Skip to main content

automatic upgrades are enabled for your Vertex AI notebook

More Info:​

Ensure that automatic upgrades are enabled for your Vertex AI notebook instances

Risk Level​

Medium

Address​

Monitoring, Security

Compliance Standards​

  • CIS GCP

Triage and Remediation​

Remediation​

Using Console

Below are concise, console‑only steps to ensure automatic upgrades are enabled for Vertex AI Workbench notebooks (both Managed and User-managed), since both appear in the same UI.

1. Open Vertex AI Workbench​

  1. Go to the Google Cloud Console: https://console.cloud.google.com
  2. In the top bar, select the correct project.
  3. From the left navigation menu, go to:
    Vertex AI → Workbench.

You will see two tabs (or filters), commonly:

  • Managed notebooks
  • User-managed notebooks

2. Managed Notebooks: Enable automatic upgrades​

  1. Click the Managed notebooks tab (if not already selected).
  2. Find the notebook instance you want to fix.
  3. Click the notebook’s name to open its Details page.
  4. On the details page, look for a section named Environment, Runtime, or Auto-upgrade (label can vary slightly by UI version).
  5. Look for an option like:
    • Auto-upgrade (or Notebook upgrades)
    • A toggle such as Enable automatic upgrades or Enable auto-upgrade
  6. If it is off, click Edit at the top of the page (or Edit settings / Edit runtime).
  7. Turn on the Auto-upgrade / Enable automatic upgrades toggle.
  8. Click Save (or Save changes / Update).

If the UI does not allow changing this on an existing managed notebook (older versions sometimes restrict it), you must:

  1. Click New notebook.
  2. During creation, under Environment / Advanced / Upgrade settings, make sure Enable automatic upgrades is checked.
  3. Recreate your environment and migrate notebooks from the old instance.

3. User-managed Notebooks: Enable automatic upgrades​

User-managed notebooks are usually tied to a Compute Engine VM and often have an “Enable upgrades” or similar flag in their configuration.

  1. Click the User-managed notebooks tab.
  2. Locate your notebook instance and click its name to open details.
  3. Look for:
    • An Edit button (or Open in AI Platform / Edit VM)
    • A configuration section showing Upgrade schedule or Enable upgrades.
  4. If present and editable:
    • Click Edit.
    • Turn on Enable upgrades / Auto-upgrade (or similar wording).
    • Click Save or Update.

If there is no way to change it on the existing instance:

  1. Click New notebook → choose the appropriate image/type.
  2. In the creation form, expand Advanced options (or similar).
  3. Ensure the checkbox for Enable upgrades / Auto-upgrade or equivalent is checked.
  4. Create the instance and migrate your notebooks/workloads from the old instance.

4. Verification​

For each notebook:

  1. Open its Details page again in Vertex AI → Workbench.
  2. Confirm that:
    • The Auto-upgrade / Automatic upgrades / Enable upgrades field is shown as Enabled or On.

That satisfies the requirement “Ensure that automatic upgrades are enabled for your Vertex AI notebook instances” via the GCP Console.

Using CLI

On Vertex AI Workbench (user-managed) notebooks, “automatic upgrades” are tied to the instance being upgradeable. If an instance was created with --no-upgradeable, it will not receive automatic upgrades; this cannot be flipped in-place and you must recreate the instance as upgradeable.

Below are CLI steps to (1) verify and (2) remediate by recreating:

1. Verify whether an instance is upgradeable​

PROJECT_ID="YOUR_PROJECT_ID"
LOCATION="us-central1"        # change as needed
INSTANCE_ID="YOUR_INSTANCE_ID"

gcloud config set project "$PROJECT_ID"

gcloud notebooks instances describe "$INSTANCE_ID" \
  --location="$LOCATION" \
  --format="yaml(name, state, upgradeable)"

Look at the upgradeable field:

  • upgradeable: true → automatic upgrades are enabled.
  • upgradeable: false → instance will not receive automatic upgrades; proceed to remediation.

2. Capture the current configuration (for recreation)​

gcloud notebooks instances describe "$INSTANCE_ID" \
  --location="$LOCATION" \
  --format="yaml"

Note the following fields you will reuse:

  • machineType
  • bootDiskType, bootDiskSizeGb
  • dataDiskType, dataDiskSizeGb (if present)
  • vmImage or containerImage
  • network, subnet
  • Any labels or metadata you care about.

3. Stop the existing instance​

gcloud notebooks instances stop "$INSTANCE_ID" \
  --location="$LOCATION"

(Wait until it reaches state: STOPPED.)

4. Create a new upgradeable instance​

Create a new instance that is upgradeable by not using --no-upgradeable (upgradeable is the default).

