[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-05。"],[],[],null,["# Enforce certificate-based access for a user group\n\nThis page explains how to enforce certificate-based access (CBA) using\ncontext-aware access policies that are based on a user group.\n\nYou can restrict access to all Google Cloud services by binding a\nCBA access level to a user group that you want to restrict access to. This\nrestriction applies to all client applications that call the Google Cloud\nAPIs.\n\nOptionally, you can apply the restrictions to specific client applications or\nexempt specific applications. The applications include both third-party\napplications and first-party applications built by Google, such as\n`Cloud Console` for the Google Cloud console and `Google Cloud SDK` for the\n[`Google Cloud CLI`](https://cloud.google.com/sdk/gcloud/reference).\n\nBefore you begin\n----------------\n\nEnsure that you have [created a CBA access level](/chrome-enterprise-premium/docs/create-cba-access-levels)\nthat requires certificates when determining access to resources.\n\n### Create a user group\n\n[Create a user group](/iam/docs/groups-in-cloud-console#creating) containing the\nmembers that should be granted access based on the CBA access level.\n| **Note:** We recommend excluding at least one `Organization Admin` or `Organization\n| Owner` from this group to reduce the risk of an accidental lockout.\n\n### Assign the Cloud Access Binding Admin role\n\nAssign the [Cloud Access Binding Admin](/iam/docs/understanding-roles#accesscontextmanager.gcpAccessAdmin)\nrole to the user group.\n\nEnsure that you are authorized with sufficient privileges to add\nIAM permissions at the organization level. At a minimum, you need\nthe [Organization Admin](/resource-manager/docs/creating-managing-organization#setting-up)\nand the [Cloud Access Binding Admin](/iam/docs/understanding-roles#accesscontextmanager.gcpAccessAdmin) roles. \n\n### Console\n\n1. In the console, go to the **IAM** page.\n\n [Go to IAM](https://console.cloud.google.com/iam-admin)\n\n \u003cbr /\u003e\n\n2. On the **Permissions** tab, click **Grant access**, and then configure\n the following:\n\n 1. **New principals**: Specify the group to which you want to grant the role.\n 2. In the **Select a role** option, select **Access Context Manager** \\\u003e **Cloud Access Binding Admin**.\n 3. Click **Save**.\n\n### gcloud\n\n1. Sign in:\n\n gcloud auth login\n\n2. Assign the `GcpAccessAdmin` role by running the following command:\n\n gcloud organizations add-iam-policy-binding \u003cvar translate=\"no\"\u003eORG_ID\u003c/var\u003e \\\n --member=user:\u003cvar translate=\"no\"\u003eEMAIL\u003c/var\u003e \\\n --role=roles/accesscontextmanager.gcpAccessAdmin\n\n - \u003cvar translate=\"no\"\u003eORG_ID\u003c/var\u003e is the ID for your organization. If you\n don't already have your organization ID, you can use the following\n command to find it:\n\n gcloud organizations list\n\n - \u003cvar translate=\"no\"\u003eEMAIL\u003c/var\u003e is the email address of the person or\n group you want to grant the role to.\n\n | **Note:** For read-only access to the bindings, you can assign the `accesscontextmanager.gcpAccessReader` role.\n\n### Bind a CBA access level to a user group\n\nIn this binding option, the CBA access level applies to all of the client\napplications for the user group that you specify.\n\n1. In the console, go to the **Chrome Enterprise Premium** page.\n\n [Go to Chrome Enterprise Premium](https://console.cloud.google.com/security/caa)\n\n \u003cbr /\u003e\n\n2. Choose an organization, and then click **Select**.\n\n3. Click **Manage access** to choose the user groups that should have access.\n\n4. Click **Add** and then configure the following:\n\n 1. **Member groups**: Specify the group to which you want to grant access. You can only select groups that are not already bound to an access level.\n 2. **Select access levels**: Select the CBA access level to apply to the group.\n 3. Click **Save**.\n\n### Bind a CBA access level to a user group and specific applications\n\nIn some use cases, such as applications that support client certificates,\n[binding a CBA access level to a user group](#bind_option_one) might be too\nbroad. You can use this option to apply CBA access levels to applications that\nsupport client certificates.\n\nThe following example binds a CBA access level to the Google Cloud console,\nthe gcloud CLI, and a user's OAuth application.\n\n1. Log into the gcloud CLI.\n\n gcloud auth application-default login\n\n2. Create a `policy_file.json` file.