, go to:\
           **Navigation menu → VPC network → Private Service Connect**.
        2. Click **Create endpoint**.
        3. Under **Endpoint type**, select:
           * **“Access Google APIs”** (or similar wording like “Connect to Google APIs”).
        4. Configure the endpoint:
           * **Project**: your project.
           * **Network**: choose the VPC network your workloads use.
           * **Subnet**: choose the subnet your workloads are in (must have free IPs).
           * **Region**: same region where your Vertex AI resources run (e.g., `us-central1`).
           * **Endpoint IP address**: either let Google assign automatically or choose a specific internal IP from the subnet.
        5. In **Target Google APIs**:
           * Choose **“All Google APIs”** or **“Selected APIs”**.
           * If selecting, make sure the Vertex AI endpoint is included (`aiplatform.googleapis.com` or regional endpoint like `us-central1-aiplatform.googleapis.com` depending on UI).
        6. Click **Create** and wait for the endpoint state to become **Ready**.

        ***

        ## 3. Configure private DNS for Vertex AI

        You must route the Vertex AI API hostname(s) to your PSC endpoint’s internal IP.

        1. In the console, go to:\
           **Navigation menu → Network services → Cloud DNS**.
        2. Click **Create zone**.
        3. Create a private DNS zone:
           * **Zone type**: Private.
           * **Name**: e.g., `vertex-ai-private-zone`.
           * **DNS name** (pick one of these depending on how you access Vertex AI):
             * For regional endpoints: e.g., `us-central1-aiplatform.googleapis.com.`
             * Or for global: `aiplatform.googleapis.com.`\
               (Match how your clients call the API.)
           * **Network**: attach the same VPC network as your workloads.
        4. After the zone is created, click into it and create an **A record**:
           * **DNS name**: `@` (root of the zone, or leave empty in UI).
           * **Record type**: `A`.
           * **TTL**: e.g., `300`.
           * **IPv4 address**: the internal IP of your PSC endpoint (from step 2).
        5. Save the record.

        Repeat with additional zones/records if you use multiple regional Vertex AI endpoints.

        ***

        ## 4. Verify that traffic uses PSC

        From a VM or GKE Pod in the same VPC/subnet:

        1. Run a DNS lookup:
           * `nslookup us-central1-aiplatform.googleapis.com` (or your chosen hostname)\
             Ensure it resolves to your PSC endpoint’s internal IP.
        2. Call the Vertex AI API from inside the VPC:
           * If DNS is correct, the call is routed via the PSC endpoint (private IP), not over the public internet.

        ***

        ## 5. Use Vertex AI resources with PSC

        Once DNS is in place, no extra setting is needed in the Vertex AI resource itself. Any client (VM, GKE, Cloud Run with Serverless VPC Access connector, etc.) in that VPC that calls the Vertex AI endpoint hostname will automatically go through the PSC endpoint.

        If you use custom code or SDKs, ensure:

        * You call the same hostname for which you created the DNS zone (e.g., `us-central1-aiplatform.googleapis.com`).
        * You do not hardcode public IPs or bypass DNS.

        ***

        Following these steps ensures your Vertex AI traffic is routed privately via Private Service Connect.
      </Accordion>

      <Accordion title="Using CLI">
        Below is a concise, CLI‑only, step‑by‑step way to set up a Private Service Connect (PSC) endpoint so your Vertex AI traffic stays on your VPC.

        Assumptions (adapt as needed):

        * Project ID: `PROJECT_ID`
        * VPC network: `VPC_NETWORK`
        * PSC IP: `10.10.0.5` (must be unused and in a subnet range routed in your VPC)
        * Vertex region: `REGION` (e.g. `us-central1`)

        ***

        ### 1. Set project and variables

        ```bash theme={null}
        PROJECT_ID=PROJECT_ID
        VPC_NETWORK=VPC_NETWORK
        PSC_IP=10.10.0.5
        REGION=us-central1   # change to your Vertex AI region

        gcloud config set project $PROJECT_ID
        ```

        ***

        ### 2. Enable required APIs

        ```bash theme={null}
        gcloud services enable \
          aiplatform.googleapis.com \
          compute.googleapis.com \
          dns.googleapis.com
        ```

        ***

        ### 3. Reserve a global PSC address in your VPC

        ```bash theme={null}
        gcloud compute addresses create vertex-ai-psc-ip \
          --global \
          --purpose=PRIVATE_SERVICE_CONNECT \
          --addresses=$PSC_IP \
          --network=projects/$PROJECT_ID/global/networks/$VPC_NETWORK
        ```

        ***

        ### 4. Create the PSC forwarding rule for Google APIs / Vertex AI

        Option A – only Vertex AI via PSC (recommended if you want to scope it):

