Configura IAM para la solución Bare Metal

Cuando deseas que un principal, como un usuario o una cuenta de servicio del proyecto de Google Cloud, obtenga acceso a los recursos en el entorno de la solución Bare Metal, debes otorgarle los roles y permisos adecuados. Para otorgar acceso, puedes crear una política de Identity and Access Management (IAM) y asignar roles predefinidos específicos a la solución Bare Metal.

Otorga roles con permisos suficientes para que tus principales puedan realizar su trabajo, pero no más, de modo que puedas seguir el principio de privilegio mínimo de seguridad de Google Cloud.

Funciones predefinidas para la solución Bare Metal

Cada función de IAM para la solución Bare Metal contiene permisos que otorgan al principal acceso a recursos específicos, como se muestra en la siguiente tabla.

Role	Permissions
Bare Metal Solution Admin (roles/baremetalsolution.admin) Administrator of Bare Metal Solution resources	baremetalsolution.instancequotas.list baremetalsolution.instances.* baremetalsolution.instances.attachNetwork baremetalsolution.instances.attachVolume baremetalsolution.instances.create baremetalsolution.instances.detachLun baremetalsolution.instances.detachNetwork baremetalsolution.instances.detachVolume baremetalsolution.instances.disableInteractiveSerialConsole baremetalsolution.instances.enableInteractiveSerialConsole baremetalsolution.instances.get baremetalsolution.instances.list baremetalsolution.instances.rename baremetalsolution.instances.reset baremetalsolution.instances.start baremetalsolution.instances.stop baremetalsolution.instances.update baremetalsolution.luns.* baremetalsolution.luns.create baremetalsolution.luns.delete baremetalsolution.luns.evict baremetalsolution.luns.get baremetalsolution.luns.list baremetalsolution.luns.update baremetalsolution.maintenanceevents.* baremetalsolution.maintenanceevents.addProposal baremetalsolution.maintenanceevents.approve baremetalsolution.maintenanceevents.get baremetalsolution.maintenanceevents.list baremetalsolution.networkquotas.list baremetalsolution.networks.* baremetalsolution.networks.create baremetalsolution.networks.delete baremetalsolution.networks.get baremetalsolution.networks.list baremetalsolution.networks.rename baremetalsolution.networks.update baremetalsolution.nfsshares.* baremetalsolution.nfsshares.create baremetalsolution.nfsshares.delete baremetalsolution.nfsshares.get baremetalsolution.nfsshares.list baremetalsolution.nfsshares.rename baremetalsolution.nfsshares.update baremetalsolution.operations.get baremetalsolution.osimages.list baremetalsolution.pods.list baremetalsolution.procurements.get baremetalsolution.procurements.list baremetalsolution.skus.list baremetalsolution.snapshotschedulepolicies.* baremetalsolution.snapshotschedulepolicies.create baremetalsolution.snapshotschedulepolicies.delete baremetalsolution.snapshotschedulepolicies.get baremetalsolution.snapshotschedulepolicies.list baremetalsolution.snapshotschedulepolicies.update baremetalsolution.sshKeys.* baremetalsolution.sshKeys.create baremetalsolution.sshKeys.delete baremetalsolution.sshKeys.list baremetalsolution.storageaggregatepools.list baremetalsolution.volumequotas.list baremetalsolution.volumes.* baremetalsolution.volumes.create baremetalsolution.volumes.delete baremetalsolution.volumes.evict baremetalsolution.volumes.get baremetalsolution.volumes.list baremetalsolution.volumes.rename baremetalsolution.volumes.resize baremetalsolution.volumes.update baremetalsolution.volumesnapshots.* baremetalsolution.volumesnapshots.create baremetalsolution.volumesnapshots.delete baremetalsolution.volumesnapshots.get baremetalsolution.volumesnapshots.list baremetalsolution.volumesnapshots.restore resourcemanager.projects.get resourcemanager.projects.list
