Apigee 프로비저닝에 사용되는 Google Cloud 프로젝트의 소유자에게는 이미 모든 기본 Apigee 프로비저닝 단계를 수행할 수 있는 권한이 있습니다.
Apigee 프로비저닝 도구가 프로젝트 소유자가 아닌 경우 이 문서를 사용하여 각 프로비저닝 단계를 수행하는 데 필요한 권한을 확인합니다.
공유 Virtual Private Cloud(VPC) 네트워킹을 사용하는 경우 공유 VPC 프로젝트에 추가 권한이 필요하며 이러한 케이스도 이 문서에 설명됩니다.
사전 정의된 역할
Apigee 관리자에게 프로비저닝을 완료할 수 있는 충분한 권한이 있는지 확인하려면 Apigee 관리자에게 다음과 같은 IAM 사전 정의된 역할을 부여합니다. 그러나 사전 정의된 역할은 Apigee 관리자가 프로비저닝을 완료하는 데 필요한 것보다 많은 권한을 부여합니다. 최소 권한을 제공하려면 커스텀 역할 및 권한을 참조하세요.
공유 Virtual Private Cloud(VPC) 네트워킹을 사용하는 경우 공유 VPC 프로젝트의 관리자 권한이 있는 사용자는 공유 VPC 네트워크 사용의 설명대로 공유 VPC 프로젝트를 Apigee와 피어링해야 합니다 Apigee 관리자가 서비스 네트워킹 단계를 완료하려면 먼저 피어링을 완료해야 합니다. 관리자 및 IAM도 참조하세요.
공유 VPC가 올바르게 설정된 경우 Apigee 관리자가 서비스 네트워킹 구성 단계를 완료하려면 다음 권한이 필요합니다.
권한
계정 유형
목적
compute.projects.get
유료 및 평가
Apigee 관리자는 Apigee가 설치된 프로젝트의 이 권한을 보유해야 합니다.
이 권한을 통해 관리자가 공유 VPC 호스트 프로젝트 ID를 볼 수 있습니다.
Compute 네트워크 사용자 역할 (compute.networkUser)
유료 및 평가
Apigee 관리자는 공유 VPC 호스트 프로젝트의 이 역할을 부여받아야 합니다.
이 역할을 통해 관리자가 Apigee 프로비저닝 UI에서 공유 VPC 네트워크를 보고 선택할 수 있습니다.
런타임 인스턴스 권한
런타임 인스턴스를 만들려면 다음 권한이 필요합니다(구독 및 사용한 만큼만 지불 계정만 해당).
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-08-18(UTC)"],[[["\u003cp\u003eThis document outlines the necessary Google Cloud IAM permissions for provisioning Apigee, excluding Apigee hybrid.\u003c/p\u003e\n"],["\u003cp\u003ePermissions can be granted via predefined roles, which may include more access than needed, or through custom roles that allow for the assignment of only the least-necessary privileges.\u003c/p\u003e\n"],["\u003cp\u003eThe Google Cloud project owner inherently has the permissions needed for all basic Apigee provisioning steps; if not the owner, specific permissions must be assigned.\u003c/p\u003e\n"],["\u003cp\u003eUsing Shared VPC requires additional permissions in the Shared VPC project, which are detailed in this document.\u003c/p\u003e\n"],["\u003cp\u003eDepending on the type of operation, such as Organization creation, Service Networking, or Access Routing, different permissions are needed, which are described in the tables.\u003c/p\u003e\n"]]],[],null,["# About Apigee provisioning permissions\n\n*This page\napplies to **Apigee** , but not to **Apigee hybrid**.*\n\n\n*View [Apigee Edge](https://docs.apigee.com/api-platform/get-started/what-apigee-edge) documentation.*\n\n\nThis document describes the [Google Cloud IAM permissions](/iam/docs/overview) that are required to successfully provision\nApigee.\n\n\nYou can specify permissions using the following:\n\n- [**Predefined roles:**](#predefined-roles) Provide sufficient permission to do the provisioning steps. Predefined roles may give the Apigee administrator more permissions than they need to complete provisioning.\n- [**Custom roles:**](#custom-roles-permissions) Provide the least-necessary privilege needed to do the provisioning steps.\n\nGoogle Cloud project owner role\n-------------------------------\n\n\nThe owner of the Google Cloud project that is used for Apigee provisioning\nalready has permission to perform all of the basic Apigee provisioning steps.\n\n\nIf the Apigee provisioner is not the project owner, then use this document to\ndetermine the permissions needed to perform each of the provisioning steps.\n\n\nIf you use Shared Virtual Private Cloud (VPC) networking, additional\npermissions in the Shared VPC project are required, and these cases are also\nnoted in this document.\n\nPredefined roles\n----------------\n\n\nIf you just want to make sure the Apigee administrator has sufficient\npermission to complete the provisioning, give the Apigee administrator the\nfollowing [IAM predefined roles](/iam/docs/understanding-roles);\nhowever, predefined roles may give the Apigee administrator more permissions\nthan they need to complete provisioning. See [Custom roles and permissions](#custom-roles-permissions) to provide least-necessary privileges.\n\n#### How to specify a predefined role\n\nTo add users and roles:\n\n1. In the Google Cloud console, go to **IAM \\& Admin \\\u003e IAM** for your\n project.\n\n [Go to the IAM/Iam page](https://console.cloud.google.com/iam-admin/iam)\n2. To add a new user:\n 1. Click **Grant access**.\n 2. Type a new **Principal** name.\n 3. Click the **Select a role** menu and then type the role name in the **Filter** field. For example, `Apigee Organization Admin`. Click the role listed in the results.\n 4. Click **Save**.\n3. To edit an existing user:\n 1. Click edit **Edit**.