使用 IAM 控制对备份和灾难恢复服务的访问权限

本页面简要介绍了Google Cloud 备份和灾难恢复服务所需的 IAM 角色和权限。向项目添加新主账号时，您可以使用 Identity and Access Management (IAM) 政策为该主账号授予一个或多个 IAM 角色。每个 IAM 角色都包含授予主账号对特定资源执行特定操作的权限。如需查看适用于 Backup and DR Service 的 IAM 权限的参考列表，请参阅 Backup and DR Service 的 IAM 权限。

IAM 如何控制访问权限

如果主账号（用户、群组或服务账号）调用 Google Cloud API，该主账号必须具有适当的 IAM 权限才能使用资源。如需向主账号授予所需的权限，您可以向主账号授予 IAM 角色。详细了解 IAM 中的主账号。

IAM 角色类型

Backup and DR Service 具有预定义角色，这些角色包含捆绑的权限，可分配给不同的正文。用户还可以定义自定义角色，该角色可以包含多种单独的权限，以便授予执行特定备份和灾难恢复工作流或操作的访问权限。

IAM 权限

有了权限，用户便可对特定资源执行特定操作。它们可以组合成角色。每项权限都指用户可以执行或访问的特定操作。

项目级权限与资源级权限

您可以在项目级或资源级授予权限。例如，Backup and DR 管理员可以根据其政策，选择仅在存储桶一级（而非整个项目）授予特定权限。在资源级层授予角色时，不会影响您当前在项目级层授予的任何角色，反之亦然。

