이 가이드에서는 특정 Vertex AI Workbench 관리형 노트북 인스턴스에 대한 액세스 권한을 부여하는 방법을 설명합니다.
Vertex AI 리소스에 대한 액세스를 관리하려면 액세스 제어에 대한 Vertex AI 페이지를 참조하세요.
인스턴스에서 Identity and Access Management(IAM) 정책을 설정하여 관리형 노트북 인스턴스에 대한 액세스 권한을 부여합니다.
이 정책은 사용자 또는 서비스 계정 같은 하나 이상의 주 구성원을 하나 이상의 역할에 바인딩합니다.
각 역할에는 주 구성원이 인스턴스와 상호작용할 수 있는 권한 목록이 포함됩니다.
최소 권한의 원칙에 따라 프로젝트, 폴더, 조직과 같은 상위 리소스 대신 인스턴스에 액세스 권한을 부여할 수 있습니다.
상위 리소스(예: 프로젝트)에 대한 액세스 권한을 부여하면 모든 하위 리소스(예: 해당 프로젝트의 모든 인스턴스)에 대한 액세스 권한이 암시적으로 부여됩니다. 리소스에 대한 액세스를 제한하려면 가급적 프로젝트 수준 이상이 아니라 하위 수준 리소스에 IAM 정책을 설정합니다.
예를 들어 Vertex AI Workbench와 관련없는 리소스에 대한 액세스 권한을 부여, 변경, 취소하는 방법(예: Google Cloud 프로젝트에 대한 액세스 권한 부여)에 대한 일반적인 정보는 리소스에 대한 액세스 권한 부여, 변경, 취소에 대한 IAM 문서를 참조하세요.
액세스 제한사항
주 구성원에게 할당하는 역할에 따라 인스턴스에 대한 액세스 권한에 광범위한 기능이 포함될 수 있습니다. 예를 들어 인스턴스 상태를 시작, 중지, 업그레이드, 모니터링할 수 있는 기능을 주 구성원에 부여할 수 있습니다. 사용 가능한 IAM 권한의 전체 목록은 사전 정의된 관리형 노트북 IAM 역할을 참조하세요.
하지만 주 구성원에게 관리형 노트북 인스턴스에 대한 전체 액세스 권한을 부여해도 인스턴스의 JupyterLab 인터페이스를 사용할 수 있는 권한은 부여되지 않습니다.
JupyterLab 인터페이스에 대한 액세스 권한을 부여하려면 관리형 노트북 인스턴스의 JupyterLab 인터페이스에 대한 액세스 관리를 참조하세요.
관리형 노트북 인스턴스에 대한 액세스 권한 부여
사용자에게 특정 관리형 노트북 인스턴스에 액세스할 수 있는 권한을 부여하려면 인스턴스에 IAM 정책을 설정합니다.
관리형 노트북 인스턴스의 주 구성원에 역할을 부여하려면 getIamPolicy 메서드를 사용해 현재 정책을 가져와 현재 정책의 액세스 권한을 수정한 후 setIamPolicy 메서드를 사용하여 인스턴스의 정책을 업데이트합니다.
현재 정책 가져오기
요청 데이터를 사용하기 전에 다음을 바꿉니다.
INSTANCE_NAME: 관리형 노트북 인스턴스의 이름
HTTP 메서드 및 URL:
GET https://notebooks.googleapis.com/v1/INSTANCE_NAME:getIamPolicy
주 구성원에게 관리형 노트북 인스턴스에 대한 액세스 권한을 부여해도 인스턴스의 JupyterLab 인터페이스를 사용할 수 있는 권한은 부여되지 않습니다.
