このページでは、ユーザー認証情報を使用して Google Cloud サービスと API にアクセスする Vertex AI Workbench インスタンスを作成する方法について説明します。
ユーザー認証情報は、Google アカウントに関連付けられている認証情報です。ユーザー認証情報によって、Google アカウントがアクセスできる Google Cloud サービスと API が決まります。
デフォルトでは、Vertex AI Workbench インスタンスでコードを実行すると、インスタンスのサービス アカウントに関連付けられた認証情報を使用して、インスタンスが Google Cloud サービスと API にアクセスできます。つまり、インスタンスにはサービス アカウントと同じ Google Cloud へのアクセス権が付与されます。
このページでは、ユーザー認証情報と同じ Google Cloud へのアクセス権を持つようにインスタンスを作成して構成する方法について説明します。
概要
Vertex AI Workbench は、グローバルな Google 管理の OAuth クライアントを使用して、ユーザー プロジェクトの Google Cloud リソースにスコープ設定されたユーザー認証情報のアクセスを管理します。ユーザーは、各 Vertex AI Workbench インスタンスの認証情報を管理するために、OAuth クライアントに同意する必要があります。これは、 Google Cloud コンソールで [JupyterLab を開く] ボタンをクリックしたときに開くダイアログで、インスタンスごとに 1 回行われます。
Vertex AI Workbench インスタンスの作成に使用されるサービス アカウントは、次のサービス エージェントです。
エンドユーザー認証情報が有効になっているインスタンスには、notebooks-managed-euc: true Compute Engine ラベルと euc-enabled: true メタデータキーが VM リソースに付加され、機能が有効になっていることを示します。
制限事項
プロジェクトを計画する際は、次の制限事項を考慮してください。
Vertex AI Workbench は、グローバルな Google 管理の OAuth クライアントを使用してユーザー認証情報のアクセスを管理します。組織は、きめ細かい制御を有効にしたり、OAuth クライアントにアクセスしたり、ロギングを使用して OAuth クライアントの使用状況を確認したりすることはできません。
マネージド ユーザー認証情報を使用して Vertex AI Workbench インスタンスのセキュリティを保護するため、ユーザーは次の操作を行うことができません。
SSH を使用してインスタンスにアクセスします。
起動後のスクリプトを実行します。
VM の詳細ページにアクセスします。
Google が作成したものではない画像を使用する。
OAuth クライアントは Google 管理の OAuth 認証情報のみをサポートしているため、サードパーティの認証情報の使用はサポートされていません。
始める前に
Sign in to your Google Cloud account. If you're new to
Google Cloud,
create an account to evaluate how our products perform in
real-world scenarios. New customers also get $300 in free credits to
run, test, and deploy workloads.
In the Google Cloud console, on the project selector page,
select or create a Google Cloud project.
Vertex AI Workbench インスタンスの作成に必要な権限を取得するには、プロジェクトに対する Notebooks ランナー （roles/notebooks.runner）の IAM ロールを付与するよう管理者に依頼してください。ロールの付与については、プロジェクト、フォルダ、組織に対するアクセス権の管理をご覧ください。
Vertex AI Workbench は、アプリケーションのデフォルト認証情報（ADC）を使用して、 Google Cloud サービスと API に対してユーザー認証情報を認証できます。このセクションでは、制限事項によりマネージド認証情報を有効にできない場合に、ユーザー認証情報を ADC に提供する方法について説明します。
[[["わかりやすい","easyToUnderstand","thumb-up"],["問題の解決に役立った","solvedMyProblem","thumb-up"],["その他","otherUp","thumb-up"]],[["わかりにくい","hardToUnderstand","thumb-down"],["情報またはサンプルコードが不正確","incorrectInformationOrSampleCode","thumb-down"],["必要な情報 / サンプルがない","missingTheInformationSamplesINeed","thumb-down"],["翻訳に関する問題","translationIssue","thumb-down"],["その他","otherDown","thumb-down"]],["最終更新日 2025-09-04 UTC。"],[],[],null,["Create an instance with user credential access\n| **Preview**\n|\n|\n| This feature is subject to the \"Pre-GA Offerings Terms\" in the General Service Terms section\n| of the [Service Specific Terms](/terms/service-terms#1).\n|\n| Pre-GA features are available \"as is\" and might have limited support.\n|\n| For more information, see the\n| [launch stage descriptions](/products#product-launch-stages).\n\nThis page describes how to create a Vertex AI Workbench instance that\naccesses Google Cloud services and APIs through your user credentials.\n\nYour user credentials are the credentials associated with your Google Account.\nYour user credentials determine which Google Cloud services and APIs your\nGoogle Account has access to.\n\nBy default, when you run code in a Vertex AI Workbench instance,\nyour instance can access Google Cloud services and APIs by using\nthe credentials associated with your instance's service account. This\nmeans that your instance has the same access to Google Cloud as\nthe service account.\n\nThis page describes how to create and configure an instance so that it\nhas the same access to Google Cloud as your user credentials.\n\nOverview\n\nVertex AI Workbench uses a global google-managed OAuth client\nto manage user credential access, scoped for the Google Cloud resources\nin the user's project. Users must grant consent to the OAuth Client to\nmanage their credentials for each Vertex AI Workbench instance.