Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Untuk membatasi akses bagi pengguna dalam project atau organisasi, Anda dapat menggunakan peran Identity and Access Management (IAM) untuk Database Migration Service dan produk database tujuan yang relevan. Anda dapat mengontrol akses ke resource terkait Layanan Migrasi Database, bukan memberikan peran Viewer, Editor, atau Pemilik kepada pengguna untuk seluruh project Google Cloud .
Halaman ini berfokus menjelaskan semua peran yang diperlukan akun pengguna dan layanan
selama migrasi Cloud SQL homogen dengan Database Migration Service.
Untuk mengetahui informasi selengkapnya tentang kapan Anda menggunakan izin ini selama proses migrasi, lihat
Memigrasikan database SQL Server ke Cloud SQL untuk SQL Server.
Akun yang terlibat dalam menjalankan tugas migrasi
Ada tiga akun yang terlibat dalam migrasi data yang dilakukan dengan
Database Migration Service:
Akun pengguna yang melakukan migrasi
Ini adalah
Akun Google yang Anda gunakan untuk login guna membuat profil koneksi,
mengupload file cadangan ke penyimpanan Cloud Storage, membuat dan menjalankan tugas
migrasi.
Akun layanan Database Migration Service
Ini adalah akun layanan yang dibuat untuk Anda saat Anda mengaktifkan Database Migration Service API. Alamat email yang terkait dengan akun ini dibuat secara otomatis dan tidak dapat diubah. Alamat email ini menggunakan format
berikut:
service-PROJECT_NUMBER@gcp-sa-datamigration.
Akun layanan instance Cloud SQL
Ini adalah akun layanan yang ditetapkan secara khusus ke instance Cloud SQL untuk SQL Server tujuan Anda. Ini dibuat setelah Anda membuat instance tujuan. Anda dapat melihat alamat email yang terkait dengan akun layanan ini di halaman detail instance Cloud SQL.
Lihat
Melihat informasi instance dalam dokumentasi Cloud SQL untuk SQL Server.
Setiap akun yang terlibat dalam proses migrasi data memerlukan kumpulan peran dan izin yang berbeda.
Izin dan peran
Untuk mendapatkan izin yang diperlukan guna melakukan migrasi SQL Server homogen dengan Database Migration Service, minta administrator untuk memberikan peran IAM yang diperlukan di project Anda untuk akun berikut:
Untuk mengetahui informasi selengkapnya tentang cara memberikan peran, lihat
Mengelola akses.
Peran yang telah ditetapkan ini berisi izin yang diperlukan untuk melakukan migrasi SQL Server homogen dengan Database Migration Service. Untuk melihat izin yang benar-benar diperlukan, luaskan bagian Izin yang diperlukan:
Izin yang diperlukan
Izin berikut diperlukan untuk melakukan migrasi SQL Server homogen dengan Database Migration Service:
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-05 UTC."],[[["\u003cp\u003eThis document outlines the necessary Identity and Access Management (IAM) roles for users and service accounts involved in homogeneous Cloud SQL migrations using Database Migration Service.\u003c/p\u003e\n"],["\u003cp\u003eThere are three types of accounts involved in the migration process: the user account performing the migration, the Database Migration Service service account, and the Cloud SQL instance service account.\u003c/p\u003e\n"],["\u003cp\u003eEach account involved in the migration requires distinct IAM roles, such as Database Migration Admin, Storage Admin, Cloud SQL Editor, Cloud SQL Studio User, and Storage Object Viewer.\u003c/p\u003e\n"],["\u003cp\u003eSpecific permissions, like \u003ccode\u003edatamigration.*\u003c/code\u003e, \u003ccode\u003ecloudsql.instances.create\u003c/code\u003e, and \u003ccode\u003estorage.objects.list\u003c/code\u003e, are necessary for each account type to carry out the migration successfully.\u003c/p\u003e\n"],["\u003cp\u003eYou can also create custom roles or use other predefined roles to carry out the same permissions.\u003c/p\u003e\n"]]],[],null,["# Access control with IAM\n\nTo limit access for users within a project or organization, you can use\nIdentity and Access Management (IAM) roles for Database Migration Service and your relevant\ndestination database product. You can control\naccess to Database Migration Service-related resources, as opposed to granting users\nthe Viewer, Editor, or Owner role to the entire Google Cloud project.\n\nThis page focuses details all of the roles that user and service accounts need\nduring a homogeneous Cloud SQL migration with Database Migration Service.