[[["わかりやすい","easyToUnderstand","thumb-up"],["問題の解決に役立った","solvedMyProblem","thumb-up"],["その他","otherUp","thumb-up"]],[["わかりにくい","hardToUnderstand","thumb-down"],["情報またはサンプルコードが不正確","incorrectInformationOrSampleCode","thumb-down"],["必要な情報 / サンプルがない","missingTheInformationSamplesINeed","thumb-down"],["翻訳に関する問題","translationIssue","thumb-down"],["その他","otherDown","thumb-down"]],["最終更新日 2025-08-18 UTC。"],[[["\u003cp\u003eThis document outlines the necessary Google Cloud IAM permissions for provisioning Apigee, excluding Apigee hybrid.\u003c/p\u003e\n"],["\u003cp\u003ePermissions can be granted via predefined roles, which may include more access than needed, or through custom roles that allow for the assignment of only the least-necessary privileges.\u003c/p\u003e\n"],["\u003cp\u003eThe Google Cloud project owner inherently has the permissions needed for all basic Apigee provisioning steps; if not the owner, specific permissions must be assigned.\u003c/p\u003e\n"],["\u003cp\u003eUsing Shared VPC requires additional permissions in the Shared VPC project, which are detailed in this document.\u003c/p\u003e\n"],["\u003cp\u003eDepending on the type of operation, such as Organization creation, Service Networking, or Access Routing, different permissions are needed, which are described in the tables.\u003c/p\u003e\n"]]],[],null,["# About Apigee provisioning permissions\n\n*This page\napplies to **Apigee** , but not to **Apigee hybrid**.*\n\n\n*View [Apigee Edge](https://docs.apigee.com/api-platform/get-started/what-apigee-edge) documentation.*\n\n\nThis document describes the [Google Cloud IAM permissions](/iam/docs/overview) that are required to successfully provision\nApigee.\n\n\nYou can specify permissions using the following:\n\n- [**Predefined roles:**](#predefined-roles) Provide sufficient permission to do the provisioning steps. Predefined roles may give the Apigee administrator more permissions than they need to complete provisioning.\n- [**Custom roles:**](#custom-roles-permissions) Provide the least-necessary privilege needed to do the provisioning steps.\n\nGoogle Cloud project owner role\n-------------------------------\n\n\nThe owner of the Google Cloud project that is used for Apigee provisioning\nalready has permission to perform all of the basic Apigee provisioning steps.\n\n\nIf the Apigee provisioner is not the project owner, then use this document to\ndetermine the permissions needed to perform each of the provisioning steps.\n\n\nIf you use Shared Virtual Private Cloud (VPC) networking, additional\npermissions in the Shared VPC project are required, and these cases are also\nnoted in this document.\n\nPredefined roles\n----------------\n\n\nIf you just want to make sure the Apigee administrator has sufficient\npermission to complete the provisioning, give the Apigee administrator the\nfollowing [IAM predefined roles](/iam/docs/understanding-roles);\nhowever, predefined roles may give the Apigee administrator more permissions\nthan they need to complete provisioning. See [Custom roles and permissions](#custom-roles-permissions) to provide least-necessary privileges.\n\n#### How to specify a predefined role\n\nTo add users and roles:\n\n1. In the Google Cloud console, go to **IAM \\& Admin \\\u003e IAM** for your\n project.\n\n [Go to the IAM/Iam page](https://console.cloud.google.com/iam-admin/iam)\n2. To add a new user:\n 1. Click **Grant access**.\n 2. Type a new **Principal** name.\n 3. Click the **Select a role** menu and then type the role name in the **Filter** field. For example, `Apigee Organization Admin`. Click the role listed in the results.\n 4. Click **Save**.\n3. To edit an existing user:\n 1. Click edit **Edit**.\n 2. To change an existing role, click the **Role** menu and then select a different role.\n 3. To add another role, click **Add another role.**\n 4. Click the **Select a role** menu and then type the role name in the **Filter** field. For example, `Apigee Organization Admin`. Click the role listed in the results.\n 5. Click **Save**.