适用于备份和灾难恢复服务的预定义 IAM 角色

备份和灾难恢复服务具有一组预定义的 IAM 角色，本页对这些角色进行了说明。您还可以创建自定义角色，这些角色包含的权限子集直接对应于您的需要。

下表介绍了与备份和灾难恢复服务相关联的 IAM 角色，并列出了每个角色中包含的权限。每个权限的说明列在备份和灾难恢复服务的 IAM 权限部分中。

Role	Permissions
Backup and DR Admin (roles/backupdr.admin) Provides full access to all Backup and DR resources.	backupdr.backupPlanAssociations.* backupdr.backupPlanAssociations.createForComputeInstance backupdr.backupPlanAssociations.deleteForComputeInstance backupdr.backupPlanAssociations.get backupdr.backupPlanAssociations.list backupdr.backupPlanAssociations.triggerBackupForComputeInstance backupdr.backupPlans.* backupdr.backupPlans.create backupdr.backupPlans.delete backupdr.backupPlans.get backupdr.backupPlans.list backupdr.backupPlans.useForComputeInstance backupdr.backupVaults.* backupdr.backupVaults.associate backupdr.backupVaults.create backupdr.backupVaults.delete backupdr.backupVaults.get backupdr.backupVaults.list backupdr.backupVaults.update backupdr.bvbackups.* backupdr.bvbackups.delete backupdr.bvbackups.get backupdr.bvbackups.list backupdr.bvbackups.restore backupdr.bvbackups.update backupdr.bvdataSources.* backupdr.bvdataSources.abandonBackup backupdr.bvdataSources.fetchAccessToken backupdr.bvdataSources.finalizeBackup backupdr.bvdataSources.get backupdr.bvdataSources.initiateBackup backupdr.bvdataSources.list backupdr.bvdataSources.remove backupdr.bvdataSources.setInternalStatus backupdr.bvdataSources.update backupdr.compute.restoreFromBackupVault backupdr.locations.* backupdr.locations.get backupdr.locations.list backupdr.managementServers.* backupdr.managementServers.access backupdr.managementServers.accessSensitiveData backupdr.managementServers.assignBackupPlans backupdr.managementServers.backupAccess backupdr.managementServers.create backupdr.managementServers.createConnection backupdr.managementServers.createDynamicProtection backupdr.managementServers.delete backupdr.managementServers.deleteDynamicProtection backupdr.managementServers.get backupdr.managementServers.getDynamicProtection backupdr.managementServers.getIamPolicy backupdr.managementServers.list backupdr.managementServers.listDynamicProtection backupdr.managementServers.manageApplications backupdr.managementServers.manageBackupPlans backupdr.managementServers.manageBackupServers backupdr.managementServers.manageBackups backupdr.managementServers.manageClones backupdr.managementServers.manageExpiration backupdr.managementServers.manageHosts backupdr.managementServers.manageInternalACL backupdr.managementServers.manageJobs backupdr.managementServers.manageLiveClones backupdr.managementServers.manageMigrations backupdr.managementServers.manageMirroring backupdr.managementServers.manageMounts backupdr.managementServers.manageRestores backupdr.managementServers.manageSensitiveData backupdr.managementServers.manageStorage backupdr.managementServers.manageSystem backupdr.managementServers.manageWorkflows backupdr.managementServers.refreshWorkflows backupdr.managementServers.runWorkflows backupdr.managementServers.setIamPolicy backupdr.managementServers.testFailOvers backupdr.managementServers.viewBackupPlans backupdr.managementServers.viewBackupServers backupdr.managementServers.viewReports backupdr.managementServers.viewStorage backupdr.managementServers.viewSystem backupdr.managementServers.viewWorkflows backupdr.operations.* backupdr.operations.cancel backupdr.operations.delete backupdr.operations.get backupdr.operations.list backupdr.serviceConfig.initialize resourcemanager.projects.get resourcemanager.projects.list
Backup and DR Backup Config Viewer ^Beta (roles/backupdr.backupConfigViewer) Provides read access to resource backup config. Resource backup config has the metadata of a Google Cloud resource that can be backed up, along with its backup configurations.	backupdr.resourceBackupConfigs.* backupdr.resourceBackupConfigs.get backupdr.resourceBackupConfigs.list
Backup and DR Backup User (roles/backupdr.backupUser) Allows the user to apply existing backup plans. This role cannot create backup plans or restore from a backup.	backupdr.backupPlanAssociations.* backupdr.backupPlanAssociations.createForComputeInstance backupdr.backupPlanAssociations.deleteForComputeInstance backupdr.backupPlanAssociations.get backupdr.backupPlanAssociations.list backupdr.backupPlanAssociations.triggerBackupForComputeInstance backupdr.backupPlans.get backupdr.backupPlans.list backupdr.backupPlans.useForComputeInstance backupdr.backupVaults.get backupdr.backupVaults.list backupdr.bvbackups.get backupdr.bvbackups.list backupdr.bvdataSources.get backupdr.bvdataSources.list backupdr.locations.* backupdr.locations.get backupdr.locations.list backupdr.managementServers.access backupdr.managementServers.assignBackupPlans backupdr.managementServers.createDynamicProtection backupdr.managementServers.deleteDynamicProtection backupdr.managementServers.get backupdr.managementServers.getDynamicProtection backupdr.managementServers.list backupdr.managementServers.listDynamicProtection backupdr.managementServers.manageApplications backupdr.managementServers.manageBackups backupdr.managementServers.manageHosts backupdr.managementServers.viewBackupPlans backupdr.managementServers.viewReports backupdr.managementServers.viewStorage backupdr.managementServers.viewSystem backupdr.operations.get backupdr.operations.list resourcemanager.projects.get resourcemanager.projects.list
