このページでは、Vertex AI Workbench インスタンスの JupyterLab インターフェースへのアクセス権を付与する方法について説明します。
Vertex AI Workbench インスタンスの JupyterLab インターフェースへのアクセスは、インスタンスのアクセスモードを介して制御します。
Vertex AI Workbench インスタンスを作成するときに、JupyterLab のアクセスモードを設定します。ノートブックの作成後にアクセスモードを変更することはできません。
JupyterLab のアクセスモードによって、インスタンスの JupyterLab インターフェースを使用できるユーザーが決まります。また、インスタンスが他の Google Cloud サービスとやり取りするときに使用する認証情報もアクセスモードによって決まります。
アクセスの制限
Vertex AI Workbench インスタンスの JupyterLab インターフェースへのアクセス権をプリンシパルに付与しても、インスタンス自体へのアクセス権は付与されません。たとえば、インスタンスを起動、停止、リセットするには、そのインスタンスの IAM ポリシーを設定して、これらのオペレーションを実行するためのアクセス権をプリンシパルに付与する必要があります。Vertex AI Workbench インスタンスへのアクセス権を付与するには、Vertex AI Workbench インスタンスへのアクセスを管理するをご覧ください。
[[["わかりやすい","easyToUnderstand","thumb-up"],["問題の解決に役立った","solvedMyProblem","thumb-up"],["その他","otherUp","thumb-up"]],[["わかりにくい","hardToUnderstand","thumb-down"],["情報またはサンプルコードが不正確","incorrectInformationOrSampleCode","thumb-down"],["必要な情報 / サンプルがない","missingTheInformationSamplesINeed","thumb-down"],["翻訳に関する問題","translationIssue","thumb-down"],["その他","otherDown","thumb-down"]],["最終更新日 2025-09-04 UTC。"],[],[],null,["# Manage access to a Vertex AI Workbench instance's JupyterLab interface\n\nManage access to an instance's JupyterLab interface\n===================================================\n\nThis page describes how to grant access to the JupyterLab interface\nof a Vertex AI Workbench instance.\n\nYou control access to a Vertex AI Workbench instance's\nJupyterLab interface through the instance's access mode.\nYou set a JupyterLab access mode when you create\na Vertex AI Workbench instance.\nThe access mode can't be changed after the notebook is created.\n\nThe JupyterLab access mode determines who can use\nthe instance's JupyterLab interface.\nThe access mode also determines which credentials are used when\nyour instance interacts with other Google Cloud services.\n\nAccess limitations\n------------------\n\nGranting a principal access to\na Vertex AI Workbench instance's JupyterLab interface\ndoesn't grant access to the instance itself. For example,\nto start, stop, or reset an instance, you must grant the principal\naccess to perform those operations by setting an\n[IAM policy](/iam/docs/policies) on the instance.\nTo grant access to the Vertex AI Workbench instance,\nsee [Manage access to\na Vertex AI Workbench instance](/vertex-ai/docs/workbench/instances/manage-access).\n\nJupyterLab access modes\n-----------------------\n\nVertex AI Workbench instances support the\nfollowing access modes:\n\n- [Single user only](#single-user-only): The **Single user only** access mode\n grants access only to the user that you specify.\n\n- [Service account](#service-account): The **Service account** access mode\n grants access to a service account. You can grant access to one or more\n users through this service account.\n\n| **Note:** To grant access to the instance through the single user option or the service account, you must use an individual's user account email address. Group access is not supported.\n\nSingle user only\n----------------\n\nWhen you create a Vertex AI Workbench instance\nwith **Single user only** access, you specify a user account.\nThe specified user account is the only user with access to\nthe JupyterLab interface. If the specified user is not the creator of the\ninstance, you must grant the specified user the\n[Service Account User role](/iam/docs/service-accounts#user-role)\n(`roles/iam.serviceAccountUser`) on the instance's service account. If the\ninstance needs to access other Google Cloud resources, this\nservice account\nmust also have access to those Google Cloud resources.\n| **Note:** When you create a Vertex AI Workbench instance with **Single user only** access, your instance completes the boot process using the Compute Engine default service account. Your specified user account can access the instance after the boot process is finished.\n\n### Grant access to a single user\n\nTo grant access to a single user, complete the following steps.\n\n1. [Create\n a Vertex AI Workbench instance](/vertex-ai/docs/workbench/instances/create-console-quickstart)\n with the following specifications:\n\n 1. In the **Create instance** dialog, in\n the **IAM and security** section, select the **Single user only** access mode.\n\n 2. In the **User email** field, enter the user account that you want\n to grant access.\n\n2. Complete the rest of the dialog, and then click **Create**.\n\nService account\n---------------\n\nWhen you create a Vertex AI Workbench instance\nwith **Service account** access, you specify a service account. If\nthe instance needs to access\nother Google resources, this service account must have access to those\nGoogle resources also.\n\nWhen you specify a service account,\nchoose one of the following:\n\n- Select the Compute Engine default service account.\n- Specify a custom service account. The custom service account must be in the same project as your Vertex AI Workbench instance. To create the instance, you must have the `iam.serviceAccounts.actAs` permission on the service account.\n\nTo grant access to users through a service account,\nyou grant the `iam.serviceAccounts.actAs` permission on\nthe specified service account for each user who needs\nto access JupyterLab.\n\n### Grant access to multiple users through a service account\n\n1. [Create\n a Vertex AI Workbench instance](/vertex-ai/docs/workbench/instances/create-console-quickstart)\n with the following specifications:\n\n 1. In the **Create instance** dialog, in\n the **IAM and security** section, select the **Service account** access mode.\n\n 2. Choose the Compute Engine default service account\n or a [custom\n service account](/iam/docs/creating-managing-service-accounts).\n\n - To use the Compute Engine default service account,\n select **Use Compute Engine default service account**.\n\n - To use a custom service account, clear\n **Use Compute Engine default service account** , and then,\n in the **Service account email** field, enter\n your custom service account email address.\n\n2. Complete the rest of the dialog, and then click **Create**.\n\n3. For each user who needs to access JupyterLab,\n [grant the `iam.serviceAccounts.actAs` permission on your\n service account](/iam/docs/manage-access-service-accounts).\n\nAccess mode metadata\n--------------------\n\nThe access mode that you configure during\nVertex AI Workbench instance creation\nis stored in the notebook metadata.\n\nWhen you select the **Single user only** access mode,\nVertex AI Workbench stores a value for `proxy-mode` and `proxy-user-mail`.\nThe following are examples of single user access metadata entries:\n\n- `proxy-mode=mail`\n- `proxy-user-mail=user@example.com`\n\nWhen you select the **Service account** access mode, Vertex AI Workbench\nstores a `proxy-mode=service_account` metadata entry.\n| **Caution:** Changing the access mode metadata is not supported and can make the JupyterLab interface inaccessible.\n\nWhat's next\n-----------\n\n- [Grant a principal access to\n a Vertex AI Workbench instance.](/vertex-ai/docs/workbench/instances/manage-access)\n\n- To learn how to grant access to other Google resources, see\n [Manage access to\n other resources](/iam/docs/granting-changing-revoking-access)."]]
