이 페이지에서는 사용자 그룹을 기반으로 하는 컨텍스트 인식 액세스 정책을 사용하여 인증서 기반 액세스 (CBA)를 적용하는 방법을 설명합니다.
액세스를 제한할 사용자 그룹에 CBA 액세스 수준을 바인딩하여 모든 Google Cloud 서비스에 대한 액세스를 제한할 수 있습니다. 이 제한은 Google CloudAPI를 호출하는 모든 클라이언트 애플리케이션에 적용됩니다.
원하는 경우 특정 클라이언트 애플리케이션에 제한사항을 적용하거나 특정 애플리케이션을 제외할 수 있습니다. 애플리케이션에는 서드 파티 애플리케이션과 Google에서 빌드한 퍼스트 파티 애플리케이션(예: Google Cloud 콘솔의 Cloud Console, Google Cloud CLI의 Google Cloud SDK)이 모두 포함됩니다.
구성원 그룹: 액세스 권한을 부여할 그룹을 지정합니다. 아직 액세스 수준에 결합되지 않은 그룹만 선택할 수 있습니다.
액세스 수준 선택: 그룹에 적용할 CBA 액세스 수준을 선택합니다.
저장을 클릭합니다.
사용자 그룹 및 특정 애플리케이션에 CBA 액세스 수준 바인딩
클라이언트 인증서를 지원하는 애플리케이션과 같은 일부 사용 사례에서는 CBA 액세스 수준을 사용자 그룹에 바인딩하는 것이 너무 광범위할 수 있습니다. 이 옵션을 사용하여 클라이언트 인증서를 지원하는 애플리케이션에 CBA 액세스 수준을 적용할 수 있습니다.
다음 예에서는 CBA 액세스 수준을 Google Cloud 콘솔, gcloud CLI, 사용자의 OAuth 애플리케이션에 바인딩합니다.
gcloud CLI에 로그인.
gcloud auth application-default login
policy_file.json 파일을 만듭니다.
OAuth 클라이언트 ID를 사용하여 애플리케이션을 지정할 수 있습니다. Google 애플리케이션을 지정하려면Google Cloud 콘솔의 경우 Cloud Console과 같은 애플리케이션 이름을 사용하세요. Google Cloud 콘솔 및 Google Cloud SDK Google 애플리케이션만 지원됩니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-05(UTC)"],[],[],null,["# Enforce certificate-based access for a user group\n\nThis page explains how to enforce certificate-based access (CBA) using\ncontext-aware access policies that are based on a user group.\n\nYou can restrict access to all Google Cloud services by binding a\nCBA access level to a user group that you want to restrict access to. This\nrestriction applies to all client applications that call the Google Cloud\nAPIs.\n\nOptionally, you can apply the restrictions to specific client applications or\nexempt specific applications. The applications include both third-party\napplications and first-party applications built by Google, such as\n`Cloud Console` for the Google Cloud console and `Google Cloud SDK` for the\n[`Google Cloud CLI`](https://cloud.google.com/sdk/gcloud/reference).\n\nBefore you begin\n----------------\n\nEnsure that you have [created a CBA access level](/chrome-enterprise-premium/docs/create-cba-access-levels)\nthat requires certificates when determining access to resources.\n\n### Create a user group\n\n[Create a user group](/iam/docs/groups-in-cloud-console#creating) containing the\nmembers that should be granted access based on the CBA access level.\n| **Note:** We recommend excluding at least one `Organization Admin` or `Organization\n| Owner` from this group to reduce the risk of an accidental lockout.\n\n### Assign the Cloud Access Binding Admin role\n\nAssign the [Cloud Access Binding Admin](/iam/docs/understanding-roles#accesscontextmanager.gcpAccessAdmin)\nrole to the user group.\n\nEnsure that you are authorized with sufficient privileges to add\nIAM permissions at the organization level. At a minimum, you need\nthe [Organization Admin](/resource-manager/docs/creating-managing-organization#setting-up)\nand the [Cloud Access Binding Admin](/iam/docs/understanding-roles#accesscontextmanager.gcpAccessAdmin) roles. \n\n### Console\n\n1. In the console, go to the **IAM** page.\n\n [Go to IAM](https://console.cloud.google.com/iam-admin)\n\n \u003cbr /\u003e\n\n2. On the **Permissions** tab, click **Grant access**, and then configure\n the following:\n\n 1. **New principals**: Specify the group to which you want to grant the role.\n 2. In the **Select a role** option, select **Access Context Manager** \\\u003e **Cloud Access Binding Admin**.\n 3. Click **Save**.