閲覧者のロールは、ジョブの実行ステータスを確認する場合や、Cloud Data Fusion インスタンスでパイプラインまたはログを表示する場合に、セルフサービスで利用するユーザーや Google グループに割り当てることをおすすめします。たとえば、処理が完了されたかを確認したい日次レポートのユーザーなどです。
このページのセクションでは、Cloud Data Fusion の RBAC に関連する問題を解決する方法について説明します。
RBAC の名前空間の Cloud Data Fusion 閲覧者のロールを持つプリンシパルがパイプラインを編集できる
アクセスは、IAM ロールと RBAC ロールの組み合わせに基づいています。IAM ロールは RBAC ロールよりも優先されます。
プリンシパルに プロジェクト編集者または Cloud Data Fusion 管理者の IAM ロールがあるかどうかを確認します。
RBAC でインスタンス管理者ロールを持つプリンシパルが Google Cloud コンソールで Cloud Data Fusion インスタンスを閲覧できない
Cloud Data Fusion には、インスタンス管理者ロールを持つプリンシパルが Google Cloud コンソールでインスタンスを閲覧できないという既知の問題があります。この問題を解決するには、プリンシパルにインスタンスへの管理者のロールだけでなく、プロジェクト閲覧者または Cloud Data Fusion IAM ロールのいずれかを付与します。これにより、プロジェクト内のすべてのインスタンスのプリンシパルに閲覧者のアクセス権が付与されます。
プリンシパルがロールを持たない名前空間を閲覧できないようにする
プリンシパルがロールを持たない名前空間を閲覧できないようにするには、プリンシパルにプロジェクト閲覧者または、いかなる Cloud Data Fusion の IAM ロールも付与されていない必要があります。代わりに、運用する必要がある名前空間のみで RBAC ロールをプリンシパルに付与します。
このようなアクセス権を持つプリンシパルは、Google Cloud コンソールで Cloud Data Fusion インスタンスのリストを閲覧できません。代わりに、次のようにインスタンスへの直接リンクを提供します。
https://INSTANCE_NAME-PROJECT_ID.REGION_NAME.datafusion.googleusercontent.com/
プリンシパルがインスタンスを開くと、Cloud Data Fusion はプリンシパルが RBAC ロールが付与されている名前空間のリストを表示します。
[[["わかりやすい","easyToUnderstand","thumb-up"],["問題の解決に役立った","solvedMyProblem","thumb-up"],["その他","otherUp","thumb-up"]],[["わかりにくい","hardToUnderstand","thumb-down"],["情報またはサンプルコードが不正確","incorrectInformationOrSampleCode","thumb-down"],["必要な情報 / サンプルがない","missingTheInformationSamplesINeed","thumb-down"],["翻訳に関する問題","translationIssue","thumb-down"],["その他","otherDown","thumb-down"]],["最終更新日 2025-09-04 UTC。"],[[["\u003cp\u003eCloud Data Fusion's role-based access control (RBAC) enables fine-grained authorization within instances and namespaces, allowing control over who can access resources and what actions they can perform.\u003c/p\u003e\n"],["\u003cp\u003eRBAC facilitates namespace-level isolation within a single Cloud Data Fusion instance, making it suitable for organizations with multiple developers, teams, or business units using the same instance.\u003c/p\u003e\n"],["\u003cp\u003eRBAC allows for assigning various roles, such as Instance Admin, Developer, Viewer, Operator, and Editor, with each role having specific permissions within defined scopes like instances or namespaces.\u003c/p\u003e\n"],["\u003cp\u003eWhile using RBAC, it is recommended to use separate projects and instances for development and production environments to ensure isolation, security, and performance stability.\u003c/p\u003e\n"],["\u003cp\u003eCloud Data Fusion RBAC is available only in the Enterprise edition, and custom roles are not supported, plus there are limitations regarding connection management authorization.\u003c/p\u003e\n"]]],[],null,["# Role-based access control (RBAC) overview\n\nThis page describes fine-grained authorization with role-based access control (RBAC) in Cloud Data Fusion.\n\nEnabling RBAC in your Cloud Data Fusion instances lets you\ncontrol access within instances and namespaces, such as who can access\nCloud Data Fusion resources and what they can do with them.\n\nUse cases for RBAC\n------------------\n\nRBAC provides namespace-level isolation within a single\nCloud Data Fusion instance. It's recommended for the following use cases:\n\n- Helping minimize the number of instances used by your organization.\n- Having multiple developers, teams, or business units use a single Cloud Data Fusion instance.\n\nWith Cloud Data Fusion RBAC, organizations can:\n\n- Allow a user to only run a pipeline within a namespace, but not modify artifacts or runtime compute profiles.\n- Allow a user to only view the pipeline, but not modify or run a pipeline.\n- Allow a user to create, deploy, and run a pipeline.\n\n**Recommended:** Even when you use RBAC, to maintain isolation,\nsecurity, and performance stability, use separate\nprojects and instances for development and production environments.\n\nLimitations\n-----------\n\n- A user can be granted with one or multiple roles at either instance or namespace level.\n- RBAC is only available in the Cloud Data Fusion **Enterprise** edition.\n- Number of namespaces: No hard limit on the number of namespaces per instance.\n- For the maximum number of concurrent users in an RBAC-enabled instance, see [Pricing](/data-fusion/pricing#compare_editions).\n- When using service account OAuth access tokens to access version 6.5 RBAC-enabled instances, the following scopes must be specified, especially the `userinfo.email` scope. Without them, you will encounter permission denied errors.\n - `https://www.googleapis.com/auth/userinfo.email`\n - `https://www.googleapis.com/auth/cloud-platform` or `https://www.googleapis.com/auth/servicecontrol`\n\nRole assignments\n----------------\n\n| **Key Point:** To control who has access to resources with RBAC, you assign [IAM roles](/iam/docs/overview#roles).\n\nA role assignment consists of three elements: principal, role definition, and\nscope.\n\n### Principal\n\nYou grant roles to [principals](/iam/docs/overview#how_cloud_iam_works)\nto change their access to Cloud Data Fusion resources.\n\n### Role definition\n\n\nA role contains a set of permissions that allows you to perform specific actions on\nGoogle Cloud resources.\n\nCloud Data Fusion provides several\n[predefined roles](/iam/docs/understanding-roles#predefined_roles) that you can\nuse.