이 페이지에서는 Apigee 리소스에 IAM 조건을 추가하는 방법을 설명합니다. IAM 조건을 사용하면 Apigee 리소스를 세부적으로 제어할 수 있습니다.
시작하기 전에
Apigee는 Google Cloud의 Identity and Access Management(IAM)를 사용하여 Apigee 리소스의 역할과 권한을 관리합니다. 따라서 IAM에서 Apigee 리소스의 조건을 지정하거나 수정하기 전에 다음 IAM 개념을 숙지해야 합니다.
이름이 지정된 리소스 URI - Apigee의 모든 리소스에는 고유한 리소스 URI가 있습니다. 예를 들어 API 제품 리소스의 URI는 organizations/{org}/apiproducts/{apiproduct}입니다.
사용 가능한 모든 URI의 전체 목록은 Apigee REST 리소스를 참조하세요. 리소스에 대한 액세스 권한을 세분화된 수준에서 제어하려면 이름 지정 규칙에 따라 리소스 이름을 지정해야 합니다. 요구사항에 따라 준수할 이름 지정 규칙을 결정할 수 있습니다. 예를 들어 마케팅팀에서 소유한 모든 API 제품에 marketing이라는 단어를 프리픽스로 사용할 수 있습니다. 이 예시에서는 마케팅팀의 API 제품에 대한 리소스 URI는 organizations/{org}/apiproducts/marketing-으로 시작합니다.
상위 요소 전용 권한 - 리소스나 하위 리소스에 상위 요소 전용 권한이 필요한지 확인합니다. 자세한 내용은 상위 요소 전용 권한을 참조하세요.
리소스 유형 - 조건에서 리소스 유형을 필터링하여 리소스 범위를 더 좁힐 수 있습니다. Apigee에서는 다음 리소스의 조건을 지원합니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-08-19(UTC)"],[[["\u003cp\u003eThis guide explains how to use IAM Conditions to gain detailed control over Apigee and Apigee hybrid resources.\u003c/p\u003e\n"],["\u003cp\u003eBefore implementing IAM Conditions, users should understand fundamental IAM concepts such as resources, resource hierarchy, roles, custom roles, and permissions.\u003c/p\u003e\n"],["\u003cp\u003eAdding an IAM condition to an Apigee resource requires specifying a named resource URI, checking for parent-only permissions, and identifying the resource type.\u003c/p\u003e\n"],["\u003cp\u003eApigee supports conditions for various resources including API proxies, API products, developers, and key-value maps, all listed in detail.\u003c/p\u003e\n"],["\u003cp\u003eFor effective implementation, ensure to include the condition \u003ccode\u003eresource.type == "cloudresourcemanager.googleapis.com/Project"\u003c/code\u003e and users also require certain additional permissions to view proxy deployments.\u003c/p\u003e\n"]]],[],null,["# Adding Apigee IAM Conditions to policies\n\n*This page\napplies to **Apigee** and **Apigee hybrid**.*\n\n\n*View [Apigee Edge](https://docs.apigee.com/api-platform/get-started/what-apigee-edge) documentation.*\n\nThis page describes how to add IAM Conditions to your Apigee resources. An IAM Condition\nlets you have granular control over your Apigee resources.\n\nBefore you begin\n----------------\n\nApigee uses Google Cloud's [Identity and Access Management (IAM)](/iam/docs/overview)\nto manage roles and permissions for Apigee's resources. Therefore, before you specify or\nmodify conditions in IAM for your Apigee resources, familiarize yourself with the following IAM concepts:\n\n- [Resource](/iam/docs/overview#resource)\n- [Resource hierarchy](/iam/docs/resource-hierarchy-access-control)\n- [Roles](/iam/docs/understanding-roles)\n- [Custom roles](/iam/docs/creating-custom-roles)\n- [Permissions](/iam/docs/overview#permissions)\n- [Parent-only permissions](/iam/docs/configuring-resource-based-access#parent-only)\n\nAdding IAM Conditions\n---------------------\n\nTo add an IAM condition to an Apigee resource, you need the following information:\n\n- **Named Resource URI** - Every resource in Apigee has a unique resource URI. For example, URI for the API products resource is `organizations/{org}/apiproducts/{apiproduct}`. For the complete list of all the available URIs, see [Apigee REST\n resources](/apigee/docs/reference/apis/apigee/rest). To control access permissions for a resource at a granular level, you must name your resource according to a naming convention. Based on your requirements, you can decide on what naming convention you want to follow. For example, you can prefix the word `marketing` for all API products owned by the marketing team. In this example, the resource URI for the marketing team's API products, will begin with `organizations/{org}/apiproducts/marketing-`.\n- **Parent only permissions** - Check if a resource or any of its child resource(s) require the parent-only permission. For more information, see [Parent-only permissions](/iam/docs/configuring-resource-based-access#parent-only).\n- **Resource type** - You can further narrow the scope of resources, by filtering for a resource type in the condition. Apigee supports conditions for the following resources:\n\nExamples\n--------\n\nThe table lists a few sample resource conditions and the corresponding permissions:\n\n| **Note:** For all your resource conditions, you must include the following condition so that the Apigee UI can enforce the IAM conditions properly: \n| `resource.type == \"cloudresourcemanager.googleapis.com/Project\"`\n| **Note:** Users must have following additional permissions to view proxy deployments in the UI when providing fine-grained access for particular business unit or teams based on conditions:\n|\n| - `apigee.deployments.get`\n| - `apigee.deployments.list`\n| - `apigee.environments.get`\n| - `apigee.environments.list`\n\nWhat's next\n-----------\n\nGo through the following information in the IAM documentation:\n\n- [Adding a conditional role binding to a policy](/iam/docs/managing-conditional-role-bindings#add)\n- [Modify an existing conditional role binding](/iam/docs/managing-conditional-role-bindings#modify)\n- [Removing a conditional role binding](/iam/docs/managing-conditional-role-bindings#removing)"]]
