You can find and edit information about a project's Looker (Google Cloud core) instances in the Google Cloud console.
Viewing instance information
Looker (Google Cloud core) instances that are associated with the selected Google Cloud project are listed on the Instances page in the Google Cloud console — including instances that are created by other users in your organization.
Required role
To view information on the Instances page, you must have the Looker Admin (roles/looker.admin) or the Looker Viewer (roles/looker.viewer) role.
You might also be able to get this permission with custom roles or other predefined roles.
The Instances page
The Instances page displays this information about each instance:
- Status:
- A green circle with a check mark is shown if the instance was created successfully and is active.
- A loading icon is shown if the instance creation is in progress.
- Name: The name of the instance that was provided by the instance creator when the instance was created. Click the name to navigate to the Details tab, which shows additional information about the selected instance.
Instance URL: The URL at which an instance using public secure connections can be accessed. By default, instance URLs take the form
https://hostname.looker.app, where the hostname is randomly assigned. Click the URL to navigate to the instance.Version: The Looker version that's running on the instance.
Region: The region in which the instance is hosted.
Created Date: The date on which the instance was created.
Instance tabs
From the Instances page, click an instance's name to view more information about the instance. After you click the name, an instance configuration page appears with information in the following tabs:
Details tab
The Details tab shows additional instance metadata:
- Platform Edition: The instance's edition. Options are Standard, Enterprise, and Embed.
- Create Time: The time at which the instance was created.
- Update Time: The time at which the instance was most recently updated.
- Public IP Enabled: Whether the instance's network connection is enabled for public secure connections. If it's enabled, true is shown. If it's not enabled, false is shown.
- Private IP Enabled: Whether the instance's network connection is enabled for private connections (private services access) connection. If it's enabled, true is shown. If it's not enabled, false is shown. This setting shows false if the instance's network connection uses Private Service Connect.
- PSC Enabled: Whether the instance's network connection is enabled for Private Service Connect. If it's enabled, true is shown. If it's not enabled, false is shown.
PSC Configuration: This setting appears if PSC Enabled is true, along with the following subsettings:
- Looker Service Attachment URI: This setting displays the URI for the Private Service Connect service attachment for Looker (Google Cloud core).
- Allowed VPCs: This setting contains a list of the VPCs that have authorized northbound access into the Private Service Connect instance.
PSC Endpoints: This setting contains a list of the southbound (egress) connections for the Private Service Connect instance, using the following subsettings:
- Local FQDN: The fully qualified domain name of the service that the instance is connecting to.
- Target Service Attachment URI: The service attachment URI for the service that the Looker (Google Cloud core) instance is connecting to.
Connection Status: The status of the connection, which can be one of the following:
- ACCEPTED: Connection is established and functioning normally.
- PENDING: Connection is not established (Looker tenant project hasn't been allowlisted).
- NEEDS ATTENTION: Issue with target service attachment, such at NAT subnet is exhausted.
- REJECTED: Connection is not established (Looker) tenant project is explicitly in the reject list).
- CLOSED: Target service attachment doesn't exist. This status is a terminal state.
- UNKNOWN: Connection status is unspecified.
Egress Public IP: The egress public IP address, which was automatically assigned when the instance was created (for instances with a public secure connection). If no value has been assigned, No value is shown.
Ingress Public IP: The ingress public IP address, which was automatically assigned when the instance was created (for instances with a public secure connection).
Ingress Private IP: The ingress private IP address for the instance (for instances with private connections (private services access)). If the instance was created with a public secure connection or with a private connection Private Service Connect, No value is shown.
Associated Network: The network selected to make a private connection (for instances with private connections (private services access)). If the instance was created with public secure connections, No value is shown.
Allocated IP Range: The range of IP addresses assigned by the instance creator or by Google when the instance was created (for instances with private connections). If the instance was created with a public secure connection, No value is shown.
Maintenance Window: The day of the week and the hour in which Looker (Google Cloud core) schedules maintenance, if a maintenance window has been defined for your instance. Maintenance windows last for one hour. If a maintenance window has not been defined, No value is shown.
Scheduled Maintenance: The scheduled date and time of upcoming maintenance for your instance. If maintenance has not been scheduled, No value is shown.
Deny Maintenance Period: A time period during which Looker (Google Cloud core) does not schedule maintenance, if a deny maintenance period has been configured for your instance.
- Start Date: The start date for the deny maintenance period. If a deny maintenance period has not been scheduled, No value is shown.
- End Date: The end date for the deny maintenance period. If a deny maintenance period has not been scheduled, No value is shown.
- Time: The time at which the deny maintenance period begins and ends on the start date and end date you specified. If a deny maintenance period has not been scheduled, No value is shown.
Last Deny Maintenance Period: The start date and end date for the most recent deny maintenance period. You must allow at least 14 days of maintenance availability between any two deny maintenance periods.
- Start Date: The start date for the most recent deny maintenance period. If a deny maintenance period was not scheduled previously, No value is shown.
- End Date: The end date for the deny maintenance period. If a deny maintenance period was not scheduled previously, No value is shown.
- Time: The time at which the previous deny maintenance period began and ended on the start date and end date for that deny maintenance period. If a deny maintenance period was not scheduled previously, No value is shown.
Encryption: The type of encryption for the Looker (Google Cloud core) instance. If the instance was created with the default Google-managed encryption, Google-managed encryption key is shown. If the instance was created with CMEK, Customer-managed encryption key (CMEK) is shown, along with the key identifier and a link to the key. You may need a Cloud KMS IAM role or permission on the key being used to see the status of the CMEK encryption key.
Email Domain Allowlist for Scheduled Content: The Email Domain Allowlist for Scheduled Content setting defines the email domains to which your Looker (Google Cloud core) users can deliver Looker content — Looks, dashboards, queries with visualizations — or alert notifications through email. By default, there are no domains in the allowlist at the time of instance creation, and Looker (Google Cloud core) users who have the appropriate Looker permissions to email content can email content to any domain. To limit content deliveries and alert notifications to email addresses from a specific domain, edit the instance configuration to restrict the domain(s) to which users can send emails. To learn more about the email domain allowlist and how it interacts with permissions and user attributes, see the