Skip to main content

root access is disabled for your Vertex AI notebook

More Info:​

Ensure root access is disabled for your Vertex AI notebook instances

Risk Level​

High

Address​

Security

Compliance Standards​

  • CIS GCP

Triage and Remediation​

Remediation​

Using Console

In Vertex AI Workbench, “no root” is a creation‑time setting. You can’t flip an existing instance from root-enabled to root-disabled; you must recreate it with root disabled.

Below are console steps to (1) identify notebooks, (2) recreate them with root access disabled, and (3) clean up.

1. Identify existing Vertex AI notebook instances​

  1. Go to Google Cloud console: https://console.cloud.google.com
  2. Make sure you’re in the correct project (top-left project selector).
  3. Navigate to Vertex AI → Workbench (or Vertex AI > Workbench > User-managed notebooks, depending on UI).
  4. In the Instances list, note each notebook instance that should not allow root access.

2. Back up any work from existing instances​

For each instance:

  1. Click the instance name to open details.
  2. Open JupyterLab or Jupyter from the console link.
  3. Export notebooks and scripts:
    • Download notebooks locally, or
    • Commit them to a repo, or
    • Copy them to a shared location (e.g., Cloud Storage bucket).

If you have data stored on the boot disk, ensure that data is backed up (e.g., copy to Cloud Storage).

3. Create a new notebook instance with root access disabled​

You must do this per notebook you want to lock down.

  1. In Vertex AI → Workbench, click New Notebook (or Create).
  2. Choose the appropriate type (Managed / User-managed) and framework (JupyterLab, TensorFlow, etc.), matching the original environment as closely as needed.
  3. In the creation wizard, expand Advanced options or Security / Permissions (label may vary slightly).
  4. Locate the setting similar to:
    • Disable root access, or
    • Disallow root login / sudo
  5. Check or enable the option to disable root access.
  6. Configure:
    • Region / zone
    • Machine type
    • GPU, if applicable
    • Disk size to match or appropriately replace the original instance.
  7. Click Create and wait for the instance to be ready.

4. Restore notebooks and verify no-root behavior​

  1. From the new instance’s row in Workbench, click Open JupyterLab/Jupyter.
  2. Upload your previously backed-up notebooks/scripts or pull them from your repo / Cloud Storage.
  3. Verify root is disabled:
    • Open a Terminal in Jupyter.
    • Run: 
      whoami
      sudo ls /
    • You should:
      • Be a non-root user (jupyter, user, etc.).
      • See sudo unavailable or permission denied (no root escalation possible).

If root is still available, confirm you created the instance with the “disable root access” flag; if not, you’ll need to recreate it again with the setting correctly applied.

5. Decommission old root-enabled instances​

After confirming the new instance works:

  1. Return to Vertex AI → Workbench.
  2. Select the old root-enabled instance.
  3. Click Stop (optional) and then Delete.
  4. Confirm deletion.

Repeat for all remaining instances that should not allow root access.

6. Enforce this for future notebooks (process / policy)​

While not strictly a console click, you should:

  • Document a process that all new Vertex AI notebooks must be created with root access disabled.
  • If you use infrastructure-as-code (e.g., Terraform/Deployment Manager), encode:
    • disable_root: true (or equivalent flag) in your notebook resource definitions.
  • Optionally restrict who can create Workbench instances via IAM so only a controlled group can create them with the right settings.
Using CLI

In Vertex AI Workbench, “disabling root access” is controlled by a boolean setting on the notebook instance. You cannot turn off root on a running instance; you must recreate it with root access disabled.

Below is how to do it with gcloud for Managed Notebooks.

1. List existing notebook instances​

gcloud notebooks instances list --location=REGION

Note the INSTANCE_ID and REGION of the instance you want to recreate.

2. Capture the current instance configuration​

Describe the existing instance so you can recreate it with the same settings (machine type, GPUs, etc.):

gcloud notebooks instances describe INSTANCE_ID \
  --location=REGION

Save/record relevant fields:

  • machineType
  • acceleratorConfig (if any)
  • bootDiskType, bootDiskSizeGb
  • network / subnet
  • serviceAccount
  • containerImage or vmImage info
  • Any other custom settings you rely on.

3. Stop and delete the current instance​

gcloud notebooks instances stop INSTANCE_ID \
  --location=REGION

gcloud notebooks instances delete INSTANCE_ID \
  --location=REGION \
  --quiet

4. Recreate the instance with root access disabled​

Use the same config you captured in step 2, but ensure root access is disabled via the --no-enable-root-access flag.

Example (adapt with your values):

gcloud notebooks instances create INSTANCE_ID \
  --location=REGION \
  --machine-type=MACHINE_TYPE \
  --boot-disk-type=PD_SSD \
  --boot-disk-size=BOOT_DISK_SIZE_GB \
  --service-account=SERVICE_ACCOUNT_EMAIL \
  --container-repository=us-docker.pkg.dev/deeplearning-platform-release/gcr.io/deeplearning-platform-release/base-cpu \
  --container-tag=latest \
  --no-enable-root-access

If you use a VM image instead of a container:

gcloud notebooks instances create INSTANCE_ID \
  --location=REGION \
  --machine-type=MACHINE_TYPE \
  --boot-disk-type=PD_SSD \
  --boot-disk-size=BOOT_DISK_SIZE_GB \
  --vm-image-project=PROJECT_WITH_IMAGE \
  --vm-image-family=IMAGE_FAMILY \
  --service-account=SERVICE_ACCOUNT_EMAIL \
  --no-enable-root-access

Adjust flags as needed (GPU, network, etc.) to match your previous configuration.