        ```bash theme={null}
        gcloud compute forwarding-rules create vertex-ai-psc-fr \
          --global \
          --network=projects/$PROJECT_ID/global/networks/$VPC_NETWORK \
          --address=vertex-ai-psc-ip \
          --target-google-apis-psc-target=$REGION-aiplatform.googleapis.com \
          --ports=443
        ```

        Option B – all Google APIs via PSC (Vertex AI included):

        ```bash theme={null}
        gcloud compute forwarding-rules create google-apis-psc-fr \
          --global \
          --network=projects/$PROJECT_ID/global/networks/$VPC_NETWORK \
          --address=vertex-ai-psc-ip \
          --target-google-apis-psc-target=all-apis \
          --ports=443
        ```

        Use only one of the options.

        ***

        ### 5. Create a private DNS zone for `googleapis.com`

        ```bash theme={null}
        gcloud dns managed-zones create googleapis-private-zone \
          --dns-name=googleapis.com. \
          --visibility=private \
          --networks=projects/$PROJECT_ID/global/networks/$VPC_NETWORK
        ```

        ***

        ### 6. Create DNS records for Vertex AI endpoint

        Vertex AI regional endpoint format:\
        `REGION-aiplatform.googleapis.com`\
        (e.g. `us-central1-aiplatform.googleapis.com`)

        ```bash theme={null}
        gcloud dns record-sets create $REGION-aiplatform.googleapis.com. \
          --zone=googleapis-private-zone \
          --type=A \
          --ttl=300 \
          --rrdatas=$PSC_IP
        ```

        If you also call the global endpoint `aiplatform.googleapis.com` (no region), add:

        ```bash theme={null}
        gcloud dns record-sets create aiplatform.googleapis.com. \
          --zone=googleapis-private-zone \
          --type=A \
          --ttl=300 \
          --rrdatas=$PSC_IP
        ```

        ***

        ### 7. Verify from a VM in the VPC

        From a VM in `VPC_NETWORK`:

        ```bash theme={null}
        nslookup $REGION-aiplatform.googleapis.com
        curl -s -o /dev/null -w "%{http_code}\n" \
          https://$REGION-aiplatform.googleapis.com/v1/projects/$PROJECT_ID/locations/$REGION
        ```

        You should see:

        * DNS resolving to `10.10.0.5`
        * HTTP status `200` or `401` (unauthorized is fine; it proves connectivity via PSC)

        Once this is in place, your Vertex AI traffic from that VPC will use the Private Service Connect endpoint instead of the public internet, remediating the misconfiguration.
      </Accordion>

      <Accordion title="Using Python">
        Below is a practical, step‑by‑step approach to ensure your Vertex AI traffic goes over a Private Service Connect (PSC) endpoint, with Python examples where the API supports it. Some PSC steps are still usually done with `gcloud`/Terraform, but I’ll show the Python API equivalents where possible.

        ***

        ## 1. Prerequisites

        1. A VPC network and subnet where your workloads run.
        2. `google-cloud-compute` and `google-cloud-aiplatform` libraries installed:

        ```bash theme={null}
        pip install google-cloud-compute google-cloud-aiplatform
        ```

        3. Vertex AI and Compute Engine APIs enabled for the project.

        ***

        ## 2. Identify the Vertex AI PSC Service Attachment

        Vertex AI exposes regional service attachments in the producer project `service-<PROJECT_NUMBER>@gcp-sa-aiplatform.iam.gserviceaccount.com`, but you don’t need to create them; Google manages them.

        For PSC to Google APIs (including Vertex AI), you typically use the Google‑managed producer:

        * `servicenetworking.googleapis.com` for private services access, or
        * regional service attachments exposed for Vertex AI in your region (e.g., `aiplatform.googleapis.com` via PSC).

        The PSC “endpoint” in your VPC is a forwarding rule pointing to a **service attachment** managed by Google.

        ***

        ## 3. Create a PSC Endpoint in Your VPC (Python)

        You create:

        1. An internal IP address.
        2. A PSC forwarding rule that points to the service attachment for Vertex AI in your region.