\n\nCustom roles and permissions\n----------------------------\n\n\nTo provide least-necessary privileges, create an\n[IAM custom role](/iam/docs/creating-custom-roles) and assign\npermissions from the following sections.\n\n#### How to specify a custom role\n\nTo add a custom role:\n\n1. In the Google Cloud console, go to **IAM \\& Admin \\\u003e Roles** for your\n project.\n\n [Go to the IAM \\& Admin/Roles page](https://console.cloud.google.com/iam-admin/roles)\n2. To add a new role:\n 1. Click **Create role**.\n 2. Type a new **Title**.\n 3. Type a **Description** (optional).\n 4. Type an **ID**.\n 5. Select a **Role launch stage**.\n 6. Click **Add permissions**.\n 7. Copy the desired permission text from the tables below and paste it into the **Filter** field. For example, `apigee.environments.create`.\n 8. Press \u003ckbd\u003eEnter\u003c/kbd\u003e or click an item from the results.\n 9. Select the checkbox for the item just added.\n 10. Click **Add** . **Note:** To add multiple permissions at a time:\n | - Select the `OR` operator between each permission as you add them, or\n | - Search for a partial permission string, for example, `apigee.environments`, select multiple checkboxes, and then click **Save**.\n 11. Once you have added all the permissions for this role, click **Create**.\n3. To edit an existing custom role:\n 1. Locate the custom role.\n 2. Click more_vert **More** \\\u003e **Edit**.\n 3. Make any desired changes.\n 4. Click **Update**.\n\n### UI-based Apigee management permissions\n\n\nThis permission is required for all users who will manage an organization through the\n[Apigee UI in Cloud console](https://console.cloud.google.com/apigee). Include it in\ncustom roles that involve management through that interface.\n\n### Provisioning permissions\n\n\nThese permissions are required to start provisioning\nApigee:\n\n### API enablement permissions\n\nThese permissions are required to enable Google Cloud APIs:\n\n### Organization creation permissions (paid org)\n\nThese permissions are needed to create an Apigee organization for\npaid accounts (Subscription or Pay-as-you-go):\n\n### Organization creation permissions (eval org)\n\n\nThis permission is required for selecting analytics and runtime hosting\nregions for an eval organization:\n\n### Service networking permissions\n\n\nThese permissions are needed in the service networking configuration steps.\nIf you are using Shared VPC networking, see\n[Service networking permissions with Shared VPC](#servicenetworkingwithsharedvpc).\n\n### Service networking permissions with Shared VPC\n\n\nIf you are using Shared Virtual Private Cloud (VPC) networking, a user with\nadministrative privileges in the Shared VPC project must peer the Shared VPC\nproject with Apigee, as described in\n[Using shared VPC networks](/apigee/docs/api-platform/system-administration/shared-vpcs). Peering must be completed before the Apigee\nadmin can complete the service networking steps. See also\n[Administrators and IAM](/vpc/docs/shared-vpc#iam_in_shared_vpc).\n\nWhen Shared VPC is properly set up, the Apigee admin needs these permissions\nto complete the service networking configuration steps:\n\n### Runtime instance permissions\n\n\nThese permissions are needed to create a runtime instance (Subscription and Pay-as-you-go accounts only):\n\n### Access routing permissions\n\nThese permissions are needed for the access routing steps:\n\n### Access routing permissions with Shared VPC\n\nIf you are using\n[Shared Virtual Private Cloud (VPC) networking](/apigee/docs/api-platform/system-administration/shared-vpcs), be aware that the Shared\nVPC configuration and peering must be completed before you can perform the\naccess routing step.\n\n\nAfter the Shared VPC is set up properly, the Apigee admin requires the\n[`compute.networkUser`](/iam/docs/understanding-roles#compute-engine-roles) role **in the Shared VPC project**\nto complete the access routing steps. See also\n[Required administrative roles](/vpc/docs/shared-vpc#iam_roles_required_for_shared_vpc) for Shared VPC."]]
