> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Vertexai workbench no external ip remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        Below are console-based steps to ensure Vertex AI Workbench (Notebooks) do **not** have external IP addresses. Since you *cannot* remove an external IP from an existing notebook instance, the remediation is to create a new instance without external IP and migrate your work.

        ***

        ## 1. Identify notebooks with external IPs

        1. Go to **Vertex AI** in the GCP console.
        2. In the left menu, click **Workbench** → **User-managed notebooks** (and **Managed notebooks** if you use those).
        3. In the list, look at the **Network** / **External IP** column:
           * If it shows an IP (e.g., `34.x.x.x`), that instance has an external IP.
           * If it says **None**, it has no external IP.

        Note which instances must be remediated.

        ***

        ## 2. Create a new notebook instance with no external IP

        You’ll create a replacement instance with only an internal IP.

        1. Still in **Vertex AI → Workbench → User-managed notebooks** (or **Managed notebooks**, as appropriate), click **New notebook** (or **Create**).
        2. Choose your **environment** (e.g., TensorFlow, PyTorch, base image, etc.).
        3. In the **Create notebook** page, expand the **Networking** or **Advanced options** section:
           * **Network**: choose your desired **VPC network**.
           * **Subnet**: select the appropriate **subnet**.
           * **External IP**:
             * Set to **None** (or uncheck any option that says “Assign external IP” or “Allow access to external networks”).
        4. If required for private access:
           * Ensure your environment can reach required services via:
             * **Private Google Access** enabled on the subnet, or
             * **Cloud NAT** or **Private Service Connect**, depending on your design.
        5. Complete the remaining configuration (machine type, disk, etc.).
        6. Click **Create**.\
           The new notebook will be created without an external IP.

        ***

        ## 3. Migrate your work from the old instance

        1. On the old notebook instance:
           * Open JupyterLab / Jupyter from the console.
           * Export notebooks, scripts, and data:
             * Download locally, or
             * Save to **Cloud Storage** (recommended).
        2. On the new instance:
           * Open JupyterLab / Jupyter.
           * Upload your notebooks and files, or pull them from **Cloud Storage**.
        3. Verify everything runs correctly without an external IP (you may need to adjust how you access external data/services).

        ***

        ## 4. Delete the old instance with external IP

        1. Go back to **Vertex AI → Workbench**.
        2. For each old instance with an external IP:
           * Stop it if it’s running (optional but a good check).
           * Click the **three-dot menu** (…) on the right and choose **Delete**.
        3. Confirm deletion.\
           This removes the external IP and prevents future exposure.

        ***

        ## 5. Enforce “no external IP” for future notebooks (operational control)

        While not a strict console-only control, you can:

        * Standardize on a **custom image** and a documented creation procedure that always sets **External IP = None**.
        * Optionally:
          * Use **Organization Policies** to restrict external IPs for Compute Engine (which backs user-managed notebooks), such as:
            * `constraints/compute.vmExternalIpAccess`\
              This forces new VMs (including notebook backends) to be created without external IPs.

        ***

        Summary: use the Vertex AI Workbench console to (1) identify notebooks with external IPs, (2) create new ones with **External IP = None** in the Networking settings, (3) migrate content, and (4) delete the old instances.
      </Accordion>

      <Accordion title="Using CLI">
        Below is how to remediate this *using gcloud CLI* for both:

        * Existing Vertex AI Notebook instances
        * New Vertex AI Notebook instances (to prevent future issues)

        > Note: Vertex AI Workbench notebooks run on underlying Compute Engine VMs. Removing the external IP is done at the VM level.

        ***

        ## 1. Identify the Notebook and Underlying VM

        1. List your Vertex AI Notebook instances:

        ```bash theme={null}
        gcloud notebooks instances list \
          --location=us-central1
        ```

        (Change `--location` as needed.)

        2. Describe the specific instance to confirm zone and details:

        ```bash theme={null}
        gcloud notebooks instances describe INSTANCE_ID \
          --location=us-central1
        ```

        Look for:

        * `gceSetup.machineType` → gives zone (e.g. `us-central1-b`)
        * `gceSetup.vmName` or similar → underlying VM name (if not obvious, it is usually very similar to the notebook instance ID).

