A consola Google Cloud não suporta a gestão de políticas de acesso. Se quiser gerir a sua política de acesso, tem de usar a ferramenta de linha de comandos gcloud ou a API.
gcloud
Para obter o nome da sua política de acesso, use o comando list. O nome da política de acesso é obrigatório para todos os comandos de nível de acesso
para a ferramenta de linha de comandos gcloud.
Defina a política de acesso predefinida para a ferramenta de linha de comandos gcloud
Quando usa a ferramenta de linha de comandos gcloud, pode definir uma política de acesso predefinida. Quando
define uma política predefinida, já não tem de especificar uma política sempre que
usa um comando do Gestor de contexto de acesso.
Para definir uma política de acesso predefinida, use o comando config.
POLICY_NUMBER é o
nome numérico da sua política de acesso.
Delegue uma política de acesso
Consola
A consola Google Cloud não suporta a gestão de políticas de acesso. Se quiser gerir a sua política de acesso, tem de usar a ferramenta de linha de comandos gcloud ou a API.
gcloud
Para delegar a administração associando um principal e uma função a uma política de acesso com âmbito, use o comando add-iam-policy-binding.
POLICY é o ID da política ou o identificador totalmente qualificado da política.
PRINCIPAL é o principal ao qual adicionar a associação. Especifique no seguinte formato: user|group|serviceAccount:email ou domain:domain.
ROLE é o nome da função a atribuir ao principal. O nome da função é o caminho completo de uma função predefinida, como roles/accesscontextmanager.policyEditor, ou o ID da função de uma função personalizada, como organizations/{ORGANIZATION_ID}/roles/accesscontextmanager.policyEditor.
API
Para delegar a administração da política de acesso restrito, faça o seguinte:
Crie um corpo do pedido.
{"policy":"IAM_POLICY",}
Onde:
IAM_POLICY é uma coleção de associações. Uma associação associa um ou mais membros, ou principais, a uma única função. Os principais podem ser contas de utilizador, contas de serviço, grupos Google e domínios. Uma função é uma lista
denominada de autorizações. Cada função pode ser uma função predefinida do IAM ou uma função personalizada
criada pelo utilizador.
POST https://accesscontextmanager.googleapis.com/v1/accessPolicies
Corpo da resposta
Se for bem-sucedido, o corpo da resposta contém uma instância de policy.
Descreva uma política de acesso
Consola
A consola Google Cloud não suporta a gestão de políticas de acesso. Se quiser gerir a sua política de acesso, tem de usar a ferramenta de linha de comandos gcloud ou a API.
gcloud
Para descrever a sua política de acesso, use o comando describe.
A consola Google Cloud não suporta a gestão de políticas de acesso. Se quiser gerir a sua política de acesso, tem de usar a ferramenta de linha de comandos gcloud ou a API.
gcloud
Para atualizar a sua política de acesso, use o comando update. Atualmente, só pode alterar o título da política.
UPDATE_MASK é uma string que representa o valor que quer atualizar. Por exemplo, title.
Corpo da resposta
Se for bem-sucedido, o corpo da resposta da chamada contém um recurso Operation que fornece detalhes sobre a operação PATCH.
Elimine uma política de acesso
Consola
Atualmente, a Google Cloud consola não suporta a gestão de políticas de acesso. Se quiser gerir a sua política de acesso, tem de usar a ferramenta de linha de comandos gcloud ou a API.
