Vertexai workbench cloud monitoring enabled remediation

PROJECT_ID="your-project-id"
REGION="us-central1"       # for managed notebooks
ZONE="us-central1-b"       # for user-managed (VM-based) notebooks

gcloud config set project "$PROJECT_ID"

gcloud services enable \
  notebooks.googleapis.com \
  monitoring.googleapis.com

gcloud notebooks instances list --location="$REGION"

gcloud notebooks instances list --location="$ZONE" --format="table(name, state, proxyUri)"

gcloud compute instances add-metadata "INSTANCE_NAME" \
  --zone="$ZONE" \
  --metadata=enable-oslogin=TRUE

gcloud compute ssh "INSTANCE_NAME" --zone="$ZONE"

curl -sSO https://dl.google.com/cloudagents/add-google-cloud-ops-agent-repo.sh
sudo bash add-google-cloud-ops-agent-repo.sh --also-install

curl -sSO https://dl.google.com/cloudagents/add-google-cloud-ops-agent-repo.sh
sudo bash add-google-cloud-ops-agent-repo.sh --also-install --distribution=el

exit

sudo systemctl status google-cloud-ops-agent

# List monitored resource types
gcloud monitoring resource-descriptors list --format="value(type)" | grep notebook

pip install google-cloud-notebooks google-api-python-client
gcloud auth application-default login

from google.cloud import notebooks_v1
from googleapiclient import discovery
from google.auth import default

PROJECT_ID = "your-project-id"
LOCATION = "us-central1"   # change as needed
PARENT = f"projects/{PROJECT_ID}/locations/{LOCATION}"

def list_notebook_instances():
    client = notebooks_v1.NotebookServiceClient()
    for inst in client.list_instances(parent=PARENT):
        yield inst

def get_compute_client():
    creds, _ = default()
    return discovery.build("compute", "v1", credentials=creds, cache_discovery=False)

def check_monitoring_for_instance(instance, compute):
    # User-managed notebooks have a single VM behind them.
    # The VM name is usually the same as the notebook instance ID.
    # The zone is in instance.gce_setup.zone (or instance.vm_image.gce_zone on some versions).
    try:
        gce_setup = instance.gce_setup
        zone = gce_setup.zone.split("/")[-1]  # e.g. "projects/.../zones/us-central1-b"
        vm_name = gce_setup.vm_name or instance.name.split("/")[-1]
    except AttributeError:
        # Fallback: parse zone from instance.name if needed
        # Adjust if your instances look different
        print(f"Could not determine VM info for {instance.name}")
        return

    vm = compute.instances().get(project=PROJECT_ID, zone=zone, instance=vm_name).execute()

    service_accounts = vm.get("serviceAccounts", [])
    if not service_accounts:
        print(f"{instance.name}: NO service account configured – monitoring/ logging are disabled")
        return

    scopes = set()
    for sa in service_accounts:
        scopes.update(sa.get("scopes", []))

    needs_monitoring = not any("monitoring.write" in s for s in scopes)
    needs_logging = not any("logging.write" in s for s in scopes)

    if needs_monitoring or needs_logging:
        print(f"{instance.name}: missing scopes -> "
              f"{'monitoring' if needs_monitoring else ''} "
              f"{'logging' if needs_logging else ''}")
    else:
        print(f"{instance.name}: OK (Monitoring & Logging scopes present)")

def main():
    compute = get_compute_client()
    for inst in list_notebook_instances():
        check_monitoring_for_instance(inst, compute)

if __name__ == "__main__":
    main()

https://www.googleapis.com/auth/logging.write
https://www.googleapis.com/auth/monitoring.write

from google.cloud import notebooks_v1
from google.protobuf import field_mask_pb2

PROJECT_ID = "your-project-id"
LOCATION = "us-central1-b"  # zone; user-managed notebooks are zonal
PARENT = f"projects/{PROJECT_ID}/locations/{LOCATION}"
INSTANCE_ID = "my-monitored-notebook"

SERVICE_ACCOUNT_EMAIL = "my-sa@your-project-id.iam.gserviceaccount.com"  # or default

def create_notebook_with_monitoring():
    client = notebooks_v1.NotebookServiceClient()

    instance = notebooks_v1.Instance(
        name=f"{PARENT}/instances/{INSTANCE_ID}",
        machine_type=f"projects/{PROJECT_ID}/zones/{LOCATION}/machineTypes/n1-standard-4",
        service_account=SERVICE_ACCOUNT_EMAIL,
        service_account_scopes=[
            "https://www.googleapis.com/auth/cloud-platform",         # superset
            "https://www.googleapis.com/auth/logging.write",
            "https://www.googleapis.com/auth/monitoring.write",
        ],
        vm_image=notebooks_v1.VmImage(
            project="deeplearning-platform-release",
            image_family="common-cpu-notebooks",  # pick an appropriate family
        ),
        install_gpu_driver=False,
        no_public_ip=True,
    )

    op = client.create_instance(
        parent=PARENT,
        instance_id=INSTANCE_ID,
        instance=instance,
    )
    print("Creating instance...")
    result = op.result()
    print(f"Created instance: {result.name}")

if __name__ == "__main__":
    create_notebook_with_monitoring()

# Enabling the built‑in “Cloud Monitoring” feature on Vertex AI Workbench
# notebook instances is not currently exposed as a Terraform argument on
# google_notebooks_instance / google_notebooks_runtime, so it cannot be
# remediated directly in Terraform.

# You must turn this on via the GCP Console or API:
# Console:
#   Vertex AI → Workbench → (select notebook instance) → Edit →
#   Monitoring → Enable Cloud Monitoring → Save.
#
# Or via the Notebooks/Vertex AI API using the corresponding field, outside
# of Terraform control.

# No valid Terraform arguments exist today that map to this specific toggle,
# so any Terraform change here would not actually satisfy the check.