User-managed notebooks instances have a specific set of Identity and Access Management (IAM) roles. Each predefined role contains a set of permissions.
You can use an IAM policy to grant a principal one or more IAM roles. Each IAM role contains permissions that grant the principal access to specific resources.
User-managed notebooks IAM permissions are used to manage instances (create, delete, modify user-managed notebooks instances by using Notebooks API). For configuring JupyterLab access please refer to this document.
What is IAM?
Google Cloud offers IAM, which lets you give granular access to specific Google Cloud resources and prevents unwanted access to other resources. IAM lets you adopt the security principle of least privilege, so you grant only the necessary access to your resources.
IAM lets you control who has what
permission to which resources by setting IAM policies.
IAM policies grant specific role(s) to a principal,
giving the principal specific permissions. For example, for a specific resource,
such as a project, you can assign the roles/notebooks.viewer role to
a user to allow that user to view notebooks within that project.
To learn more, read the IAM documentation.
Accessing the JupyterLab web interface of a user-managed notebooks instance
When you create a user-managed notebooks instance, user-managed notebooks, by default, grants a service account access to the JupyterLab web interface. To grant a user access to the JupyterLab web interface, you must grant the user access to the service account used by the user-managed notebooks instance. To troubleshoot problems with accessing the web interface, see the Vertex AI troubleshooting guide.
Learn more about service accounts and how to grant access to service accounts.
Predefined user-managed notebooks IAM roles
With IAM, every API method in user-managed notebooks requires that the identity making the API request has the appropriate permissions to use the resource. Permissions are granted by setting policies that grant roles to a principal (user, group, or service account) of your project.
In addition to basic roles (viewer, editor, owner) and custom roles, you can assign the following user-managed notebooks predefined roles to principals.
The following table describes the predefined user-managed notebooks
IAM roles,
as well as the permissions contained within each role. Each role contains a set
of permissions that is suitable for a specific task. For example,
the Notebooks Viewer (roles/notebooks.viewer) role grants read-only access
to the specified resource.
| Role | Permissions |
|---|---|
|
Notebooks Admin
Full access to Notebooks, all resources. Lowest-level resources where you can grant this role:
|
|
|
Notebooks Legacy Admin
Full access to Notebooks all resources through compute API. |
|
|
Notebooks Legacy Viewer
Read-only access to Notebooks all resources through compute API. |
|
|
Notebooks Runner
Restricted access for running scheduled Notebooks. |
|
|
Notebooks Viewer
Read-only access to Notebooks, all resources. Lowest-level resources where you can grant this role:
|
|
What's next
- Learn more about IAM.
- Grant user-managed notebooks IAM roles to principals.
- Learn how to create and manage custom IAM roles.