create_dlvm_with_limited_access.sh

# usage: start_dlvm_for_user tf-latest-cpu [email protected] my-awesome-instance my-project us-west1-b
function start_dlvm_for_user() {
    export IMAGE_FAMILY=$1
    export USER_GOOGLE_ACCOUNT_MAIL=$2
    export INSTANCE_NAME=$3
    export PROJECT_ID=$4
    export ZONE=$5
    export INSTANCE_TYPE="n1-standard-8"
    SERVICE_ACCOUNT_NAME="${INSTANCE_NAME}-sa"
    
    gcloud iam service-accounts create "${SERVICE_ACCOUNT_NAME}"
    
    gcloud iam service-accounts add-iam-policy-binding \
        "${SERVICE_ACCOUNT_NAME}@${PROJECT_ID}.iam.gserviceaccount.com" \
        --member="user:${USER_GOOGLE_ACCOUNT_MAIL}" --role="roles/iam.serviceAccountUser"
    
    # Replace osAdminLogin with osLogin is you do NOT want the user to have an
    # ability to act as root.
    gcloud projects add-iam-policy-binding ${PROJECT_ID} \
        --member="serviceAccount:${SERVICE_ACCOUNT_NAME}@${PROJECT_ID}.iam.gserviceaccount.com" \
        --role="roles/compute.osAdminLogin"
    
    gcloud compute instances create $INSTANCE_NAME \
            --zone=$ZONE \
            --image-family=$IMAGE_FAMILY \
            --image-project=deeplearning-platform-release \
            --machine-type=$INSTANCE_TYPE \
            --boot-disk-size=120GB \
            --min-cpu-platform=Intel\ Skylake \
            --metadata enable-oslogin=TRUE \
            --service-account ${SERVICE_ACCOUNT_NAME}@${PROJECT_ID}.iam.gserviceaccount.com
}