Bare Metal Solution Editor (roles/baremetalsolution.editor) Editor of Bare Metal Solution resources	baremetalsolution.instancequotas.list baremetalsolution.instances.* baremetalsolution.instances.attachNetwork baremetalsolution.instances.attachVolume baremetalsolution.instances.create baremetalsolution.instances.detachLun baremetalsolution.instances.detachNetwork baremetalsolution.instances.detachVolume baremetalsolution.instances.disableInteractiveSerialConsole baremetalsolution.instances.enableInteractiveSerialConsole baremetalsolution.instances.get baremetalsolution.instances.list baremetalsolution.instances.rename baremetalsolution.instances.reset baremetalsolution.instances.start baremetalsolution.instances.stop baremetalsolution.instances.update baremetalsolution.luns.* baremetalsolution.luns.create baremetalsolution.luns.delete baremetalsolution.luns.evict baremetalsolution.luns.get baremetalsolution.luns.list baremetalsolution.luns.update baremetalsolution.maintenanceevents.* baremetalsolution.maintenanceevents.addProposal baremetalsolution.maintenanceevents.approve baremetalsolution.maintenanceevents.get baremetalsolution.maintenanceevents.list baremetalsolution.networkquotas.list baremetalsolution.networks.* baremetalsolution.networks.create baremetalsolution.networks.delete baremetalsolution.networks.get baremetalsolution.networks.list baremetalsolution.networks.rename baremetalsolution.networks.update baremetalsolution.nfsshares.* baremetalsolution.nfsshares.create baremetalsolution.nfsshares.delete baremetalsolution.nfsshares.get baremetalsolution.nfsshares.list baremetalsolution.nfsshares.rename baremetalsolution.nfsshares.update baremetalsolution.operations.get baremetalsolution.osimages.list baremetalsolution.pods.list baremetalsolution.procurements.get baremetalsolution.procurements.list baremetalsolution.skus.list baremetalsolution.snapshotschedulepolicies.* baremetalsolution.snapshotschedulepolicies.create baremetalsolution.snapshotschedulepolicies.delete baremetalsolution.snapshotschedulepolicies.get baremetalsolution.snapshotschedulepolicies.list baremetalsolution.snapshotschedulepolicies.update baremetalsolution.sshKeys.* baremetalsolution.sshKeys.create baremetalsolution.sshKeys.delete baremetalsolution.sshKeys.list baremetalsolution.storageaggregatepools.list baremetalsolution.volumequotas.list baremetalsolution.volumes.* baremetalsolution.volumes.create baremetalsolution.volumes.delete baremetalsolution.volumes.evict baremetalsolution.volumes.get baremetalsolution.volumes.list baremetalsolution.volumes.rename baremetalsolution.volumes.resize baremetalsolution.volumes.update baremetalsolution.volumesnapshots.* baremetalsolution.volumesnapshots.create baremetalsolution.volumesnapshots.delete baremetalsolution.volumesnapshots.get baremetalsolution.volumesnapshots.list baremetalsolution.volumesnapshots.restore resourcemanager.projects.get resourcemanager.projects.list
Bare Metal Solution Instances Admin (roles/baremetalsolution.instancesadmin) Admin of Bare Metal Solution Instance resources	baremetalsolution.instances.* baremetalsolution.instances.attachNetwork baremetalsolution.instances.attachVolume baremetalsolution.instances.create baremetalsolution.instances.detachLun baremetalsolution.instances.detachNetwork baremetalsolution.instances.detachVolume baremetalsolution.instances.disableInteractiveSerialConsole baremetalsolution.instances.enableInteractiveSerialConsole baremetalsolution.instances.get baremetalsolution.instances.list baremetalsolution.instances.rename baremetalsolution.instances.reset baremetalsolution.instances.start baremetalsolution.instances.stop baremetalsolution.instances.update baremetalsolution.operations.get baremetalsolution.osimages.list baremetalsolution.pods.list resourcemanager.projects.get resourcemanager.projects.list
Bare Metal Solution Instances Viewer (roles/baremetalsolution.instancesviewer) Viewer of Bare Metal Solution Instance resources	baremetalsolution.instancequotas.list baremetalsolution.instances.get baremetalsolution.instances.list baremetalsolution.operations.get resourcemanager.projects.get resourcemanager.projects.list
Luns Admin (roles/baremetalsolution.lunsadmin) Administrator of Bare Metal Solution Lun resources	baremetalsolution.luns.get baremetalsolution.luns.list baremetalsolution.operations.get