\nFor more information about when you use these permissions during the migration process, see\n[Migrate your SQL Server databases to Cloud SQL for SQL Server](/database-migration/docs/sqlserver/guide).\n\nAccounts involved in performing migration jobs\n----------------------------------------------\n\nThere are three accounts involved in data migrations performed with\nDatabase Migration Service:\n\nUser account that performs the migration\n: This is the\n [Google Account](/iam/docs/overview#google_account) that you sign in with to create the connection profiles,\n upload the backup files to the Cloud Storage storage, create and run the migration\n job.\n\nDatabase Migration Service service account\n: This is the service account that is created for you when you enable the\n Database Migration Service API. The email address associated with this account is generated\n automatically and can't be changed. This email address uses the following\n format: \n\n ```\n service-PROJECT_NUMBER@gcp-sa-datamigration.iam.gserviceaccount.com\n ```\n\nCloud SQL instance service account\n: This is a service account assigned specifically to your destination\n Cloud SQL for SQL Server instance. It is created after you create the destination\n instance. You can view the email address associated with this service account\n on the Cloud SQL instance detail page.\n See [View instance information](/sql/docs/sqlserver/instance-info#service_account) in the Cloud SQL for SQL Server documentation.\n\nEach account involved in the data migration process requires a different\nset of roles and permissions.\n\nPermissions and roles\n---------------------\n\nTo get the permissions that you need to perform homogeneous SQL Server\nmigrations with Database Migration Service, ask your administrator to grant the\nrequired IAM roles on your project for the following accounts:\n\n- User account that performs the migration:\n - [Database Migration Admin](/iam/docs/roles-permissions/datamigration#datamigration.admin) (`roles/datamigration.admin`)\n - [Storage Admin](/iam/docs/roles-permissions/storage#storage.admin) (`roles/storage.admin`)\n - [Cloud SQL Editor](/iam/docs/roles-permissions/cloudsql#cloudsql.editor) (`roles/cloudsql.editor`)\n- Database Migration Service service account:\n - [Database Migration Admin](/iam/docs/roles-permissions/datamigration#datamigration.admin) (`roles/datamigration.admin`)\n - [Storage Admin](/iam/docs/roles-permissions/storage#storage.admin) (`roles/storage.admin`)\n - [Cloud SQL Editor](/iam/docs/roles-permissions/cloudsql#cloudsql.editor) (`roles/cloudsql.editor`)\n - [Cloud SQL Studio User](/iam/docs/roles-permissions/cloudsql#cloudsql.studioUser) (`roles/cloudsql.studioUser`)\n- Cloud SQL instance service account: [Storage Object Viewer](/iam/docs/roles-permissions/storage#storage.objectViewer) (`roles/storage.objectViewer`)\n\nFor more information about granting roles, see\n[Manage access](/iam/docs/granting-changing-revoking-access).\n\nThese predefined roles contain the permissions required to perform homogeneous\nSQL Server migrations with Database Migration Service. To see the exact permissions\nthat are required, expand the **Required permissions** section: \n\n#### Required permissions\n\nThe following permissions are required to perform homogeneous SQL Server\nmigrations with Database Migration Service:\n\n- User account that performs the migration:\n - `datamigration.* `\n - `resourcemanager.projects.get`\n - `resourcemanager.projects.list`\n - `cloudsql.operations.get`\n - `cloudsql.instances.create`\n - `cloudsql.instances.get`\n - `cloudsql.instances.list`\n - `cloudsql.instances.import`\n - `cloudsql.databases.get`\n - `cloudsql.databases.list`\n - `cloudsql.databases.delete`\n - `compute.machineTypes.list`\n - `compute.machineTypes.get`\n - `compute.projects.get`\n - `storage.buckets.create`\n - `storage.buckets.list`\n- Database Migration Service service account:\n - `datamigration.* `\n - `resourcemanager.projects.get`\n - `resourcemanager.projects.list`\n - `cloudsql.instances.create`\n - `cloudsql.instances.get`\n - `cloudsql.instances.list`\n - `cloudsql.instances.executeSql`\n - `storage.objects.create`\n - `storage.objects.list`\n- Cloud SQL instance service account:\n - `storage.objects.list`\n - `storage.objects.get`\n\nYou might also be able to get these permissions with\n[custom roles](/iam/docs/creating-custom-roles) or other\n[predefined roles](/iam/docs/roles-permissions)."]]
