本頁面說明如何授予 Vertex AI Workbench 執行個體的 JupyterLab 介面存取權。
您可以透過執行個體的存取模式，控管 Vertex AI Workbench 執行個體的 JupyterLab 介面存取權。建立 Vertex AI Workbench 執行個體時，您會設定 JupyterLab 存取模式。筆記本建立後即無法變更存取模式。
JupyterLab 存取模式會決定誰可以使用執行個體的 JupyterLab 介面。存取模式也會決定執行個體與其他 Google Cloud 服務互動時使用的憑證。
存取限制
將主要存取權授予 Vertex AI Workbench 執行個體的 JupyterLab 介面，並不會授予對該執行個體的存取權。舉例來說，如要啟動、停止或重設執行個體，您必須在執行個體上設定 IAM 政策，授予主要使用者執行這些作業的存取權。如要授予 Vertex AI Workbench 執行個體的存取權，請參閱「管理 Vertex AI Workbench 執行個體的存取權」。
建立 單一使用者存取權的 Vertex AI Workbench 執行個體時，請指定使用者帳戶。指定的使用者帳戶是唯一可存取 JupyterLab 介面的使用者。如果指定使用者不是執行個體的建立者，您必須為該使用者授予執行個體服務帳戶的服務帳戶使用者角色 (roles/iam.serviceAccountUser)。如果執行個體需要存取其他 Google Cloud 資源，這個服務帳戶也必須具備存取這些 Google Cloud 資源的權限。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[],[],null,["# Manage access to a Vertex AI Workbench instance's JupyterLab interface\n\nManage access to an instance's JupyterLab interface\n===================================================\n\nThis page describes how to grant access to the JupyterLab interface\nof a Vertex AI Workbench instance.\n\nYou control access to a Vertex AI Workbench instance's\nJupyterLab interface through the instance's access mode.\nYou set a JupyterLab access mode when you create\na Vertex AI Workbench instance.\nThe access mode can't be changed after the notebook is created.\n\nThe JupyterLab access mode determines who can use\nthe instance's JupyterLab interface.\nThe access mode also determines which credentials are used when\nyour instance interacts with other Google Cloud services.\n\nAccess limitations\n------------------\n\nGranting a principal access to\na Vertex AI Workbench instance's JupyterLab interface\ndoesn't grant access to the instance itself. For example,\nto start, stop, or reset an instance, you must grant the principal\naccess to perform those operations by setting an\n[IAM policy](/iam/docs/policies) on the instance.\nTo grant access to the Vertex AI Workbench instance,\nsee [Manage access to\na Vertex AI Workbench instance](/vertex-ai/docs/workbench/instances/manage-access).\n\nJupyterLab access modes\n-----------------------\n\nVertex AI Workbench instances support the\nfollowing access modes:\n\n- [Single user only](#single-user-only): The **Single user only** access mode\n grants access only to the user that you specify.\n\n- [Service account](#service-account): The **Service account** access mode\n grants access to a service account. You can grant access to one or more\n users through this service account.\n\n| **Note:** To grant access to the instance through the single user option or the service account, you must use an individual's user account email address. Group access is not supported.\n\nSingle user only\n----------------\n\nWhen you create a Vertex AI Workbench instance\nwith **Single user only** access, you specify a user account.\nThe specified user account is the only user with access to\nthe JupyterLab interface. If the specified user is not the creator of the\ninstance, you must grant the specified user the\n[Service Account User role](/iam/docs/service-accounts#user-role)\n(`roles/iam.serviceAccountUser`) on the instance's service account. If the\ninstance needs to access other Google Cloud resources, this\nservice account\nmust also have access to those Google Cloud resources.\n| **Note:** When you create a Vertex AI Workbench instance with **Single user only** access, your instance completes the boot process using the Compute Engine default service account. Your specified user account can access the instance after the boot process is finished.\n\n### Grant access to a single user\n\nTo grant access to a single user, complete the following steps.\n\n1. [Create\n a Vertex AI Workbench instance](/vertex-ai/docs/workbench/instances/create-console-quickstart)\n with the following specifications:\n\n 1. In the **Create instance** dialog, in\n the **IAM and security** section, select the **Single user only** access mode.\n\n 2. In the **User email** field, enter the user account that you want\n to grant access.\n\n2. Complete the rest of the dialog, and then click **Create**.\n\nService account\n---------------\n\nWhen you create a Vertex AI Workbench instance\nwith **Service account** access, you specify a service account. If\nthe instance needs to access\nother Google resources, this service account must have access to those\nGoogle resources also.\n\nWhen you specify a service account,\nchoose one of the following:\n\n- Select the Compute Engine default service account.\n- Specify a custom service account. The custom service account must be in the same project as your Vertex AI Workbench instance. To create the instance, you must have the `iam.serviceAccounts.actAs` permission on the service account.\n\nTo grant access to users through a service account,\nyou grant the `iam.serviceAccounts.actAs` permission on\nthe specified service account for each user who needs\nto access JupyterLab.\n\n### Grant access to multiple users through a service account\n\n1. [Create\n a Vertex AI Workbench instance](/vertex-ai/docs/workbench/instances/create-console-quickstart)\n with the following specifications:\n\n 1. In the **Create instance** dialog, in\n the **IAM and security** section, select the **Service account** access mode.\n\n 2. Choose the Compute Engine default service account\n or a [custom\n service account](/iam/docs/creating-managing-service-accounts).\n\n - To use the Compute Engine default service account,\n select **Use Compute Engine default service account**.\n\n - To use a custom service account, clear\n **Use Compute Engine default service account** , and then,\n in the **Service account email** field, enter\n your custom service account email address.\n\n2. Complete the rest of the dialog, and then click **Create**.\n\n3. For each user who needs to access JupyterLab,\n [grant the `iam.serviceAccounts.actAs` permission on your\n service account](/iam/docs/manage-access-service-accounts).\n\nAccess mode metadata\n--------------------\n\nThe access mode that you configure during\nVertex AI Workbench instance creation\nis stored in the notebook metadata.\n\nWhen you select the **Single user only** access mode,\nVertex AI Workbench stores a value for `proxy-mode` and `proxy-user-mail`.\nThe following are examples of single user access metadata entries:\n\n- `proxy-mode=mail`\n- `proxy-user-mail=user@example.com`\n\nWhen you select the **Service account** access mode, Vertex AI Workbench\nstores a `proxy-mode=service_account` metadata entry.\n| **Caution:** Changing the access mode metadata is not supported and can make the JupyterLab interface inaccessible.\n\nWhat's next\n-----------\n\n- [Grant a principal access to\n a Vertex AI Workbench instance.](/vertex-ai/docs/workbench/instances/manage-access)\n\n- To learn how to grant access to other Google resources, see\n [Manage access to\n other resources](/iam/docs/granting-changing-revoking-access)."]]