        ```python theme={null}
        from google.cloud import compute_v1

        PROJECT_ID = "your-project-id"
        REGION = "us-central1"
        NETWORK = "projects/your-project-id/global/networks/your-vpc"
        SUBNETWORK = f"projects/your-project-id/regions/{REGION}/subnetworks/your-subnet"

        # 1. Reserve an internal IP for the PSC endpoint
        def create_internal_ip():
            addresses_client = compute_v1.AddressesClient()
            address = compute_v1.Address(
                name="vertex-ai-psc-ip",
                address_type="INTERNAL",
                subnetwork=SUBNETWORK,
                purpose="GCE_ENDPOINT"
            )

            op = addresses_client.insert(
                project=PROJECT_ID,
                region=REGION,
                address_resource=address,
            )
            op.result()  # wait for completion

            return addresses_client.get(
                project=PROJECT_ID, region=REGION, address="vertex-ai-psc-ip"
            ).address

        # 2. Create the PSC forwarding rule
        def create_psc_forwarding_rule(ip_address: str):
            forwarding_rules_client = compute_v1.ForwardingRulesClient()

            # Replace with the actual Vertex AI service attachment for your region.
            # Example pattern (check documentation or `gcloud` describe):
            # service_attachment = "projects/123456789/regions/us-central1/serviceAttachments/aiplatform-us-central1"
            service_attachment = "projects/PRODUCER_PROJECT_NUMBER/regions/us-central1/serviceAttachments/aiplatform-us-central1"

            fr = compute_v1.ForwardingRule(
                name="vertex-ai-psc-endpoint",
                load_balancing_scheme="INTERNAL",
                network=NETWORK,
                subnetwork=SUBNETWORK,
                ip_address=ip_address,
                ip_protocol="TCP",
                ports=["443"],
                target=service_attachment,
                network_tier="PREMIUM"
            )

            op = forwarding_rules_client.insert(
                project=PROJECT_ID,
                region=REGION,
                forwarding_rule_resource=fr,
            )
            op.result()  # wait for completion

        ip = create_internal_ip()
        create_psc_forwarding_rule(ip)
        print(f"PSC endpoint IP: {ip}")
        ```

        Notes:

        * You must use the correct **service attachment name** for Vertex AI in your region. Get it via `gcloud compute service-attachments list --project=<producer>` or from Vertex AI PSC docs.
        * The endpoint is created in your consumer project’s VPC.

        ***

        ## 4. Configure DNS to Route Vertex AI Traffic to the PSC Endpoint

        Create a private DNS zone so `REGION-aiplatform.googleapis.com` (or the host you use) resolves to the PSC IP.

        You can do this with the Cloud DNS API, but it’s typically easier with `gcloud`. Python equivalent (simplified):

        ```python theme={null}
        from google.cloud import dns

        PROJECT_ID = "your-project-id"
        PSC_IP = ip  # from step 3
        REGION = "us-central1"

        def create_dns_zone_and_record():
            client = dns.Client(project=PROJECT_ID)

            zone_name = "vertex-ai-psc-zone"
            dns_name = "us-central1-aiplatform.googleapis.com."  # adjust region
            zone = client.zone(zone_name, dns_name)
            zone.create()  # create zone

            changes = zone.changes()
            record = zone.resource_record_set(
                dns_name=dns_name,
                record_type="A",
                ttl=300,
                rrdatas=[PSC_IP],
            )
            changes.add_record_set(record)
            changes.create()

        create_dns_zone_and_record()
        ```

        Important:

        * Use the exact hostname that your Vertex AI client will call (e.g. `us-central1-aiplatform.googleapis.com`).
        * Ensure this is a **private** zone linked to your VPC (Cloud DNS managed zone with appropriate `privateVisibilityConfig` if using REST/infra as code).

        ***

        ## 5. Use Vertex AI Over PSC from Python

        Once DNS is in place, your workloads in the VPC will resolve the Vertex AI regional endpoint to the PSC IP and route privately.

        Use the regional endpoint as usual:

        ```python theme={null}
        from google.cloud import aiplatform

        PROJECT_ID = "your-project-id"
        REGION = "us-central1"

        aiplatform.init(
            project=PROJECT_ID,
            location=REGION,
            # This endpoint host must match the DNS name you pointed to PSC
            api_endpoint=f"{REGION}-aiplatform.googleapis.com"
        )

        # Example: list models to confirm connectivity works
        models = aiplatform.Model.list()
        for m in models:
            print(m.resource_name)
        ```

        If DNS is correctly configured, no extra PSC-specific flags are required in the Vertex AI client; it simply resolves to the private IP and uses PSC.

        ***

        ## 6. Verification

        From a VM or container in the VPC:

        1. Check DNS resolution:

        ```bash theme={null}
        dig us-central1-aiplatform.googleapis.com
        ```

        It should return the PSC IP you created.

        2. Run a simple Vertex AI call (like the `Model.list()` above) and confirm:
           * The call succeeds.
           * In VPC Flow Logs (if enabled), traffic to the PSC IP (TCP/443) is visible, not to public IPs.

        ***

        If you share your region and whether you want the exact service‑attachment name lookup shown via `gcloud`, I can tailor the `service_attachment` field precisely for your case.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>