Cloud ID, Google Workspace, 서드 파티 ID 공급업체(예: Okta 또는 Azure AD)를 사용하여 사용자, 그룹, 인증을 관리할 수 있습니다.
이 페이지에서는 Cloud ID 또는 Google Workspace를 사용하는 방법을 설명합니다.
Cloud ID 또는 Google Workspace를 사용할 때는 관리형 사용자 계정을 만들어 Google Cloud 리소스와 Google SecOps에 대한 액세스 권한을 제어합니다.
Google SecOps 기능에 액세스할 수 있는 사용자와 그룹을 정의하는 IAM 정책을 만듭니다. 이러한 IAM 정책은 Google SecOps에서 제공하는 사전 정의된 역할과 권한 또는 개발자가 만든 커스텀 역할을 통해 정의됩니다.
Google SecOps 인스턴스를 Google Cloud
서비스에 연결하는 과정에서 Google Cloud IdP에 대한 연결을 구성합니다. Google SecOps 인스턴스는 Cloud ID 또는 Google Workspace와 직접 통합되어 사용자를 인증하고 구성된 IAM 정책에 따라 액세스 제어를 시행합니다.
Cloud ID 또는 Google Workspace 계정을 만드는 방법에 대한 자세한 내용은 사용자의 ID를 참조하세요.
Google SecOps에 로그인을 사용 설정하도록 역할 부여
다음 단계에서는 사용자가 Google SecOps에 로그인할 수 있도록 IAM을 사용하여 특정 역할을 부여하는 방법을 설명합니다. 앞에서 만든 Google SecOps에 바인딩된 Google Cloud 프로젝트를 사용하여 구성을 수행합니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-04(UTC)"],[[["\u003cp\u003eGoogle Security Operations integrates with Cloud Identity or Google Workspace to manage user authentication and access.\u003c/p\u003e\n"],["\u003cp\u003eIAM policies are used to define which users and groups can access specific Google Security Operations features using predefined or custom roles.\u003c/p\u003e\n"],["\u003cp\u003eTo enable users to sign in to Google Security Operations, grant them the Chronicle API Viewer role using the \u003ccode\u003egcloud\u003c/code\u003e command.\u003c/p\u003e\n"],["\u003cp\u003eAfter setting up user authentication, you must link the Google Security Operations instance to Google Cloud services for it to work.\u003c/p\u003e\n"],["\u003cp\u003eThis process does not configure authorization for Google Security Operation features, that is handled by IAM for feature access control.\u003c/p\u003e\n"]]],[],null,["# Configure a Google Cloud identity provider\n==========================================\n\nSupported in: \nGoogle secops [SIEM](/chronicle/docs/secops/google-secops-siem-toc)\n\nYou can use Cloud Identity, Google Workspace, or a third-party identity\nprovider (such as Okta or Azure AD) to manage users, groups, and authentication.\n\nThis page describes how to use Cloud Identity or Google Workspace.\n\nWhen using Cloud Identity or Google Workspace, you create managed user accounts\nto control access to Google Cloud resources and to Google SecOps.\n\nYou create IAM policies that define which users and groups have access\nto Google SecOps features. These IAM policies\nare defined using predefined roles and permissions provided by Google SecOps\nor custom roles that you create.\n\nAs part of linking a Google SecOps instance to Google Cloud\nservices, configure a connection to a Google Cloud IdP. The\nGoogle SecOps instance integrates directly with Cloud Identity\nor Google Workspace to authenticate users and enforce access control based on\nyour configured IAM policies.\n\nSee [Identities for users](/iam/docs/user-identities#google-accounts)\nfor detailed information about creating Cloud Identity or Google Workspace accounts.\n\nGrant a role to enable sign-in to Google SecOps\n-----------------------------------------------\n\nThe following steps describe how to grant a specific role using IAM\nso that a user can sign in to Google SecOps. Perform the configuration using\nthe Google SecOps-bound Google Cloud project you created earlier.\n\n1. Grant the [Chronicle API Viewer (`roles/chronicle.viewer`)](/iam/docs/understanding-roles#chronicle.viewer)\n role to users or groups that should have access to the Google Security Operations application.\n\n | **Note:** The following examples use the `gcloud` command. To use the Google Cloud console, see [Grant a single role](/iam/docs/granting-changing-revoking-access#grant-single-role).\n | **Important:** The following examples don't configure authorization to Google SecOps features. This is done using IAM for feature access control.\n - The following example grants the Chronicle API Viewer role to to a specific group:\n\n gcloud projects add-iam-policy-binding \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e \\\n --role roles/chronicle.viewer \\\n --member \"group:\u003cvar translate=\"no\"\u003eGROUP_EMAIL\u003c/var\u003e\"\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: with the project ID of the Google Security Operations-bound project you configured in [Configure a Google Cloud project for Google Security Operations](/chronicle/docs/onboard/configure-cloud-project). See [Creating and managing projects](/resource-manager/docs/creating-managing-projects) for a description of fields that identify a project.\n - \u003cvar translate=\"no\"\u003eGROUP_EMAIL\u003c/var\u003e: the email alias for the group, such as `analyst-t1@example.com`.\n - To grant the Chronicle API Viewer role to a specific user, run the following command:\n\n gcloud projects add-iam-policy-binding \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e \\\n --role roles/chronicle.viewer \\\n --member \"principal:\u003cvar translate=\"no\"\u003eUSER_EMAIL\u003c/var\u003e\"\n\n Replace \u003cvar translate=\"no\"\u003eUSER_EMAIL\u003c/var\u003e: the user's user email address, such as `alice@example.com`.\n - For examples of how to grant roles to other members, such as a group or\n domain, see\n [gcloud projects add-iam-policy-binding](/sdk/gcloud/reference/projects/add-iam-policy-binding)\n and [Principal identifiers](/iam/docs/principal-identifiers) reference\n documentation.\n\n2. Configure additional IAM policies to meet your\n organization's access and security requirements.\n\n| **Note:** Custom IAM role mappings aren't supported for the SOAR side of the Google SecOps platform.\n\nWhat's next\n-----------\n\nAfter completing the steps in this document, perform the following:\n\n- Perform steps to [Link a Google Security Operations instance to Google Cloud services](/chronicle/docs/onboard/link-chronicle-cloud).\n\n- If you have not yet set up audit logging, continue with\n [enabling Google Security Operations audit logging](/chronicle/docs/preview/audit-logging/audit-logging).\n\n- If you are configuring for Google Security Operations, perform additional steps in\n [Provision, authenticate, and map users in Google Security Operations](/chronicle/docs/soar/admin-tasks/user-secops/map-users-in-the-secops-platform).\n\n- To configure access to features, perform additional steps in [Configure feature access control using IAM](/chronicle/docs/onboard/configure-feature-access) and [Google Security Operations permissions in IAM](/chronicle/docs/reference/feature-rbac-permissions-roles).\n\n**Need more help?** [Get answers from Community members and Google SecOps professionals.](https://security.googlecloudcommunity.com/google-security-operations-2)"]]
