> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Vertexai workbench integrity monitoring enabled remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        Below are the GCP Console steps to ensure Integrity Monitoring is enabled for Vertex AI notebook instances (which run on Compute Engine VMs).

        ### 1. Identify the Notebook VM

        1. Go to **Google Cloud Console**: [https://console.cloud.google.com](https://console.cloud.google.com)
        2. In the left menu, go to **Vertex AI** → **Workbench** (or **Notebooks**, depending on UI version).
        3. Locate the notebook instance you want to fix.
        4. Note its type:
           * **User-managed notebook** → directly backed by a Compute Engine VM.
           * **Managed notebook** → some settings are controlled by Vertex AI; Shielded VM options may not be editable after creation.

        If it is a **user-managed** notebook, continue with the steps below. If it’s **managed** and you don’t see Shielded VM options, you’ll need to recreate it with Integrity Monitoring enabled at creation time.

        ***

        ### 2. Stop the Notebook Instance

        1. In **Vertex AI → Workbench**, find your notebook instance.
        2. Click the **three dots (⋮)** on the right of the instance row.
        3. Click **Stop**.
        4. Wait until the status changes to **Stopped**.

        ***

        ### 3. Open the Backing VM in Compute Engine

        1. Still on the notebook details (or the row), click on the **instance name** to open its details.
        2. In the details panel, locate the **VM name** (often similar to the notebook name).
        3. Click the VM name link (this takes you to **Compute Engine → VM instances** for that VM).

        ***

        ### 4. Enable Integrity Monitoring (Shielded VM Option)

        1. In the **VM instances** page for that VM, click **Edit** (top of the page).
        2. Scroll down to the **Security** or **Shielded VM** section (name may vary slightly).
        3. Under **Shielded VM options**, ensure:
           * **Turn on Integrity monitoring** is **checked**.
           * Optionally, also enable **Turn on virtual trusted platform module (vTPM)** and **Secure boot** if your policy requires full Shielded VM protections.
        4. Click **Save** at the bottom.

        ***

        ### 5. Restart the Notebook Instance

        1. Go back to **Vertex AI → Workbench**.
        2. On your notebook instance, click the **three dots (⋮)**.
        3. Click **Start**.
        4. Wait until the status becomes **Running**.

        ***

        ### 6. Verify Integrity Monitoring Is Enabled

        1. Go again to **Compute Engine → VM instances**, open the VM for the notebook.
        2. In the **Details** page, under **Shielded VM** or **Security**, confirm that **Integrity monitoring** is shown as **On** / enabled.

        Repeat these steps for each relevant notebook VM. For **managed notebooks** where Shielded VM settings can’t be edited, recreate the notebook and ensure Shielded VM / Integrity Monitoring is enabled during creation (look for “Security” or “Shielded VM” options in the creation wizard).
      </Accordion>

      <Accordion title="Using CLI">
        Below are concise, CLI-based steps to ensure Integrity Monitoring is enabled for Vertex AI Notebook instances (Workbench / Notebooks) in GCP.

        ***

        ### 1. Prerequisites

        ```bash theme={null}
        # Make sure required APIs are enabled
        gcloud services enable notebooks.googleapis.com compute.googleapis.com
        ```

        Set your defaults (optional):

        ```bash theme={null}
        gcloud config set project YOUR_PROJECT_ID
        gcloud config set compute/region YOUR_REGION
        gcloud config set compute/zone YOUR_ZONE
        ```

        ***

        ### 2. Identify the underlying VM for a Vertex AI Notebook

        Managed and user-managed notebooks both run on Compute Engine VMs. You must enable Shielded VM integrity monitoring on that VM.

        List notebook instances:

        ```bash theme={null}
        gcloud notebooks instances list --location=YOUR_REGION
        ```

        Take note of the `name` and `location` of the notebook instance you want to fix.

        Describe the notebook to find the underlying VM:

        ```bash theme={null}
        gcloud notebooks instances describe NOTEBOOK_NAME \
            --location=YOUR_REGION
        ```

        Look for a field such as:

        * `proxyUri` – often contains the Compute Engine instance name, or
        * `gceInstanceId` / `gceInstance` – the actual GCE VM name (depending on notebook type).

        If unclear, you can locate the instance via labels:

        ```bash theme={null}
        gcloud compute instances list \
            --filter="labels.notebook_id:NOTEBOOK_NAME"
        ```

        Note the `NAME` and `ZONE` of the VM instance.

        ***

        ### 3. Check current Shielded VM integrity monitoring setting

        ```bash theme={null}
        gcloud compute instances describe VM_NAME \
            --zone=ZONE \
            --format="get(shieldedInstanceConfig.enableIntegrityMonitoring)"
        ```

        If it returns `False` or is empty, you need to enable it.

        ***

        ### 4. Enable Integrity Monitoring on the VM

        ```bash theme={null}
        gcloud compute instances update VM_NAME \
            --zone=ZONE \
            --shielded-integrity-monitoring
        ```

        This turns on Shielded VM integrity monitoring for that notebook’s VM.

