Vertex AI Vector Search: VPC Service Controls blocks unless identity_type is ANY_IDENTITY (vpc_sc_blocked)

Not specified by the original author.

Vertex AI Vector Search: VPC Service Controls blocks unless identitytype is ANYIDENTITY (vpcscblocked)

TL;DR

[Google Cloud VPC Service Controls troubleshooting]: Vertex AI API requests can still be blocked by VPC Service Controls even when you allowed them in an ingress or egress rule. If identitytype is ANYUSERACCOUNT or ANYSERVICEACCOUNT, the request gets blocked. Update identitytype to ANY_IDENTITY in the rule and it goes through.

Use this when you run into the situation in the title.

When not to use this skill: unrelated tasks. It covers only the procedure above.

Compatibility

The steps above apply to the commands named in them. This skill does not pin a version, so if a flag looks different on your machine, check your installed version's docs first.

Details

Context: Google Cloud VPC Service Controls troubleshooting: Vertex AI API requests can be blocked by VPC Service Controls even when you have allowed them in an ingress or egress rule. If the identitytype field is set to ANYUSERACCOUNT or ANYSERVICEACCOUNT, access is blocked. The fix is to update the identitytype field to ANY_IDENTITY in the ingress or egress rule. The same applies to user-managed notebooks API requests inside a perimeter.

Source: Google Cloud VPC Service Controls troubleshooting: Vertex AI API requests can be blocked by VPC Service Controls even when you have allowed them in an ingress or egress rule. If the identitytype field is set to ANYUSERACCOUNT or ANYSERVICEACCOUNT, access is blocked. The fix is to update the identitytype field to ANY_IDENTITY in the ingress or egress rule. The same applies to user-managed notebooks API requests inside a perimeter.

Verified resolution: [Google Cloud VPC Service Controls troubleshooting]: Vertex AI API requests can still be blocked by VPC Service Controls even when you allowed them in an ingress or egress rule. If identitytype is ANYUSERACCOUNT or ANYSERVICEACCOUNT, the request gets blocked. Update identitytype to ANY_IDENTITY in the rule and it goes through.

Source URL: https://docs.cloud.google.com/vpc-service-controls/docs/troubleshoot-services-within-perimeter