[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-03 (世界標準時間)。"],[[["\u003cp\u003eBefore creating an API on API Gateway, you need a Google Cloud project with the appropriate roles, the Google Cloud CLI installed and configured, and the required Google services enabled.\u003c/p\u003e\n"],["\u003cp\u003eSetting up the Google Cloud CLI for deployment involves installing, updating, authorizing, and setting the default project ID with the \u003ccode\u003egcloud\u003c/code\u003e commands.\u003c/p\u003e\n"],["\u003cp\u003eAPI Gateway requires enabling \u003ccode\u003eapigateway.googleapis.com\u003c/code\u003e, \u003ccode\u003eservicemanagement.googleapis.com\u003c/code\u003e, and \u003ccode\u003eservicecontrol.googleapis.com\u003c/code\u003e services, which can be done through the \u003ccode\u003egcloud services enable\u003c/code\u003e command.\u003c/p\u003e\n"],["\u003cp\u003eIt is recommended to create a separate service account with limited permissions for API Gateway, and the user creating or updating an API config must have the \u003ccode\u003eiam.serviceAccounts.actAs\u003c/code\u003e permission on that service account.\u003c/p\u003e\n"],["\u003cp\u003eAPI Gateway requests to backend services can be secured using OpenID Connect (OIDC) tokens signed by the gateway's service account, which requires proper backend service configuration.\u003c/p\u003e\n"]]],[],null,["# Configuring the development environment\n=======================================\n\nThis document describes how to configure your API Gateway development environment.\n\nPrerequisites\n-------------\n\nBefore you can create an API on API Gateway, ensure that you have:\n\n- Created a [Google Cloud project](/resource-manager/docs/creating-managing-projects)\n in which you have the **Editor** or **Owner** role. After the initial deployment, you can grant\n the more restrictive **Service Config Editor** role to a user, group, or service account.\n\n- Prepared the [Google Cloud CLI](https://cloud.google.com/sdk/docs) as described [below](#preparing_the_for_deployment).\n\n- Enabled the required Google services as described [below](#enabling_required_services).\n\n- Configure the service account used to create API configs as described [below](#configuring_a_service_account).\n\nPreparing the Google Cloud CLI for deployment\n---------------------------------------------\n\nTo prepare `gcloud` for the deployment:\n\n1. Install and initialize the [gcloud CLI](/sdk/docs/quickstarts).\n2. Update gcloud CLI: \n\n ```\n gcloud components update\n ```\n3. Make sure that gcloud CLI is authorized to access your data and services: \n\n ```\n gcloud auth login\n ```\n\n A new browser tab opens and you are prompted to choose an account.\n4. Set the default project. Replace \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e with your Google Cloud project ID: \n\n ```\n gcloud config set project PROJECT_ID \n ```\n\nEnabling required services\n--------------------------\n\nAPI Gateway requires that you enable the following Google services:\n\nTo confirm that the required services are enabled: \n\n```\ngcloud services list\n```\n\nIf you do not see the required services listed, enable them: \n\n gcloud services enable apigateway.googleapis.com\n gcloud services enable servicemanagement.googleapis.com\n gcloud services enable servicecontrol.googleapis.com\n\nFor more information about the `gcloud` services, see\n[`gcloud` services](/sdk/gcloud/reference/services).\n\nConfiguring a service account\n-----------------------------\n\nAn API config deployed on a gateway executes with the permissions associated with the gateway\n[service account](/api-gateway/docs/reference/rest/v1/projects.locations.apis.configs).\n\nAs a best practice, [create a separate service account](/iam/docs/creating-managing-service-accounts)\nin the same project you are using for API Gateway. Then, assign the service account only the permissions necessary to access the backend service. In that way, you limit the permissions associated with the API config.\n\nFor API Gateway, the user creating or updating an API config or gateway requires the `iam.serviceAccounts.actAs` permission on the service account object. This permission is included in the [Service Account User](/iam/docs/service-account-permissions#user-role) role.\n\nThe role and permission can be added to the service account for the user with the following command: \n\n```\ngcloud iam service-accounts add-iam-policy-binding SERVICE_ACCOUNT_EMAIL \\\n --member user:USER_EMAIL \\\n --role roles/iam.serviceAccountUser\n```\n\nwhere:\n\n- \u003cvar translate=\"no\"\u003eSERVICE_ACCOUNT_EMAIL\u003c/var\u003e is the email of the service account, in the format \u003cvar translate=\"no\"\u003eSA_NAME\u003c/var\u003e`@`\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e`.iam.gserviceaccount.com`.\n- \u003cvar translate=\"no\"\u003eUSER_EMAIL\u003c/var\u003e is the email address of the user.\n\nFor example: \n\n```\ngcloud iam service-accounts add-iam-policy-binding my-service-account@my-project.iam.gserviceaccount.com \\\n --member user:myemail@email.com \\\n --role roles/iam.serviceAccountUser\n```\n\nIn addition, the gateway service account requires the permissions necessary to access your backend service. For example:\n\n- For a Cloud Function backend, the service account must be assigned the role of **Cloud Functions Invoker**.\n- For a Cloud Run backend, the service account must be assigned the role of **Cloud Run Invoker**.\n- For an App Engine backend, you must follow the steps in [Setting up IAP access](/iap/docs/authenticate-users-google-accounts#iap-access) to grant the service account associated with your gateway the **IAP-secured Web App User** role.\n\nBy limiting the permissions associated with the API config, you can better secure your backend systems. For more information, see the [Identity and Access Management (IAM) documentation](/iam/docs).\n\nAfter you create the service account, use the `--backend-auth-service-account` option\nto specify the email address of that service account when creating an API config: \n\n```\ngcloud api-gateway api-configs create CONFIG_ID \\\n --api=API_ID --openapi-spec=API_DEFINITION --project=PROJECT_ID \\\n --backend-auth-service-account=\u003cvar translate=\"no\"\u003eSERVICE_ACCOUNT_EMAIL\u003c/var\u003e\n```\n\nSee [Creating an API](/api-gateway/docs/creating-api) for more on creating API configs.\n\n### Using a default service account\n\nSome Google Cloud products define a *default* service account.\nFor example, if you are using Compute Engine and have enabled the Compute Engine API\nfor your project, a default Compute Engine service account is created for you.\nThe default service account is identifiable by its email address:\n\n\u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e`-compute@developer.gserviceaccount.com`\n\nIf you assign the necessary permissions to the default service account, you can omit\nthe `--backend-auth-service-account` option when creating an API config: \n\n```\ngcloud api-gateway api-configs create CONFIG_ID \\\n --api=API_ID --openapi-spec=API_DEFINITION --project=PROJECT_ID\n```\n\nSee [Using the Compute Engine Default Service Account](/compute/docs/access/create-enable-service-accounts-for-instances#using_the_default_service_account) for more.\n\nUsing OpenID Connect\n--------------------\n\nRequests from API Gateway to backend services may use authentication. These requests are secured using OpenID Connect (OIDC) tokens signed by the [gateway's service account](#configuring_a_service_account). You should confirm that your backend service is correctly configured to accept OIDC tokens for authentication and authorization. Cloud Run functions, Cloud Run, and the Identity Aware Proxy (IAP) provide this option.\n\nWhat's next\n-----------\n\n- [Creating an API](/api-gateway/docs/creating-api)"]]
