[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-05 (世界標準時間)。"],[[["\u003cp\u003eThe VerifyIAM policy in Apigee enforces authorization checks on API access using Google Cloud IAM, offering an alternative to OAuthv2 and VerifyAPIKey policies.\u003c/p\u003e\n"],["\u003cp\u003eThis Standard policy can be deployed to any Apigee environment type, but it is not available with Apigee hybrid.\u003c/p\u003e\n"],["\u003cp\u003eThe policy's \u003ccode\u003eCredentialSource\u003c/code\u003e element specifies the flow variable where the credential value is located, and if omitted, it defaults to looking in the authorization header.\u003c/p\u003e\n"],["\u003cp\u003eSeveral runtime errors can occur, such as \u003ccode\u003eCredentialSourceRefUnresolved\u003c/code\u003e, \u003ccode\u003eForbidden\u003c/code\u003e, and \u003ccode\u003eUnauthorized\u003c/code\u003e, each with specific HTTP status codes and causes.\u003c/p\u003e\n"],["\u003cp\u003eFault variables like \u003ccode\u003efault.name\u003c/code\u003e and \u003ccode\u003everifyiam.policy_name.failed\u003c/code\u003e are set when errors occur, enabling the creation of Fault Rule conditions for handling issues.\u003c/p\u003e\n"]]],[],null,["# VerifyIAM policy\n\n*This page\napplies to **Apigee** , but not to **Apigee hybrid**.*\n\n\n*View [Apigee Edge](https://docs.apigee.com/api-platform/get-started/what-apigee-edge) documentation.*\n\n### Overview\n\nUse VerifyIAM to enforce authorization checks on API access, based on Google Cloud IAM. This\nis an alternative to the [OAuthv2 policy](/apigee/docs/api-platform/reference/policies/oauthv2-policy), and the [VerifyAPIKey policy](/apigee/docs/api-platform/reference/policies/verify-api-key-policy). For\ninformation on how to include VerifyIAM in an IAM-based access control solution, see\n[IAM-based API authentication overview](/apigee/docs/api-platform/security/iam/iam-overview).\n\nThis policy is a *Standard policy* and can be deployed to any environment type. For\ninformation on policy types and availability with each environment type, see\n[Policy types](/apigee/docs/api-platform/reference/policies/reference-overview-policy#policy-types).\n| **Important:** Use of VerifyIAM is subject to the [Characteristics and limitations of IAM-based access control](/apigee/docs/api-platform/security/iam/iam-overview#characteristics-and-limitations-of-iam-based-access-control).\n| **Note:** This policy is not available with Apigee hybrid at this time.\n\nElement reference\n-----------------\n\nThis reference shows the elements and attributes of the VerifyIAM policy. \n\n```gdscript\n\u003cVerifyIAM async=\"false\" continueOnError=\"false\" enabled=\"true\" name=\"MyVerifyIAMPolicy\"\u003e\n \u003cDisplayName\u003eCustom label used in UI\u003c/DisplayName\u003e\n \u003cCredentialSource\u003eflow_variable_name_containing_credential_value\u003c/CredentialSource\u003e\n\u003c/VerifyIAM\u003e\n```\n\n\\\u003cVerifyIAM\\\u003e attributes\n------------------------\n\n```text\n\u003cVerifyIAM async=\"false\" continueOnError=\"false\" enabled=\"true\" name=\"MyVerifyIAMPolicy\"\u003e\n```\n\nThe following table describes attributes that are common to all policy parent elements:\n\n\\\u003cDisplayName\\\u003e element\n-----------------------\n\nUse in addition to the `name` attribute to label the policy in the\nmanagement UI proxy editor with a different, natural-language name. \n\n```text\n\u003cDisplayName\u003ePolicy Display Name\u003c/DisplayName\u003e\n```\n\n\\\u003cCredentialSource\\\u003e element\n----------------------------\n\n```gdscript\n\u003cCredentialSource\u003eflow_variable_name_containing_credential_value\u003c/CredentialSource\u003e\n```\n\nThis element specifies the flow variable containing the credential value, and has these\ncharacteristics:\n\n- Typically, the client sends the value in a query parameter, HTTP header, or a form parameter. The string must specify the corresponding flow variable in the form `request.queryparam.token`.\n- When read from the reference, a direct value is expected. For example, 'Bearer' should not be present as the prefix.\n- If omitted, policy execution assumes the value is in the authorization header and in the standard format \"Bearer xyz\".\n\nExample: \n\n```text\n\u003cVerifyIAM async=\"false\" continueOnError=\"false\" enabled=\"true\" name=\"Verify-IAM-Permissions-1\"\u003e\n \u003cDisplayName\u003eVerifyIAM policy for flow 1\u003c/DisplayName\u003e\n \u003cCredentialSource\u003erequest.queryparam.token\u003c/CredentialSource\u003e\n\u003c/VerifyIAM\u003e\n```\n\nError reference\n---------------\n\n\nThis section describes the fault codes and error messages that are returned and fault variables\nthat are set by Apigee when this policy triggers an error. This information is important to know\nif you are developing fault rules to handle faults. To learn more, see\n[What you need to know\nabout policy errors](/apigee/docs/api-platform/fundamentals/what-you-need-know-about-policy-errors) and [Handling\nfaults](/apigee/docs/api-platform/fundamentals/fault-handling).\n\n### Runtime errors\n\nThese errors can occur when the policy executes.\n\n### Deployment errors\n\nThis policy does not return any policy-specific deployment errors.\n\n### Fault variables\n\nThese variables are set when this policy triggers an error at runtime.\n| **Note:** You can use these variables to create Fault Rule conditions.\n\n\u003cbr /\u003e"]]