Luns Viewer (roles/baremetalsolution.lunsviewer) Viewer of Bare Metal Solution Lun resources	baremetalsolution.luns.get baremetalsolution.luns.list baremetalsolution.operations.get
Maintenance Events Admin (roles/baremetalsolution.maintenanceeventsadmin) Administrator of Bare Metal Solution maintenance events resources	baremetalsolution.maintenanceevents.* baremetalsolution.maintenanceevents.addProposal baremetalsolution.maintenanceevents.approve baremetalsolution.maintenanceevents.get baremetalsolution.maintenanceevents.list
Maintenance Events Editor (roles/baremetalsolution.maintenanceeventseditor) Editor of Bare Metal Solution maintenance events resources	baremetalsolution.maintenanceevents.* baremetalsolution.maintenanceevents.addProposal baremetalsolution.maintenanceevents.approve baremetalsolution.maintenanceevents.get baremetalsolution.maintenanceevents.list
Maintenance Events Viewer (roles/baremetalsolution.maintenanceeventsviewer) Viewer of Bare Metal Solution maintenance events resources	baremetalsolution.maintenanceevents.get baremetalsolution.maintenanceevents.list
Networks Admin (roles/baremetalsolution.networksadmin) Admin of Bare Metal Solution networks resources	baremetalsolution.networkquotas.list baremetalsolution.networks.* baremetalsolution.networks.create baremetalsolution.networks.delete baremetalsolution.networks.get baremetalsolution.networks.list baremetalsolution.networks.rename baremetalsolution.networks.update baremetalsolution.operations.get baremetalsolution.pods.list
NFS Shares Admin (roles/baremetalsolution.nfssharesadmin) Administrator of Bare Metal Solution NFS Share resources	baremetalsolution.nfsshares.* baremetalsolution.nfsshares.create baremetalsolution.nfsshares.delete baremetalsolution.nfsshares.get baremetalsolution.nfsshares.list baremetalsolution.nfsshares.rename baremetalsolution.nfsshares.update baremetalsolution.operations.get baremetalsolution.pods.list
NFS Shares Editor (roles/baremetalsolution.nfsshareseditor) Editor of Bare Metal Solution NFS Share resources	baremetalsolution.nfsshares.* baremetalsolution.nfsshares.create baremetalsolution.nfsshares.delete baremetalsolution.nfsshares.get baremetalsolution.nfsshares.list baremetalsolution.nfsshares.rename baremetalsolution.nfsshares.update baremetalsolution.operations.get baremetalsolution.pods.list
NFS Shares Viewer (roles/baremetalsolution.nfssharesviewer) Viewer of Bare Metal Solution NFS Share resources	baremetalsolution.nfsshares.get baremetalsolution.nfsshares.list baremetalsolution.operations.get
OS Images Viewer (roles/baremetalsolution.osimagesviewer) Viewer of Bare Metal Solution OS images resources	baremetalsolution.osimages.list
Bare Metal Solution Procurements Admin (roles/baremetalsolution.procurementsadmin) Administrator of Bare Metal Solution Procurements	baremetalsolution.pods.list baremetalsolution.procurements.* baremetalsolution.procurements.create baremetalsolution.procurements.get baremetalsolution.procurements.list baremetalsolution.skus.list
Bare Metal Solution Procurements Editor (roles/baremetalsolution.procurementseditor) Editor of Bare Metal Solution Procurements	baremetalsolution.pods.list baremetalsolution.procurements.* baremetalsolution.procurements.create baremetalsolution.procurements.get baremetalsolution.procurements.list baremetalsolution.skus.list
Bare Metal Solution Procurements Viewer (roles/baremetalsolution.procurementsviewer) Viewer of Bare Metal Solution Procurements	baremetalsolution.procurements.get baremetalsolution.procurements.list baremetalsolution.skus.list
