Esta página descreve como adicionar condições da IAM aos seus recursos do Apigee. Uma condição da IAM
permite-lhe ter um controlo detalhado sobre os seus recursos do Apigee.
Antes de começar
O Apigee usa a gestão de identidade e de acesso (IAM) do Google Cloud
para gerir funções e autorizações para os recursos do Apigee. Por conseguinte, antes de especificar ou modificar as condições no IAM para os seus recursos do Apigee, familiarize-se com os seguintes conceitos do IAM:
Para adicionar uma condição do IAM a um recurso do Apigee, precisa das seguintes informações:
URI do recurso com nome: cada recurso no Apigee tem um URI do recurso exclusivo. Por exemplo, o URI do recurso de produtos da API é organizations/{org}/apiproducts/{apiproduct}.
Para ver a lista completa de todos os URIs disponíveis, consulte os recursos REST do Apigee. Para controlar as autorizações de acesso de um recurso ao nível detalhado, tem de
atribuir um nome ao recurso de acordo com uma convenção de nomenclatura. Com base nos seus requisitos, pode
decidir que convenção de nomenclatura quer seguir. Por exemplo, pode adicionar o prefixo
marketing a todos os produtos de API pertencentes à equipa de marketing. Neste exemplo,
o URI do recurso para os produtos de API da equipa de marketing começa com
organizations/{org}/apiproducts/marketing-.
Autorizações apenas para pais: verifique se um recurso ou qualquer um dos respetivos recursos subordinados requer a autorização apenas para pais. Para mais informações,
consulte o artigo Autorizações apenas para pais.
Tipo de recurso: pode restringir ainda mais o âmbito dos recursos filtrando por um tipo de recurso na condição. O Apigee suporta condições para os seguintes recursos:
[[["Fácil de entender","easyToUnderstand","thumb-up"],["Meu problema foi resolvido","solvedMyProblem","thumb-up"],["Outro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Informações incorretas ou exemplo de código","incorrectInformationOrSampleCode","thumb-down"],["Não contém as informações/amostras de que eu preciso","missingTheInformationSamplesINeed","thumb-down"],["Problema na tradução","translationIssue","thumb-down"],["Outro","otherDown","thumb-down"]],["Última atualização 2025-08-21 UTC."],[[["\u003cp\u003eThis guide explains how to use IAM Conditions to gain detailed control over Apigee and Apigee hybrid resources.\u003c/p\u003e\n"],["\u003cp\u003eBefore implementing IAM Conditions, users should understand fundamental IAM concepts such as resources, resource hierarchy, roles, custom roles, and permissions.\u003c/p\u003e\n"],["\u003cp\u003eAdding an IAM condition to an Apigee resource requires specifying a named resource URI, checking for parent-only permissions, and identifying the resource type.\u003c/p\u003e\n"],["\u003cp\u003eApigee supports conditions for various resources including API proxies, API products, developers, and key-value maps, all listed in detail.\u003c/p\u003e\n"],["\u003cp\u003eFor effective implementation, ensure to include the condition \u003ccode\u003eresource.type == "cloudresourcemanager.googleapis.com/Project"\u003c/code\u003e and users also require certain additional permissions to view proxy deployments.\u003c/p\u003e\n"]]],[],null,["# Adding Apigee IAM Conditions to policies\n\n*This page\napplies to **Apigee** and **Apigee hybrid**.*\n\n\n*View [Apigee Edge](https://docs.apigee.com/api-platform/get-started/what-apigee-edge) documentation.*\n\nThis page describes how to add IAM Conditions to your Apigee resources. An IAM Condition\nlets you have granular control over your Apigee resources.\n\nBefore you begin\n----------------\n\nApigee uses Google Cloud's [Identity and Access Management (IAM)](/iam/docs/overview)\nto manage roles and permissions for Apigee's resources. Therefore, before you specify or\nmodify conditions in IAM for your Apigee resources, familiarize yourself with the following IAM concepts:\n\n- [Resource](/iam/docs/overview#resource)\n- [Resource hierarchy](/iam/docs/resource-hierarchy-access-control)\n- [Roles](/iam/docs/understanding-roles)\n- [Custom roles](/iam/docs/creating-custom-roles)\n- [Permissions](/iam/docs/overview#permissions)\n- [Parent-only permissions](/iam/docs/configuring-resource-based-access#parent-only)\n\nAdding IAM Conditions\n---------------------\n\nTo add an IAM condition to an Apigee resource, you need the following information:\n\n- **Named Resource URI** - Every resource in Apigee has a unique resource URI. For example, URI for the API products resource is `organizations/{org}/apiproducts/{apiproduct}`. For the complete list of all the available URIs, see [Apigee REST\n resources](/apigee/docs/reference/apis/apigee/rest). To control access permissions for a resource at a granular level, you must name your resource according to a naming convention. Based on your requirements, you can decide on what naming convention you want to follow. For example, you can prefix the word `marketing` for all API products owned by the marketing team. In this example, the resource URI for the marketing team's API products, will begin with `organizations/{org}/apiproducts/marketing-`.\n- **Parent only permissions** - Check if a resource or any of its child resource(s) require the parent-only permission. For more information, see [Parent-only permissions](/iam/docs/configuring-resource-based-access#parent-only).\n- **Resource type** - You can further narrow the scope of resources, by filtering for a resource type in the condition. Apigee supports conditions for the following resources:\n\nExamples\n--------\n\nThe table lists a few sample resource conditions and the corresponding permissions:\n\n| **Note:** For all your resource conditions, you must include the following condition so that the Apigee UI can enforce the IAM conditions properly: \n| `resource.type == \"cloudresourcemanager.googleapis.com/Project\"`\n| **Note:** Users must have following additional permissions to view proxy deployments in the UI when providing fine-grained access for particular business unit or teams based on conditions:\n|\n| - `apigee.deployments.get`\n| - `apigee.deployments.list`\n| - `apigee.environments.get`\n| - `apigee.environments.list`\n\nWhat's next\n-----------\n\nGo through the following information in the IAM documentation:\n\n- [Adding a conditional role binding to a policy](/iam/docs/managing-conditional-role-bindings#add)\n- [Modify an existing conditional role binding](/iam/docs/managing-conditional-role-bindings#modify)\n- [Removing a conditional role binding](/iam/docs/managing-conditional-role-bindings#removing)"]]