[[["Fácil de entender","easyToUnderstand","thumb-up"],["Meu problema foi resolvido","solvedMyProblem","thumb-up"],["Outro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Informações incorretas ou exemplo de código","incorrectInformationOrSampleCode","thumb-down"],["Não contém as informações/amostras de que eu preciso","missingTheInformationSamplesINeed","thumb-down"],["Problema na tradução","translationIssue","thumb-down"],["Outro","otherDown","thumb-down"]],["Última atualização 2025-08-21 UTC."],[[["\u003cp\u003eThis page details the management of existing access policies, including how to retrieve the policy name and etag for reference.\u003c/p\u003e\n"],["\u003cp\u003eYou can set a default access policy for the \u003ccode\u003egcloud\u003c/code\u003e command-line tool, streamlining command execution by eliminating the need to specify the policy each time.\u003c/p\u003e\n"],["\u003cp\u003eAccess policy administration can be delegated to others by binding a principal and role, granting them specified levels of control.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003egcloud\u003c/code\u003e command-line tool or API can be used to describe, update, or delete an access policy, whereas the Google Cloud console does not currently support these actions.\u003c/p\u003e\n"],["\u003cp\u003eDeleting an access policy is permanent and will also delete the access levels associated with it, so caution should be exercised.\u003c/p\u003e\n"]]],[],null,["# Manage an access policy\n\nThis page describes how to manage an existing access policy. You can do the following:\n\n- [Get the name and etag of an access policy](#get_the_name_of_an_access_policy)\n\n- [Set the default access policy for the `gcloud` command-line tool](#set-default)\n\n- [Describe an access policy](#describe_an_access_policy)\n\n- [Update an access policy](#update_an_access_policy)\n\n- [Delete an access policy](#delete_an_access_policy)\n\nGet the name and etag of an access policy\n-----------------------------------------\n\n### Console\n\nThe Google Cloud console does not support managing\naccess policies. If you want to manage your access policy, you must\nuse the `gcloud` command-line tool or the API.\n\n### gcloud\n\nTo get the name of your access policy, use the [`list`](/sdk/gcloud/reference/access-context-manager/policies/list)\ncommand. The access policy name is required for all access level commands\nfor the `gcloud` command-line tool. \n\n```bash\ngcloud access-context-manager policies list \\\n --organization ORGANIZATION_ID\n```\n\nWhere:\n\n- \u003cvar translate=\"no\"\u003eORGANIZATION_ID\u003c/var\u003e is the numeric ID of your organization.\n\nYou should see output similar to: \n\n```\nNAME ORGANIZATION TITLE ETAG\n1034095178592 511928527926 Corp Policy 10bc3c76ca809ab2\n```\n\n### API\n\nTo get the name of your access policy, call [`accessPolicies.list`](/access-context-manager/docs/reference/rest/v1/accessPolicies/list). \n\n```\nGET https://accesscontextmanager.googleapis.com/v1/accessPolicies\n```\n\n### Request body\n\nThe request body must be empty.\n\n### Response body\n\nIf successful, the response body will look similar to: \n\n```json\n{\n \"accessPolicies\": [\n {\n object(AccessPolicy)\n }\n ],\n \"nextPageToken\": string\n}\n```\n\nWhere:\n\n- `accessPolicies` is a list of [`AccessPolicy` objects](/access-context-manager/docs/reference/rest/v1/accessPolicies#AccessPolicy).\n\nSet the default access policy for the `gcloud` command-line tool\n----------------------------------------------------------------\n\nWhen using the `gcloud` command-line tool, you can set a default access policy. When\nyou set a default policy, you no longer need to specify a policy each time you\nuse an Access Context Manager command.