Konsol Google Cloud tidak mendukung pengelolaan
kebijakan akses. Jika ingin mengelola kebijakan akses, Anda harus
menggunakan alat command line gcloud atau API.
gcloud
Untuk mendapatkan nama kebijakan akses Anda, gunakan perintah list. Nama kebijakan akses diperlukan untuk semua perintah tingkat akses
untuk alat command line gcloud.
Menetapkan kebijakan akses default untuk alat command line gcloud
Saat menggunakan alat command line gcloud, Anda dapat menetapkan kebijakan akses default. Saat
menetapkan kebijakan default, Anda tidak perlu lagi menentukan kebijakan setiap kali
menggunakan perintah Access Context Manager.
Untuk menetapkan kebijakan akses default, gunakan perintah config.
POLICY_NUMBER adalah
nama numerik kebijakan akses Anda.
Mendelegasikan kebijakan akses
Konsol
Konsol Google Cloud tidak mendukung pengelolaan
kebijakan akses. Jika ingin mengelola kebijakan akses, Anda harus
menggunakan alat command line gcloud atau API.
gcloud
Untuk mendelegasikan administrasi dengan mengikat akun utama dan peran dengan kebijakan akses yang tercakup, gunakan perintah add-iam-policy-binding.
POLICY adalah ID kebijakan atau ID yang sepenuhnya memenuhi syarat untuk kebijakan.
PRINCIPAL adalah akun utama yang akan ditambahkan binding-nya. Tentukan dalam
format berikut: user|group|serviceAccount:email atau domain:domain.
ROLE adalah nama peran yang akan ditetapkan ke akun utama. Nama peran
adalah jalur lengkap peran standar, seperti roles/accesscontextmanager.policyEditor,
atau ID peran untuk peran khusus, seperti
organizations/{ORGANIZATION_ID}/roles/accesscontextmanager.policyEditor.
API
Untuk mendelegasikan administrasi kebijakan akses yang tercakup, lakukan hal berikut:
Buat isi permintaan.
{"policy":"IAM_POLICY",}
Dengan:
IAM_POLICY adalah kumpulan binding. Binding mengikat satu
atau beberapa anggota, atau akun utama, ke satu peran. Akun utama dapat berupa akun pengguna, akun layanan, grup Google, dan domain. Peran adalah daftar izin yang diberi nama; setiap peran dapat berupa peran bawaan IAM atau peran khusus yang dibuat pengguna.
POST https://accesscontextmanager.googleapis.com/v1/accessPolicies
Isi respons
Jika berhasil, isi respons berisi instance policy.
Mendeskripsikan kebijakan akses
Konsol
Konsol Google Cloud tidak mendukung pengelolaan
kebijakan akses. Jika ingin mengelola kebijakan akses, Anda harus
menggunakan alat command line gcloud atau API.
gcloud
Untuk mendeskripsikan kebijakan akses Anda, gunakan perintah describe.
GET https://accesscontextmanager.googleapis.com/v1/accessPolicies/POLICY_NUMBER
Dengan:
POLICY_NUMBER adalah nama numerik kebijakan Anda.
Isi permintaan
Isi permintaan harus kosong.
Isi respons
Jika berhasil, isi respons berisi objek
AccessPolicy.
Memperbarui kebijakan akses
Konsol
Konsol Google Cloud tidak mendukung pengelolaan
kebijakan akses. Jika ingin mengelola kebijakan akses, Anda harus
menggunakan alat command line gcloud atau API.
gcloud
Untuk memperbarui kebijakan akses Anda, gunakan perintah update. Saat ini, Anda hanya dapat mengubah judul kebijakan.
UPDATE_MASK adalah string yang merepresentasikan nilai yang ingin
Anda perbarui. Contoh, title.
Isi respons
Jika berhasil, isi respons untuk panggilan berisi resource
Operation yang memberikan detail tentang operasi
PATCH.
