TPU VM에 연결할 사용자에게 roles/iap.tunnelResourceAccessor와 roles/tpu.admin을 부여합니다.
공개 IP 주소가 없는 TPU VM을 만듭니다.
--tunnel-through-iap 옵션을 사용하여 TPU VM에 연결합니다.
비공개 Google 액세스 사용 설정
IAP를 사용하려면 외부 IP 주소가 없는 VM에 연결할 수 있게 해주는 비공개 Google 액세스를 사용 설정해야 합니다. 다음 명령어에서 your-subnet을 TPU VM을 만들려는 서브넷의 이름으로 바꾸고 your-region을 TPU VM이 배치되는 리전으로 바꿉니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-04(UTC)"],[],[],null,["# Connect to a TPU VM without a public IP address\n===============================================\n\nIf your organization has a `constraints/compute.vmExternalIpAccess` organization\npolicy constraint, you need to create TPU VMs that don't have an external IP\naddress. To connect to a TPU VM without an external IP address, you need to:\n\n1. Enable [Private Google Access](/vpc/docs/private-google-access) for the subnet where you will create a TPU VM.\n2. Grant `roles/iap.tunnelResourceAccessor` and `roles/tpu.admin` to users who will connect to the TPU VMs.\n3. Create a TPU VM without a public IP address.\n4. Connect to your TPU VM using `--tunnel-through-iap` option.\n\nEnable Private Google Access\n----------------------------\n\nTo use an IAP, you must enable Private Google Access which lets you connect\nto VMs that don't have external IP addresses. In the following command replace\n\u003cvar translate=\"no\"\u003eyour-subnet\u003c/var\u003e with the name of the subnet where you will create the TPU\nVM and \u003cvar translate=\"no\"\u003eyour-region\u003c/var\u003e with the region where the TPU VM will be located. \n\n```bash\ngcloud compute networks subnets update your-subnet \\\n--region=your-region \\\n--enable-private-ip-google-access\n```\n\nGrant permissions\n-----------------\n\nUsers that need to connect to the TPU VMs using SSH that don't have public IP\naddresses must be granted the iap.tunnelResourceAccessor role. For more\ninformation about granting a role, see\n[Granting an IAM Role](/iam/docs/granting-changing-revoking-access#grant-single-role).\n\nCreate a TPU VM without a public IP address\n-------------------------------------------\n\nThe following command shows how to create a TPU VM with no public IP address. \n\n```bash\ngcloud compute tpus tpu-vm create tpu-vm-name \\\n --zone $ZONE \\\n --project your-project \\\n --internal-ips \\\n --version tpu-vm-tf-2.17.1-pjrt \\\n --accelerator-type v2-8 \\\n --subnetwork your-subnet \\\n```\n\nConnect to your TPU VM using SSH with IAP tunneling\n---------------------------------------------------\n\nThe following command shows how to connect to a TPU VM using IAP tunneling. \n\n```bash\ngcloud alpha compute tpus tpu-vm ssh tpu-vm-name --tunnel-through-iap\n```"]]
