Nesta página, descrevemos como adicionar condições do IAM aos recursos da Apigee. Uma condição do IAM
permite ter controle granular sobre os recursos da Apigee.
Antes de começar
A Apigee usa o Identity and Access Management (IAM) do Google Cloud
para gerenciar papéis e permissões para os recursos da Apigee. Portanto, antes de especificar ou
modificar condições do IAM para seus recursos da Apigee, familiarize-se com os seguintes conceitos do IAM:
Para adicionar uma condição do IAM a um recurso da Apigee, você precisa das seguintes informações:
URI de recurso nomeado: todo recurso na Apigee tem um URI de recurso exclusivo. Por exemplo,
o URI do recurso de produtos da API é organizations/{org}/apiproducts/{apiproduct}.
Para a lista completa de todos os URIs disponíveis, consulte Recursos REST
da Apigee. Para controlar as permissões de acesso de um recurso em um nível granular,
nomeie seu recurso de acordo com uma convenção de nomenclatura. Com base nos seus requisitos,
você decide qual convenção de nomenclatura quer seguir. Por exemplo, é possível prefixar a
palavra marketing para todos os produtos da API que pertencem à equipe de marketing. Neste exemplo,
o URI de recurso dos produtos de API da equipe de marketing começará com
organizations/{org}/apiproducts/marketing-.
Permissões somente para o pai: verifique se um recurso ou os recursos filhos dele
exigem permissão somente para o pai. Para mais informações,
consulte Permissões somente para pais.
Tipo de recurso: é possível restringir ainda mais o escopo dos recursos, filtrando um
tipo de recurso na condição. A Apigee é compatível com as condições dos seguintes recursos:
[[["Fácil de entender","easyToUnderstand","thumb-up"],["Meu problema foi resolvido","solvedMyProblem","thumb-up"],["Outro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Informações incorretas ou exemplo de código","incorrectInformationOrSampleCode","thumb-down"],["Não contém as informações/amostras de que eu preciso","missingTheInformationSamplesINeed","thumb-down"],["Problema na tradução","translationIssue","thumb-down"],["Outro","otherDown","thumb-down"]],["Última atualização 2025-09-03 UTC."],[[["\u003cp\u003eThis guide explains how to use IAM Conditions to gain detailed control over Apigee and Apigee hybrid resources.\u003c/p\u003e\n"],["\u003cp\u003eBefore implementing IAM Conditions, users should understand fundamental IAM concepts such as resources, resource hierarchy, roles, custom roles, and permissions.\u003c/p\u003e\n"],["\u003cp\u003eAdding an IAM condition to an Apigee resource requires specifying a named resource URI, checking for parent-only permissions, and identifying the resource type.\u003c/p\u003e\n"],["\u003cp\u003eApigee supports conditions for various resources including API proxies, API products, developers, and key-value maps, all listed in detail.\u003c/p\u003e\n"],["\u003cp\u003eFor effective implementation, ensure to include the condition \u003ccode\u003eresource.type == "cloudresourcemanager.googleapis.com/Project"\u003c/code\u003e and users also require certain additional permissions to view proxy deployments.\u003c/p\u003e\n"]]],[],null,["# Adding Apigee IAM Conditions to policies\n\n*This page\napplies to **Apigee** and **Apigee hybrid**.*\n\n\n*View [Apigee Edge](https://docs.apigee.com/api-platform/get-started/what-apigee-edge) documentation.*\n\nThis page describes how to add IAM Conditions to your Apigee resources. An IAM Condition\nlets you have granular control over your Apigee resources.\n\nBefore you begin\n----------------\n\nApigee uses Google Cloud's [Identity and Access Management (IAM)](/iam/docs/overview)\nto manage roles and permissions for Apigee's resources. Therefore, before you specify or\nmodify conditions in IAM for your Apigee resources, familiarize yourself with the following IAM concepts:\n\n- [Resource](/iam/docs/overview#resource)\n- [Resource hierarchy](/iam/docs/resource-hierarchy-access-control)\n- [Roles](/iam/docs/understanding-roles)\n- [Custom roles](/iam/docs/creating-custom-roles)\n- [Permissions](/iam/docs/overview#permissions)\n- [Parent-only permissions](/iam/docs/configuring-resource-based-access#parent-only)\n\nAdding IAM Conditions\n---------------------\n\nTo add an IAM condition to an Apigee resource, you need the following information:\n\n- **Named Resource URI** - Every resource in Apigee has a unique resource URI. For example, URI for the API products resource is `organizations/{org}/apiproducts/{apiproduct}`. For the complete list of all the available URIs, see [Apigee REST\n resources](/apigee/docs/reference/apis/apigee/rest). To control access permissions for a resource at a granular level, you must name your resource according to a naming convention. Based on your requirements, you can decide on what naming convention you want to follow. For example, you can prefix the word `marketing` for all API products owned by the marketing team. In this example, the resource URI for the marketing team's API products, will begin with `organizations/{org}/apiproducts/marketing-`.\n- **Parent only permissions** - Check if a resource or any of its child resource(s) require the parent-only permission. For more information, see [Parent-only permissions](/iam/docs/configuring-resource-based-access#parent-only).\n- **Resource type** - You can further narrow the scope of resources, by filtering for a resource type in the condition. Apigee supports conditions for the following resources:\n\nExamples\n--------\n\nThe table lists a few sample resource conditions and the corresponding permissions:\n\n| **Note:** For all your resource conditions, you must include the following condition so that the Apigee UI can enforce the IAM conditions properly: \n| `resource.type == \"cloudresourcemanager.googleapis.com/Project\"`\n| **Note:** Users must have following additional permissions to view proxy deployments in the UI when providing fine-grained access for particular business unit or teams based on conditions:\n|\n| - `apigee.deployments.get`\n| - `apigee.deployments.list`\n| - `apigee.environments.get`\n| - `apigee.environments.list`\n\nWhat's next\n-----------\n\nGo through the following information in the IAM documentation:\n\n- [Adding a conditional role binding to a policy](/iam/docs/managing-conditional-role-bindings#add)\n- [Modify an existing conditional role binding](/iam/docs/managing-conditional-role-bindings#modify)\n- [Removing a conditional role binding](/iam/docs/managing-conditional-role-bindings#removing)"]]
