本文档介绍了在创建允许 Cloud Data Fusion 服务账号访问您的资源的自定义角色时，应向该服务账号授予哪些权限。
默认情况下，Cloud Data Fusion API Service Agent (roles/datafusion.serviceAgent) Identity and Access Management 角色会分配给 Cloud Data Fusion 服务账号。此角色具有高度的许可性。
不过，您可以使用自定义角色来仅提供服务账号主账号所需的权限。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-04。"],[[["\u003cp\u003eThis document outlines the necessary permissions for the Cloud Data Fusion Service Account when using custom roles to access resources, as opposed to the default highly permissive role.\u003c/p\u003e\n"],["\u003cp\u003eCustom roles allow you to grant specific permissions to the service account principal, tailoring access to only what is needed for designated tasks.\u003c/p\u003e\n"],["\u003cp\u003ePermissions required for tasks such as instance creation, Dataproc cluster access, Cloud Storage interaction, and publishing logs or metrics are detailed in the provided table.\u003c/p\u003e\n"],["\u003cp\u003eAdditional configurations like VPC peering, DNS peering, and Private Service Connect each have their own specific permissions needed to create a Cloud Data Fusion instance.\u003c/p\u003e\n"]]],[],null,["# Minimum permissions required for the Cloud Data Fusion Service Account\n\nThis document explains which permissions to give to the\nCloud Data Fusion Service Account when you create a custom role that\nlets it access your resources.\n| **Note:** The principal name for the [Cloud Data Fusion Service Account](/data-fusion/docs/access-control#data-fusion-service-account) is `service-`\u003cvar translate=\"no\"\u003eCUSTOMER_PROJECT_NUMBER\u003c/var\u003e`@gcp-sa-datafusion.iam.gserviceaccount.com`\n\nBy default, the\n[Cloud Data Fusion API Service Agent](/iam/docs/understanding-roles#datafusion.serviceAgent)\n(`roles/datafusion.serviceAgent`) Identity and Access Management role is assigned to the\nCloud Data Fusion Service Account. This role is highly permissive.\nInstead, you can use custom roles to provide only the permissions that the\nservice account principal needs.\n\nFor more information about the Cloud Data Fusion service accounts, see\n[Service accounts in Cloud Data Fusion](/data-fusion/docs/concepts/service-accounts).\n\nFor more information about creating custom roles, see\n[Create a custom role](/iam/docs/creating-custom-roles#creating).\n\nRequired permissions for the Cloud Data Fusion Service Account\n--------------------------------------------------------------\n\nWhen you create a custom role for the Cloud Data Fusion Service Account,\ngive the following permissions based on the tasks you plan to perform in your\ninstance. This lets Cloud Data Fusion access your resources.\n\nWhat's next\n-----------\n\n- Learn more about [creating and managing custom roles](/iam/docs/creating-custom-roles).\n- Learn more about [access control options in Cloud Data Fusion](/data-fusion/docs/access-control)."]]