Menghapus kebijakan akses
Konsol
Saat ini, konsol Google Cloud tidak mendukung pengelolaan kebijakan akses. Jika ingin mengelola kebijakan akses, Anda harus
menggunakan alat command line gcloud atau API.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-04 UTC."],[[["\u003cp\u003eThis page details the management of existing access policies, including how to retrieve the policy name and etag for reference.\u003c/p\u003e\n"],["\u003cp\u003eYou can set a default access policy for the \u003ccode\u003egcloud\u003c/code\u003e command-line tool, streamlining command execution by eliminating the need to specify the policy each time.\u003c/p\u003e\n"],["\u003cp\u003eAccess policy administration can be delegated to others by binding a principal and role, granting them specified levels of control.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003egcloud\u003c/code\u003e command-line tool or API can be used to describe, update, or delete an access policy, whereas the Google Cloud console does not currently support these actions.\u003c/p\u003e\n"],["\u003cp\u003eDeleting an access policy is permanent and will also delete the access levels associated with it, so caution should be exercised.\u003c/p\u003e\n"]]],[],null,["# Manage an access policy\n\nThis page describes how to manage an existing access policy. You can do the following:\n\n- [Get the name and etag of an access policy](#get_the_name_of_an_access_policy)\n\n- [Set the default access policy for the `gcloud` command-line tool](#set-default)\n\n- [Describe an access policy](#describe_an_access_policy)\n\n- [Update an access policy](#update_an_access_policy)\n\n- [Delete an access policy](#delete_an_access_policy)\n\nGet the name and etag of an access policy\n-----------------------------------------\n\n### Console\n\nThe Google Cloud console does not support managing\naccess policies. If you want to manage your access policy, you must\nuse the `gcloud` command-line tool or the API.\n\n### gcloud\n\nTo get the name of your access policy, use the [`list`](/sdk/gcloud/reference/access-context-manager/policies/list)\ncommand. The access policy name is required for all access level commands\nfor the `gcloud` command-line tool. \n\n```bash\ngcloud access-context-manager policies list \\\n --organization ORGANIZATION_ID\n```\n\nWhere:\n\n- \u003cvar translate=\"no\"\u003eORGANIZATION_ID\u003c/var\u003e is the numeric ID of your organization.\n\nYou should see output similar to: \n\n```\nNAME ORGANIZATION TITLE ETAG\n1034095178592 511928527926 Corp Policy 10bc3c76ca809ab2\n```\n\n### API\n\nTo get the name of your access policy, call [`accessPolicies.list`](/access-context-manager/docs/reference/rest/v1/accessPolicies/list). \n\n```\nGET https://accesscontextmanager.googleapis.com/v1/accessPolicies\n```\n\n### Request body\n\nThe request body must be empty.\n\n### Response body\n\nIf successful, the response body will look similar to: \n\n```json\n{\n \"accessPolicies\": [\n {\n object(AccessPolicy)\n }\n ],\n \"nextPageToken\": string\n}\n```\n\nWhere:\n\n- `accessPolicies` is a list of [`AccessPolicy` objects](/access-context-manager/docs/reference/rest/v1/accessPolicies#AccessPolicy).\n\nSet the default access policy for the `gcloud` command-line tool\n----------------------------------------------------------------\n\nWhen using the `gcloud` command-line tool, you can set a default access policy. When\nyou set a default policy, you no longer need to specify a policy each time you\nuse an Access Context Manager command.\n\nTo set a default access policy, use the `config` command. \n\n```bash\ngcloud config set access_context_manager/policy POLICY_NUMBER\n```\n\nWhere:\n\n- \u003cvar translate=\"no\"\u003ePOLICY_NUMBER\u003c/var\u003e is the [numeric name](#get_the_name_of_an_access_policy) of your access policy.