Backup and DR Backup Vault Accessor (roles/backupdr.backupvaultAccessor) Allows the Backup Appliance permissions to create and manage backups in a backup vault.	backupdr.backupVaults.get backupdr.backupVaults.list backupdr.bvbackups.delete backupdr.bvbackups.get backupdr.bvbackups.list backupdr.bvbackups.update backupdr.bvdataSources.* backupdr.bvdataSources.abandonBackup backupdr.bvdataSources.fetchAccessToken backupdr.bvdataSources.finalizeBackup backupdr.bvdataSources.get backupdr.bvdataSources.initiateBackup backupdr.bvdataSources.list backupdr.bvdataSources.remove backupdr.bvdataSources.setInternalStatus backupdr.bvdataSources.update backupdr.operations.* backupdr.operations.cancel backupdr.operations.delete backupdr.operations.get backupdr.operations.list
Backup and DR Backup Vault Admin (roles/backupdr.backupvaultAdmin) Allows the Backup Appliance full administrative control of backup vault resources.	backupdr.backupVaults.* backupdr.backupVaults.associate backupdr.backupVaults.create backupdr.backupVaults.delete backupdr.backupVaults.get backupdr.backupVaults.list backupdr.backupVaults.update backupdr.bvbackups.* backupdr.bvbackups.delete backupdr.bvbackups.get backupdr.bvbackups.list backupdr.bvbackups.restore backupdr.bvbackups.update backupdr.bvdataSources.get backupdr.bvdataSources.list backupdr.bvdataSources.update backupdr.compute.restoreFromBackupVault backupdr.locations.* backupdr.locations.get backupdr.locations.list backupdr.operations.* backupdr.operations.cancel backupdr.operations.delete backupdr.operations.get backupdr.operations.list
Backup and DR Backup Vault Lister (roles/backupdr.backupvaultLister) Allows the Backup Appliance permission to list backup vaults in a given project.	backupdr.backupVaults.list
Backup and DR Backup Vault Viewer (roles/backupdr.backupvaultViewer) Allows read-only permissions to access backup vault resources and backups.	backupdr.backupVaults.get backupdr.backupVaults.list backupdr.bvbackups.get backupdr.bvbackups.list backupdr.bvdataSources.get backupdr.bvdataSources.list backupdr.operations.get backupdr.operations.list
Backup and DR Cloud Storage Operator (roles/backupdr.cloudStorageOperator) Allows a Backup and DR service account to store and manage data (backups or metadata) in Cloud Storage.	storage.buckets.create storage.buckets.get storage.objects.create storage.objects.delete storage.objects.get storage.objects.list
Backup and DR Compute Engine Operator (roles/backupdr.computeEngineOperator) Allows a Backup and DR service account to discover, back up, and restore Compute Engine VM instances.	backupdr.managementServers.createConnection compute.addresses.list compute.addresses.use compute.addresses.useInternal compute.diskTypes.* compute.diskTypes.get compute.diskTypes.list compute.disks.create compute.disks.createSnapshot compute.disks.delete compute.disks.get compute.disks.setLabels compute.disks.use compute.firewalls.list compute.globalOperations.get compute.images.create compute.images.delete compute.images.get compute.images.useReadOnly compute.instances.attachDisk compute.instances.create compute.instances.createTagBinding compute.instances.delete compute.instances.detachDisk compute.instances.get compute.instances.list compute.instances.listEffectiveTags compute.instances.pscInterfaceCreate compute.instances.setDeletionProtection compute.instances.setLabels compute.instances.setMetadata compute.instances.setServiceAccount compute.instances.setTags compute.instances.start compute.instances.stop compute.instances.updateDisplayDevice compute.instances.useReadOnly compute.machineTypes.* compute.machineTypes.get compute.machineTypes.list compute.networks.list compute.nodeGroups.get compute.nodeGroups.list compute.nodeTemplates.get compute.projects.get compute.regionOperations.get compute.regions.* compute.regions.get compute.regions.list compute.resourcePolicies.use compute.snapshots.create compute.snapshots.delete compute.snapshots.get compute.snapshots.setLabels compute.snapshots.useReadOnly compute.subnetworks.list compute.subnetworks.use compute.subnetworks.useExternalIp compute.zoneOperations.get compute.zones.list iam.serviceAccounts.actAs iam.serviceAccounts.get iam.serviceAccounts.list resourcemanager.projects.get resourcemanager.projects.list
Backup and DR Management Server Accessor ^Beta (roles/backupdr.managementServerAccessor) Grants the Backup and DR management server access role to Backup Appliances.	backupdr.managementServers.createConnection
Backup and DR Mount User (roles/backupdr.mountUser) Allows the user to mount from a backup. This role cannot create a backup plan or restore from a backup.	backupdr.locations.* backupdr.locations.get backupdr.locations.list backupdr.managementServers.access backupdr.managementServers.get backupdr.managementServers.getDynamicProtection backupdr.managementServers.list backupdr.managementServers.listDynamicProtection backupdr.managementServers.manageApplications backupdr.managementServers.manageClones backupdr.managementServers.manageHosts backupdr.managementServers.manageLiveClones backupdr.managementServers.manageMirroring backupdr.managementServers.manageMounts backupdr.managementServers.manageWorkflows backupdr.managementServers.refreshWorkflows backupdr.managementServers.runWorkflows backupdr.managementServers.viewBackupPlans backupdr.managementServers.viewReports backupdr.managementServers.viewStorage backupdr.managementServers.viewSystem backupdr.managementServers.viewWorkflows backupdr.operations.get backupdr.operations.list resourcemanager.projects.get resourcemanager.projects.list