\n\nTo set a default access policy, use the `config` command. \n\n```bash\ngcloud config set access_context_manager/policy POLICY_NUMBER\n```\n\nWhere:\n\n- \u003cvar translate=\"no\"\u003ePOLICY_NUMBER\u003c/var\u003e is the [numeric name](#get_the_name_of_an_access_policy) of your access policy.\n\nDelegate an access policy\n-------------------------\n\n### Console\n\nThe Google Cloud console does not support managing\naccess policies. If you want to manage your access policy, you must\nuse the `gcloud` command-line tool or the API.\n\n### gcloud\n\nTo delegate administration by binding a principal and role with a scoped access policy, use the [`add-iam-policy-binding`](/sdk/gcloud/reference/access-context-manager/policies/add-iam-policy-binding)\ncommand. \n\n```bash\ngcloud access-context-manager policies add-iam-policy-binding \\\n[POLICY] --member=PRINCIPAL --role=ROLE\n```\n\nWhere:\n\n- \u003cvar translate=\"no\"\u003ePOLICY\u003c/var\u003e is ID of the policy or fully qualified identifier for the policy.\n\n- \u003cvar translate=\"no\"\u003ePRINCIPAL\u003c/var\u003e is the principal to add the binding for. Specify in the\n following format: `user|group|serviceAccount:email` or `domain:domain`.\n\n- \u003cvar translate=\"no\"\u003eROLE\u003c/var\u003e is the role name to assign to the principal. The role name\n is the complete path of a predefined role, such as `roles/accesscontextmanager.policyEditor`,\n or the role ID for a custom role, such as\n `organizations/{ORGANIZATION_ID}/roles/accesscontextmanager.policyEditor`.\n\n### API\n\nTo delegate administration of the scoped access policy, do the following:\n\n1. Create a request body.\n\n ```json\n {\n \"policy\": \"\u003cvar translate=\"no\"\u003eIAM_POLICY\u003c/var\u003e\",\n }\n ```\n\n Where:\n - \u003cvar translate=\"no\"\u003eIAM_POLICY\u003c/var\u003e is a collection of bindings. A binding binds one or more members, or principals, to a single role. Principals can be user accounts, service accounts, Google groups, and domains. A role is a named list of permissions; each role can be an IAM predefined role or a user-created custom role.\n2. Delegate the access policy by\n calling [`accessPolicies.setIamPolicy`](/access-context-manager/docs/reference/rest/v1/accessPolicies/setIamPolicy).\n\n ```\n POST https://accesscontextmanager.googleapis.com/v1/accessPolicies\n ```\n\n#### Response body\n\nIf successful, the response body contains an instance of [`policy`](/access-context-manager/docs/reference/rest/Shared.Types/Policy).\n\nDescribe an access policy\n-------------------------\n\n### Console\n\nThe Google Cloud console does not support managing\naccess policies. If you want to manage your access policy, you must\nuse the `gcloud` command-line tool or the API.\n\n### gcloud\n\nTo describe your access policy, use the [`describe`](/sdk/gcloud/reference/access-context-manager/policies/describe)\ncommand. \n\n```bash\ngcloud access-context-manager policies describe POLICY_NUMBER\n```\n\nWhere:\n\n- \u003cvar translate=\"no\"\u003ePOLICY_NUMBER\u003c/var\u003e is the numeric name of your policy.\n\nThe following output appears: \n\n```\nname: accessPolicies/1034095178592\nparent: organizations/511928527926\ntitle: Corp Policy\n```\n\n### API\n\nTo describe your access policy, call [`accessPolicies.get`](/access-context-manager/docs/reference/rest/v1/accessPolicies/get) \n\n```\nGET https://accesscontextmanager.googleapis.com/v1/accessPolicies/POLICY_NUMBER\n```\n\nWhere:\n\n- \u003cvar translate=\"no\"\u003ePOLICY_NUMBER\u003c/var\u003e is the numeric name of your policy.\n\n### Request body\n\nThe request body must be empty.\n\n### Response body\n\nIf successful, the response body contains an\n[`AccessPolicy` object](/access-context-manager/docs/reference/rest/v1/accessPolicies#AccessPolicy).