在 RBAC 中具有“实例管理员”角色的主账号无法在 Google Cloud 控制台中查看 Cloud Data Fusion 实例
Cloud Data Fusion 中存在一个已知问题，即具有 Instance Admin 角色的主账号无法在 Google Cloud 控制台中查看实例。如需解决此问题，请向主账号授予 Project Viewer 或某个 Cloud Data Fusion IAM 角色，并使其成为实例的管理员。这会向主账号授予对项目中所有实例的 Viewer 访问权限。
具有此类访问权限的主账号将无法在 Google Cloud 控制台中看到 Cloud Data Fusion 实例的列表。而是向他们提供指向实例的直接链接，如下所示：
https://INSTANCE_NAME-PROJECT_ID.REGION_NAME.datafusion.googleusercontent.com/
当主账号打开实例时，Cloud Data Fusion 会显示主账号被授予 RBAC 角色的命名空间列表。
向主账号授予 Cloud Data Fusion Accessor 角色
当向主账号分配任何其他 Cloud Data Fusion 实例的 RBAC 角色时，系统会隐式向该主账号分配 Accessor 角色。如需验证某主账号是否在特定实例中拥有该角色，请参阅 IAM Policy Analyzer。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-04。"],[[["\u003cp\u003eCloud Data Fusion's role-based access control (RBAC) enables fine-grained authorization within instances and namespaces, allowing control over who can access resources and what actions they can perform.\u003c/p\u003e\n"],["\u003cp\u003eRBAC facilitates namespace-level isolation within a single Cloud Data Fusion instance, making it suitable for organizations with multiple developers, teams, or business units using the same instance.\u003c/p\u003e\n"],["\u003cp\u003eRBAC allows for assigning various roles, such as Instance Admin, Developer, Viewer, Operator, and Editor, with each role having specific permissions within defined scopes like instances or namespaces.\u003c/p\u003e\n"],["\u003cp\u003eWhile using RBAC, it is recommended to use separate projects and instances for development and production environments to ensure isolation, security, and performance stability.\u003c/p\u003e\n"],["\u003cp\u003eCloud Data Fusion RBAC is available only in the Enterprise edition, and custom roles are not supported, plus there are limitations regarding connection management authorization.\u003c/p\u003e\n"]]],[],null,["# Role-based access control (RBAC) overview\n\nThis page describes fine-grained authorization with role-based access control (RBAC) in Cloud Data Fusion.\n\nEnabling RBAC in your Cloud Data Fusion instances lets you\ncontrol access within instances and namespaces, such as who can access\nCloud Data Fusion resources and what they can do with them.\n\nUse cases for RBAC\n------------------\n\nRBAC provides namespace-level isolation within a single\nCloud Data Fusion instance. It's recommended for the following use cases:\n\n- Helping minimize the number of instances used by your organization.\n- Having multiple developers, teams, or business units use a single Cloud Data Fusion instance.\n\nWith Cloud Data Fusion RBAC, organizations can:\n\n- Allow a user to only run a pipeline within a namespace, but not modify artifacts or runtime compute profiles.\n- Allow a user to only view the pipeline, but not modify or run a pipeline.\n- Allow a user to create, deploy, and run a pipeline.\n\n**Recommended:** Even when you use RBAC, to maintain isolation,\nsecurity, and performance stability, use separate\nprojects and instances for development and production environments.\n\nLimitations\n-----------\n\n- A user can be granted with one or multiple roles at either instance or namespace level.\n- RBAC is only available in the Cloud Data Fusion **Enterprise** edition.\n- Number of namespaces: No hard limit on the number of namespaces per instance.\n- For the maximum number of concurrent users in an RBAC-enabled instance, see [Pricing](/data-fusion/pricing#compare_editions).\n- When using service account OAuth access tokens to access version 6.5 RBAC-enabled instances, the following scopes must be specified, especially the `userinfo.email` scope. Without them, you will encounter permission denied errors.\n - `https://www.googleapis.com/auth/userinfo.email`\n - `https://www.googleapis.com/auth/cloud-platform` or `https://www.googleapis.com/auth/servicecontrol`\n\nRole assignments\n----------------\n\n| **Key Point:** To control who has access to resources with RBAC, you assign [IAM roles](/iam/docs/overview#roles).\n\nA role assignment consists of three elements: principal, role definition, and\nscope.\n\n### Principal\n\nYou grant roles to [principals](/iam/docs/overview#how_cloud_iam_works)\nto change their access to Cloud Data Fusion resources.\n\n### Role definition\n\n\nA role contains a set of permissions that allows you to perform specific actions on\nGoogle Cloud resources.\n\nCloud Data Fusion provides several\n[predefined roles](/iam/docs/understanding-roles#predefined_roles) that you can\nuse.\n\n**Examples:**\n\n- The Instance Admin role (`datafusion.admin`) lets principals create and delete namespaces, and grant permissions.\n- The Developer role (`datafusion.developer`) lets principals create and delete pipelines, deploy pipelines, and run previews.\n\n### Scope\n\nThe scope is the set of resources that the access applies to. When you assign a\nrole, you can further limit the actions allowed by defining a scope, such as an\ninstance or a namespace. This is helpful if you want to assign somebody the\nDeveloper role, but only for one namespace.