Manage access to a runtime template

This page describes how you can grant and revoke access to a runtime template in Colab Enterprise.

Before you begin

  1. Sign in to your Google Cloud account. If you're new to Google Cloud, create an account to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.

  2. In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

    Roles required to select or create a project

    • Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
    • Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

    Go to project selector

  3. Verify that billing is enabled for your Google Cloud project.

  4. Enable the Agent Platform, Dataform, and Compute Engine APIs.

    Roles required to enable APIs

    To enable APIs, you need the serviceusage.services.enable permission. If you created the project, then you likely already have this permission through the Owner role (roles/owner). Otherwise, you can get this permission through the Service Usage Admin role (roles/serviceusage.serviceUsageAdmin). Learn how to grant roles.

    Enable the APIs

  5. In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

    Roles required to select or create a project

    • Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
    • Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

    Go to project selector

  6. Verify that billing is enabled for your Google Cloud project.

  7. Enable the Agent Platform, Dataform, and Compute Engine APIs.

    Roles required to enable APIs

    To enable APIs, you need the serviceusage.services.enable permission. If you created the project, then you likely already have this permission through the Owner role (roles/owner). Otherwise, you can get this permission through the Service Usage Admin role (roles/serviceusage.serviceUsageAdmin). Learn how to grant roles.

    Enable the APIs

    8.

Required roles

To get the permissions that you need to manage access to a runtime template, ask your administrator to grant you the Colab Enterprise Admin (roles/aiplatform.colabEnterpriseAdmin) IAM role on the project. For more information about granting roles, see Manage access to projects, folders, and organizations.

You might also be able to get the required permissions through custom roles or other predefined roles.

Grant access to a runtime template

To grant a principal access to a runtime template, you can use the Google Cloud console, the Google Cloud CLI, or Terraform.

Console

  1. In the Google Cloud console, go to the Colab Enterprise Runtime templates page.

    Go to Runtime templates

  2. In the Region menu, select the region that contains your runtime template.

  3. In the Runtime template menu, select a runtime template. If there aren't any runtime templates listed, create a runtime template.

  4. Click  Permissions.

  5. In the Permissions window, click  Add principal.

  6. In the Grant access dialog, in the New principals field, enter one or a comma separated list of principals.

  7. In the Select a role menu, complete the dialog to assign a role.

  8. Optional: Click  Add another role, and repeat the last step.

  9. Click Save.

gcloud

Before using any of the command data below, make the following replacements:

  • RUNTIME_TEMPLATE_ID: the ID of your runtime template.
  • PRINCIPAL: the principal to add the binding for.
  • ROLE: the role name to assign to the principal.
  • PROJECT_ID: your project ID.
  • REGION: the region where your runtime template is located.

Execute the following command:

Linux, macOS, or Cloud Shell

gcloud colab runtime-templates add-iam-policy-binding RUNTIME_TEMPLATE_ID \
    --member=PRINCIPAL \
    --role=ROLE \
    --project=PROJECT_ID \
    --region