VerifyIAM을 사용하여 Google Cloud IAM에 따라 API 액세스에 대한 승인 검사를 적용합니다. 이는 OAuthv2 정책 및 VerifyAPIKey 정책을 대체합니다. IAM 기반 액세스 제어 솔루션에 VerifyIAM을 포함하는 방법에 관한 자세한 내용은 IAM 기반 API 인증 개요를 참고하세요.
이 정책은 표준 정책이며 모든 환경 유형에 배포할 수 있습니다. 정책 유형과 각 환경 유형에서의 가용성에 대한 자세한 내용은 정책 유형을 참조하세요.
이 섹션에서는 반환되는 오류 코드 및 오류 메시지와 이 정책이 오류를 트리거할 때 Apigee에서 설정한 오류 변수를 설명합니다. 오류를 처리하기 위해 오류 규칙을 개발 중인 경우 이 정보는 중요합니다. 자세한 내용은 정책 오류에 대해 알아야 할 사항 및 오류 처리를 참조하세요.
런타임 오류
이러한 오류는 정책이 실행될 때 발생할 수 있습니다.
오류 코드
HTTP 상태
원인
steps.verifyiam.CredentialSourceRefUnresolved
400
사용자 인증 정보 소스 내에 제공된 흐름 변수를 확인할 수 없습니다.
steps.verifyiam.CredentialValueNotProvided
400
사용자 인증 정보를 찾을 수 없습니다. 사용자 인증 정보 소스 참조가 제공되지 않으면 승인 헤더와 같은 기본 위치를 조사합니다.
steps.verifyiam.Forbidden
403
충분한 권한이 없거나 액세스 범위가 누락되었거나 기타 관련 문제로 인해 요청이 전달되지 않을 수 있습니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-05(UTC)"],[[["\u003cp\u003eThe VerifyIAM policy in Apigee enforces authorization checks on API access using Google Cloud IAM, offering an alternative to OAuthv2 and VerifyAPIKey policies.\u003c/p\u003e\n"],["\u003cp\u003eThis Standard policy can be deployed to any Apigee environment type, but it is not available with Apigee hybrid.\u003c/p\u003e\n"],["\u003cp\u003eThe policy's \u003ccode\u003eCredentialSource\u003c/code\u003e element specifies the flow variable where the credential value is located, and if omitted, it defaults to looking in the authorization header.\u003c/p\u003e\n"],["\u003cp\u003eSeveral runtime errors can occur, such as \u003ccode\u003eCredentialSourceRefUnresolved\u003c/code\u003e, \u003ccode\u003eForbidden\u003c/code\u003e, and \u003ccode\u003eUnauthorized\u003c/code\u003e, each with specific HTTP status codes and causes.\u003c/p\u003e\n"],["\u003cp\u003eFault variables like \u003ccode\u003efault.name\u003c/code\u003e and \u003ccode\u003everifyiam.policy_name.failed\u003c/code\u003e are set when errors occur, enabling the creation of Fault Rule conditions for handling issues.\u003c/p\u003e\n"]]],[],null,["# VerifyIAM policy\n\n*This page\napplies to **Apigee** , but not to **Apigee hybrid**.*\n\n\n*View [Apigee Edge](https://docs.apigee.com/api-platform/get-started/what-apigee-edge) documentation.*\n\n### Overview\n\nUse VerifyIAM to enforce authorization checks on API access, based on Google Cloud IAM. This\nis an alternative to the [OAuthv2 policy](/apigee/docs/api-platform/reference/policies/oauthv2-policy), and the [VerifyAPIKey policy](/apigee/docs/api-platform/reference/policies/verify-api-key-policy). For\ninformation on how to include VerifyIAM in an IAM-based access control solution, see\n[IAM-based API authentication overview](/apigee/docs/api-platform/security/iam/iam-overview).\n\nThis policy is a *Standard policy* and can be deployed to any environment type. For\ninformation on policy types and availability with each environment type, see\n[Policy types](/apigee/docs/api-platform/reference/policies/reference-overview-policy#policy-types).\n| **Important:** Use of VerifyIAM is subject to the [Characteristics and limitations of IAM-based access control](/apigee/docs/api-platform/security/iam/iam-overview#characteristics-and-limitations-of-iam-based-access-control).\n| **Note:** This policy is not available with Apigee hybrid at this time.\n\nElement reference\n-----------------\n\nThis reference shows the elements and attributes of the VerifyIAM policy. \n\n```gdscript\n\u003cVerifyIAM async=\"false\" continueOnError=\"false\" enabled=\"true\" name=\"MyVerifyIAMPolicy\"\u003e\n \u003cDisplayName\u003eCustom label used in UI\u003c/DisplayName\u003e\n \u003cCredentialSource\u003eflow_variable_name_containing_credential_value\u003c/CredentialSource\u003e\n\u003c/VerifyIAM\u003e\n```\n\n\\\u003cVerifyIAM\\\u003e attributes\n------------------------\n\n```text\n\u003cVerifyIAM async=\"false\" continueOnError=\"false\" enabled=\"true\" name=\"MyVerifyIAMPolicy\"\u003e\n```\n\nThe following table describes attributes that are common to all policy parent elements:\n\n\\\u003cDisplayName\\\u003e element\n-----------------------\n\nUse in addition to the `name` attribute to label the policy in the\nmanagement UI proxy editor with a different, natural-language name. \n\n```text\n\u003cDisplayName\u003ePolicy Display Name\u003c/DisplayName\u003e\n```\n\n\\\u003cCredentialSource\\\u003e element\n----------------------------\n\n```gdscript\n\u003cCredentialSource\u003eflow_variable_name_containing_credential_value\u003c/CredentialSource\u003e\n```\n\nThis element specifies the flow variable containing the credential value, and has these\ncharacteristics:\n\n- Typically, the client sends the value in a query parameter, HTTP header, or a form parameter. The string must specify the corresponding flow variable in the form `request.queryparam.token`.\n- When read from the reference, a direct value is expected. For example, 'Bearer' should not be present as the prefix.\n- If omitted, policy execution assumes the value is in the authorization header and in the standard format \"Bearer xyz\".\n\nExample: \n\n```text\n\u003cVerifyIAM async=\"false\" continueOnError=\"false\" enabled=\"true\" name=\"Verify-IAM-Permissions-1\"\u003e\n \u003cDisplayName\u003eVerifyIAM policy for flow 1\u003c/DisplayName\u003e\n \u003cCredentialSource\u003erequest.queryparam.token\u003c/CredentialSource\u003e\n\u003c/VerifyIAM\u003e\n```\n\nError reference\n---------------\n\n\nThis section describes the fault codes and error messages that are returned and fault variables\nthat are set by Apigee when this policy triggers an error. This information is important to know\nif you are developing fault rules to handle faults. To learn more, see\n[What you need to know\nabout policy errors](/apigee/docs/api-platform/fundamentals/what-you-need-know-about-policy-errors) and [Handling\nfaults](/apigee/docs/api-platform/fundamentals/fault-handling).\n\n### Runtime errors\n\nThese errors can occur when the policy executes.\n\n### Deployment errors\n\nThis policy does not return any policy-specific deployment errors.\n\n### Fault variables\n\nThese variables are set when this policy triggers an error at runtime.\n| **Note:** You can use these variables to create Fault Rule conditions.\n\n\u003cbr /\u003e"]]