JupyterLab 인터페이스에 대한 액세스 권한을 부여하려면 관리형 노트북 인스턴스의 JupyterLab 인터페이스에 대한 액세스 관리를 참조하세요.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-04(UTC)"],[],[],null,["# Manage access to a Vertex AI Workbench managed notebooks instance\n\nManage access to a managed notebooks instance\n=============================================\n\n\n| Vertex AI Workbench managed notebooks is\n| [deprecated](/vertex-ai/docs/deprecations). On\n| April 14, 2025, support for\n| managed notebooks will end and the ability to create managed notebooks instances\n| will be removed. Existing instances will continue to function\n| but patches, updates, and upgrades won't be available. To continue using\n| Vertex AI Workbench, we recommend that you\n| [migrate\n| your managed notebooks instances to Vertex AI Workbench instances](/vertex-ai/docs/workbench/managed/migrate-to-instances).\n\n\u003cbr /\u003e\n\nThis guide describes how you can grant access to\na specific Vertex AI Workbench managed notebooks instance.\nTo manage access to Vertex AI resources, see\nthe [Vertex AI page on access control](/vertex-ai/docs/general/access-control).\n\nYou grant access to a managed notebooks instance by setting an\n[Identity and Access Management (IAM) policy](/iam/docs/policies) on the instance.\nThe policy binds one or more principals, such as a user or a\nservice account, to one or more\n[roles](/vertex-ai/docs/workbench/managed/access-control#predefined-roles).\nEach role contains a list of permissions that let the principal interact\nwith the instance.\n\nYou can grant access to an instance, instead of to a parent resource\nsuch as a project, folder, or organization, to exercise the\nprinciple of [least privilege](/iam/docs/using-iam-securely#least_privilege).\n\nIf you grant access to a\n[parent resource](/iam/docs/resource-hierarchy-access-control)\n(for example, to a project), you implicitly grant access to all its child\nresources (for example, to all instances in that project). To limit access to\nresources, set IAM policies on lower-level resources when\npossible, instead of at the project level or above.\n\nFor general information about how to grant, change, and revoke access to\nresources unrelated to Vertex AI Workbench, for example, to grant access to\na Google Cloud project, see the IAM documentation for\n[Granting, changing, and revoking access\nto resources](/iam/docs/granting-changing-revoking-access).\n\n### Access limitations\n\nAccess to an instance can include a broad range of abilities, depending\non the role you assign to the principal. For example,\nyou might grant a principal the ability to start, stop, upgrade, and\nmonitor the health status of an instance. For the complete list of\nIAM permissions available, see [Predefined\nmanaged notebooks IAM\nroles](/vertex-ai/docs/workbench/managed/access-control#predefined-roles).\n\nHowever, even granting a principal full access to\na managed notebooks instance doesn't grant\nthe ability to use the instance's JupyterLab interface.\nTo grant access to the JupyterLab interface, see [Manage access to a\nmanaged notebooks instance's\nJupyterLab interface](/vertex-ai/docs/workbench/managed/manage-access-jupyterlab).\n\nGrant access to managed notebooks instances\n-------------------------------------------\n\nTo grant users permission to access\na specific managed notebooks instance,\nset an [IAM policy](/iam/docs/policies) on the instance.\n\nTo grant a role to a principal on\na managed notebooks instance, use the\n[`getIamPolicy`](/vertex-ai/docs/workbench/reference/rest/v1/projects.locations.runtimes/getIamPolicy)\nmethod to retrieve the current policy,\nedit the current policy's access, and then use the\n[`setIamPolicy`](/vertex-ai/docs/workbench/reference/rest/v1/projects.locations.runtimes/setIamPolicy)\nmethod to update the policy on the instance.\n\n### Retrieve the current policy\n\n\nBefore using any of the request data,\nmake the following replacements:\n\n- \u003cvar translate=\"no\"\u003eINSTANCE_NAME\u003c/var\u003e: The name of your managed notebooks instance\n\n\nHTTP method and URL:\n\n```\nGET https://notebooks.googleapis.com/v1/INSTANCE_NAME:getIamPolicy\n```\n\nTo send your request, choose one of these options: \n\n#### curl\n\n| **Note:** The following command assumes that you have logged in to the `gcloud` CLI with your user account by running [`gcloud init`](/sdk/gcloud/reference/init) or [`gcloud auth login`](/sdk/gcloud/reference/auth/login) , or by using [Cloud Shell](/shell/docs), which automatically logs you into the `gcloud` CLI . You can check the currently active account by running [`gcloud auth list`](/sdk/gcloud/reference/auth/list).\n\n\nExecute the following command:\n\n```\ncurl -X GET \\\n -H \"Authorization: Bearer $(gcloud auth print-access-token)\" \\\n \"https://notebooks.googleapis.com/v1/INSTANCE_NAME:getIamPolicy\"\n```\n\n#### PowerShell\n\n| **Note:** The following command assumes that you have logged in to the `gcloud` CLI with your user account by running [`gcloud init`](/sdk/gcloud/reference/init) or [`gcloud auth login`](/sdk/gcloud/reference/auth/login) . You can check the currently active account by running [`gcloud auth list`](/sdk/gcloud/reference/auth/list).