이 페이지에서는 Assured Workloads를 구성하는 데 사용할 수 있는 Identity and Access Management(IAM) 역할을 설명합니다. 역할은 주 구성원의 리소스 액세스 기능을 제한합니다. 해당 Google Cloud API, 기능 또는 리소스와 상호작용하는 데 필요한 권한만 주 구성원에 부여합니다.
Assured Workloads 폴더를 만들려면 아래에 나열된 해당 권한을 가진 역할 중 하나와 Cloud Billing 액세스 제어 역할을 할당해야 합니다. 또한 활성 상태의 유효한 결제 계정이 있어야 합니다. 자세한 내용은 Cloud Billing 액세스 제어 개요를 참조하세요.
필요한 역할
다음은 필요한 최소 Assured Workloads 관련 역할입니다. IAM 역할을 사용해 리소스에 대한 액세스 권한을 부여, 변경 또는 취소하는 방법에 대한 자세한 내용은 리소스에 대한 액세스 권한 부여, 변경, 취소를 참조하세요.
Assured Workloads 관리자(roles/assuredworkloads.admin): Assured Workloads 폴더를 만들고 삭제하는 데 필요한 역할입니다.
Resource Manager 조직 뷰어(roles/resourcemanager.organizationViewer): 조직에 속한 모든 리소스를 볼 수 있는 액세스 권한입니다.
Assured Workloads 역할
다음은 Assured Workloads와 연결된 IAM 역할과 Google Cloud CLI를 사용하여 이러한 역할을 부여하는 방법입니다. Google Cloud 콘솔에서 또는 프로그래매틱 방식으로 이러한 역할을 부여하는 방법을 알아보려면 IAM 문서에서 리소스에 대한 액세스 권한 부여, 변경, 취소를 참조하세요.
ORGANIZATION_ID 자리표시자를 실제 조직 식별자로 바꾸고 example@customer.org를 사용자 이메일 주소로 바꿉니다. 조직 ID를 가져오려면 조직 ID 검색을 참조하세요.
최소 권한을 따르도록 IAM 역할을 적절히 보호하는 것이 Google Cloud 보안 권장사항입니다. 이 원칙은 사용자가 자신의 역할에 필요한 제품, 서비스, 애플리케이션에만 액세스해야 한다는 규칙을 따릅니다. Assured Workloads 폴더 외부에서 제품 및 서비스를 배포할 때 현재는 사용자가 Assured Workloads 프로젝트에서 범위 밖 서비스를 사용하는 것이 제한되지 않습니다.
제어 패키지의 범위 내 제품 목록을 사용하면 보안 관리자가 사용자의 액세스 권한을 Assured Workloads 폴더의 범위 내 제품으로만 제한하는 커스텀 역할을 만들 때 안내할 수 있습니다. 커스텀 역할은 Assured Workloads 폴더 내에서 규정 준수 동의를 얻고 유지할 수 있도록 지원합니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2024-12-21(UTC)"],[[["\u003cp\u003eIAM roles are essential for managing access to Assured Workloads resources, ensuring that users only have the permissions needed to interact with Google Cloud services.\u003c/p\u003e\n"],["\u003cp\u003eCreating an Assured Workloads folder requires specific roles, such as the Assured Workloads Administrator (\u003ccode\u003eroles/assuredworkloads.admin\u003c/code\u003e), along with a Cloud Billing access control role and an active billing account.\u003c/p\u003e\n"],["\u003cp\u003eAssured Workloads provides predefined roles like \u003ccode\u003eroles/assuredworkloads.admin\u003c/code\u003e, \u003ccode\u003eroles/assuredworkloads.editor\u003c/code\u003e, and \u003ccode\u003eroles/assuredworkloads.reader\u003c/code\u003e, which offer varying levels of read and write access to Assured Workloads folders.\u003c/p\u003e\n"],["\u003cp\u003eCustom roles can be defined to bundle specific permissions, allowing for granular control over access within Assured Workloads, and adherence to the principle of least privilege.\u003c/p\u003e\n"],["\u003cp\u003eProperly securing IAM roles by following the principle of least privilege, limiting users to only in-scope products within the Assured Workloads folder, is a critical security best practice.\u003c/p\u003e\n"]]],[],null,["# IAM roles\n=========\n\nThis page describes the Identity and Access Management (IAM) roles you can use to\nconfigure Assured Workloads. Roles limit a principal's ability to\naccess resources. Only grant a principal the permissions it needs in order to\ninteract with applicable Google Cloud APIs, features, or resources.\n\nTo be able to create an Assured Workloads folder, you must be assigned\none of the roles listed below with that ability, as well as a Cloud Billing\naccess control role. You must also have an active, valid billing account. For\nmore information, see\n[Overview of Cloud Billing access control](/billing/docs/how-to/billing-access).