\n\nSecurity recommendations\n------------------------\n\nAdopting a security model and catering it to your organization's needs and\nrequirements can be challenging. The following recommendations are intended to\nhelp you simplify your journey to adopt Cloud Data Fusion's\nRBAC model:\n\n- **Instance Admin role** should be granted cautiously. This role enables full access to an instance and all its underlying Cloud Data Fusion resources. A principal with this role can grant permissions to others by using the REST API.\n- **Instance Admin role** shouldn't be granted when principals are required to have access to individual namespaces within a Cloud Data Fusion instance. Instead, grant the Instance Accessor role with one of the Viewer/Developer/Operator/Editor roles granted on a subset of the namespaces.\n- **Instance Accessor** role is safe to assign first, as it enables principals' access to instance, but won't grant access to any resources within the instance. This role is typically used along with one of Viewer/Developer/Operator/Editor to give access to one or a subset of the namespaces within an instance.\n- **Viewer role** is recommended to be assigned to users or Google groups who would like to self-serve for understanding the status of running jobs, or viewing pipelines or logs with Cloud Data Fusion instances. For example, consumers of daily reports who would like to know whether processing has been completed.\n- **Developer role** is recommended for ETL developers who are responsible for creating, testing, and managing pipelines.\n- **Operator role** for a namespace is recommended for users who are providing operations administrator or DevOps services. They are able to perform all actions that developers can perform (except for previewing pipelines) and also deploy artifacts and manage compute profiles.\n- **Editor role** for a namespace is a privileged role that gives the user or Google group full access to all resources in the namespace. Editor can be considered the union of the developer and operator roles.\n- **Operators** and **Admins** should be wary of installing untrusted plugins or artifacts as this can present a security risk.\n\nTroubleshooting\n---------------\n\nThis page section shows you how to resolve issues related to RBAC in\nCloud Data Fusion.\n\n### A principal who has the Cloud Data Fusion Viewer role for a namespace in RBAC can edit pipelines\n\nAccess is based on a combination of IAM and RBAC\nroles. IAM roles have precedence over RBAC roles.\nCheck if the principal has\n[Project Editor](/iam/docs/understanding-roles#basic-definitions) or\n[Cloud Data Fusion Admin](/data-fusion/docs/access-control#roles)\nIAM roles.\n\n### A principal who has the Instance Admin role in RBAC can't view Cloud Data Fusion instances in the Google Cloud console\n\nThere is a known issue in Cloud Data Fusion where principals with the\nInstance Admin role cannot view instances in the Google Cloud console. To fix the\nissue, grant either the\n[Project Viewer](/iam/docs/understanding-roles#basic-definitions) or one of the\n[Cloud Data Fusion IAM roles](/data-fusion/docs/access-control#roles) to\nthe principal in addition to making them Admin to an instance. This grants\nViewer access to the principal for all instances in the project.\n\n### Prevent a principal from viewing namespaces where they have no role\n\nTo prevent a principal from viewing namespaces where they have no role, they\nmust not have the\n[Project Viewer](/iam/docs/understanding-roles#basic-definitions) or any of the\n[Cloud Data Fusion IAM roles](/data-fusion/docs/access-control#roles).\nInstead, only grant RBAC roles to the principal in the namespace\nwhere they need to operate.\n\nThe principal with this kind of access won't see the list of Cloud Data Fusion\ninstances in the Google Cloud console. Instead, give them a direct link to the\ninstance, similar to the following:\n`https://`\u003cvar translate=\"no\"\u003eINSTANCE_NAME\u003c/var\u003e`-`\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e`.`\u003cvar translate=\"no\"\u003eREGION_NAME\u003c/var\u003e`.datafusion.googleusercontent.com/`\n\nWhen the principal opens the instance, Cloud Data Fusion displays a list of\nnamespaces where the principal is granted RBAC role.\n\n### Grant the Cloud Data Fusion Accessor role to a principal\n\nThe Accessor role is implicitly assigned to a principal when any other\nRBAC role is assigned to them for any Cloud Data Fusion\ninstance. To verify if a principal has that role on a particular instance, see\nthe\n[IAM Policy Analyzer](/policy-intelligence/docs/analyze-iam-policies#policy-analyzer-what-access-console).\n\nWhat's next\n-----------\n\n- Learn how to [use RBAC in Cloud Data Fusion](/data-fusion/docs/how-to/create-role-based-access-control)."]]