Backup and DR Restore User (roles/backupdr.restoreUser) Allows the user to restore or mount from a backup. This role cannot create a backup plan.	backupdr.backupVaults.get backupdr.backupVaults.list backupdr.bvbackups.get backupdr.bvbackups.list backupdr.bvbackups.restore backupdr.bvdataSources.get backupdr.bvdataSources.list backupdr.compute.restoreFromBackupVault backupdr.locations.* backupdr.locations.get backupdr.locations.list backupdr.managementServers.access backupdr.managementServers.get backupdr.managementServers.getDynamicProtection backupdr.managementServers.list backupdr.managementServers.listDynamicProtection backupdr.managementServers.manageApplications backupdr.managementServers.manageClones backupdr.managementServers.manageHosts backupdr.managementServers.manageLiveClones backupdr.managementServers.manageMigrations backupdr.managementServers.manageMirroring backupdr.managementServers.manageMounts backupdr.managementServers.manageRestores backupdr.managementServers.manageWorkflows backupdr.managementServers.refreshWorkflows backupdr.managementServers.runWorkflows backupdr.managementServers.testFailOvers backupdr.managementServers.viewBackupPlans backupdr.managementServers.viewReports backupdr.managementServers.viewStorage backupdr.managementServers.viewSystem backupdr.managementServers.viewWorkflows backupdr.operations.get backupdr.operations.list resourcemanager.projects.get resourcemanager.projects.list
Backup and DR User (roles/backupdr.user) Provides access to management console. Granular Backup and DR permissions depend on ACL configuration provided by Backup and DR admin within the management console.	backupdr.backupPlanAssociations.createForComputeInstance backupdr.backupPlanAssociations.deleteForComputeInstance backupdr.managementServers.access backupdr.managementServers.backupAccess backupdr.managementServers.get backupdr.managementServers.getDynamicProtection backupdr.managementServers.getIamPolicy backupdr.managementServers.list backupdr.managementServers.listDynamicProtection backupdr.managementServers.viewBackupPlans backupdr.managementServers.viewBackupServers backupdr.managementServers.viewReports backupdr.managementServers.viewStorage backupdr.managementServers.viewSystem backupdr.managementServers.viewWorkflows backupdr.operations.get backupdr.operations.list resourcemanager.projects.get resourcemanager.projects.list
Backup and DR User V2 (roles/backupdr.userv2) Provides full access to Backup and DR resources except deploying and managing backup infrastructure, expiring backups, changing data sensitivity and configuring on-premises billing.	backupdr.backupPlanAssociations.* backupdr.backupPlanAssociations.createForComputeInstance backupdr.backupPlanAssociations.deleteForComputeInstance backupdr.backupPlanAssociations.get backupdr.backupPlanAssociations.list backupdr.backupPlanAssociations.triggerBackupForComputeInstance backupdr.backupPlans.* backupdr.backupPlans.create backupdr.backupPlans.delete backupdr.backupPlans.get backupdr.backupPlans.list backupdr.backupPlans.useForComputeInstance backupdr.backupVaults.associate backupdr.backupVaults.get backupdr.backupVaults.list backupdr.bvbackups.get backupdr.bvbackups.list backupdr.bvbackups.restore backupdr.bvdataSources.get backupdr.bvdataSources.list backupdr.compute.restoreFromBackupVault backupdr.locations.* backupdr.locations.get backupdr.locations.list backupdr.managementServers.access backupdr.managementServers.assignBackupPlans backupdr.managementServers.backupAccess backupdr.managementServers.createDynamicProtection backupdr.managementServers.deleteDynamicProtection backupdr.managementServers.get backupdr.managementServers.getDynamicProtection backupdr.managementServers.getIamPolicy backupdr.managementServers.list backupdr.managementServers.listDynamicProtection backupdr.managementServers.manageApplications backupdr.managementServers.manageBackupPlans backupdr.managementServers.manageBackups backupdr.managementServers.manageClones backupdr.managementServers.manageHosts backupdr.managementServers.manageJobs backupdr.managementServers.manageLiveClones backupdr.managementServers.manageMigrations backupdr.managementServers.manageMirroring backupdr.managementServers.manageMounts backupdr.managementServers.manageRestores backupdr.managementServers.manageWorkflows backupdr.managementServers.refreshWorkflows backupdr.managementServers.runWorkflows backupdr.managementServers.testFailOvers backupdr.managementServers.viewBackupPlans backupdr.managementServers.viewBackupServers backupdr.managementServers.viewReports backupdr.managementServers.viewStorage backupdr.managementServers.viewSystem backupdr.managementServers.viewWorkflows backupdr.operations.get backupdr.operations.list resourcemanager.projects.get resourcemanager.projects.list
Backup and DR Viewer (roles/backupdr.viewer) Provides read-only access to all Backup and DR resources.	backupdr.backupPlanAssociations.get backupdr.backupPlanAssociations.list backupdr.backupPlans.get backupdr.backupPlans.list backupdr.backupVaults.get backupdr.backupVaults.list backupdr.bvbackups.get backupdr.bvbackups.list backupdr.bvdataSources.get backupdr.bvdataSources.list backupdr.locations.* backupdr.locations.get backupdr.locations.list backupdr.managementServers.access backupdr.managementServers.backupAccess backupdr.managementServers.get backupdr.managementServers.getDynamicProtection backupdr.managementServers.getIamPolicy backupdr.managementServers.list backupdr.managementServers.listDynamicProtection backupdr.managementServers.viewBackupPlans backupdr.managementServers.viewBackupServers backupdr.managementServers.viewReports backupdr.managementServers.viewStorage backupdr.managementServers.viewSystem backupdr.managementServers.viewWorkflows backupdr.operations.get backupdr.operations.list resourcemanager.projects.get resourcemanager.projects.list

