gclouddnsmanaged-zonescreateZONE_NAME\--visibility=private\--networks=https://www.googleapis.com/compute/v1/projects/PROJECT_ID/global/networks/NETWORK_NAME\--dns-name=DNS_NAME\--description="Description of your managed zone"
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-28。"],[],[],null,["# Use a Vertex AI Workbench instance within a service perimeter\n\nUse an instance within a service perimeter\n==========================================\n\nThis page describes how to use VPC Service Controls to set up\na Vertex AI Workbench instance within a service perimeter.\n\nBefore you begin\n----------------\n\n1. Read the [Overview of\n VPC Service Controls](/vpc-service-controls/docs/overview).\n\n2. [Create a Vertex AI Workbench\n instance](/vertex-ai/docs/workbench/instances/create).\n This instance is not within a service\n perimeter yet.\n\n3. [Create a service perimeter using\n VPC Service Controls](/vpc-service-controls/docs/create-service-perimeters).\n This service perimeter protects the Google-managed resources of services\n that you specify. While creating your service perimeter, do the following:\n\n 1. When it's time to add projects to your service perimeter, add the\n project that contains your Vertex AI Workbench instance.\n\n 2. When it's time to add services to your service perimeter, add the\n **Notebooks API**.\n\n If you have created your service perimeter without adding the\n projects and services you need, see [Managing service\n perimeters](/vpc-service-controls/docs/manage-service-perimeters)\n to learn how to update your service perimeter.\n\nConfigure your DNS entries using Cloud DNS\n------------------------------------------\n\n\nVertex AI Workbench instances use several domains that a\nVirtual Private Cloud network doesn't handle by default.\nTo ensure that your VPC network correctly handles requests sent\nto those domains, use Cloud DNS to add DNS records. For more\ninformation about VPC routes, see [Routes](/vpc/docs/routes).\n\n\nTo create a [managed zone](/dns/docs/zones#create_managed_zones) for\na domain, add a DNS entry that will route the request, and execute\nthe transaction, complete the following steps.\nRepeat these steps for each of [several\ndomains](#domains) that you need to handle requests for, starting\nwith `*.notebooks.googleapis.com`.\n\n\nIn [Cloud Shell](https://console.cloud.google.com?cloudshell=true)\nor any environment where the [Google Cloud CLI](/sdk/docs)\nis installed, enter the following [Google Cloud CLI](/sdk/gcloud) commands.\n\n1.\n To create a private managed zone\n for one of the domains that your\n VPC network needs to handle:\n\n ```bash\n gcloud dns managed-zones create ZONE_NAME \\\n --visibility=private \\\n --networks=https://www.googleapis.com/compute/v1/projects/PROJECT_ID/global/networks/NETWORK_NAME \\\n --dns-name=DNS_NAME \\\n --description=\"Description of your managed zone\"\n \n ```\n\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eZONE_NAME\u003c/var\u003e: a name for the zone to create. You must use a separate zone for each domain. This zone name is used in each of the following steps.\n - \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: the ID of the project that hosts your VPC network\n - \u003cvar translate=\"no\"\u003eNETWORK_NAME\u003c/var\u003e: the name of the VPC network that you created earlier\n - \u003cvar translate=\"no\"\u003eDNS_NAME\u003c/var\u003e: the part of the domain name that comes after the `*.`, with a period on the end. For example, `*.notebooks.googleapis.com` has a \u003cvar translate=\"no\"\u003eDNS_NAME\u003c/var\u003e of `notebooks.googleapis.com.`\n2.\n Start a transaction.\n\n ```bash\n gcloud dns record-sets transaction start --zone=ZONE_NAME\n \n ```\n3.\n Add the following DNS A record. This reroutes traffic to\n Google's restricted IP addresses.\n\n ```bash\n gcloud dns record-sets transaction add \\\n --name=DNS_NAME. \\\n --type=A 199.36.153.4 199.36.153.5 199.36.153.6 199.36.153.7 \\\n --zone=ZONE_NAME \\\n --ttl=300\n \n ```\n4.\n Add the following DNS CNAME record to point to the A record\n that you just added. This redirects all traffic matching the\n domain to the IP addresses listed in the previous step.