\n 2. To change an existing role, click the **Role** menu and then select a different role.\n 3. To add another role, click **Add another role.**\n 4. Click the **Select a role** menu and then type the role name in the **Filter** field. For example, `Apigee Organization Admin`. Click the role listed in the results.\n 5. Click **Save**.\n\nCustom roles and permissions\n----------------------------\n\n\nTo provide least-necessary privileges, create an\n[IAM custom role](/iam/docs/creating-custom-roles) and assign\npermissions from the following sections.\n\n#### How to specify a custom role\n\nTo add a custom role:\n\n1. In the Google Cloud console, go to **IAM \\& Admin \\\u003e Roles** for your\n project.\n\n [Go to the IAM \\& Admin/Roles page](https://console.cloud.google.com/iam-admin/roles)\n2. To add a new role:\n 1. Click **Create role**.\n 2. Type a new **Title**.\n 3. Type a **Description** (optional).\n 4. Type an **ID**.\n 5. Select a **Role launch stage**.\n 6. Click **Add permissions**.\n 7. Copy the desired permission text from the tables below and paste it into the **Filter** field. For example, `apigee.environments.create`.\n 8. Press \u003ckbd\u003eEnter\u003c/kbd\u003e or click an item from the results.\n 9. Select the checkbox for the item just added.\n 10. Click **Add** . **Note:** To add multiple permissions at a time:\n | - Select the `OR` operator between each permission as you add them, or\n | - Search for a partial permission string, for example, `apigee.environments`, select multiple checkboxes, and then click **Save**.\n 11. Once you have added all the permissions for this role, click **Create**.\n3. To edit an existing custom role:\n 1. Locate the custom role.\n 2. Click more_vert **More** \\\u003e **Edit**.\n 3. Make any desired changes.\n 4. Click **Update**.\n\n### UI-based Apigee management permissions\n\n\nThis permission is required for all users who will manage an organization through the\n[Apigee UI in Cloud console](https://console.cloud.google.com/apigee). Include it in\ncustom roles that involve management through that interface.\n\n### Provisioning permissions\n\n\nThese permissions are required to start provisioning\nApigee:\n\n### API enablement permissions\n\nThese permissions are required to enable Google Cloud APIs:\n\n### Organization creation permissions (paid org)\n\nThese permissions are needed to create an Apigee organization for\npaid accounts (Subscription or Pay-as-you-go):\n\n### Organization creation permissions (eval org)\n\n\nThis permission is required for selecting analytics and runtime hosting\nregions for an eval organization:\n\n### Service networking permissions\n\n\nThese permissions are needed in the service networking configuration steps.\nIf you are using Shared VPC networking, see\n[Service networking permissions with Shared VPC](#servicenetworkingwithsharedvpc).\n\n### Service networking permissions with Shared VPC\n\n\nIf you are using Shared Virtual Private Cloud (VPC) networking, a user with\nadministrative privileges in the Shared VPC project must peer the Shared VPC\nproject with Apigee, as described in\n[Using shared VPC networks](/apigee/docs/api-platform/system-administration/shared-vpcs). Peering must be completed before the Apigee\nadmin can complete the service networking steps. See also\n[Administrators and IAM](/vpc/docs/shared-vpc#iam_in_shared_vpc).\n\nWhen Shared VPC is properly set up, the Apigee admin needs these permissions\nto complete the service networking configuration steps:\n\n### Runtime instance permissions\n\n\nThese permissions are needed to create a runtime instance (Subscription and Pay-as-you-go accounts only):\n\n### Access routing permissions\n\nThese permissions are needed for the access routing steps:\n\n### Access routing permissions with Shared VPC\n\nIf you are using\n[Shared Virtual Private Cloud (VPC) networking](/apigee/docs/api-platform/system-administration/shared-vpcs), be aware that the Shared\nVPC configuration and peering must be completed before you can perform the\naccess routing step.\n\n\nAfter the Shared VPC is set up properly, the Apigee admin requires the\n[`compute.networkUser`](/iam/docs/understanding-roles#compute-engine-roles) role **in the Shared VPC project**\nto complete the access routing steps. See also\n[Required administrative roles](/vpc/docs/shared-vpc#iam_roles_required_for_shared_vpc) for Shared VPC."]]