\n\n**Examples:**\n\n- The Instance Admin role (`datafusion.admin`) lets principals create and delete namespaces, and grant permissions.\n- The Developer role (`datafusion.developer`) lets principals create and delete pipelines, deploy pipelines, and run previews.\n\n### Scope\n\nThe scope is the set of resources that the access applies to. When you assign a\nrole, you can further limit the actions allowed by defining a scope, such as an\ninstance or a namespace. This is helpful if you want to assign somebody the\nDeveloper role, but only for one namespace.\n\nSecurity recommendations\n------------------------\n\nAdopting a security model and catering it to your organization's needs and\nrequirements can be challenging. The following recommendations are intended to\nhelp you simplify your journey to adopt Cloud Data Fusion's\nRBAC model:\n\n- **Instance Admin role** should be granted cautiously. This role enables full access to an instance and all its underlying Cloud Data Fusion resources. A principal with this role can grant permissions to others by using the REST API.\n- **Instance Admin role** shouldn't be granted when principals are required to have access to individual namespaces within a Cloud Data Fusion instance. Instead, grant the Instance Accessor role with one of the Viewer/Developer/Operator/Editor roles granted on a subset of the namespaces.\n- **Instance Accessor** role is safe to assign first, as it enables principals' access to instance, but won't grant access to any resources within the instance. This role is typically used along with one of Viewer/Developer/Operator/Editor to give access to one or a subset of the namespaces within an instance.\n- **Viewer role** is recommended to be assigned to users or Google groups who would like to self-serve for understanding the status of running jobs, or viewing pipelines or logs with Cloud Data Fusion instances. For example, consumers of daily reports who would like to know whether processing has been completed.\n- **Developer role** is recommended for ETL developers who are responsible for creating, testing, and managing pipelines.\n- **Operator role** for a namespace is recommended for users who are providing operations administrator or DevOps services. They are able to perform all actions that developers can perform (except for previewing pipelines) and also deploy artifacts and manage compute profiles.\n- **Editor role** for a namespace is a privileged role that gives the user or Google group full access to all resources in the namespace. Editor can be considered the union of the developer and operator roles.\n- **Operators** and **Admins** should be wary of installing untrusted plugins or artifacts as this can present a security risk.\n\nTroubleshooting\n---------------\n\nThis page section shows you how to resolve issues related to RBAC in\nCloud Data Fusion.\n\n### A principal who has the Cloud Data Fusion Viewer role for a namespace in RBAC can edit pipelines\n\nAccess is based on a combination of IAM and RBAC\nroles. IAM roles have precedence over RBAC roles.\nCheck if the principal has\n[Project Editor](/iam/docs/understanding-roles#basic-definitions) or\n[Cloud Data Fusion Admin](/data-fusion/docs/access-control#roles)\nIAM roles.\n\n### A principal who has the Instance Admin role in RBAC can't view Cloud Data Fusion instances in the Google Cloud console\n\nThere is a known issue in Cloud Data Fusion where principals with the\nInstance Admin role cannot view instances in the Google Cloud console. To fix the\nissue, grant either the\n[Project Viewer](/iam/docs/understanding-roles#basic-definitions) or one of the\n[Cloud Data Fusion IAM roles](/data-fusion/docs/access-control#roles) to\nthe principal in addition to making them Admin to an instance. This grants\nViewer access to the principal for all instances in the project.\n\n### Prevent a principal from viewing namespaces where they have no role\n\nTo prevent a principal from viewing namespaces where they have no role, they\nmust not have the\n[Project Viewer](/iam/docs/understanding-roles#basic-definitions) or any of the\n[Cloud Data Fusion IAM roles](/data-fusion/docs/access-control#roles).\nInstead, only grant RBAC roles to the principal in the namespace\nwhere they need to operate.\n\nThe principal with this kind of access won't see the list of Cloud Data Fusion\ninstances in the Google Cloud console. Instead, give them a direct link to the\ninstance, similar to the following:\n`https://`\u003cvar translate=\"no\"\u003eINSTANCE_NAME\u003c/var\u003e`-`\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e`.`\u003cvar translate=\"no\"\u003eREGION_NAME\u003c/var\u003e`.datafusion.googleusercontent.com/`\n\nWhen the principal opens the instance, Cloud Data Fusion displays a list of\nnamespaces where the principal is granted RBAC role.\n\n### Grant the Cloud Data Fusion Accessor role to a principal\n\nThe Accessor role is implicitly assigned to a principal when any other\nRBAC role is assigned to them for any Cloud Data Fusion\ninstance. To verify if a principal has that role on a particular instance, see\nthe\n[IAM Policy Analyzer](/policy-intelligence/docs/analyze-iam-policies#policy-analyzer-what-access-console).\n\nWhat's next\n-----------\n\n- Learn how to [use RBAC in Cloud Data Fusion](/data-fusion/docs/how-to/create-role-based-access-control)."]]