\n\nDelegate an access policy\n-------------------------\n\n### Console\n\nThe Google Cloud console does not support managing\naccess policies. If you want to manage your access policy, you must\nuse the `gcloud` command-line tool or the API.\n\n### gcloud\n\nTo delegate administration by binding a principal and role with a scoped access policy, use the [`add-iam-policy-binding`](/sdk/gcloud/reference/access-context-manager/policies/add-iam-policy-binding)\ncommand. \n\n```bash\ngcloud access-context-manager policies add-iam-policy-binding \\\n[POLICY] --member=PRINCIPAL --role=ROLE\n```\n\nWhere:\n\n- \u003cvar translate=\"no\"\u003ePOLICY\u003c/var\u003e is ID of the policy or fully qualified identifier for the policy.\n\n- \u003cvar translate=\"no\"\u003ePRINCIPAL\u003c/var\u003e is the principal to add the binding for. Specify in the\n following format: `user|group|serviceAccount:email` or `domain:domain`.\n\n- \u003cvar translate=\"no\"\u003eROLE\u003c/var\u003e is the role name to assign to the principal. The role name\n is the complete path of a predefined role, such as `roles/accesscontextmanager.policyEditor`,\n or the role ID for a custom role, such as\n `organizations/{ORGANIZATION_ID}/roles/accesscontextmanager.policyEditor`.\n\n### API\n\nTo delegate administration of the scoped access policy, do the following:\n\n1. Create a request body.\n\n ```json\n {\n \"policy\": \"\u003cvar translate=\"no\"\u003eIAM_POLICY\u003c/var\u003e\",\n }\n ```\n\n Where:\n - \u003cvar translate=\"no\"\u003eIAM_POLICY\u003c/var\u003e is a collection of bindings. A binding binds one or more members, or principals, to a single role. Principals can be user accounts, service accounts, Google groups, and domains. A role is a named list of permissions; each role can be an IAM predefined role or a user-created custom role.\n2. Delegate the access policy by\n calling [`accessPolicies.setIamPolicy`](/access-context-manager/docs/reference/rest/v1/accessPolicies/setIamPolicy).\n\n ```\n POST https://accesscontextmanager.googleapis.com/v1/accessPolicies\n ```\n\n#### Response body\n\nIf successful, the response body contains an instance of [`policy`](/access-context-manager/docs/reference/rest/Shared.Types/Policy).\n\nDescribe an access policy\n-------------------------\n\n### Console\n\nThe Google Cloud console does not support managing\naccess policies. If you want to manage your access policy, you must\nuse the `gcloud` command-line tool or the API.\n\n### gcloud\n\nTo describe your access policy, use the [`describe`](/sdk/gcloud/reference/access-context-manager/policies/describe)\ncommand. \n\n```bash\ngcloud access-context-manager policies describe POLICY_NUMBER\n```\n\nWhere:\n\n- \u003cvar translate=\"no\"\u003ePOLICY_NUMBER\u003c/var\u003e is the numeric name of your policy.\n\nThe following output appears: \n\n```\nname: accessPolicies/1034095178592\nparent: organizations/511928527926\ntitle: Corp Policy\n```\n\n### API\n\nTo describe your access policy, call [`accessPolicies.get`](/access-context-manager/docs/reference/rest/v1/accessPolicies/get) \n\n```\nGET https://accesscontextmanager.googleapis.com/v1/accessPolicies/POLICY_NUMBER\n```\n\nWhere:\n\n- \u003cvar translate=\"no\"\u003ePOLICY_NUMBER\u003c/var\u003e is the numeric name of your policy.\n\n### Request body\n\nThe request body must be empty.\n\n### Response body\n\nIf successful, the response body contains an\n[`AccessPolicy` object](/access-context-manager/docs/reference/rest/v1/accessPolicies#AccessPolicy).\n\nUpdate an access policy\n-----------------------\n\n### Console\n\nThe Google Cloud console does not support managing\naccess policies. If you want to manage your access policy, you must\nuse the `gcloud` command-line tool or the API.