Manage access to a managed notebooks instance's JupyterLab interface

Vertex AI Workbench managed notebooks isdeprecated. On April 14, 2025, support for managed notebooks ended and the ability to create managed notebooks instances was removed. Existing instances will continue to function until March 30, 2026, but patches, updates, and upgrades won't be available. To continue using Vertex AI Workbench, we recommend that youmigrate your managed notebooks instances to Vertex AI Workbench instances.

This page describes how to grant access to the JupyterLab interfaceof a Vertex AI Workbench managed notebooks instance.

You control access to a managed notebooks instance'sJupyterLab interface through the instance's access mode.You set a JupyterLab access mode when you createa managed notebooks instance.The access mode can't be changed after the notebook is created.

The JupyterLab access mode determines who can usethe instance's JupyterLab interface.The access mode also determines which credentials are used whenyour instance interacts with other Google Cloud services.

Access limitations

Granting a principal access toa managed notebooks instance's JupyterLab interfacedoesn't grant access to the instance itself. For example,to start, stop, or reset an instance, you must grant the principalaccess to perform those operations by setting anIAM policy on the instance.To grant access to the managed notebooks instance,seeManage access toa managed notebooks instance.

JupyterLab access modes

Managed notebooks instances support thefollowing access modes:

  • Single user only: TheSingle user only access modegrants access only to the user that you specify.

  • Service account: TheService account access modegrants access to a service account. You can grant access to one or moreusers through this service account.

Note: To grant access to the instance through the single user option or the service account, you must use an individual's user account email address. Group access is not supported.

Single user only

When you create a managed notebooks instancewithSingle user only access, you specify a user account.The specified user account is the only user with access tothe JupyterLab interface. Ifthe instance needs to accessother Google Cloud resources,this user account must also have accessto those Google Cloud resources.

Note: When you create a managed notebooks instancewithSingle user only access, your instance completes the boot processusing the Compute Engine default service account.Your specified user account can access the instance after the boot processis finished.

Grant access to a single user

To grant access to a single user, complete the following steps.

  1. Createa managed notebooks instancewith the following specifications:

    1. In theCreate instance dialog, intheIAM and security section, select theSingle user only access mode.

    2. In theUser email field, enter the user account that you wantto grant access.

  2. Complete the rest of the dialog, and then clickCreate.

Service account

When you create a managed notebooks instancewithService account access, you specify a service account. Ifthe instance needs to accessother Google resources, this service account must have access to thoseGoogle resources also.

When you specify a service account,choose one of the following:

  • Select the Compute Engine default service account.
  • Specify a custom service account. The custom service account must bein the same project as your managed notebooks instance.To create the instance, you must havetheiam.serviceAccounts.actAs permission on the service account.

To grant access to users through a service account,you grant theiam.serviceAccounts.actAs permission onthe specified service account for each user who needsto access JupyterLab.

Grant access to multiple users through a service account

  1. Createa managed notebooks instancewith the following specifications:

    1. In theCreate instance dialog, intheIAM and security section, select theService account access mode.

    2. Choose the Compute Engine default service accountor acustomservice account.

      • To use the Compute Engine default service account,selectUse Compute Engine default service account.

      • To use a custom service account, clearUse Compute Engine default service account, and then,in theService account email field, enteryour custom service account email address.

  2. Complete the rest of the dialog, and then clickCreate.

  3. For each user who needs to access JupyterLab,grant theiam.serviceAccounts.actAs permission on yourservice account.

Access mode metadata

The access mode that you configure duringmanaged notebooks instance creationis stored in the notebook metadata.

When you select theSingle user only access mode,Vertex AI Workbench stores a value forproxy-mode andproxy-user-mail.The following are examples of single user access metadata entries:

  • proxy-mode=mail
  • proxy-user-mail=user@example.com

When you select theService account access mode, Vertex AI Workbenchstores aproxy-mode=service_account metadata entry.

Caution: Changing the access mode metadata is not supported and can make theJupyterLab interface inaccessible.

What's next

Except as otherwise noted, the content of this page is licensed under theCreative Commons Attribution 4.0 License, and code samples are licensed under theApache 2.0 License. For details, see theGoogle Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.

Last updated 2025-12-15 UTC.