\n\n### gcloud\n\n1. Sign in:\n\n gcloud auth login\n\n2. Assign the `GcpAccessAdmin` role by running the following command:\n\n gcloud organizations add-iam-policy-binding \u003cvar translate=\"no\"\u003eORG_ID\u003c/var\u003e \\\n --member=user:\u003cvar translate=\"no\"\u003eEMAIL\u003c/var\u003e \\\n --role=roles/accesscontextmanager.gcpAccessAdmin\n\n - \u003cvar translate=\"no\"\u003eORG_ID\u003c/var\u003e is the ID for your organization. If you\n don't already have your organization ID, you can use the following\n command to find it:\n\n gcloud organizations list\n\n - \u003cvar translate=\"no\"\u003eEMAIL\u003c/var\u003e is the email address of the person or\n group you want to grant the role to.\n\n | **Note:** For read-only access to the bindings, you can assign the `accesscontextmanager.gcpAccessReader` role.\n\n### Bind a CBA access level to a user group\n\nIn this binding option, the CBA access level applies to all of the client\napplications for the user group that you specify.\n\n1. In the console, go to the **Chrome Enterprise Premium** page.\n\n [Go to Chrome Enterprise Premium](https://console.cloud.google.com/security/caa)\n\n \u003cbr /\u003e\n\n2. Choose an organization, and then click **Select**.\n\n3. Click **Manage access** to choose the user groups that should have access.\n\n4. Click **Add** and then configure the following:\n\n 1. **Member groups**: Specify the group to which you want to grant access. You can only select groups that are not already bound to an access level.\n 2. **Select access levels**: Select the CBA access level to apply to the group.\n 3. Click **Save**.\n\n### Bind a CBA access level to a user group and specific applications\n\nIn some use cases, such as applications that support client certificates,\n[binding a CBA access level to a user group](#bind_option_one) might be too\nbroad. You can use this option to apply CBA access levels to applications that\nsupport client certificates.\n\nThe following example binds a CBA access level to the Google Cloud console,\nthe gcloud CLI, and a user's OAuth application.\n\n1. Log into the gcloud CLI.\n\n gcloud auth application-default login\n\n2. Create a `policy_file.json` file.\n\n You can specify applications using their OAuth client ID. To specify Google\n applications, use the application name, such as `Cloud Console` for the\n Google Cloud console. Only the Google Cloud console and Google Cloud SDK\n Google applications are supported. \n\n scopedAccessSettings:\n - scope:\n clientScope:\n restrictedClientApplication:\n name: Cloud Console\n activeSettings:\n accessLevels:\n - \u003cvar translate=\"no\"\u003eCBA_ACCESS_LEVEL\u003c/var\u003e\n - scope:\n clientScope:\n restrictedClientApplication:\n name: Google Cloud SDK\n activeSettings:\n accessLevels:\n - \u003cvar translate=\"no\"\u003eCBA_ACCESS_LEVEL\u003c/var\u003e\n - scope:\n clientScope:\n restrictedClientApplication:\n clientId: \u003cvar translate=\"no\"\u003eCLIENT_ID_1\u003c/var\u003e\n activeSettings:\n accessLevels:\n - \u003cvar translate=\"no\"\u003eCBA_ACCESS_LEVEL\u003c/var\u003e\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eCLIENT_ID_1\u003c/var\u003e: The OAuth client ID.\n - \u003cvar translate=\"no\"\u003eCBA_ACCESS_LEVEL\u003c/var\u003e: A CBA access level name in the format `accessPolicies/POLICY_ID/accessLevels/ACCESS_LEVEL_NAME`.\n3. Create the CBA access level binding.