Manage access to a notebook

Manage access to a notebook

This page describes how you can grant and revoke access to a Colab Enterprise notebook (IPYNB file).

Before you begin

1. Sign in to your Google Cloud account. If you're new to Google Cloud, create an account to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.

2. In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

   Note: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.

   Go to project selector

3. Make sure that billing is enabled for your Google Cloud project.

4. Enable the Vertex AI, Dataform, and Compute Engine APIs.

   Enable the APIs

5. In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

   Note: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.

   Go to project selector

6. Make sure that billing is enabled for your Google Cloud project.

7. Enable the Vertex AI, Dataform, and Compute Engine APIs.

   Enable the APIs

Required roles

To ensure that your user account has the necessary permissions to manage access to a Colab Enterprise notebook, ask your administrator to grant your user account the Colab Enterprise Admin (roles/aiplatform.colabEnterpriseAdmin) IAM role on the project. For more information about granting roles, see Manage access.

Your administrator might also be able to give your user account the required permissions through custom roles or other predefined roles.

One or more of the required roles includes the dataform.repositories.list permission. Users who are granted the dataform.repositories.list permission or the Code Creator (roles/dataform.codeCreator) role in a project can list the names of code assets in that project by using the Dataform API or the Dataform command-line interface (CLI). Non-administrators using BigQuery Studio can only see code assets that they created or that were shared with them.

Grant access to a notebook

This section describes how to grant a principal access to a Colab Enterprise notebook.

Important: Users who have access to the notebook can see all output generated by code in the notebook. Users can see this output even if the output contains data from resources that they don't have access to. To prevent saved output from being shared, turn off notebook output saving.

To grant a principal access to a Colab Enterprise notebook, do the following:

1. In the Google Cloud console, go to the Colab Enterprise Notebooks page.

   Go to Notebooks

2. In the Region menu, select the region that contains your notebook.

3. Next to the notebook that you want to share, click the Notebook actions menu and select Share.

4. In the Share permissions window, click  Add user/group.

5. In the Add user/group dialog, in the New principals field, enter one or more principals with commas between them.

6. In the Role list, select one of the following roles:

   • Code Owner: Can perform any action on the notebook, including deleting or sharing it.
   • Code Editor: Can edit the notebook.
   • Code Viewer: Can view the notebook.
   The principal must also have the Notebook Runtime User (roles/aiplatform.notebookRuntimeUser) role to run the notebook.

7. Click Save.

Colab Enterprise principals are users, groups, or domains

You can grant access to users, groups, or domains. See the following table:

Principal	Example user account
Single user	[e-mail]
Google group	[e-mail]
Google Workspace domain	example.com

Turn off notebook output saving

To prevent sharing saved notebook output with other users who have access to the notebook file, you can turn off notebook output saving.

When you turn off output saving for a selected notebook, Colab Enterprise deletes all output saved in the notebook file and doesn't save the output of subsequent runs.

However, users who have access to the notebook can still view its output in the following ways:

• Run the notebook to view its current output. This output isn't saved.

• View an archival version of the notebook and its output in revision history.

To turn off output saving for a selected notebook, do the following:

1. In the Google Cloud console, go to the Colab Enterprise Notebooks page.

   Go to Notebooks

2. In the Region menu, select the region that contains your notebook.

3. Select the notebook for which you want to turn off output saving.

4. Click  Toggle header visibility > Edit > Notebook settings.

5. In the Notebook settings window, select Omit code cell output when saving this notebook.

6. Click Save.

7. Click Reload.

Revoke access to a notebook

To revoke access to a Colab Enterprise notebook:

1. In the Google Cloud console, go to the IAM page.

   Go to IAM

2. Select a project, folder, or organization.

3. Find the row containing the principal whose access you want to revoke. Then, click Edit principal in that row.

   Note: You cannot edit inherited roles when managing access to a resource. To edit inherited roles, go to the resource where the role was granted.

4. Click the Delete button for the role that you want to revoke, and then click Save.

What's next

• To learn how to grant access to a runtime template, see Manage access to a runtime template.