        If unsure, list VMs and match:

        ```bash theme={null}
        gcloud compute instances list \
          --filter="name~'INSTANCE_ID'" \
          --zones=us-central1-b
        ```

        ***

        ## 2. Stop the Notebook / VM

        To be safe, stop the notebook instance first:

        ```bash theme={null}
        gcloud notebooks instances stop INSTANCE_ID \
          --location=us-central1
        ```

        Alternatively, stop the VM directly:

        ```bash theme={null}
        gcloud compute instances stop VM_NAME \
          --zone=us-central1-b
        ```

        ***

        ## 3. Remove the External IP (Access Config) from the VM

        1. Check the network interfaces and access config name:

        ```bash theme={null}
        gcloud compute instances describe VM_NAME \
          --zone=us-central1-b \
          --format="flattened(networkInterfaces[].accessConfigs[])"
        ```

        You’ll usually see:

        * `name: external-nat`
        * `type: ONE_TO_ONE_NAT`

        2. Remove the external IP (delete access config) from the primary NIC:

        ```bash theme={null}
        gcloud compute instances delete-access-config VM_NAME \
          --zone=us-central1-b \
          --access-config-name="external-nat" \
          --network-interface=nic0
        ```

        If the access config name is different, use the actual name from the describe output.

        3. Start the VM / notebook instance again:

        ```bash theme={null}
        gcloud compute instances start VM_NAME \
          --zone=us-central1-b
        ```

        or:

        ```bash theme={null}
        gcloud notebooks instances start INSTANCE_ID \
          --location=us-central1
        ```

        Now the instance will have only an internal IP.

        ***

        ## 4. Verify No External IP Exists

        ```bash theme={null}
        gcloud compute instances describe VM_NAME \
          --zone=us-central1-b \
          --format="get(networkInterfaces[0].accessConfigs)"
        ```

        This should output `[]` or no `ONE_TO_ONE_NAT` entry.

        ***

        ## 5. Prevent External IPs for New Notebook Instances

        When creating **Vertex AI Workbench Notebooks** via CLI, always specify **no public IP** (flag name can vary depending on type):

        For classic/user-managed notebooks:

        ```bash theme={null}
        gcloud notebooks instances create INSTANCE_ID \
          --location=us-central1 \
          --vm-image-project=deeplearning-platform-release \
          --vm-image-family=tf-latest-gpu \
          --machine-type=n1-standard-4 \
          --no-public-ip
        ```

        For managed notebooks (Vertex AI Workbench Managed):

        ```bash theme={null}
        gcloud notebooks runtime-templates create RUNTIME_ID \
          --location=us-central1 \
          --machine-type=n1-standard-4 \
          --no-public-ip
        ```

        (Use the appropriate `gcloud notebooks instances create` / `gcloud notebooks runtimes create` flags available in your version: any option that disables the public/external IP such as `--no-public-ip` or equivalent.)

        ***

        If you share your exact notebook type (Managed vs User-managed) and region, I can give a fully concrete create command for that case.
      </Accordion>

      <Accordion title="Using Python">
        Below is a practical way to remediate this using Python:

        **Goal:**

        1. Detect Vertex AI Workbench (Notebooks API) instances that have external IPs.
        2. Ensure future instances are created **without** external IPs (no\_public\_ip = True).
        3. For existing non‑compliant instances, you generally must recreate them without a public IP.

        ***

        ## 1. Setup

        ```bash theme={null}
        pip install google-cloud-notebooks
        gcloud auth application-default login
        ```

        Make sure your ADC (Application Default Credentials) has permissions:

        * `roles/notebooks.admin`
        * `roles/compute.viewer` (if you want to double-check NICs)

        ***

        ## 2. List notebook instances and check `no_public_ip`

        ```python theme={null}
        from google.cloud import notebooks_v1

        project_id = "YOUR_PROJECT_ID"
        location = "YOUR_REGION"  # e.g. "us-central1"

        client = notebooks_v1.NotebookServiceClient()
        parent = f"projects/{project_id}/locations/{location}"

        for instance in client.list_instances(parent=parent):
            name = instance.name
            no_public_ip = getattr(instance, "no_public_ip", None)
            print(f"{name} -> no_public_ip={no_public_ip}")
        ```

        * If `no_public_ip` is `True`, the instance is configured **without** an external IP.
        * If `no_public_ip` is `False` or missing, treat it as **non‑compliant**.

        ***

        ## 3. Create new notebook instances **without** external IP

        This is the primary technical remediation: make sure all new instances set `no_public_ip = True`.

