Google CloudOverview
AI inference endpoints should produce enough telemetry to investigate abuse, prompt injection attempts, anomalous invocation volume, data leakage, and unauthorized access. Missing endpoint logging makes AI incidents difficult to detect and reconstruct.
Remediation guidance
Remediation
Enable access logging and container logging for AI endpoints. Route logs to the approved SIEM or monitoring pipeline with retention aligned to incident response requirements.
- Enable endpoint access logging.
- Avoid disabling deployed model container logs unless approved.
- Add monitoring for spikes, failures, unusual callers, and denied requests.
Query logic
These are the stored checks tied to this control.
AI endpoint access logging should be enabled
Connectors
Google Cloud
Covered asset types
AI ServicesEndpointLogging
Expected check: eq []
{
vertexAIEndpoints(where: { deployedModels_SOME: { OR: [ { enableAccessLogging: { eq: false } } { disableContainerLogging: { eq: true } } ] } }) { ...AssetFragment }
}
