# GCP Vertex AI Workbench Notebook Has Public IP

> Workbench notebooks created without disabling public IP receive an ephemeral external address by default, exposing a research VM to the internet. ZopNight fires only when the discoverer positively stamped publicIp=true, resolved from the gceSetup.disablePublicIp boolean plus an accessConfigs scan, and recommends IAP TCP forwarding instead, a $0 security fix.

Source: https://zop.dev/integrations/gcp/recommendations/gcp-vertex-ai-workbench-notebook-has-public-ip
Updated: 2026-08-19

---

## Public by default is the trap

A Workbench instance created without an explicit network choice gets a default ephemeral
external IP, which is GCE's behavior inherited by the notebook VM underneath. Data-science
notebooks are a bad thing to expose: they hold service-account credentials, mounted
datasets, and a Jupyter server, and they are typically created quickly outside the
hardened-infrastructure review path that catches this on production VMs.

## How the flag is resolved

The discoverer resolves exposure from the authoritative source: the
`gceSetup.disablePublicIp` boolean on Workbench v2 instances (top-level `noPublicIp` on
legacy ones), defaulting to public when unset (an instance with no explicit
access configuration still receives an ephemeral address), OR-ed with a direct scan of
`accessConfigs` for an external IP. The result lands as a single `publicIp` stamp, and
the rule fires only on a positively recorded true; a notebook whose exposure was never
resolved is skipped rather than guessed at. This is a $0, severity-medium security
finding: there is no dollar lever, and the categories that carry savings floors do not
apply.

## IAP replaces the address

Connectivity without exposure is a solved problem: IAP TCP forwarding tunnels the Jupyter
session through Google's identity-aware proxy, and Private Google Access covers the
notebook's outbound calls to Google APIs. Neither needs the external address, and both
leave access controlled by IAM rather than by whoever finds the IP.

## Audit exposure across notebooks

```bash
gcloud workbench instances list --location us-central1-a \
  --format="table(name,gceSetup.disablePublicIp,state)"
```

Every row showing false (or empty) in the middle column is carrying an external address.

## Recreate, not patch

Workbench does not support flipping an existing instance to private-only in place. The
remediation is to recreate the instance with public IP disabled and move the work over.
Since notebook state lives on the data disk and in Git, the recreate is cheap; schedule
it alongside the Secure Boot fix (RC-1236) so the fleet is touched once, not twice.