Skip to main content

the Idle Shutdown feature is enabled for your Vertex AI

More Info:​

Ensure that the Idle Shutdown feature is enabled for your Vertex AI notebook instances

Risk Level​

Medium

Address​

Security

Compliance Standards​

  • CIS GCP

Triage and Remediation​

Remediation​

Using Console

Below are step‑by‑step instructions to enable Idle Shutdown for Vertex AI Workbench notebook instances using the GCP Console.

A. Enable Idle Shutdown on an existing Vertex AI Workbench notebook​

  1. Go to the Vertex AI Workbench page

    • In the Google Cloud Console, open the navigation menu (☰).
    • Go to Vertex AI → Workbench.
    • Make sure you are in the correct project and region.

  2. Locate your notebook instance

    • In the Workbench page, under the User-managed notebooks (or “Managed notebooks” depending on your type), find the notebook instance you want to configure.

  3. Stop the instance (if required)

    • If the instance is running, some settings might be locked.
    • Click the three‑dot menu (⋮) next to the instance and select Stop.
    • Wait until the status shows Stopped.

  4. Edit the instance settings

    • Click the three‑dot menu (⋮) next to the notebook instance.
    • Select Edit (or Edit settings).

  5. Enable Idle Shutdown

    • In the edit screen, scroll to the Idle shutdown or Idle timeout section (wording may vary slightly by UI version).
    • Check Enable idle shutdown (or similar toggle).
    • Set the Idle time (e.g., 60 minutes, 120 minutes) according to your policy.

  6. Save changes

    • Click Save (or Save & update).
    • If prompted to confirm changes and restart, confirm.
    • Start the instance again if needed: use the Start option from the three‑dot menu.

B. Ensure Idle Shutdown is set for new notebook instances​

  1. Create a new notebook

    • In Vertex AI → Workbench, click New notebook.
    • Choose the appropriate environment / image (JupyterLab, VS Code, etc.).

  2. Configure Idle Shutdown during creation

    • In the creation wizard, find the Idle shutdown section.
    • Enable Idle shutdown.
    • Set the idle timeout duration according to your standard (e.g., 60 minutes).

  3. Finish creation

    • Complete the remaining configuration (machine type, disk, network, etc.).
    • Click Create.

By doing this for all existing and newly created Vertex AI Workbench notebook instances, you ensure the Idle Shutdown feature is consistently enabled.

Using CLI

Below are concise, step‑by‑step CLI instructions to ensure Idle Shutdown is enabled on Vertex AI Workbench notebooks.

Note: Commands differ for Managed vs User-Managed notebooks.

1. Set common variables​

PROJECT_ID="your-project-id"
REGION="us-central1"           # change as needed
gcloud config set project "$PROJECT_ID"

2. Managed Notebooks (Vertex AI Workbench “Managed”)​

2.1 List managed notebook instances​

gcloud notebooks instances list --location="$REGION"

Note the INSTANCE_NAME you want to fix.

2.2 Enable Idle Shutdown on a managed notebook​

INSTANCE_NAME="your-managed-notebook"

gcloud notebooks instances update "$INSTANCE_NAME" \
  --location="$REGION" \
  --idle-shutdown \
  --idle-shutdown-timeout=30
  • --idle-shutdown turns the feature on.
  • --idle-shutdown-timeout is in minutes (e.g., 30 minutes).

2.3 Verify configuration​

gcloud notebooks instances describe "$INSTANCE_NAME" \
  --location="$REGION" \
  --format="get(idleShutdown,idleShutdownTimeout)"

You should see true and the timeout you set.

3. User-Managed Notebooks (legacy AI Platform / user-managed Workbench)​

These are regular Compute Engine VMs with a notebook proxy.

3.1 List user-managed notebooks​

gcloud notebooks runtimes list --location="$REGION"
# or for older:
# gcloud compute instances list --filter="labels.goog-ai-notebook:true"

3.2 Enable Idle Shutdown on a user-managed runtime​

For Vertex AI Workbench user-managed runtime:

RUNTIME_NAME="your-user-managed-runtime"

gcloud notebooks runtimes update "$RUNTIME_NAME" \
  --location="$REGION" \
  --idle-shutdown \
  --idle-shutdown-timeout=30

For older AI Platform Notebooks VM (Compute Engine):

Idle shutdown is controlled via metadata; set the idle timeout in minutes:

INSTANCE_NAME="your-legacy-notebook-vm"

gcloud compute instances add-metadata "$INSTANCE_NAME" \
  --metadata=proxy-idle-timeout-minutes=30

After these steps, the notebook instances/runtimes will automatically shut down after the configured period of inactivity.

Using Python

Below is one way to enable the Idle Shutdown feature on all (or selected) Vertex AI / Workbench notebook instances using Python and the Notebooks API.

