Vertex AI Vector Search: VPC Service Controls blocks unless identity_type is ANY_IDENTITY (vpc_sc_blocked)

[Google Cloud VPC Service Controls troubleshooting]: Vertex AI API requests can still be blocked by VPC Service Controls even when you allowed them in an ingress or egress rule. If identitytype is ANYUSERACCOUNT or ANYSERVICEACCOUNT, the request gets blocked. Update identitytype to ANY_IDENTITY in the rule and it goes through.

Context: Google Cloud VPC Service Controls troubleshooting: Vertex AI API requests can be blocked by VPC Service Controls even when you have allowed them in an ingress or egress rule. If the identitytype field is set to ANYUSERACCOUNT or ANYSERVICEACCOUNT, access is blocked. The fix is to update the identitytype field to ANY_IDENTITY in the ingress or egress rule. The same applies to user-managed notebooks API requests inside a perimeter.

Source: Google Cloud VPC Service Controls troubleshooting: Vertex AI API requests can be blocked by VPC Service Controls even when you have allowed them in an ingress or egress rule. If the identitytype field is set to ANYUSERACCOUNT or ANYSERVICEACCOUNT, access is blocked. The fix is to update the identitytype field to ANY_IDENTITY in the ingress or egress rule. The same applies to user-managed notebooks API requests inside a perimeter.

Verified resolution: [Google Cloud VPC Service Controls troubleshooting]: Vertex AI API requests can still be blocked by VPC Service Controls even when you allowed them in an ingress or egress rule. If identitytype is ANYUSERACCOUNT or ANYSERVICEACCOUNT, the request gets blocked. Update identitytype to ANY_IDENTITY in the rule and it goes through.

Source URL: https://docs.cloud.google.com/vpc-service-controls/docs/troubleshoot-services-within-perimeter