\n\nUpdate an access policy\n-----------------------\n\n### Console\n\nThe Google Cloud console does not support managing\naccess policies. If you want to manage your access policy, you must\nuse the `gcloud` command-line tool or the API.\n\n### gcloud\n\nTo update your access policy, use the [`update`](/sdk/gcloud/reference/access-context-manager/policies/update)\ncommand. Currently, you can change only the title of the policy. \n\n```bash\ngcloud access-context-manager policies update POLICY_NUMBER \\\n --title=POLICY_TITLE\n```\n\nWhere:\n\n- \u003cvar translate=\"no\"\u003ePOLICY_NUMBER\u003c/var\u003e is the numeric name of your policy.\n\n- \u003cvar translate=\"no\"\u003ePOLICY_TITLE\u003c/var\u003e is a human-readable title for your policy.\n\nThe following output appears: \n\n```\nWaiting for PATCH operation [accessPolicies/POLICY_NUMBER/update/1542234231134882]...done.\n```\n\n### API\n\nCurrently, you can change only the title of your access policy.\n\nTo update your policy:\n\n1. Create a request body.\n\n ```json\n {\n \"parent\": \"\u003cvar translate=\"no\"\u003eORGANIZATION_ID\u003c/var\u003e\",\n \"title\": \"\u003cvar translate=\"no\"\u003ePOLICY_TITLE\u003c/var\u003e\"\n }\n ```\n\n Where:\n - \u003cvar translate=\"no\"\u003eORGANIZATION_ID\u003c/var\u003e is the numeric ID of your organization.\n\n - \u003cvar translate=\"no\"\u003ePOLICY_TITLE\u003c/var\u003e is a human-readable title for your policy.\n\n2. Call [`accessPolicies.patch`](/access-context-manager/docs/reference/rest/v1/accessPolicies/patch).\n\n ```\n PATCH https://accesscontextmanager.googleapis.com/v1/accessPolicies/POLICY_NUMBER/UPDATE_MASK\n ```\n\n Where:\n - \u003cvar translate=\"no\"\u003ePOLICY_NUMBER\u003c/var\u003e is the numeric name of your policy.\n\n - \u003cvar translate=\"no\"\u003eUPDATE_MASK\u003c/var\u003e is a string that represents the value you want\n to update. For example, `title`.\n\n ### Response body\n\n If successful, the response body for the call contains an\n [`Operation`](/access-context-manager/docs/reference/rest/Shared.Types/Operation) resource that provides details about the\n `PATCH` operation.\n\nDelete an access policy\n-----------------------\n\n**Warning:** When you delete a policy, the levels that the policy contains are also deleted and cannot be recovered. \n\n### Console\n\nThe Google Cloud console does not currently support managing\naccess policies. If you want to manage your access policy, you must\nuse the `gcloud` command-line tool or the API.\n\n### gcloud\n\nTo delete an access policy:\n\n1. Use the [`delete`](/sdk/gcloud/reference/access-context-manager/policies/delete) command.\n\n ```bash\n gcloud access-context-manager policies delete POLICY_NUMBER\n ```\n\n Where:\n - \u003cvar translate=\"no\"\u003ePOLICY_NUMBER\u003c/var\u003e is the numeric name of your policy.\n2. Confirm that you want to delete the access policy.\n\n For example: \n\n ```\n You are about to delete policy [POLICY_NUMBER]\n\n Do you want to continue (Y/n)?\n ```\n\n The following output appears: \n\n ```\n Deleted policy [1034095178592].\n ```\n\n### API\n\nTo delete your access policy, call [`accessPolicies.delete`](/access-context-manager/docs/reference/rest/v1/accessPolicies/delete). \n\n```\nDELETE https://accesscontextmanager.googleapis.com/v1/accessPolicies/POLICY_NUMBER\n```\n\nWhere:\n\n- \u003cvar translate=\"no\"\u003ePOLICY_NUMBER\u003c/var\u003e is the numeric name of your policy.\n\n### Request body\n\nThe request body must be empty.\n\n### Response body\n\nIf successful, the response body for the call contains an\n[`Operation`](/access-context-manager/docs/reference/rest/Shared.Types/Operation) resource that provides details about the\n`DELETE` operation.\n\nWhat's next\n-----------\n\n- [Managing access levels](/access-context-manager/docs/manage-access-levels)"]]
