Cloud Build controls for generative AI use cases

This document includes the best practices and guidelines for Cloud Build when running generative AI workloads on Google Cloud. Use Cloud Build with Vertex AI to build, test, and deploy a serverless CI/CD platform on Google Cloud.

Consider the following use cases for Cloud Build with Vertex AI:

  • Automate ML pipeline builds: Cloud Build lets you automate the building and testing of your ML pipelines defined in Vertex AI Pipelines. This automation helps you build and deploy your models faster and with greater consistency.
  • Build custom container images for deployment: Cloud Build can build custom container images for your model-serving environments. Cloud Build lets you package your model code, dependencies, and runtime environment into a single image that you can deploy to Vertex AI Inference for serving predictions.
  • Integrate with CI/CD workflows: Cloud Build lets you automate the build and deployment of your ML models in your CI/CD workflows. This automation ensures that your models are up-to-date and deployed to production.
  • Trigger builds based on code changes: Cloud Build can automatically trigger builds when changes are made to your model code or pipeline definition. This automation helps to ensure that your models are built with the latest code and that any changes are automatically deployed to production.
  • Get scalable and secure infrastructure: Cloud Build uses Google Cloud scalable and secure infrastructure to build and deploy your models. This scalability means you don't need to worry about managing your own infrastructure and can focus on developing your models.
  • Support for various programming languages: Cloud Build supports various programming languages, including Python, Java, Go, and Node.js. This support lets you build your models using the language of your choice.
  • Use prebuilt build steps: To help simplify the build process, Cloud Build offers prebuilt build steps for common ML tasks, such as installing dependencies, running tests, and pushing images to container registries.
  • Create custom build steps: You can define your own custom build steps in Cloud Build to execute any arbitrary code during the build process.
  • Build artifacts for other Vertex AI services: Cloud Build can build artifacts for other Vertex AI services such as Vertex AI Feature Store and Vertex AI Data Labeling. This flexibility helps you build a complete ML workflow on Google Cloud.
  • Realize a cost-effective solution: Cloud Build offers a pay-as-you-go pricing model, so you only pay for the resources you use.

Required Cloud Build controls

The following controls are strongly recommended when using Cloud Build.

Define permitted private pools

Google control ID CBD-CO-6.1
Category Required
Description

The cloudbuild.allowedWorkerPools list constraint lets you define the permitted private pools that you can use within your organization, folder, or project.

Use one of the following formats to define an allowed or denied list of Worker Pools:

  • under:organizations/ORGANIZATION_ID
  • under:folders/FOLDER_ID
  • under:projects/PROJECT_ID
  • projects/PROJECT_ID/locations/REGION/workerPools/WORKER_POOL_ID
Applicable products
  • Organization Policy Service
  • Cloud Build
Path constraints/cloudbuild.allowedWorkerPools
Operator =
Type String
Related NIST-800-53 controls
  • AC-3
  • AC-5
  • AC-6
  • AC-12
  • AC-17
  • AC-20
Related CRI profile controls
  • PR.AC-3.1
  • PR.AC-3.2
  • PR.AC-4.1
  • PR.AC-4.2
  • PR.AC-4.3
  • PR.AC-6.1
  • PR.AC-7.1
  • PR.AC-7.2
  • PR.PT-3.1
  • PR-PT-4.1
Related information

Define which external services can invoke build triggers

Google control ID CBD-CO-6.2
Category Required
Description

The cloudbuild.allowedIntegrations constraint defines which external services (for example, GitHub) can invoke build triggers. For example, if your build trigger listens for changes to a GitHub repository and GitHub is denied in this constraint, your trigger won't run. You can specify any number of allowed or denied values for your organization or project.
Applicable products
  • Organization Policy Service
  • Cloud Build
Path constraints/cloudbuild.allowedIntegrations
Operator =
Type List
Related NIST-800-53 controls
  • AC-3
  • AC-12
  • AC-17
  • AC-20
Related CRI profile controls
  • PR.AC-3.1
  • PR.AC-3.2
  • PR.AC-4.1
  • PR.AC-4.2
  • PR.AC-4.3
  • PR.AC-6.1
  • PR.AC-7.1
  • PR.AC-7.2
  • PR.PT-3.1
  • PR-PT-4.1
Related information

Define permitted external IP addresses for VM instances

Google control ID CBD-CO-6.3
Category Required
Description

The compute.vmExternalIpAccess list constraint lets you restrict external access to virtual machines by not assigning external IP addresses. Configure this list constraint to deny all external IP addresses to virtual machines.
Applicable products
  • Organization Policy Service
  • Cloud Build
Path compute.vmExternalIpAccess
Operator =
Value
  • Deny All
Type List
Related NIST-800-53 controls
  • AC-3
  • AC-12
  • AC-17
  • AC-20
Related CRI profile controls
  • PR.AC-3.1
  • PR.AC-3.2
  • PR.AC-4.1
  • PR.AC-4.2
  • PR.AC-4.3
  • PR.AC-6.1
  • PR.AC-7.1
  • PR.AC-7.2
  • PR.PT-3.1
  • PR-PT-4.1
Related information

What's next