Bare Metal Solution Storage Admin (roles/baremetalsolution.storageadmin) Administrator of Bare Metal Solution storage resources	baremetalsolution.luns.* baremetalsolution.luns.create baremetalsolution.luns.delete baremetalsolution.luns.evict baremetalsolution.luns.get baremetalsolution.luns.list baremetalsolution.luns.update baremetalsolution.nfsshares.* baremetalsolution.nfsshares.create baremetalsolution.nfsshares.delete baremetalsolution.nfsshares.get baremetalsolution.nfsshares.list baremetalsolution.nfsshares.rename baremetalsolution.nfsshares.update baremetalsolution.operations.get baremetalsolution.pods.list baremetalsolution.snapshotschedulepolicies.* baremetalsolution.snapshotschedulepolicies.create baremetalsolution.snapshotschedulepolicies.delete baremetalsolution.snapshotschedulepolicies.get baremetalsolution.snapshotschedulepolicies.list baremetalsolution.snapshotschedulepolicies.update baremetalsolution.storageaggregatepools.list baremetalsolution.volumequotas.list baremetalsolution.volumes.* baremetalsolution.volumes.create baremetalsolution.volumes.delete baremetalsolution.volumes.evict baremetalsolution.volumes.get baremetalsolution.volumes.list baremetalsolution.volumes.rename baremetalsolution.volumes.resize baremetalsolution.volumes.update baremetalsolution.volumesnapshots.* baremetalsolution.volumesnapshots.create baremetalsolution.volumesnapshots.delete baremetalsolution.volumesnapshots.get baremetalsolution.volumesnapshots.list baremetalsolution.volumesnapshots.restore resourcemanager.projects.get resourcemanager.projects.list
Bare Metal Solution Viewer (roles/baremetalsolution.viewer) Viewer of Bare Metal Solution resources	baremetalsolution.instancequotas.list baremetalsolution.instances.get baremetalsolution.instances.list baremetalsolution.luns.get baremetalsolution.luns.list baremetalsolution.maintenanceevents.get baremetalsolution.maintenanceevents.list baremetalsolution.networkquotas.list baremetalsolution.networks.get baremetalsolution.networks.list baremetalsolution.nfsshares.get baremetalsolution.nfsshares.list baremetalsolution.operations.get baremetalsolution.osimages.list baremetalsolution.pods.list baremetalsolution.procurements.get baremetalsolution.procurements.list baremetalsolution.skus.list baremetalsolution.snapshotschedulepolicies.get baremetalsolution.snapshotschedulepolicies.list baremetalsolution.sshKeys.list baremetalsolution.storageaggregatepools.list baremetalsolution.volumequotas.list baremetalsolution.volumes.get baremetalsolution.volumes.list baremetalsolution.volumesnapshots.get baremetalsolution.volumesnapshots.list resourcemanager.projects.get resourcemanager.projects.list
Volume Admin (roles/baremetalsolution.volumesadmin) Administrator of Bare Metal Solution volume resources	baremetalsolution.operations.get baremetalsolution.pods.list baremetalsolution.volumes.* baremetalsolution.volumes.create baremetalsolution.volumes.delete baremetalsolution.volumes.evict baremetalsolution.volumes.get baremetalsolution.volumes.list baremetalsolution.volumes.rename baremetalsolution.volumes.resize baremetalsolution.volumes.update
Volumes Editor (roles/baremetalsolution.volumeseditor) Editor of Bare Metal Solution volumes resources	baremetalsolution.operations.get baremetalsolution.pods.list baremetalsolution.volumequotas.list baremetalsolution.volumes.create baremetalsolution.volumes.delete baremetalsolution.volumes.get baremetalsolution.volumes.list baremetalsolution.volumes.rename baremetalsolution.volumes.resize baremetalsolution.volumes.update
Snapshots Admin (roles/baremetalsolution.volumesnapshotsadmin) Administrator of Bare Metal Solution snapshots resources	baremetalsolution.operations.get baremetalsolution.volumesnapshots.* baremetalsolution.volumesnapshots.create baremetalsolution.volumesnapshots.delete baremetalsolution.volumesnapshots.get baremetalsolution.volumesnapshots.list baremetalsolution.volumesnapshots.restore
Snapshots Editor (roles/baremetalsolution.volumesnapshotseditor) Editor of Bare Metal Solution snapshots resources	baremetalsolution.operations.get baremetalsolution.volumesnapshots.create baremetalsolution.volumesnapshots.delete baremetalsolution.volumesnapshots.get baremetalsolution.volumesnapshots.list
Snapshots Viewer (roles/baremetalsolution.volumesnapshotsviewer) Viewer of Bare Metal Solution snapshots resources	baremetalsolution.operations.get baremetalsolution.volumesnapshots.get baremetalsolution.volumesnapshots.list
Volumes Viewer (roles/baremetalsolution.volumessviewer) Viewer of Bare Metal Solution volumes resources	baremetalsolution.operations.get baremetalsolution.volumes.get baremetalsolution.volumes.list

