[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[[["\u003cp\u003eYou can use the \u003ccode\u003eGDCHRestrictedService\u003c/code\u003e policy type to grant or restrict access to Vertex AI Workbench for an entire organization or for specific projects.\u003c/p\u003e\n"],["\u003cp\u003eRestricting access to Vertex AI Workbench involves editing the \u003ccode\u003eGDCHRestrictedService\u003c/code\u003e policy and adding the \u003ccode\u003eaiplatform.gdc.goog\u003c/code\u003e API group and the \u003ccode\u003eNotebook\u003c/code\u003e kind to the \u003ccode\u003ekinds\u003c/code\u003e field.\u003c/p\u003e\n"],["\u003cp\u003eTo restrict access for a specific project, you must also specify the project namespace within the \u003ccode\u003enamespaces\u003c/code\u003e field of the \u003ccode\u003eGDCHRestrictedService\u003c/code\u003e policy.\u003c/p\u003e\n"],["\u003cp\u003eTo restore access to Vertex AI Workbench for an organization, either delete the \u003ccode\u003eGDCHRestrictedService\u003c/code\u003e resource entirely or remove the \u003ccode\u003eaiplatform.gdc.goog\u003c/code\u003e API group and the \u003ccode\u003eNotebook\u003c/code\u003e kind from the \u003ccode\u003ekinds\u003c/code\u003e field if other services are restricted.\u003c/p\u003e\n"]]],[],null,["# Control access to Vertex AI Workbench\n\nYou can grant and restrict access to Vertex AI Workbench for an\norganization or a project. To do so, you define an organization policy using the\n`GDCHRestrictedService` policy type, which lets you restrict which service you\ncan use on Google Distributed Cloud (GDC) air-gapped. When applied, the policy prevents the\nuse of the APIs that it references.\n\nFor example, you can use this policy type to restrict the use of\nVertex AI Workbench to specific projects. Only non-restricted\norganizations or projects can create or update JupyterLab notebooks. You can also\nuse the policy to completely restrict access to the\nVertex AI Workbench service because you want to run tests before allowing\nyour teams to use it.\n\nThis page describes how to grant and restrict access to\nVertex AI Workbench using the `GDCHRestrictedService` policy type. To\nlearn more about organization policies and how to edit the\n`GDCHRestrictedService` organization policy, see\n[Configure organization policies](/distributed-cloud/hosted/docs/latest/gdch/platform/pa-user/org-policy).\n\nBefore you begin\n----------------\n\nTo get the permissions you need to grant or restrict access to\nVertex AI Workbench for an organization or a project, ask your\nOrganization IAM Admin to grant you the GDC Restricted\nService Policy Admin (`gdchrestrictedservice-policy-admin`) cluster role in your\nproject namespace.\n\nFor more information about this role, see [Prepare IAM permissions](/distributed-cloud/hosted/docs/latest/gdch/application/ao-user/vertex-ai-ao-permissions).\n\nRestrict access to Vertex AI Workbench for your organization\n------------------------------------------------------------\n\nTo restrict access to Vertex AI Workbench for your organization, edit the\n`GDCHRestrictedService` policy type by adding the `aiplatform.gdc.goog` API\ngroup and the `Notebook` kind to the `kinds` field of the policy.\n\nThe following example shows how the `kinds` field looks in the\n`GDCHRestrictedService` policy type when you restrict access to\nVertex AI Workbench for your entire organization: \n\n apiVersion: constraints.gatekeeper.sh/v1beta1\n kind: GDCHRestrictedService\n metadata:\n name: restrict-notebook-for-organization\n spec:\n match:\n scope: \"Namespaced\"\n kinds:\n - apiGroups:\n - \"aiplatform.gdc.goog\"\n kinds:\n - Notebook\n\n [...]\n\nTo restore an organization's access to Vertex AI Workbench, see\n[Grant access to Vertex AI Workbench for your organization](#restore-org-access).\n\nRestrict access to Vertex AI Workbench for a project\n----------------------------------------------------\n\nTo restrict access to Vertex AI Workbench for a project, edit the\n`GDCHRestrictedService` policy type by adding the `aiplatform.gdc.goog` API\ngroup and the `Notebook` kind to the `kinds` field of the policy for the project\nnamespace.\n\nThe difference with [restricting access for an organization](#restrict-org-access)\nis that you must specify the namespace that the policy should impact. Add the\n`namespaces` field to the policy with your project namespace.\n\nThe following example shows how the `kinds` field looks in the\n`GDCHRestrictedService` policy type when you restrict access to\nVertex AI Workbench for a project: \n\n apiVersion: constraints.gatekeeper.sh/v1beta1\n kind: GDCHRestrictedService\n metadata:\n name: restrict-notebook-for-organization\n spec:\n match:\n scope: \"Namespaced\"\n namespaces: [\u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-nv\"\u003ePROJECT_NAMESPACE\u003c/span\u003e\u003c/var\u003e]\n kinds:\n - apiGroups:\n - \"aiplatform.gdc.goog\"\n kinds:\n - Notebook\n\n [...]\n\nReplace \u003cvar translate=\"no\"\u003ePROJECT_NAMESPACE\u003c/var\u003e with the namespace of the project\nwhere you want to restrict access to Vertex AI Workbench.\n\nGrant access to Vertex AI Workbench for your organization\n---------------------------------------------------------\n\nBy default, Distributed Cloud organizations have access to\nVertex AI Workbench. However, if you\n[restricted access to Vertex AI Workbench for your organization](#restrict-org-access),\nyou can grant access again.\n\nFollow these steps to grant access to Vertex AI Workbench for all the\nprojects in your organization:\n\n1. Identify the `GDCHRestrictedService` policy type in your organization.\n\n2. Find the `aiplatform.gdc.goog` API group and the `Notebook` kind in the\n policy.\n\n3. If the `aiplatform.gdc.goog` API group and the `Notebook` kind are the only\n content in the `kinds` field of the policy, delete the\n `GDCHRestrictedService` resource.\n\n4. If the `GDCHRestrictedService` policy contains other restricted services,\n remove the `aiplatform.gdc.goog` API group and the `Notebook` kind from the\n `kinds` field and save the changes to the policy.\n\n| **Note:** The `kinds` field must always contain a value."]]
