このページでは、別の Google Cloud プロジェクトで Dataproc クラスタを使用するパイプラインをデプロイして実行する際のアクセス制御の管理について説明します。
シナリオ
デフォルトでは、Cloud Data Fusion インスタンスが Google Cloud プロジェクトで起動されると、同じプロジェクト内の Dataproc クラスタを使用してパイプラインをデプロイして実行します。ただし、組織によっては、別のプロジェクトでクラスタを使用することが必要な場合があります。このユースケースでは、プロジェクト間のアクセスを管理する必要があります。次のページでは、ベースライン（デフォルト）構成を変更して適切なアクセス制御を適用する方法について説明します。
[[["わかりやすい","easyToUnderstand","thumb-up"],["問題の解決に役立った","solvedMyProblem","thumb-up"],["その他","otherUp","thumb-up"]],[["わかりにくい","hardToUnderstand","thumb-down"],["情報またはサンプルコードが不正確","incorrectInformationOrSampleCode","thumb-down"],["必要な情報 / サンプルがない","missingTheInformationSamplesINeed","thumb-down"],["翻訳に関する問題","translationIssue","thumb-down"],["その他","otherDown","thumb-down"]],["最終更新日 2025-09-04 UTC。"],[[["\u003cp\u003eThis document outlines how to manage access control for Cloud Data Fusion pipelines that utilize Dataproc clusters in a different Google Cloud project than the one where the Cloud Data Fusion instance is deployed.\u003c/p\u003e\n"],["\u003cp\u003eThe solution details a comparison between the default baseline configuration, where both the Cloud Data Fusion instance and Dataproc clusters reside in the same project, and a use case configuration where they exist in separate projects, specifically highlighting the changes for using Dataproc clusters in the \u003cem\u003eDataproc project\u003c/em\u003e.\u003c/p\u003e\n"],["\u003cp\u003eThe use case requires granting specific IAM roles to the Cloud Data Fusion API Service Agent and the default Compute Engine service account in the \u003cem\u003eDataproc project\u003c/em\u003e to enable communication and resource access across projects.\u003c/p\u003e\n"],["\u003cp\u003eWhen running in separate projects, it is necessary to manually enable the Resource Manager API and ensure the Compute Engine and Dataproc APIs are enabled in the \u003cem\u003eDataproc project\u003c/em\u003e.\u003c/p\u003e\n"],["\u003cp\u003eIf Customer-Managed Encryption Keys (CMEK) are used, the Cloud KMS CryptoKey Encrypter/Decrypter role must be granted to relevant service accounts in the project where the key is created, and this requirement is further detailed in separate use case instructions.\u003c/p\u003e\n"]]],[],null,["# Use case: Access control for a Dataproc cluster in another project\n\nThis page describes managing access control when you deploy and run a pipeline\nthat uses Dataproc clusters in another Google Cloud project.\n\nScenario\n--------\n\nBy default, when a Cloud Data Fusion instance is launched in a\nGoogle Cloud project, it deploys and runs pipelines using\nDataproc clusters within the same project. However, your\norganization might require you to use clusters in another project. For this\nuse case, you must manage access between the projects. The following page\ndescribes how you can change the *baseline* (default) configurations and apply\nthe appropriate access controls.\n\nBefore you begin\n----------------\n\nTo understand the solutions in this use case, you need the following context:\n\n- Familiarity with basic [Cloud Data Fusion concepts](/data-fusion/docs/concepts/overview#explore-concepts)\n- Familiarity with [Identity and Access Management (IAM) for Cloud Data Fusion](/data-fusion/docs/access-control)\n- Familiarity with [Cloud Data Fusion networking](/data-fusion/docs/concepts/networking)\n\nAssumptions and scope\n---------------------\n\nThis use case has the following requirements:\n\n- A [private Cloud Data Fusion instance](/data-fusion/docs/how-to/create-private-ip). For security reasons, an organization may require that you use this type of instance.\n- A BigQuery source and sink.\n- Access control with IAM, not role-based access control (RBAC).\n\n| **Note:** This use case doesn't show networking scenarios where sources and sinks are in other VPCs.\n\nSolution\n--------\n\nThis solution compares baseline and use case specific architecture and\nconfiguration.\n\n### Architecture\n\nThe following diagrams compare the project architecture for creating a\nCloud Data Fusion instance and running pipelines when you use clusters in\nthe same project (baseline) and in a different project through the tenant\nproject VPC.\n\n#### Baseline architecture\n\nThis diagram shows the baseline architecture of the projects:\n\nFor the baseline configuration, you create a private Cloud Data Fusion\ninstance and run a pipeline with no additional customization:\n\n- You use one of the built-in compute profiles\n- The source and sink are in the same project as the instance\n- No additional roles have been granted to any of the service accounts\n\nFor more information about tenant and customer projects, see\n[Networking](/data-fusion/docs/concepts/networking).\n\n#### Use case architecture\n\nThis diagram shows the project architecture when you use clusters in another\nproject:\n\n### Configurations\n\nThe following sections compare the baseline configurations to the use case\nspecific configurations for using Dataproc clusters in a\ndifferent project through the default, tenant project VPC.\n\nIn the following use case descriptions, the *customer project* is where the\nCloud Data Fusion instance runs and the *Dataproc project*\nis where the Dataproc cluster is launched.\n| **Note:** The use case configurations assume that you use the default Compute Engine service account in the Dataproc project for running Dataproc jobs.\n\n#### Tenant project VPC and instance\n\n#### Customer project\n\n#### Customer VPC\n\n#### Cloud Data Fusion subnet\n\n#### Dataproc subnet\n\n#### Sources and sinks\n\n#### Cloud Storage\n\n#### Temporary buckets used by source and sink\n\n#### Buckets that are sources or sinks of data for plugins\n\n#### IAM: Cloud Data Fusion API Service Agent\n\n#### IAM: Dataproc service account\n\n#### APIs\n\n#### Encryption keys\n\nAfter you make these use case specific configurations, your data pipeline can\nstart running on clusters in another project.\n\nWhat's next\n-----------\n\n- Learn more about [networking in Cloud Data Fusion](/data-fusion/docs/concepts/networking).\n- Refer to the [IAM basic and predefined roles reference](/iam/docs/understanding-roles)."]]