Te recomendamos que apliques los roles de la siguiente manera:

• Completa un formulario de admisión

  • Funciones de la solución Bare Metal: administrador, editor o administrador de instancias Y visualizador de red de Compute
  • Roles básicos: propietario o editor

• Reinicia un servidor de la solución Bare Metal

  • Funciones de la solución Bare Metal: administrador o editor
  • Roles básicos: propietario o editor

• Muestra una lista de servidores o solicita un estado

  • Funciones de la solución Bare Metal: Visualizador o visualizador de instancias
  • Función básica: Visualizador

• Administra componentes de almacenamiento

  • Roles de la solución Bare Metal: administrador, editor o administrador de almacenamiento
  • Roles básicos: propietario o editor

• Administra componentes de herramientas de redes

  • Roles de la solución Bare Metal: administrador, editor o administrador de redes
  • Roles básicos: propietario o editor

Para obtener una lista completa de los roles de solución Bare Metal, consulta Roles predefinidos y, luego, ingresa baremetalsolution. en el cuadro de búsqueda.

Para obtener una lista completa de los permisos de la solución Bare Metal, consulta Cómo buscar un permiso y, luego, ingresa baremetalsolution. en el cuadro de búsqueda.

Otorga una función de IAM

Agrega una política de IAM para asignar un rol de solución Bare Metal a un principal. El rol contiene permisos que permiten que la cuenta principal realice ciertas acciones. Para otorgar una función:

Console

1. Asegúrate de tener una función que contenga los permisos de IAM adecuados para asignar funciones a otros, comopropietario, Administrador de IAM de proyecto o Administrador de seguridad. Para obtener más información sobre este requisito, consulta Roles requeridos.

2. En la consola de Google Cloud, ve a la página de permisos de IAM.

   Ir a IAM

3. Haz clic en Otorgar acceso.

4. Ingresa la siguiente información:

   • En Agregar principales, ingresa a tus usuarios. Puedes agregar usuarios individuales, Grupos de Google, cuentas de servicio o dominios de Google Workspace.

   • En Asignar roles, elige un rol del menú Seleccionar un rol para otorgarlo a los principales.

   • Haz clic en Agregar otro rol si necesitas asignar varios roles a tus directores.

   • Haz clic en Guardar.

   Tus principales y sus roles asignados aparecen en la página de estado de los permisos de IAM.

gcloud

1. Asegúrate de tener una función que contenga los permisos de IAM adecuados para asignar funciones a otros, comopropietario, Administrador de IAM de proyecto, o Administrador de seguridad. Para obtener más información sobre este requisito, consulta Roles requeridos.

2. Abre una ventana de Cloud Shell en tu proyecto de Google Cloud.

3. Agrega el ID de tu proyecto de Google Cloud, la dirección de correo electrónico de la cuenta de Google Cloud de la principal y la ruta de la función de la solución Bare Metal deseada al siguiente comando:

   gcloud projects add-iam-policy-binding PROJECT_ID \
    --member=user:[e-mail] \
    --role=roles/baremetalsolution.admin
    

4. Copia el comando y pégalo en tu ventana de Cloud Shell.

5. Presiona las teclas Intro o Volver.

6. En algunos casos, se abrirá una ventana Autorizar Cloud Shell que solicitará que permitas una llamada a la API. Si ves esto, haz clic en Autorizar.

7. Cuando hayas escrito los comandos correctamente, el resultado obtenido se verá así:

   Updated IAM policy for project [PROJECT_ID].
     bindings:
     - members:
      - user:[e-mail]
      role: roles/baremetalsolution.admin
     - members:
      - serviceAccount:[e-mail]
      role: roles/compute.serviceAgent
     - members:
      - serviceAccount:[e-mail]
      - serviceAccount:[e-mail]
      role: roles/editor
     - members:
      - user:[e-mail]
      role: roles/owner
     etag: ETAG_NUMBER
     version: 1
    

Si quieres obtener más información sobre IAM, consulta Administración de identidades y accesos.