5. Verify root is disabled​

After creation:

gcloud notebooks instances describe INSTANCE_ID \
  --location=REGION \
  --format="value(enableRootAccess)"

Ensure it returns False. Root access is now disabled for this Vertex AI notebook instance.

Using Python

In Vertex AI Workbench (user‑managed notebooks), root access is controlled by the disable_root flag on the notebook instance. You remediate by updating existing instances to set disable_root = True (and enforce it on all new ones).

Below is a minimal, step‑by‑step Python approach using the Notebooks API.

1. Install and authenticate​

pip install google-cloud-notebooks
gcloud auth application-default login

Make sure your ADC is set to a principal with permission:

  • notebooks.instances.get
  • notebooks.instances.update

2. Disable root on a single Notebook instance​

Replace:

  • YOUR_PROJECT_ID
  • YOUR_REGION (e.g. us-central1)
  • YOUR_INSTANCE_ID (Notebook instance name, not full path)
from google.cloud import notebooks_v1
from google.protobuf import field_mask_pb2

project_id = "YOUR_PROJECT_ID"
region = "YOUR_REGION"
instance_id = "YOUR_INSTANCE_ID"

client = notebooks_v1.NotebookServiceClient()

name = f"projects/{project_id}/locations/{region}/instances/{instance_id}"

# Define the fields to change
instance = notebooks_v1.Instance(
    name=name,
    disable_root=True
)

update_mask = field_mask_pb2.FieldMask(paths=["disable_root"])

operation = client.update_instance(
    instance=instance,
    update_mask=update_mask,
)

print("Disabling root; waiting for operation to complete...")
result = operation.result()  # waits until done
print(f"Updated instance: {result.name}, disable_root={result.disable_root}")

This will:

  • Patch only the disable_root field.
  • Restart/update the instance as required by the service (it may take a few minutes).

3. Disable root on all existing instances in a region​

from google.cloud import notebooks_v1
from google.protobuf import field_mask_pb2

project_id = "YOUR_PROJECT_ID"
region = "YOUR_REGION"

client = notebooks_v1.NotebookServiceClient()

parent = f"projects/{project_id}/locations/{region}"

for inst in client.list_instances(parent=parent):
    if inst.disable_root:
        print(f"Already disabled: {inst.name}")
        continue

    print(f"Disabling root on: {inst.name}")
    instance = notebooks_v1.Instance(
        name=inst.name,
        disable_root=True
    )
    update_mask = field_mask_pb2.FieldMask(paths=["disable_root"])

    op = client.update_instance(instance=instance, update_mask=update_mask)
    op.result()
    print(f"Done: {inst.name}")

Run per region you use.

4. Enforce disable_root on new instances (creation example)​

from google.cloud import notebooks_v1

project_id = "YOUR_PROJECT_ID"
region = "YOUR_REGION"
instance_id = "NEW_INSTANCE_ID"

client = notebooks_v1.NotebookServiceClient()

parent = f"projects/{project_id}/locations/{region}"

instance = notebooks_v1.Instance(
    name=f"{parent}/instances/{instance_id}",
    machine_type=f"projects/{project_id}/zones/{region}-a/machineTypes/n1-standard-4",
    vm_image=notebooks_v1.VmImage(
        project="deeplearning-platform-release",
        image_family="tf2-ent-2-11-cpu"
    ),
    disable_root=True,  # critical line
)

operation = client.create_instance(
    parent=parent,
    instance_id=instance_id,
    instance=instance,
)

print("Creating instance with root disabled; waiting...")
res = operation.result()
print(f"Created: {res.name}, disable_root={res.disable_root}")

If you tell me whether you use user‑managed or managed notebooks across your project, I can tailor this to your exact setup and add policy/guardrails (e.g., org policy + CI checks).

Using Terraform
# There is currently no Terraform argument on the official Google provider
# (google or google-beta) for Vertex AI Workbench / Notebooks instances
# that directly maps to the "Disable root access" setting.

# Root access for Vertex AI notebook instances must be controlled via:
# - The Vertex AI Workbench UI (Edit > Security > Disable root/terminal/SSH), or
# - Organization policy / OS Login / OS configuration outside of Terraform.

# Example (for context only) of a Vertex AI Workbench instance managed by Terraform;
# note there is NO disable-root flag you can set here:

resource "google_workbench_instance" "vertex_notebook" {
  name     = "VERTEX_NOTEBOOK_NAME"          # replace with your instance name
  location = "REGION"                        # replace with the instance region

  gce_setup {
    machine_type = "e2-standard-4"

    // security-related flags that DO exist, but do NOT disable root:
    disable_public_ip = true

    service_accounts {
      email = "SERVICE_ACCOUNT_EMAIL"        # replace with the SA used by the instance
    }
  }
}

Disabling root access inside the notebook VM for Vertex AI Workbench is not currently exposed via Terraform; you must apply this control through the Google Cloud Console (Workbench instance security settings) or via OS policy/organization policies outside Terraform. To verify, terraform plan will show no arguments or changes related to a “disable root access” setting, because none exist in the provider.