\nThis is done one time per instance through a dialog that opens when\nyou click the **Open JupyterLab** button in the Google Cloud console.\n\nThe service account used to create the Vertex AI Workbench instance is the\nfollowing service agent:\n\n`service-`\u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e`@gcp-sa-notebooks-vm.``iam.``gserviceaccount.``com`.\n\nThis service agent provides limited permissions for essential services such\nas exporting logs. Users can't specify a different service account\nif the end user credentials feature is enabled.\n\nInstances with end user credentials enabled have the `notebooks-managed-euc: true`\nCompute Engine label and the `euc-enabled: true` metadata key\nattached to the VM resource to denote the feature enablement.\n\nLimitations\n\nConsider the following limitations when you plan your project:\n\n- Vertex AI Workbench uses a global google-managed OAuth client\n to manage user credential access. Organizations can't\n enact fine grain controls, access the OAuth client, or use logging\n to check for use of the OAuth client.\n\n- To protect the security of Vertex AI Workbench instances with\n managed user credentials, **users aren't able to**:\n\n - Use SSH to access the instance.\n - Run a post-startup script.\n - Access the detailed VM page.\n - Use an image that isn't created by Google.\n- Using [third party\n credentials](/vertex-ai/docs/workbench/instances/create-third-party-instance)\n isn't supported because the OAuth client only supports Google-managed\n OAuth credentials.\n\nBefore you begin\n\n- Sign in to your Google Cloud account. If you're new to Google Cloud, [create an account](https://console.cloud.google.com/freetrial) to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.\n- In the Google Cloud console, on the project selector page,\n select or create a Google Cloud project.\n\n | **Note**: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.\n\n [Go to project selector](https://console.cloud.google.com/projectselector2/home/dashboard)\n-\n [Verify that billing is enabled for your Google Cloud project](/billing/docs/how-to/verify-billing-enabled#confirm_billing_is_enabled_on_a_project).\n\n-\n\n\n Enable the Notebooks API.\n\n\n [Enable the API](https://console.cloud.google.com/flows/enableapi?apiid=notebooks.googleapis.com&redirect=https://console.cloud.google.com)\n\n- In the Google Cloud console, on the project selector page,\n select or create a Google Cloud project.\n\n | **Note**: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.\n\n [Go to project selector](https://console.cloud.google.com/projectselector2/home/dashboard)\n-\n [Verify that billing is enabled for your Google Cloud project](/billing/docs/how-to/verify-billing-enabled#confirm_billing_is_enabled_on_a_project).\n\n-\n\n\n Enable the Notebooks API.\n\n\n [Enable the API](https://console.cloud.google.com/flows/enableapi?apiid=notebooks.googleapis.com&redirect=https://console.cloud.google.com)\n\n\u003cbr /\u003e\n\nRequired roles\n\n\nTo get the permissions that\nyou need to create a Vertex AI Workbench instance,\n\nask your administrator to grant you the\n\n\n[Notebooks Runner](/iam/docs/roles-permissions/notebooks#notebooks.runner) (`roles/notebooks.runner`)\nIAM role on the project.\n\n\nFor more information about granting roles, see [Manage access to projects, folders, and organizations](/iam/docs/granting-changing-revoking-access).\n\n\nYou might also be able to get\nthe required permissions through [custom\nroles](/iam/docs/creating-custom-roles) or other [predefined\nroles](/iam/docs/roles-overview#predefined).\n\nCreate a single user instance\n\nTo create a Vertex AI Workbench instance by using\nthe Google Cloud console, do the following:\n\n1. In the Google Cloud console, go to the **Instances** page.\n\n [Go to Instances](https://console.cloud.google.com/vertex-ai/workbench/instances)\n2. Click add_box **Create new**.\n\n3. In the **New instance** dialog, click **Advanced options**.