terraform-google-secure-vertex-workbench

KO | EN

gitlite — search

#python #java #python3 #arduino #golang #machine-learning #rust #html #flask #javascript #seismology #nodejs

terraform-google-secure-vertex-workbench

★ 12 Open GitHub ↗

Terraform module for secured deployment of Vertex Workbench instances

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# Terraform Private Vertex AI Workbench Notebooks Module

This module deploys [Vertex AI Workbench User-Managed Notebooks](https://cloud.google.com/vertex-ai/docs/workbench/user-managed/introduction) and [Vertex AI Workbench Managed Notebooks](https://cloud.google.com/vertex-ai/docs/workbench/managed/introduction) on GCP that are private (internal IP only), while still remaining easily usable and accessible by the user of the notebook.

## Introduction

User-Managed and Managed Notebooks on Vertex AI allow users to easily deploy GCE VMs with JupyterLab pre-installed. These VMs use an external IP address by default for access to the internet for the purposes of setting up the instance (running startup scripts), exposing the Jupyter user interface, and accessing 3rd party services (such as PyPI and GitHub).

The problem with this is the security issue that arises with external IP addresses. GCE VM Security best practice states that VMs should not have an external IP assigned to it (unless absolutely necessary), as it opens the instance up to attack from the public internet. Therefore, by default, Vertex AI Managed and User-Managed Notebooks are vulnerable to attack from the public internet too.

This Terraform module is the answer to this problem. The module deploys Vertex Workbench instances using only internal IP addresses while still allowing the user interface to be accessed directly via the GCP Vertex Workbench GUI by clicking the 'OPEN JUPYTERLAB' button.

## Architecture

The following Notebook/Network Architecture is deployed in this module:

![Notebook/Network Archietcture ](https://raw.githubusercontent.com/teamdatatonic/terraform-google-secure-vertex-workbench/main/docs/images/private-notebooks.png "Notebook/Network Architecture")

For more information about each component of this design, please refer to [ARCHITECTURE.md](./docs/ARCHITECTURE.md)

## Development

### Local setup

- Install [pre-commit](https://pre-commit.com/)
- Install the pre-commit hooks - `pre-commit install`

### README

The README file is autogenerated using [`terraform-docs`](https://github.com/terraform-docs/terraform-docs). This is done when you create a pull request (or push to an existing PR).

You can customise the template (including this text for example) in `.github/workflows/pr-checks.yml`.

## Usage

There is an example of how to use this module in the [example](./example/) folder but simple usage is as follows:

```hcl
module "private_vertex_nb_instances" {
  source                        = "teamdatatonic/secure-vertex-workbench/google"
  version                       = "2.0.0"
  project                       = var.project
  zone                          = var.zone
  region                        = var.region
  notebooks                     = var.notebooks
  additional_vertex_nb_sa_roles = var.additional_vertex_nb_sa_roles
  vpc_network_name              = var.vpc_network_name
  subnet_ip_cidr_range          = var.subnet_ip_cidr_range
  vpc_sc_enabled                = false
  gcs_bucket_name               = var.gcs_bucket_name
  gcs_labels                    = var.gcs_labels
  additional_fw_rules           = var.additional_fw_rules
}
```

Then perform the following commands on the root folder:

- `terraform init` to get the plugins
- `terraform plan` to see the infrastructure plan
- `terraform apply` to apply the infrastructure build
- `terraform destroy` to destroy the built infrastructure

## Requirements

| Name | Version |
|------|---------|
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.14.5 |

## Providers

No providers.

## Modules

| Name | Source | Version |
|------|--------|---------|
| <a name="module_private_vertex_nb_instances"></a> [private\_vertex\_nb\_instances](#module\_private\_vertex\_nb\_instances) | ../ | n/a |

## Resources

No resources.

## Inputs

| Name | Description | Type | Default | Required |
|------|-------------|------|---------|:--------:|
| <a name="input_additional_fw_rules"></a> [additional\_fw\_rules](#input\_additional\_fw\_rules) | Additional firewall rules that you may want to create to allow other traffic | <pre>list(object({ name = string description = string direction = string priority = number ranges = list(string) source_tags = optional(list(string)) source_service_accounts = optional(list(string)) target_tags = optional(list(string)) target_service_accounts = optional(list(string)) allow = list(object({ protocol = string ports = list(string) })) deny = list(object({ protocol = string ports = list(string) })) log_config = optional(object({ metadata = string })) }))</pre> | `[]` | no |
| <a name="input_additional_vertex_nb_sa_roles"></a> [additional\_vertex\_nb\_sa\_roles](#input\_additional\_vertex\_nb\_sa\_roles) | Additional roles that you may want to assign to the Vertex AI NB SA | `list(string)` | `[]` | no |
| <a name="input_gcs_bucket_name"></a> [gcs\_bucket\_name](#input\_gcs\_bucket\_name) | Name of the GCS Bucket that will contain the post startup script | `string` | n/a | yes |
| <a name="input_gcs_labels"></a> [gcs\_labels](#input\_gcs\_labels) | Labels to attach to the GCS Bucket. Useful for labelling resources for billing purposes | `map(string)` | `null` | no |
| <a name="input_notebooks"></a> [notebooks](#input\_notebooks) | A map containing the containing the configuration for the desired Vertex AI Workbench User-Managed Notebooks | <pre>map(object({ labels = map(string), instance_owner = string, metadata = map(string), type = string, access_type = optional(string) }))</pre> | `{}` | no |
| <a name="input_project"></a> [project](#input\_project) | Your GCP Project ID | `string` | n/a | yes |
| <a name="input_region"></a> [region](#input\_region) | The GCP region for the GCS bucket and Artifact Registry | `string` | n/a | yes |
| <a name="input_subnet_ip_cidr_range"></a> [subnet\_ip\_cidr\_range](#input\_subnet\_ip\_cidr\_range) | The name of your VPC Subnetwork | `string` | `"10.0.0.0/21"` | no |
| <a name="input_vpc_network_name"></a> [vpc\_network\_name](#input\_vpc\_network\_name) | The name of your VPC Network | `string` | n/a | yes |
| <a name="input_zone"></a> [zone](#input\_zone) | The GCP Zone for Vertex Notebook User-Managed Instances | `string` | n/a | yes |