\n\n ```scdoc\n gcloud access-context-manager cloud-bindings create \\\n --group-key='GROUP_KEY' \\\n --organization='ORG_ID' \\\n --binding-file=.../policy_file.json\n ```\n\n Replace \u003cvar translate=\"no\"\u003eGROUP_KEY\u003c/var\u003e with the context-aware access group and\n \u003cvar translate=\"no\"\u003eORG_ID\u003c/var\u003e with your organization ID.\n\n If you don't have the \u003cvar translate=\"no\"\u003eGROUP_KEY\u003c/var\u003e available, you can retrieve it by\n calling the\n [`get`](https://developers.google.com/admin-sdk/directory/reference/rest/v1/groups/get)\n method on the group resource.\n4. (Optional) Update an existing access level binding.\n\n ```scdoc\n gcloud access-context-manager cloud-bindings update \\\n --binding='BINDING_NAME' \\\n --binding-file=.../policy_file.json\n ```\n\n Replace \u003cvar translate=\"no\"\u003eBINDING_NAME\u003c/var\u003e with the binding name that was automatically generated\n when the binding was created.\n\n### Exempt an application from a binding\n\nAnother way to apply a CBA access level without blocking client applications\nthat don't support client certificates is to exempt those applications from the\npolicy.\n\nThe following steps assume that you have previously\n[created a CBA access level](/chrome-enterprise-premium/docs/create-cba-access-levels)\nthat requires certificates when determining access to resources.\n\n1. Create an exemption access level using one of the following methods.\n\n - [Custom access level](/access-context-manager/docs/create-custom-access-level): Provide `true` as the value in the CEL expression condition.\n - [Basic access level](/access-context-manager/docs/create-basic-access-level): Create an [IP range-based access level](/access-context-manager/docs/create-basic-access-level#gcloud_1) by providing IP subnetworks `0.0.0.0/0` and `::/0`, which correspond to IPv4 and IPv6 respectively.\n2. Create an `exemption_file.json` file.\n\n scopedAccessSettings:\n - scope:\n clientScope:\n restrictedClientApplication:\n clientId: \u003cvar translate=\"no\"\u003eCLIENT_ID_2\u003c/var\u003e\n activeSettings:\n accessLevels:\n - \u003cvar translate=\"no\"\u003eEXEMPT_ACCESS_LEVEL\u003c/var\u003e\n - scope:\n clientScope:\n restrictedClientApplication:\n name: \u003cvar translate=\"no\"\u003eAPPLICATION_NAME_2\u003c/var\u003e\n activeSettings:\n accessLevels:\n - \u003cvar translate=\"no\"\u003eEXEMPT_ACCESS_LEVEL\u003c/var\u003e\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eCLIENT_ID_2\u003c/var\u003e: The OAuth client ID.\n - \u003cvar translate=\"no\"\u003eAPPLICATION_NAME_2\u003c/var\u003e: The application name.\n - \u003cvar translate=\"no\"\u003eEXEMPT_ACCESS_LEVEL\u003c/var\u003e: An exemption access level name in the format `accessPolicies/POLICY_ID/accessLevels/ACCESS_LEVEL_NAME`.\n3. Create the exemption binding policy.\n\n ```scdoc\n gcloud access-context-manager cloud-bindings create \\\n --group-key='GROUP_KEY' \\\n --organization='ORG_ID' \\\n --binding-file=.../exemption_file.json\n ```\n\n Replace \u003cvar translate=\"no\"\u003eGROUP_KEY\u003c/var\u003e with the context-aware access group and\n \u003cvar translate=\"no\"\u003eORG_ID\u003c/var\u003e with your organization ID.\n\n If you don't have the \u003cvar translate=\"no\"\u003eGROUP_KEY\u003c/var\u003e available, you can retrieve it by\n calling the\n [`get`](https://developers.google.com/admin-sdk/directory/reference/rest/v1/groups/get)\n method on the group resource."]]