        ***

        ### 5. Verify Integrity Monitoring is enabled

        ```bash theme={null}
        gcloud compute instances describe VM_NAME \
            --zone=ZONE \
            --format="get(shieldedInstanceConfig.enableIntegrityMonitoring)"
        ```

        You should now see:

        ```text theme={null}
        True
        ```

        ***

        ### 6. Enforce for new Vertex AI notebook instances (optional)

        When creating new **user-managed** notebook instances (directly via Compute Engine), specify Shielded VM flags:

        ```bash theme={null}
        gcloud compute instances create NEW_VM_NAME \
            --zone=ZONE \
            --machine-type=n1-standard-4 \
            --image-family=common-cu110 \
            --image-project=deeplearning-platform-release \
            --shielded-secure-boot \
            --shielded-vtpm \
            --shielded-integrity-monitoring
        ```

        Then attach this VM as the backend for your notebook or use it as the base for a Vertex AI Workbench instance, depending on your setup.

        For **managed** Vertex AI Workbench notebooks, ensure your organization policy does not disable Shielded VM, and follow steps 2–5 after creation to verify/enable integrity monitoring on the underlying VM.
      </Accordion>

      <Accordion title="Using Python">
        Below is a minimal, practical way to enable Integrity Monitoring on Vertex AI / AI Platform notebook instances using Python and the Notebooks API.

        ***

        ### 1. Prerequisites

        1. You have `gcloud` configured and are authenticated:
           ```bash theme={null}
           gcloud auth application-default login
           ```
        2. Install the Notebooks client library:
           ```bash theme={null}
           pip install google-cloud-notebooks
           ```

        ***

        ### 2. Enabling Integrity Monitoring **when creating** a notebook instance

        ```python theme={null}
        from google.cloud import notebooks_v1

        project_id = "YOUR_PROJECT_ID"
        location = "us-central1-b"  # or your zone
        instance_id = "my-notebook-instance"

        client = notebooks_v1.NotebookServiceClient()

        parent = f"projects/{project_id}/locations/{location}"

        instance = notebooks_v1.Instance(
            name=f"{parent}/instances/{instance_id}",
            machine_type=f"projects/{project_id}/zones/{location}/machineTypes/n1-standard-4",
            # Shielded VM / Integrity Monitoring
            shielded_instance_config=notebooks_v1.Instance.ShieldedInstanceConfig(
                enable_integrity_monitoring=True,
                enable_secure_boot=True,          # optional but recommended
                enable_vtpm=True                  # optional but recommended
            )
        )

        operation = client.create_instance(
            parent=parent,
            instance_id=instance_id,
            instance=instance,
        )

        print("Creating instance, waiting for operation to complete...")
        result = operation.result()
        print("Instance created:", result.name)
        ```

        ***

        ### 3. Enabling Integrity Monitoring **on an existing** notebook instance

        For existing instances, patch the `shielded_instance_config`:

        ```python theme={null}
        from google.cloud import notebooks_v1
        from google.protobuf import field_mask_pb2

        project_id = "YOUR_PROJECT_ID"
        location = "us-central1-b"   # zone where the instance lives
        instance_id = "EXISTING_INSTANCE_NAME"

        client = notebooks_v1.NotebookServiceClient()

        name = f"projects/{project_id}/locations/{location}/instances/{instance_id}"

        # Define the desired Shielded config
        instance = notebooks_v1.Instance(
            name=name,
            shielded_instance_config=notebooks_v1.Instance.ShieldedInstanceConfig(
                enable_integrity_monitoring=True,
                enable_secure_boot=True,   # optional but recommended
                enable_vtpm=True           # optional but recommended
            )
        )

        # Only update the shielded_instance_config field
        update_mask = field_mask_pb2.FieldMask(
            paths=["shielded_instance_config"]
        )

        operation = client.update_instance(
            instance=instance,
            update_mask=update_mask,
        )

        print("Patching instance, waiting for operation to complete...")
        result = operation.result()
        print("Instance updated:", result.name)
        ```

        ***

        ### 4. Verifying Integrity Monitoring is enabled

        You can verify via Python:

        ```python theme={null}
        from google.cloud import notebooks_v1

        project_id = "YOUR_PROJECT_ID"
        location = "us-central1-b"
        instance_id = "EXISTING_INSTANCE_NAME"

        client = notebooks_v1.NotebookServiceClient()
        name = f"projects/{project_id}/locations/{location}/instances/{instance_id}"

        instance = client.get_instance(name=name)
        print("Integrity Monitoring enabled:",
              instance.shielded_instance_config.enable_integrity_monitoring)
        ```

        These steps ensure Integrity Monitoring is enabled for your Vertex AI / AI Platform notebook instances programmatically in GCP using Python.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "google_workbench_instance" "VERTEX_NOTEBOOK_INSTANCE" {
          name     = "VERTEX_NOTEBOOK_INSTANCE_NAME"   # replace with your instance name
          location = "VERTEX_NOTEBOOK_LOCATION"        # e.g. "us-central1-a"
          project  = "GCP_PROJECT_ID"                  # replace with your GCP project ID

          gce_setup {
            machine_type = "e2-standard-4"             # keep your existing type

            shielded_instance_config {
              enable_secure_boot          = true       # keep/set as needed
              enable_vtpm                 = true       # keep/set as needed
              enable_integrity_monitoring = true       # <-- required: Integrity Monitoring enabled
            }

            # ...your existing config (boot_disk, network_interfaces, etc.)
          }

          # ...any other existing arguments (vm_image, metadata, labels, etc.)
        }
        ```

        `terraform plan` should show an update (or replacement, depending on current state) to the `google_workbench_instance` that sets `shielded_instance_config.enable_integrity_monitoring` from `false` (or unset) to `true`.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>