\n\n\nExecute the following command:\n\n```\n$cred = gcloud auth print-access-token\n$headers = @{ \"Authorization\" = \"Bearer $cred\" }\n\nInvoke-WebRequest `\n -Method GET `\n -Headers $headers `\n -Uri \"https://notebooks.googleapis.com/v1/INSTANCE_NAME:getIamPolicy\" | Select-Object -Expand Content\n```\nThe response is the text of your instance's IAM policy. See the following for an example.\n\n```\n{\n \"bindings\": [\n {\n \"role\": \"roles/notebooks.viewer\",\n \"members\": [\n \"user:email@example.com\"\n ]\n }\n ],\n \"etag\": \"BwWWja0YfJA=\",\n \"version\": 3\n}\n```\n\n### Edit the policy\n\nEdit the policy with a text editor to add or remove principals and their\nassociated roles. For example, to grant the `notebooks.admin` role to\neve@example.com, add the following new binding to the policy\nin the `\"bindings\"` section: \n\n {\n \"role\": \"roles/notebooks.admin\",\n \"members\": [\n \"user:eve@example.com\"\n ]\n }\n\nAfter adding the new binding, the policy might look like the following: \n\n {\n \"bindings\": [\n {\n \"role\": \"roles/notebooks.viewer\",\n \"members\": [\n \"user:email@example.com\"\n ]\n },\n {\n \"role\": \"roles/notebooks.admin\",\n \"members\": [\n \"user:eve@example.com\"\n ]\n }\n ],\n \"etag\": \"BwWWja0YfJA=\",\n \"version\": 3\n }\n\n### Update the policy on the instance\n\nIn the body of the request, provide the updated IAM\npolicy from the previous step, nested inside a `\"policy\"` section.\n\n\nBefore using any of the request data,\nmake the following replacements:\n\n- \u003cvar translate=\"no\"\u003eINSTANCE_NAME\u003c/var\u003e: The name of your managed notebooks instance\n\n\nHTTP method and URL:\n\n```\nPOST https://notebooks.googleapis.com/v1/INSTANCE_NAME:setIamPolicy\n```\n\n\nRequest JSON body:\n\n```\n{\n \"policy\": {\n \"bindings\": [\n {\n \"role\": \"roles/notebooks.viewer\",\n \"members\": [\n \"user:email@example.com\"\n ]\n },\n {\n \"role\": \"roles/notebooks.admin\",\n \"members\": [\n \"user:eve@example.com\"\n ]\n }\n ],\n \"etag\": \"BwWWja0YfJA=\",\n \"version\": 3\n }\n}\n```\n\nTo send your request, choose one of these options: \n\n#### curl\n\n| **Note:** The following command assumes that you have logged in to the `gcloud` CLI with your user account by running [`gcloud init`](/sdk/gcloud/reference/init) or [`gcloud auth login`](/sdk/gcloud/reference/auth/login) , or by using [Cloud Shell](/shell/docs), which automatically logs you into the `gcloud` CLI . You can check the currently active account by running [`gcloud auth list`](/sdk/gcloud/reference/auth/list).\n\n\nSave the request body in a file named `request.json`,\nand execute the following command:\n\n```\ncurl -X POST \\\n -H \"Authorization: Bearer $(gcloud auth print-access-token)\" \\\n -H \"Content-Type: application/json; charset=utf-8\" \\\n -d @request.json \\\n \"https://notebooks.googleapis.com/v1/INSTANCE_NAME:setIamPolicy\"\n```\n\n#### PowerShell\n\n| **Note:** The following command assumes that you have logged in to the `gcloud` CLI with your user account by running [`gcloud init`](/sdk/gcloud/reference/init) or [`gcloud auth login`](/sdk/gcloud/reference/auth/login) . You can check the currently active account by running [`gcloud auth list`](/sdk/gcloud/reference/auth/list).\n\n\nSave the request body in a file named `request.json`,\nand execute the following command:\n\n```\n$cred = gcloud auth print-access-token\n$headers = @{ \"Authorization\" = \"Bearer $cred\" }\n\nInvoke-WebRequest `\n -Method POST `\n -Headers $headers `\n -ContentType: \"application/json; charset=utf-8\" `\n -InFile request.json `\n -Uri \"https://notebooks.googleapis.com/v1/INSTANCE_NAME:setIamPolicy\" | Select-Object -Expand Content\n```\n\nYou should receive a successful status code (2xx) and an empty response.\n\n### Grant access to the JupyterLab interface\n\nGranting a principal access to\na managed notebooks instance doesn't grant\nthe ability to use the instance's JupyterLab interface.\nTo grant access to the JupyterLab interface, see [Manage access to a\nmanaged notebooks instance's\nJupyterLab interface](/vertex-ai/docs/workbench/managed/manage-access-jupyterlab).\n\nWhat's next\n-----------\n\n- [Grant a principal access to\n JupyterLab.](/vertex-ai/docs/workbench/managed/manage-access-jupyterlab)\n\n- To learn about Identity and Access Management (IAM) and how\n IAM roles can help grant and restrict access,\n see the [IAM documentation](/iam/docs).\n\n- Learn about the [IAM roles available\n to Vertex AI Workbench\n managed notebooks](/vertex-ai/docs/workbench/managed/access-control).\n\n- Learn how to create and manage\n [custom roles](/iam/docs/creating-custom-roles).\n\n- To learn how to grant access to other Google resources, see\n [Manage access to\n other resources](/iam/docs/granting-changing-revoking-access)."]]