\n\n4. In the **Create instance** dialog, in the **Details** section,\n provide the following information for your new instance:\n\n - **Name**: Provide a name for your new instance. The name must start with a letter followed by up to 62 lowercase letters, numbers, or hyphens (-), and cannot end with a hyphen.\n - **Region** and **Zone** : Select a region and zone for the new instance. For best network performance, select the region that is geographically closest to you. See the available [Vertex AI Workbench\n locations](/vertex-ai/docs/general/locations#instances).\n5. In the **IAM and Security** section, select **Single user**.\n\n6. In the **User email** field,\n enter the user account that you want to grant access. If the\n specified user is not the creator of the instance, you must grant\n the specified user the [Service Account User\n role](/iam/docs/service-account-permissions#user-role)\n (`roles/iam.serviceAccountUser`) on the instance's service account.\n\n7. Select **Enable managed end user credentials**.\n\n8. Complete the rest of the instance creation dialog, and then\n click **Create**.\n\n Vertex AI Workbench creates an instance and automatically starts it.\n When the instance is ready to use, Vertex AI Workbench\n activates an **Open JupyterLab** link in the Google Cloud console.\n9. Users must grant consent to the OAuth client to manage their credentials\n for each Vertex AI Workbench instance. This is done one time\n per instance. To grant consent, click **Open JupyterLab** and complete\n the dialog that appears.\n\n If you try to access the instance without granting consent, JupyterLab\n displays a message to authenticate by opening JupyterLab from the\n Google Cloud console.\n10. To verify that your end user credentials are available within JupyterLab,\n open a Terminal in JupyterLab, and enter the following command:\n\n ```bash\n gcloud auth list\n ```\n\nAuthenticate the instance with your user credentials\n\nVertex AI Workbench can use Application Default Credentials (ADC)\nto authenticate your user credentials to Google Cloud services and APIs.\nThis section describes how to provide your user credentials to ADC if any of\nthe limitations prevent you from enabling managed credentials.\n\nThe authentication steps depend on whether you are using a Google Account\nor third party credentials. \n\nGoogle Account\n\nAfter you can access JupyterLab on your instance, do the following:\n\n1. In the Google Cloud console, go to the **Instances** page.\n\n [Go to Instances](https://console.cloud.google.com/vertex-ai/workbench/instances)\n2. Next to your instance's name, click **Open JupyterLab**.\n\n3. In JupyterLab, select\n **File \\\u003e New \\\u003e Terminal**.\n\n4. In the terminal window, run the following:\n\n ```bash\n gcloud auth login\n ```\n5. Enter `Y`.\n\n6. Follow the instructions to copy a verification code and enter it into\n the terminal.\n\nThird party credentials\n\nIf you [created an instance with\nthird party credentials](/vertex-ai/docs/workbench/instances/create-third-party-instance),\nthen after the JupyterLab proxy is available, do the following:\n\n1. Open JupyterLab by using the federated JupyterLab proxy.\n\n2. In JupyterLab, select\n **File \\\u003e New \\\u003e Terminal**.\n\n3. Create a Workforce Identity Federation\n [credential file](/iam/docs/workforce-sign-in-okta) with headless sign-in.\n\n4. In the terminal window, run the following:\n\n ```bash\n gcloud auth login --cred-file=\"\u003cvar translate=\"no\"\u003eCREDENTIAL_FILE\u003c/var\u003e\"\n ```\n\n Replace \u003cvar translate=\"no\"\u003eCREDENTIAL_FILE\u003c/var\u003e with the path and name of the\n credential file that you created.\n5. Follow the instructions to authenticate through the\n third party authentication portal.\n\n6. Confirm that your credentials are accessible through your instance\n by using the following command:\n\n ```bash\n gcloud auth list\n ```"]]