\n\n ```bash\n gcloud dns record-sets transaction add \\\n --name=\\*.DNS_NAME. \\\n --type=CNAME DNS_NAME. \\\n --zone=ZONE_NAME \\\n --ttl=300\n \n ```\n5.\n Execute the transaction.\n\n ```bash\n gcloud dns record-sets transaction execute --zone=ZONE_NAME\n \n ```\n6.\n Repeat these steps for each of the following domains. For each\n repetition, change \u003cvar translate=\"no\"\u003eZONE_NAME\u003c/var\u003e\n and \u003cvar translate=\"no\"\u003eDNS_NAME\u003c/var\u003e to the appropriate values for that\n domain. Keep \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e and \u003cvar translate=\"no\"\u003eNETWORK_NAME\u003c/var\u003e\n the same each time. You already\n completed these steps for `*.notebooks.googleapis.com`.\n\n - `*.notebooks.googleapis.com`\n - `*.notebooks.cloud.google.com`\n - `*.notebooks.googleusercontent.com`\n - `*.googleapis.com` to run code that interacts with other Google APIs and services\n\nConfigure the service perimeter\n-------------------------------\n\nAfter [configuring the DNS records](#configure-dns), either\n[create a service\nperimeter](/vpc-service-controls/docs/create-service-perimeters)\nor [update an existing\nperimeter](/vpc-service-controls/docs/manage-service-perimeters#update)\nto add your project to the service perimeter.\n\nIn the VPC network, add a route for the `199.36.153.4/30` range with a\nnext hop of `Default internet gateway`.\n| **Note:** The `199.36.153.4/30` range is for `restricted.googleapis.com` to access APIs that are only VPC Service Controls compatible. If you aren't using VPC Service Controls, you can use the `199.36.153.8/30` range for `private.googleapis.com`. For more information about Private Google Access, see [Configure\n| Private Google Access](/vpc/docs/configure-private-google-access).\n\nUse Artifact Registry within your service perimeter\n---------------------------------------------------\n\nIf you want to use Artifact Registry in your service perimeter,\nsee [Configure restricted access for GKE\nprivate clusters](/artifact-registry/docs/gke-private-clusters).\n\nUse Shared VPC\n--------------\n\nIf you are using [Shared VPC](/vpc/docs/shared-vpc),\nyou must add the host and the service projects to the service\nperimeter. In the host project, you must also grant the\n[Compute Network User\n(`roles/compute.networkUser`)](/iam/docs/understanding-roles#compute.networkUser)\nrole to the [Notebooks Service\nAgent](/iam/docs/service-agents#cloud-ai-platform-notebooks-service-account)\nfrom the service project. For more information, see [Manage\nservice perimeters](/vpc-service-controls/docs/manage-service-perimeters).\n\nAccess your Vertex AI Workbench instance\n----------------------------------------\n\nTo open a Jupyter notebook on your new instance:\n\n1. In the Google Cloud console,\n go to the **Instances** page.\n\n [Go to Instances](https://console.cloud.google.com/vertex-ai/workbench/instances)\n2. Next to your instance's name, click **Open JupyterLab**.\n\n3. In JupyterLab,\n select **File \\\u003e New \\\u003e Notebook**.\n\n4. In the **Select kernel** dialog, choose a kernel,\n and then click **Select**.\n\n Your new notebook file opens.\n\nLimitations\n-----------\n\nThe following limitations apply when using VPC Service Controls with\nVertex AI Workbench:\n\n### Identity type for ingress and egress policies\n\nWhen you specify an ingress or egress policy for a service perimeter,\nyou can't use `ANY_SERVICE_ACCOUNT`\nor `ANY_USER_ACCOUNT` as an identity type for\nall Vertex AI Workbench operations.\n\nInstead, use `ANY_IDENTITY` as the identity type.\n\n### Accessing the Vertex AI Workbench proxy from a workstation without internet\n\nTo access Vertex AI Workbench instances\nfrom a workstation with limited internet access,\nverify with your IT administrator that you can access the following domains:\n\n- `*.accounts.google.com`\n- `*.accounts.youtube.com`\n- `*.googleusercontent.com`\n- `*.kernels.googleusercontent.com`\n- `*.gstatic.com`\n- `*.notebooks.cloud.google.com`\n- `*.notebooks.googleapis.com`\n\nYou must have access to these domains for authentication to\nGoogle Cloud. See the previous section,\n[Configure your DNS entries using Cloud DNS](#configure-dns),\nfor further configuration information."]]
