Skip to main content
orphan · gcp

Vertex AI registry models deployed to no endpoint

resource types
1
rule IDs covered
1
severity
low

What does ZopNight detect here?

Vertex AI models sitting in the registry with deployedModelCount at 0 serve nothing. The registry itself is free, so ZopNight only surfaces a model when GCP billing attributed real spend to its UID. The shown figure is measured billing, never a fabricated storage estimate, and artifact cleanup is the real win.

Signal and threshold

How ZopNight evaluates Vertex AI registry models deployed to no endpoint.
Field Value
Rule IDsRC-1214
Categoryorphan
Severitylow
Metricnone — pure configuration read
Sourcevertex_orphan.go

The registry is free; the residue is not

Google documents the Model Registry itself as costing nothing: registering a model creates no standing charge, and serving costs belong to the endpoint it deploys to. So an undeployed model is not a monthly leak in the way an idle VM is. What it represents is clutter with attached spend: training residue billed against the model’s identity, and artifact bytes parked in Cloud Storage. The rule fires on models whose deployedModelCount reads exactly 0 and to which billing has attributed real spend; deleting them closes out that spend and, more importantly, prunes a registry where the next engineer can no longer tell live models from dead ones.

Discovered by polling, not asset inventory

Cloud Asset Inventory, ZopNight’s bulk discovery surface for most GCP resources, does not index aiplatform.googleapis.com/Model at all. Models are found by a live REST poller calling models.list per region, covered by the aiplatform.models.list permission inside roles/aiplatform.viewer, which also stamps each model’s deployment count. A model this rule names was therefore seen directly on the API, not inferred from a stale inventory snapshot.

Check deployment state per model

Terminal window
gcloud ai models list --region us-central1 \
--format="table(name,displayName,deployedModels.len())"

A zero in the last column reproduces the rule’s gate. Confirm the version is not staged for an imminent deployment before removing it.

Artifacts live in your bucket

Deleting the registry entry does not delete the artifact. Model files live in a GCS bucket in your project and bill to that bucket. Cleanup that actually recovers storage money means archiving or deleting the artifact folder too, after exporting anything with retraining value.

Firing conditions are narrow

Abstention covers most of the fleet by design: models whose deployment count is anything but a recorded “0”, and models with no billing-attributed cost, produce nothing. There is no minimum-age gate yet (GCP’s Model resource carries no last-undeployed timestamp), so treat a very recently created model that appears here with corresponding caution.

See it fire on your bill.

Connect an account read-only. The first findings land in minutes.

417 rule families across 353 resource types on 22 platforms. Every threshold, metric, and IAM action is documented on these pages before you grant anything.

417 rule families documented
353 resource types covered
read-only default access level
Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console· Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console·