        ```python theme={null}
        from google.cloud import notebooks_v1
        from google.cloud.notebooks_v1 import Instance

        project_id = "YOUR_PROJECT_ID"
        location = "YOUR_REGION"
        instance_id = "my-secure-notebook"

        client = notebooks_v1.NotebookServiceClient()
        parent = f"projects/{project_id}/locations/{location}"

        instance = Instance(
            machine_type=f"projects/{project_id}/zones/{location}-b/machineTypes/n1-standard-4",
            # IMPORTANT: disable public IP
            no_public_ip=True,
            # Use a private VPC/subnet
            network="projects/YOUR_PROJECT_ID/global/networks/YOUR_VPC_NAME",
            subnet="projects/YOUR_PROJECT_ID/regions/YOUR_REGION/subnetworks/YOUR_SUBNET_NAME",
        )

        operation = client.create_instance(
            parent=parent,
            instance_id=instance_id,
            instance=instance,
        )

        print("Creating instance...")
        result = operation.result()
        print("Created:", result.name)
        ```

        Key field:

        * `no_public_ip=True` → instructs Vertex AI Workbench to *not* assign an external IP.

        ***

        ## 4. Handling existing non‑compliant instances

        The `no_public_ip` setting is effectively a **creation-time** property. There is no simple “flip a flag” API call to strip the external IP from an existing Workbench instance in a supported way.

        Typical remediation pattern:

        1. **Export / backup content** from the old instance (e.g., clone repos, copy notebooks to Cloud Storage or Git).
        2. **Stop and delete** the old instance:
           ```python theme={null}
           from google.cloud import notebooks_v1

           client = notebooks_v1.NotebookServiceClient()
           name = "projects/PROJECT_ID/locations/REGION/instances/INSTANCE_ID"

           op = client.delete_instance(name=name)
           op.result()
           print("Deleted:", name)
           ```
        3. **Recreate** a new instance with identical config (machine type, image, environment), but with `no_public_ip=True` as shown in section 3.
        4. **Restore** your notebook content.

        If you must automate: script a loop that:

        * Lists instances
        * Filters those with `no_public_ip != True`
        * Logs them (for manual migration) or, if your policy allows, deletes and recreates them with the secure configuration.

        ***

        ## 5. (Optional) Policy enforcement / guardrail

        To ensure all future notebooks are compliant, combine this with:

        * An organization policy to restrict external IPs on Compute Engine VMs (`constraints/compute.vmExternalIpAccess`).
        * A CI/CD or infra-as-code pipeline where notebooks are created only via code like the above, never via console clicks.

        This is the core Python-based remediation for “Ensure that external IP addresses are not assigned to Vertex AI notebook instances.”
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "google_workbench_instance" "VERTEX_AI_NOTEBOOK_INSTANCE" {
          # Replace with your instance name and project/region
          name     = "VERTEX_AI_NOTEBOOK_INSTANCE_NAME"
          location = "REGION"
          project  = "PROJECT_ID"

          gce_setup {
            machine_type = "e2-standard-4"

            # Key setting: do not assign an external IP
            disable_public_ip = true

            network_interfaces {
              network         = "projects/PROJECT_ID/global/networks/VPC_NETWORK_NAME"
              subnetwork      = "projects/PROJECT_ID/regions/REGION/subnetworks/SUBNET_NAME"
              internal_ip_only = true
            }

            service_accounts {
              email  = "SERVICE_ACCOUNT_EMAIL"
              scopes = ["https://www.googleapis.com/auth/cloud-platform"]
            }
          }
        }
        ```

        Substitute:

        * `VERTEX_AI_NOTEBOOK_INSTANCE_NAME` with your Vertex AI Workbench instance name.
        * `PROJECT_ID` with your GCP project ID.
        * `REGION` with the region of the instance.
        * `VPC_NETWORK_NAME` and `SUBNET_NAME` with your VPC and subnet.
        * `SERVICE_ACCOUNT_EMAIL` with the service account the instance should use.

        Changing `disable_public_ip` from `false` to `true` may require recreation depending on the current instance configuration; check the `terraform plan` output for any `-/+` replacement indicator on `google_workbench_instance.VERTEX_AI_NOTEBOOK_INSTANCE`.

        For verification, `terraform plan` should show:

        * An update (or replacement) to `google_workbench_instance.VERTEX_AI_NOTEBOOK_INSTANCE` setting `disable_public_ip = true` (and `internal_ip_only = true` if you added it), with no remaining attributes indicating an external/public IP.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>