命名资源 URI - Apigee 中的每个资源都有唯一的资源 URI。例如，API 产品资源的 URI 为 organizations/{org}/apiproducts/{apiproduct}。如需查看所有可用 URI 的完整列表，请参阅 Apigee REST 资源。如需精细控制资源的访问权限，您必须根据命名惯例为资源命名。您可以根据需要决定要遵循的命名惯例。例如，您可以为营销团队拥有的所有 API 产品添加 marketing 一词作为前缀。在此示例中，营销团队 API 产品的资源 URI 将以 organizations/{org}/apiproducts/marketing- 开头。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-03。"],[[["\u003cp\u003eThis guide explains how to use IAM Conditions to gain detailed control over Apigee and Apigee hybrid resources.\u003c/p\u003e\n"],["\u003cp\u003eBefore implementing IAM Conditions, users should understand fundamental IAM concepts such as resources, resource hierarchy, roles, custom roles, and permissions.\u003c/p\u003e\n"],["\u003cp\u003eAdding an IAM condition to an Apigee resource requires specifying a named resource URI, checking for parent-only permissions, and identifying the resource type.\u003c/p\u003e\n"],["\u003cp\u003eApigee supports conditions for various resources including API proxies, API products, developers, and key-value maps, all listed in detail.\u003c/p\u003e\n"],["\u003cp\u003eFor effective implementation, ensure to include the condition \u003ccode\u003eresource.type == "cloudresourcemanager.googleapis.com/Project"\u003c/code\u003e and users also require certain additional permissions to view proxy deployments.\u003c/p\u003e\n"]]],[],null,["# Adding Apigee IAM Conditions to policies\n\n*This page\napplies to **Apigee** and **Apigee hybrid**.*\n\n\n*View [Apigee Edge](https://docs.apigee.com/api-platform/get-started/what-apigee-edge) documentation.*\n\nThis page describes how to add IAM Conditions to your Apigee resources. An IAM Condition\nlets you have granular control over your Apigee resources.\n\nBefore you begin\n----------------\n\nApigee uses Google Cloud's [Identity and Access Management (IAM)](/iam/docs/overview)\nto manage roles and permissions for Apigee's resources. Therefore, before you specify or\nmodify conditions in IAM for your Apigee resources, familiarize yourself with the following IAM concepts:\n\n- [Resource](/iam/docs/overview#resource)\n- [Resource hierarchy](/iam/docs/resource-hierarchy-access-control)\n- [Roles](/iam/docs/understanding-roles)\n- [Custom roles](/iam/docs/creating-custom-roles)\n- [Permissions](/iam/docs/overview#permissions)\n- [Parent-only permissions](/iam/docs/configuring-resource-based-access#parent-only)\n\nAdding IAM Conditions\n---------------------\n\nTo add an IAM condition to an Apigee resource, you need the following information:\n\n- **Named Resource URI** - Every resource in Apigee has a unique resource URI. For example, URI for the API products resource is `organizations/{org}/apiproducts/{apiproduct}`. For the complete list of all the available URIs, see [Apigee REST\n resources](/apigee/docs/reference/apis/apigee/rest). To control access permissions for a resource at a granular level, you must name your resource according to a naming convention. Based on your requirements, you can decide on what naming convention you want to follow. For example, you can prefix the word `marketing` for all API products owned by the marketing team. In this example, the resource URI for the marketing team's API products, will begin with `organizations/{org}/apiproducts/marketing-`.\n- **Parent only permissions** - Check if a resource or any of its child resource(s) require the parent-only permission. For more information, see [Parent-only permissions](/iam/docs/configuring-resource-based-access#parent-only).\n- **Resource type** - You can further narrow the scope of resources, by filtering for a resource type in the condition. Apigee supports conditions for the following resources:\n\nExamples\n--------\n\nThe table lists a few sample resource conditions and the corresponding permissions:\n\n| **Note:** For all your resource conditions, you must include the following condition so that the Apigee UI can enforce the IAM conditions properly: \n| `resource.type == \"cloudresourcemanager.googleapis.com/Project\"`\n| **Note:** Users must have following additional permissions to view proxy deployments in the UI when providing fine-grained access for particular business unit or teams based on conditions:\n|\n| - `apigee.deployments.get`\n| - `apigee.deployments.list`\n| - `apigee.environments.get`\n| - `apigee.environments.list`\n\nWhat's next\n-----------\n\nGo through the following information in the IAM documentation:\n\n- [Adding a conditional role binding to a policy](/iam/docs/managing-conditional-role-bindings#add)\n- [Modify an existing conditional role binding](/iam/docs/managing-conditional-role-bindings#modify)\n- [Removing a conditional role binding](/iam/docs/managing-conditional-role-bindings#removing)"]]