基本角色

基本角色是指在引入 IAM 之前的项目级层角色。如需了解详情，请参阅基本角色。

虽然备份和灾难恢复支持以下基本角色，但您应尽可能使用预定义角色之一。基本角色包括适用于您的所有 Google Cloud 资源的广泛权限；与此相对，备份和灾难恢复的预定义角色则包括仅适用于备份和灾难恢复的精细权限。

基本 IAM 角色	说明
编辑器 (roles/editor)	拥有对所有 Backup and DR 资源的完整权限。
Owner (roles/owner)	拥有对所有 Backup and DR 资源的完整权限。

Backup and DR Service 的 IAM 权限

下表列出了与备份和灾难恢复服务关联的 IAM 权限。IAM 权限分组为角色，然后您将角色分配给用户和群组。

下表列出了每项备份和灾难恢复权限的说明。

权限名称	说明
backupdr.managementServers.manageClones	提供从备份创建和管理克隆的权限。
backupdr.managementServers.manageLiveClones	提供从备份创建和管理 LiveClone 的权限。
backupdr.managementServers.manageMounts	提供使用备份创建和管理活跃挂载的权限。
backupdr.managementServers.manageRestores	提供使用备份进行恢复所需的权限。
backupdr.managementServers.manageBackups	提供执行备份操作的权限：立即备份。
backupdr.managementServers.viewSystem	提供查看备份/恢复设备配置的权限。
backupdr.managementServers.manageSystem	提供配置备份/恢复设备和报告管理器的权限。
backupdr.managementServers.viewStorage	提供查看存储空间和磁盘池配置的权限。
backupdr.managementServers.manageStorage	提供添加、修改、移除和查看存储空间和磁盘池的权限。
backupdr.managementServers.viewBackupPlans	提供查看备份方案（备份模板和资源配置文件）的权限。
backupdr.managementServers.assignBackupPlans	提供向应用或工作负载分配预配置备份方案（备份模板和资源配置文件）的权限。
backupdr.managementServers.manageBackupPlans	提供创建、修改、删除、查看和分配备份方案（备份模板和资源配置文件）的权限。
backupdr.managementServers.testFailOvers	提供在远程 StreamSnap 备份上执行测试故障切换和删除测试故障切换操作的权限。
backupdr.managementServers.viewWorkflows	提供查看备份 Backup and DR 工作流的权限，以便自动访问 Backup and DR Service 中的数据复制权限。
backupdr.managementServers.runWorkflows	提供运行预配置的备份和灾难恢复工作流的权限，以便自动访问备份和灾难恢复服务中的数据复制功能。
backupdr.managementServers.refreshWorkflows	提供刷新由备份 Backup and DR 工作流创建的克隆的权限，该工作流会自动访问 Backup and DR Service 中的数据副本。
backupdr.managementServers.manageWorkflows	提供添加、修改、移除、运行和查看备份 Backup and DR 工作流的权限，以便自动访问 Backup and DR Service 中的数据复制权限。
backupdr.managementServers.manageMirroring	提供对远程 StreamSnap 备份执行故障切换、同步回、清理、故障恢复、测试故障切换和删除测试故障切换操作的权限。
backupdr.managementServers.manageHosts	提供添加、修改、移除和查看主机（实体机器和虚拟机）的权限
backupdr.managementServers.manageApplications	提供管理应用的所有方面（包括逻辑组和一致性组）的权限，可按需运行备份以及导出模板。
backupdr.managementServers.manageSensitiveData	提供标记应用和备份为敏感数据或非敏感数据所需的权限。
backupdr.managementServers.accessSensitiveData	提供对标记为敏感的应用和备份的访问权限。
backupdr.managementServers.manageBackupServers	提供通过管理控制台执行备份服务器 API 所需的权限。
backupdr.managementServers.manageExpiration	提供使备份过期所需的权限。
backupdr.managementServers.access	提供对管理控制台和关联 API 的访问权限。
backupdr.managementServers.onpremUsageUpload	提供对将使用情况上传到本地适配器所需的所有端点的访问权限。
backupdr.managementServers.viewReports	提供对报告管理器的访问权限，以便运行报告并查看或下载输出。
backupdr.managementServers.manageJobs	提供取消作业和修改作业优先级的权限。
backupdr.managementServers.manageMigrations	提供权限，以便在恢复或克隆操作的最后一步中管理已挂载数据的迁移。