\n\n### gcloud\n\nTo update your access policy, use the [`update`](/sdk/gcloud/reference/access-context-manager/policies/update)\ncommand. Currently, you can change only the title of the policy. \n\n```bash\ngcloud access-context-manager policies update POLICY_NUMBER \\\n --title=POLICY_TITLE\n```\n\nWhere:\n\n- \u003cvar translate=\"no\"\u003ePOLICY_NUMBER\u003c/var\u003e is the numeric name of your policy.\n\n- \u003cvar translate=\"no\"\u003ePOLICY_TITLE\u003c/var\u003e is a human-readable title for your policy.\n\nThe following output appears: \n\n```\nWaiting for PATCH operation [accessPolicies/POLICY_NUMBER/update/1542234231134882]...done.\n```\n\n### API\n\nCurrently, you can change only the title of your access policy.\n\nTo update your policy:\n\n1. Create a request body.\n\n ```json\n {\n \"parent\": \"\u003cvar translate=\"no\"\u003eORGANIZATION_ID\u003c/var\u003e\",\n \"title\": \"\u003cvar translate=\"no\"\u003ePOLICY_TITLE\u003c/var\u003e\"\n }\n ```\n\n Where:\n - \u003cvar translate=\"no\"\u003eORGANIZATION_ID\u003c/var\u003e is the numeric ID of your organization.\n\n - \u003cvar translate=\"no\"\u003ePOLICY_TITLE\u003c/var\u003e is a human-readable title for your policy.\n\n2. Call [`accessPolicies.patch`](/access-context-manager/docs/reference/rest/v1/accessPolicies/patch).\n\n ```\n PATCH https://accesscontextmanager.googleapis.com/v1/accessPolicies/POLICY_NUMBER/UPDATE_MASK\n ```\n\n Where:\n - \u003cvar translate=\"no\"\u003ePOLICY_NUMBER\u003c/var\u003e is the numeric name of your policy.\n\n - \u003cvar translate=\"no\"\u003eUPDATE_MASK\u003c/var\u003e is a string that represents the value you want\n to update. For example, `title`.\n\n ### Response body\n\n If successful, the response body for the call contains an\n [`Operation`](/access-context-manager/docs/reference/rest/Shared.Types/Operation) resource that provides details about the\n `PATCH` operation.\n\nDelete an access policy\n-----------------------\n\n**Warning:** When you delete a policy, the levels that the policy contains are also deleted and cannot be recovered. \n\n### Console\n\nThe Google Cloud console does not currently support managing\naccess policies. If you want to manage your access policy, you must\nuse the `gcloud` command-line tool or the API.\n\n### gcloud\n\nTo delete an access policy:\n\n1. Use the [`delete`](/sdk/gcloud/reference/access-context-manager/policies/delete) command.\n\n ```bash\n gcloud access-context-manager policies delete POLICY_NUMBER\n ```\n\n Where:\n - \u003cvar translate=\"no\"\u003ePOLICY_NUMBER\u003c/var\u003e is the numeric name of your policy.\n2. Confirm that you want to delete the access policy.\n\n For example: \n\n ```\n You are about to delete policy [POLICY_NUMBER]\n\n Do you want to continue (Y/n)?\n ```\n\n The following output appears: \n\n ```\n Deleted policy [1034095178592].\n ```\n\n### API\n\nTo delete your access policy, call [`accessPolicies.delete`](/access-context-manager/docs/reference/rest/v1/accessPolicies/delete). \n\n```\nDELETE https://accesscontextmanager.googleapis.com/v1/accessPolicies/POLICY_NUMBER\n```\n\nWhere:\n\n- \u003cvar translate=\"no\"\u003ePOLICY_NUMBER\u003c/var\u003e is the numeric name of your policy.\n\n### Request body\n\nThe request body must be empty.\n\n### Response body\n\nIf successful, the response body for the call contains an\n[`Operation`](/access-context-manager/docs/reference/rest/Shared.Types/Operation) resource that provides details about the\n`DELETE` operation.\n\nWhat's next\n-----------\n\n- [Managing access levels](/access-context-manager/docs/manage-access-levels)"]]