\n\nRequired roles\n--------------\n\nFollowing are the minimum required Assured Workloads-related roles. To\nlearn how to grant, change, or revoke access to resources using\nIAM roles, see\n[Granting, changing, and revoking access to resources](/iam/docs/granting-changing-revoking-access).\n\n- **Assured Workloads Administrator (`roles/assuredworkloads.admin`):** For creating and deleting Assured Workloads folders.\n- **Resource Manager Organization Viewer (`roles/resourcemanager.organizationViewer`):** Access to view all resources belonging to an organization.\n\n| **Note:** To be able to assign roles, you must have the `resourcemanager.organizations.setIamPolicy` permission. This permission is included in the Organization Administrator role (`resourcemanager.organizationAdmin`). To learn more, see [Using predefined roles](/resource-manager/docs/access-control-org#using_predefined_roles).\n\nAssured Workloads roles\n-----------------------\n\nFollowing are the IAM roles that are associated with\nAssured Workloads, and how to grant these roles using the\nGoogle Cloud CLI. To learn how to grant these roles in the\nGoogle Cloud console or programmatically, see\n[Granting, changing, and revoking access to resources](/iam/docs/granting-changing-revoking-access)\nin the IAM documentation.\n\nReplace the \u003cvar translate=\"no\"\u003eORGANIZATION_ID\u003c/var\u003e placeholder with the actual organization\nidentifier and `example@customer.org` with the user email address. To retrieve\nyour organization ID, see\n[Retrieving your organization ID](/resource-manager/docs/creating-managing-organization#retrieving_your_organization_id).\n\n### `roles/assuredworkloads.admin`\n\nFor creating and deleting Assured Workloads folders. Allows read-write\naccess. \n\n```\ngcloud organizations add-iam-policy-binding ORGANIZATION_ID \\\n --member=\"user:example@customer.org\" \\\n --role=\"roles/assuredworkloads.admin\"\n```\n\n### `roles/assuredworkloads.editor`\n\nAllows read-write access. \n\n```\ngcloud organizations add-iam-policy-binding ORGANIZATION_ID \\\n --member=\"user:example@customer.org\" \\\n --role=\"roles/assuredworkloads.editor\"\n```\n\n### `roles/assuredworkloads.reader`\n\nFor getting and listing Assured Workloads folders. Allows read-only\naccess. \n\n```\ngcloud organizations add-iam-policy-binding ORGANIZATION_ID \\\n --member=\"user:example@customer.org\" \\\n --role=\"roles/assuredworkloads.reader\"\n```\n\nCustom roles\n------------\n\nIf you want to define your own roles to contain bundles of permissions that\nyou specify, use [custom roles](/iam/docs/creating-custom-roles).\n\nAssured Workloads IAM best practices\n------------------------------------\n\nProperly securing IAM roles to follow\n[least privilege](/iam/docs/using-iam-securely) is a Google Cloud security\nbest practice. This principle follows the rule that users should only have\naccess to the products, services, and applications required by their role. Users\nare not currently restricted from using out-of-scope services with\nAssured Workloads projects when deploying products and services outside\nof an Assured Workloads folder.\n\nThe\n[list of in-scope products by control package](/assured-workloads/docs/supported-products)\nhelps to guide security admins when creating\n[custom roles](/iam/docs/understanding-custom-roles) that limit user access to\nonly in-scope products within the Assured Workloads folder. Custom\nroles are able to help support obtaining and maintaining compliance within an\nAssured Workloads folder."]]