Example (adjust with values from step 2):

NEW_INSTANCE_ID="YOUR_NEW_INSTANCE_ID"

gcloud notebooks instances create "$NEW_INSTANCE_ID" \
  --location="$LOCATION" \
  --vm-image-project=deeplearning-platform-release \
  --vm-image-family=tf-latest-gpu \
  --machine-type=n1-standard-4 \
  --boot-disk-type=PD_SSD \
  --boot-disk-size=100 \
  --network=projects/$PROJECT_ID/global/networks/default \
  --subnet=projects/$PROJECT_ID/regions/$LOCATION/subnetworks/default
  # NOTE: Do NOT add --no-upgradeable

Key point: do not pass --no-upgradeable. If you omit it, the instance is upgradeable and will receive automatic upgrades.

You can confirm again:

gcloud notebooks instances describe "$NEW_INSTANCE_ID" \
  --location="$LOCATION" \
  --format="yaml(name, state, upgradeable)"

upgradeable: true confirms auto-upgrades are enabled.

5. Move notebook files and delete old instance​

  1. Start both old and new instances.
  2. Copy notebooks (e.g., via:
    • gsutil to a Cloud Storage bucket, or
    • SSH / SCP between VMs, or
    • direct file upload/download in the Jupyter UI).
  3. Once everything is migrated and verified, delete the old non‑upgradeable instance:
gcloud notebooks instances delete "$INSTANCE_ID" \
  --location="$LOCATION"

After this, your notebooks will run on an upgradeable (auto‑updating) Vertex AI Workbench instance.

Using Python

Below is how to enable automatic upgrades for Vertex AI Workbench (Managed Notebooks) instances using Python.

1. Prerequisites​

  1. Have gcloud configured and authenticated: 
    gcloud auth application-default login
  2. Install the Notebooks client library: 
    pip install google-cloud-notebooks

2. Enable automatic upgrades on an existing instance​

from google.cloud import notebooks_v1
from google.protobuf import field_mask_pb2

def enable_auto_upgrades(
    project_id: str,
    location: str,
    instance_id: str,
) -> None:
    client = notebooks_v1.NotebookServiceClient()

    name = f"projects/{project_id}/locations/{location}/instances/{instance_id}"

    # Get current instance
    instance = client.get_instance(name=name)

    # Set upgrade_type to AUTOMATIC
    instance.upgrade_type = notebooks_v1.Instance.UpgradeType.AUTOMATIC

    # Only update the upgrade_type field
    update_mask = field_mask_pb2.FieldMask(paths=["upgrade_type"])

    operation = client.update_instance(
        instance=instance,
        update_mask=update_mask,
    )

    print("Waiting for operation to complete...")
    result = operation.result()
    print(f"Updated instance {result.name} with automatic upgrades enabled.")

if __name__ == "__main__":
    enable_auto_upgrades(
        project_id="YOUR_PROJECT_ID",
        location="us-central1",      # e.g., "us-central1"
        instance_id="YOUR_INSTANCE", # instance name (not full path)
    )

3. Create a new instance with automatic upgrades enabled​

from google.cloud import notebooks_v1

def create_instance_with_auto_upgrades(
    project_id: str,
    location: str,
    instance_id: str,
) -> None:
    client = notebooks_v1.NotebookServiceClient()

    parent = f"projects/{project_id}/locations/{location}"

    instance = notebooks_v1.Instance(
        machine_type=f"projects/{project_id}/zones/{location}-b/machineTypes/n1-standard-4",
        upgrade_type=notebooks_v1.Instance.UpgradeType.AUTOMATIC,
        # add other config fields here as needed
    )

    operation = client.create_instance(
        parent=parent,
        instance_id=instance_id,
        instance=instance,
    )

    print("Waiting for instance creation...")
    result = operation.result()
    print(f"Created instance {result.name} with automatic upgrades enabled.")

if __name__ == "__main__":
    create_instance_with_auto_upgrades(
        project_id="YOUR_PROJECT_ID",
        location="us-central1",
        instance_id="new-notebook-instance",
    )

4. Notes​

  • UpgradeType.AUTOMATIC is the key setting to ensure automatic upgrades.
  • Replace project_id, location, instance_id, and machine_type with your actual values.
Using Terraform
# As of the current google / google-beta providers, the Vertex AI Workbench
# / Notebooks APIs do NOT expose the "automatic upgrades" toggle as a
# Terraform-available argument on google_workbench_instance or
# google_notebooks_instance. It cannot be remediated via Terraform.

# You must enable automatic upgrades manually or via gcloud, for example:
#
# 1. Console:
#    - Vertex AI → Workbench → Instances
#    - Click the instance NAME
#    - Edit
#    - Under Maintenance / Upgrades, enable "Automatic upgrades"
#    - Save
#
# 2. Or gcloud (example – adjust to your instance):
#    gcloud notebooks instances update INSTANCE_NAME \
#      --location=LOCATION \
#      --enable-upgrade-scheduler
#
# There is no Terraform argument to add, so `terraform plan` will show no
# changes related to automatic upgrades.