## Outputs

| Name | Description |
|------|-------------|
| <a name="output_dns_policy_id"></a> [dns\_policy\_id](#output\_dns\_policy\_id) | an identifier for the dns policy with format projects/{{project}}/policies/{{name}} |
| <a name="output_firewall_id"></a> [firewall\_id](#output\_firewall\_id) | an identifier for the fw rules with format projects/{{project}}/global/firewalls/{{name}} |
| <a name="output_gcr-response-policy-rule_id"></a> [gcr-response-policy-rule\_id](#output\_gcr-response-policy-rule\_id) | an identifier for the gcr dns policy rule with format projects/{{project}}/responsePolicies/{{response\_policy}}/rules/{{rule\_name}} |
| <a name="output_gcs_bucket_self_link"></a> [gcs\_bucket\_self\_link](#output\_gcs\_bucket\_self\_link) | The URI of the created bucket. |
| <a name="output_gcs_bucket_url"></a> [gcs\_bucket\_url](#output\_gcs\_bucket\_url) | The base URL of the bucket, in the format gs://<bucket-name> |
| <a name="output_google-managed-notebooks-response-policy-rule-id"></a> [google-managed-notebooks-response-policy-rule-id](#output\_google-managed-notebooks-response-policy-rule-id) | an identifier for the notebooks dns policy rule with format projects/{{project}}/responsePolicies/{{response\_policy}}/rules/{{rule\_name}} |
| <a name="output_google_managed_notebook_id"></a> [google\_managed\_notebook\_id](#output\_google\_managed\_notebook\_id) | an identifier for the fw rules with format projects/{{project}}/global/firewalls/{{name}} |
| <a name="output_googleapis-response-policy-rule_id"></a> [googleapis-response-policy-rule\_id](#output\_googleapis-response-policy-rule\_id) | an identifier for the googleapis dns policy rule with format projects/{{project}}/responsePolicies/{{response\_policy}}/rules/{{rule\_name}} |
| <a name="output_nat_id"></a> [nat\_id](#output\_nat\_id) | an identifier for the NAT with format {{project}}/{{region}}/{{router}}/{{name}} |
| <a name="output_pkg-response-policy-rule_id"></a> [pkg-response-policy-rule\_id](#output\_pkg-response-policy-rule\_id) | an identifier for the pkg.dev dns policy rule with format projects/{{project}}/responsePolicies/{{response\_policy}}/rules/{{rule\_name}} |
| <a name="output_private_ip_alloc_id"></a> [private\_ip\_alloc\_id](#output\_private\_ip\_alloc\_id) | an identifier for the private ip allocation with format projects/{{project}}/global/addresses/{{name}} |
| <a name="output_private_ip_self_link"></a> [private\_ip\_self\_link](#output\_private\_ip\_self\_link) | The URI of the created IP address. |
| <a name="output_router_id"></a> [router\_id](#output\_router\_id) | an identifier for the router with format projects/{{project}}/regions/{{region}}/routers/{{name}} |
| <a name="output_router_self_link"></a> [router\_self\_link](#output\_router\_self\_link) | The URI of the created router. |
| <a name="output_subnetwork_id"></a> [subnetwork\_id](#output\_subnetwork\_id) | an identifier for the VPC subnetwork with format projects/{{project}}/regions/{{region}}/subnetworks/{{name}} |
| <a name="output_subnetwork_self_link"></a> [subnetwork\_self\_link](#output\_subnetwork\_self\_link) | The URI of the created subnetwork. |
| <a name="output_user-managed-notebooks-response-policy-rule-id"></a> [user-managed-notebooks-response-policy-rule-id](#output\_user-managed-notebooks-response-policy-rule-id) | an identifier for the notebooks dns policy rule with format projects/{{project}}/responsePolicies/{{response\_policy}}/rules/{{rule\_name}} |
| <a name="output_user_managed_notebook_id"></a> [user\_managed\_notebook\_id](#output\_user\_managed\_notebook\_id) | an identifier for the fw rules with format projects/{{project}}/global/firewalls/{{name}} |
| <a name="output_vpc_id"></a> [vpc\_id](#output\_vpc\_id) | an identifier for the VPC network with format projects/{{project}}/global/networks/{{name}} |
| <a name="output_vpc_self_link"></a> [vpc\_self\_link](#output\_vpc\_self\_link) | The URI of the created VPC. |

terraform-google-secure-vertex-workbench

Explore Similar Repositories

Was this content helpful?

Recent Feedback

Download README