Assumptions (common for CIS-style checks):

  • Idle shutdown is controlled via instance metadata:
    • idleShutdown: "true" / "false"
    • idleShutdownTimeout: integer minutes (e.g., "60" for 1 hour)
  • You have permission to use the Notebooks API on the project.

1. Enable APIs and install libraries​

Make sure these are enabled in your project:

  • notebooks.googleapis.com

Install the client libraries:

pip install google-api-python-client google-auth google-auth-httplib2 google-auth-oauthlib

Authenticate (one way):

gcloud auth application-default login

2. Python script to enable Idle Shutdown​

This script:

  • Lists all Vertex AI / Workbench notebook instances in a region.
  • For each instance, sets idleShutdown=true and idleShutdownTimeout=60 (change as needed).
  • Uses the patch method with an updateMask on metadata.
from googleapiclient.discovery import build
from google.auth import default as google_auth_default

PROJECT_ID = "your-project-id"
LOCATION = "us-central1"        # or the region of your notebooks
IDLE_SHUTDOWN_ENABLED = "true"
IDLE_SHUTDOWN_TIMEOUT_MIN = "60"  # e.g., 60 minutes

def main():
    # Get default credentials
    creds, _ = google_auth_default(scopes=["https://www.googleapis.com/auth/cloud-platform"])

    # Build the Notebooks API client (v1 or v2 depending on your environment; v1 shown here)
    notebooks = build("notebooks", "v1", credentials=creds, cache_discovery=False)

    parent = f"projects/{PROJECT_ID}/locations/{LOCATION}"

    # List all notebook instances in the region
    request = notebooks.projects().locations().instances().list(parent=parent)
    response = request.execute()

    instances = response.get("instances", [])
    if not instances:
        print("No notebook instances found.")
        return

    for inst in instances:
        name = inst["name"]  # e.g., projects/.../locations/.../instances/...
        metadata = inst.get("metadata", {})

        # Check current settings
        current_idle = metadata.get("idleShutdown")
        current_timeout = metadata.get("idleShutdownTimeout")

        # If already configured as desired, skip
        if (current_idle == IDLE_SHUTDOWN_ENABLED and
                current_timeout == IDLE_SHUTDOWN_TIMEOUT_MIN):
            print(f"Instance {name}: already configured, skipping.")
            continue

        # Update metadata
        metadata["idleShutdown"] = IDLE_SHUTDOWN_ENABLED
        metadata["idleShutdownTimeout"] = IDLE_SHUTDOWN_TIMEOUT_MIN

        body = {
            "metadata": metadata
        }

        # Only update metadata
        update_mask = "metadata"

        print(f"Patching instance {name} with idleShutdown={IDLE_SHUTDOWN_ENABLED}, "
              f"idleShutdownTimeout={IDLE_SHUTDOWN_TIMEOUT_MIN} minutes")

        op = notebooks.projects().locations().instances().patch(
            name=name,
            updateMask=update_mask,
            body=body,
        ).execute()

        print(f"Patch operation started: {op.get('name')}")

if __name__ == "__main__":
    main()

3. Notes / adjustments​

  • To target a single instance, set name explicitly and call patch once instead of looping over list.
  • Adjust IDLE_SHUTDOWN_TIMEOUT_MIN to your policy (e.g., "30", "120").
  • If you are using Workbench “Managed notebooks” (v2 “runtimes”), the resource type is runtimes instead of instances; the logic is similar but use:
    • build("notebooks", "v1")
    • projects().locations().runtimes().list(...) and ...runtimes().patch(...).
  • For organization-wide remediation, run this per-project and per-region where notebooks exist.
Using Terraform
resource "google_workbench_instance" "VERTEX_NOTEBOOK" {
  # Replace with your instance name and location
  name     = "VERTEX_NOTEBOOK_NAME"
  location = "GCP_REGION"

  gce_setup {
    machine_type = "MACHINE_TYPE"

    # Other required config (disks, network, etc.) goes here …

    # Enable Idle Shutdown for the Vertex AI Workbench instance
    metadata = {
      # Turns on idle shutdown
      "notebooks.googleapis.com/idle_shutdown" = "true"

      # Idle timeout in minutes before shutdown; replace with your required threshold
      # e.g. "60" for 60 minutes
      "notebooks.googleapis.com/idle_shutdown_timeout" = "IDLE_TIMEOUT_MINUTES"
    }
  }
}

IDLE_TIMEOUT_MINUTES should be replaced with the numeric string for your desired idle timeout (for example "60"). Updating these metadata keys is an in‑place change and does not force replacement of the instance.

To verify, terraform plan should show an update to the google_workbench_instance.VERTEX_NOTEBOOK resource adding or changing the two metadata entries above and no -/+ (destroy/create) for the instance.