\n\n You can specify applications using their OAuth client ID. To specify Google\n applications, use the application name, such as `Cloud Console` for the\n Google Cloud console. Only the Google Cloud console and Google Cloud SDK\n Google applications are supported. \n\n scopedAccessSettings:\n - scope:\n clientScope:\n restrictedClientApplication:\n name: Cloud Console\n activeSettings:\n accessLevels:\n - \u003cvar translate=\"no\"\u003eCBA_ACCESS_LEVEL\u003c/var\u003e\n - scope:\n clientScope:\n restrictedClientApplication:\n name: Google Cloud SDK\n activeSettings:\n accessLevels:\n - \u003cvar translate=\"no\"\u003eCBA_ACCESS_LEVEL\u003c/var\u003e\n - scope:\n clientScope:\n restrictedClientApplication:\n clientId: \u003cvar translate=\"no\"\u003eCLIENT_ID_1\u003c/var\u003e\n activeSettings:\n accessLevels:\n - \u003cvar translate=\"no\"\u003eCBA_ACCESS_LEVEL\u003c/var\u003e\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eCLIENT_ID_1\u003c/var\u003e: The OAuth client ID.\n - \u003cvar translate=\"no\"\u003eCBA_ACCESS_LEVEL\u003c/var\u003e: A CBA access level name in the format `accessPolicies/POLICY_ID/accessLevels/ACCESS_LEVEL_NAME`.\n3. Create the CBA access level binding.\n\n ```scdoc\n gcloud access-context-manager cloud-bindings create \\\n --group-key='GROUP_KEY' \\\n --organization='ORG_ID' \\\n --binding-file=.../policy_file.json\n ```\n\n Replace \u003cvar translate=\"no\"\u003eGROUP_KEY\u003c/var\u003e with the context-aware access group and\n \u003cvar translate=\"no\"\u003eORG_ID\u003c/var\u003e with your organization ID.\n\n If you don't have the \u003cvar translate=\"no\"\u003eGROUP_KEY\u003c/var\u003e available, you can retrieve it by\n calling the\n [`get`](https://developers.google.com/admin-sdk/directory/reference/rest/v1/groups/get)\n method on the group resource.\n4. (Optional) Update an existing access level binding.\n\n ```scdoc\n gcloud access-context-manager cloud-bindings update \\\n --binding='BINDING_NAME' \\\n --binding-file=.../policy_file.json\n ```\n\n Replace \u003cvar translate=\"no\"\u003eBINDING_NAME\u003c/var\u003e with the binding name that was automatically generated\n when the binding was created.\n\n### Exempt an application from a binding\n\nAnother way to apply a CBA access level without blocking client applications\nthat don't support client certificates is to exempt those applications from the\npolicy.\n\nThe following steps assume that you have previously\n[created a CBA access level](/chrome-enterprise-premium/docs/create-cba-access-levels)\nthat requires certificates when determining access to resources.\n\n1. Create an exemption access level using one of the following methods.\n\n - [Custom access level](/access-context-manager/docs/create-custom-access-level): Provide `true` as the value in the CEL expression condition.\n - [Basic access level](/access-context-manager/docs/create-basic-access-level): Create an [IP range-based access level](/access-context-manager/docs/create-basic-access-level#gcloud_1) by providing IP subnetworks `0.0.0.0/0` and `::/0`, which correspond to IPv4 and IPv6 respectively.\n2. Create an `exemption_file.json` file.\n\n scopedAccessSettings:\n - scope:\n clientScope:\n restrictedClientApplication:\n clientId: \u003cvar translate=\"no\"\u003eCLIENT_ID_2\u003c/var\u003e\n activeSettings:\n accessLevels:\n - \u003cvar translate=\"no\"\u003eEXEMPT_ACCESS_LEVEL\u003c/var\u003e\n - scope:\n clientScope:\n restrictedClientApplication:\n name: \u003cvar translate=\"no\"\u003eAPPLICATION_NAME_2\u003c/var\u003e\n activeSettings:\n accessLevels:\n - \u003cvar translate=\"no\"\u003eEXEMPT_ACCESS_LEVEL\u003c/var\u003e\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eCLIENT_ID_2\u003c/var\u003e: The OAuth client ID.\n - \u003cvar translate=\"no\"\u003eAPPLICATION_NAME_2\u003c/var\u003e: The application name.\n - \u003cvar translate=\"no\"\u003eEXEMPT_ACCESS_LEVEL\u003c/var\u003e: An exemption access level name in the format `accessPolicies/POLICY_ID/accessLevels/ACCESS_LEVEL_NAME`.\n3. Create the exemption binding policy.\n\n ```scdoc\n gcloud access-context-manager cloud-bindings create \\\n --group-key='GROUP_KEY' \\\n --organization='ORG_ID' \\\n --binding-file=.../exemption_file.json\n ```\n\n Replace \u003cvar translate=\"no\"\u003eGROUP_KEY\u003c/var\u003e with the context-aware access group and\n \u003cvar translate=\"no\"\u003eORG_ID\u003c/var\u003e with your organization ID.\n\n If you don't have the \u003cvar translate=\"no\"\u003eGROUP_KEY\u003c/var\u003e available, you can retrieve it by\n calling the\n [`get`](https://developers.google.com/admin-sdk/directory/reference/rest/v1/groups/get)\n method on the group resource."]]
