本页介绍了如何授予对 Vertex AI Workbench 实例的 JupyterLab 界面的访问权限。
您可以通过 Vertex AI Workbench 实例的访问模式来控制对该实例的 JupyterLab 界面的访问权限。您可以在创建 Vertex AI Workbench 实例时设置 JupyterLab 访问模式。
创建笔记本后，访问模式便无法更改。
JupyterLab 访问模式决定了谁可以使用实例的 JupyterLab 界面。该访问模式还决定了在实例与其他 Google Cloud 服务进行交互时使用哪些凭据。
访问权限限制
向主账号授予对 Vertex AI Workbench 实例的 JupyterLab 界面的访问权限不会授予对该实例本身的访问权限。例如，要启动、停止或重置实例，您必须通过在实例上设置 IAM 政策来授予主账号执行这些操作的权限。如需授予对 Vertex AI Workbench 实例的访问权限，请参阅管理对 Vertex AI Workbench 实例的访问权限。
创建具有仅限单个用户访问权限的 Vertex AI Workbench 实例时，您需要指定用户账号。指定的用户账号是唯一有权访问 JupyterLab 界面的用户。如果指定用户不是实例的创建者，您必须向指定用户授予实例的服务账号的 Service Account User 角色 (roles/iam.serviceAccountUser)。如果实例需要访问其他 Google Cloud 资源，则此服务账号还必须有权访问这些 Google Cloud 资源。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-19。"],[],[],null,["# Manage access to a Vertex AI Workbench instance's JupyterLab interface\n\nManage access to an instance's JupyterLab interface\n===================================================\n\nThis page describes how to grant access to the JupyterLab interface\nof a Vertex AI Workbench instance.\n\nYou control access to a Vertex AI Workbench instance's\nJupyterLab interface through the instance's access mode.\nYou set a JupyterLab access mode when you create\na Vertex AI Workbench instance.\nThe access mode can't be changed after the notebook is created.\n\nThe JupyterLab access mode determines who can use\nthe instance's JupyterLab interface.\nThe access mode also determines which credentials are used when\nyour instance interacts with other Google Cloud services.\n\nAccess limitations\n------------------\n\nGranting a principal access to\na Vertex AI Workbench instance's JupyterLab interface\ndoesn't grant access to the instance itself. For example,\nto start, stop, or reset an instance, you must grant the principal\naccess to perform those operations by setting an\n[IAM policy](/iam/docs/policies) on the instance.\nTo grant access to the Vertex AI Workbench instance,\nsee [Manage access to\na Vertex AI Workbench instance](/vertex-ai/docs/workbench/instances/manage-access).\n\nJupyterLab access modes\n-----------------------\n\nVertex AI Workbench instances support the\nfollowing access modes:\n\n- [Single user only](#single-user-only): The **Single user only** access mode\n grants access only to the user that you specify.\n\n- [Service account](#service-account): The **Service account** access mode\n grants access to a service account. You can grant access to one or more\n users through this service account.\n\n| **Note:** To grant access to the instance through the single user option or the service account, you must use an individual's user account email address. Group access is not supported.\n\nSingle user only\n----------------\n\nWhen you create a Vertex AI Workbench instance\nwith **Single user only** access, you specify a user account.\nThe specified user account is the only user with access to\nthe JupyterLab interface. If the specified user is not the creator of the\ninstance, you must grant the specified user the\n[Service Account User role](/iam/docs/service-accounts#user-role)\n(`roles/iam.serviceAccountUser`) on the instance's service account. If the\ninstance needs to access other Google Cloud resources, this\nservice account\nmust also have access to those Google Cloud resources.\n| **Note:** When you create a Vertex AI Workbench instance with **Single user only** access, your instance completes the boot process using the Compute Engine default service account. Your specified user account can access the instance after the boot process is finished.\n\n### Grant access to a single user\n\nTo grant access to a single user, complete the following steps.\n\n1. [Create\n a Vertex AI Workbench instance](/vertex-ai/docs/workbench/instances/create-console-quickstart)\n with the following specifications:\n\n 1. In the **Create instance** dialog, in\n the **IAM and security** section, select the **Single user only** access mode.\n\n 2. In the **User email** field, enter the user account that you want\n to grant access.\n\n2. Complete the rest of the dialog, and then click **Create**.\n\nService account\n---------------\n\nWhen you create a Vertex AI Workbench instance\nwith **Service account** access, you specify a service account. If\nthe instance needs to access\nother Google resources, this service account must have access to those\nGoogle resources also.\n\nWhen you specify a service account,\nchoose one of the following:\n\n- Select the Compute Engine default service account.\n- Specify a custom service account. The custom service account must be in the same project as your Vertex AI Workbench instance. To create the instance, you must have the `iam.serviceAccounts.actAs` permission on the service account.\n\nTo grant access to users through a service account,\nyou grant the `iam.serviceAccounts.actAs` permission on\nthe specified service account for each user who needs\nto access JupyterLab.\n\n### Grant access to multiple users through a service account\n\n1. [Create\n a Vertex AI Workbench instance](/vertex-ai/docs/workbench/instances/create-console-quickstart)\n with the following specifications:\n\n 1. In the **Create instance** dialog, in\n the **IAM and security** section, select the **Service account** access mode.\n\n 2. Choose the Compute Engine default service account\n or a [custom\n service account](/iam/docs/creating-managing-service-accounts).\n\n - To use the Compute Engine default service account,\n select **Use Compute Engine default service account**.\n\n - To use a custom service account, clear\n **Use Compute Engine default service account** , and then,\n in the **Service account email** field, enter\n your custom service account email address.\n\n2. Complete the rest of the dialog, and then click **Create**.\n\n3. For each user who needs to access JupyterLab,\n [grant the `iam.serviceAccounts.actAs` permission on your\n service account](/iam/docs/manage-access-service-accounts).\n\nAccess mode metadata\n--------------------\n\nThe access mode that you configure during\nVertex AI Workbench instance creation\nis stored in the notebook metadata.\n\nWhen you select the **Single user only** access mode,\nVertex AI Workbench stores a value for `proxy-mode` and `proxy-user-mail`.\nThe following are examples of single user access metadata entries:\n\n- `proxy-mode=mail`\n- `proxy-user-mail=user@example.com`\n\nWhen you select the **Service account** access mode, Vertex AI Workbench\nstores a `proxy-mode=service_account` metadata entry.\n| **Caution:** Changing the access mode metadata is not supported and can make the JupyterLab interface inaccessible.\n\nWhat's next\n-----------\n\n- [Grant a principal access to\n a Vertex AI Workbench instance.](/vertex-ai/docs/workbench/instances/manage-access)\n\n- To learn how to grant access to other Google resources, see\n [Manage access to\n other resources](/iam/docs/granting-changing-revoking-access)."]]
