403 when running Workbench Instance

julliet

I was running User-managed notebooks before with the same settings having no issue.

Now I'm running new instance and want to use Jupyter Notebook UI.

I'm running instance from service account.
For fast troubleshooting I have all these roles:

Service Account Token Creator
Service Account User
Vertex AI Administrator

Service account has everything like:

Vertex AI Service Agent
Compute Instance Admin (v1)
AI Platform Notebooks Service Agent

I couldn't troubleshoot it myself. I can connect to the instance via my ssh and run jupyter this way, but I can't normally impersonate the service account when doing ssh. Moreover I would need this Vertex UI running for other team members

nikacalupas

Hi @julliet,

Welcome to the Google Cloud Community!

Here are some suggestions that might help to resolve your issue:

Given that you're using a service account to run the notebook, the most likely cause is that your service account is missing necessary IAM roles. Carefully verify that the service account that is attached to the notebook has the following roles:

Verify ingress/egress firewall rules for your notebook's network instance.
Confirm the Vertex AI API is enabled for your project.
Check the Cloud Logging for both the Notebook instance and the associated Compute Engine instance. Look for any errors such as "Permission denied," "Insufficient permissions," or "Failed to connect.
After making IAM changes, wait several minutes (up to 5-10) to ensure they propagate through the system. Then, try connecting to the notebook again.
Consider deleting and recreating the notebook instance. Make absolutely sure you're selecting the correct service account during creation.

For more details on troubleshooting workbench, you may refer to this documentation.

Was this helpful? If so, please accept this answer as “Solution”. If you need additional assistance, reply here within 2 business days and I’ll be happy to help.