프로젝트 또는 조직 내 사용자의 액세스 권한을 제한하려면 Database Migration Service 및 관련 대상 데이터베이스 제품에 Identity and Access Management (IAM) 역할을 사용하면 됩니다. 사용자에게 전체 Google Cloud 프로젝트에 대한 뷰어, 편집자 또는 소유자 역할을 부여하는 대신 Database Migration Service 관련 리소스에 대한 액세스 권한을 제어할 수 있습니다.
이 페이지에서는 Database Migration Service를 사용한 동질적인 Cloud SQL 이전 중에 사용자 및 서비스 계정에 필요한 모든 역할에 대해 자세히 설명합니다.
마이그레이션 프로세스 중에 이러한 권한을 사용하는 경우에 관한 자세한 내용은
SQL Server 데이터베이스를 SQL Server용 Cloud SQL로 마이그레이션을 참고하세요.
이전 작업 실행과 관련된 계정
Database Migration Service로 수행되는 데이터 이전에는 세 가지 계정이 관여합니다.
이전을 실행하는 사용자 계정
연결 프로필을 만들고, 백업 파일을 Cloud Storage 저장소에 업로드하고, 이전 작업을 만들고 실행하는 데 로그인하는
Google 계정입니다.
Database Migration Service 서비스 계정
Database Migration Service API를 사용 설정할 때 생성되는 서비스 계정입니다. 이 계정과 연결된 이메일 주소는 자동으로 생성되며 변경할 수 없습니다. 이 이메일 주소의 형식은 다음과 같습니다.
특히 대상 SQL Server용 Cloud SQL 인스턴스에 할당되는 서비스 계정이며, 대상 인스턴스를 만든 후에 생성됩니다. Cloud SQL 인스턴스 세부정보 페이지에서 이 서비스 계정과 연결된 이메일 주소를 확인할 수 있습니다.
SQL Server용 Cloud SQL 문서의
인스턴스 정보 보기를 참고하세요.
데이터 이전 프로세스에 참여하는 각 계정에는 서로 다른 역할 및 권한이 필요합니다.
권한 및 역할
Database Migration Service로 동질적인 SQL Server 이전을 실행하는 데 필요한 권한을 얻으려면 관리자에게 프로젝트에서 다음 계정에 필요한 IAM 역할을 부여해 달라고 요청하세요.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-05(UTC)"],[[["\u003cp\u003eThis document outlines the necessary Identity and Access Management (IAM) roles for users and service accounts involved in homogeneous Cloud SQL migrations using Database Migration Service.\u003c/p\u003e\n"],["\u003cp\u003eThere are three types of accounts involved in the migration process: the user account performing the migration, the Database Migration Service service account, and the Cloud SQL instance service account.\u003c/p\u003e\n"],["\u003cp\u003eEach account involved in the migration requires distinct IAM roles, such as Database Migration Admin, Storage Admin, Cloud SQL Editor, Cloud SQL Studio User, and Storage Object Viewer.\u003c/p\u003e\n"],["\u003cp\u003eSpecific permissions, like \u003ccode\u003edatamigration.*\u003c/code\u003e, \u003ccode\u003ecloudsql.instances.create\u003c/code\u003e, and \u003ccode\u003estorage.objects.list\u003c/code\u003e, are necessary for each account type to carry out the migration successfully.\u003c/p\u003e\n"],["\u003cp\u003eYou can also create custom roles or use other predefined roles to carry out the same permissions.\u003c/p\u003e\n"]]],[],null,["# Access control with IAM\n\nTo limit access for users within a project or organization, you can use\nIdentity and Access Management (IAM) roles for Database Migration Service and your relevant\ndestination database product. You can control\naccess to Database Migration Service-related resources, as opposed to granting users\nthe Viewer, Editor, or Owner role to the entire Google Cloud project.\n\nThis page focuses details all of the roles that user and service accounts need\nduring a homogeneous Cloud SQL migration with Database Migration Service.\nFor more information about when you use these permissions during the migration process, see\n[Migrate your SQL Server databases to Cloud SQL for SQL Server](/database-migration/docs/sqlserver/guide).\n\nAccounts involved in performing migration jobs\n----------------------------------------------\n\nThere are three accounts involved in data migrations performed with\nDatabase Migration Service:\n\nUser account that performs the migration\n: This is the\n [Google Account](/iam/docs/overview#google_account) that you sign in with to create the connection profiles,\n upload the backup files to the Cloud Storage storage, create and run the migration\n job.\n\nDatabase Migration Service service account\n: This is the service account that is created for you when you enable the\n Database Migration Service API. The email address associated with this account is generated\n automatically and can't be changed. This email address uses the following\n format: \n\n ```\n service-PROJECT_NUMBER@gcp-sa-datamigration.iam.gserviceaccount.com\n ```\n\nCloud SQL instance service account\n: This is a service account assigned specifically to your destination\n Cloud SQL for SQL Server instance. It is created after you create the destination\n instance. You can view the email address associated with this service account\n on the Cloud SQL instance detail page.\n See [View instance information](/sql/docs/sqlserver/instance-info#service_account) in the Cloud SQL for SQL Server documentation.\n\nEach account involved in the data migration process requires a different\nset of roles and permissions.\n\nPermissions and roles\n---------------------\n\nTo get the permissions that you need to perform homogeneous SQL Server\nmigrations with Database Migration Service, ask your administrator to grant the\nrequired IAM roles on your project for the following accounts:\n\n- User account that performs the migration:\n - [Database Migration Admin](/iam/docs/roles-permissions/datamigration#datamigration.admin) (`roles/datamigration.admin`)\n - [Storage Admin](/iam/docs/roles-permissions/storage#storage.admin) (`roles/storage.admin`)\n - [Cloud SQL Editor](/iam/docs/roles-permissions/cloudsql#cloudsql.editor) (`roles/cloudsql.editor`)\n- Database Migration Service service account:\n - [Database Migration Admin](/iam/docs/roles-permissions/datamigration#datamigration.admin) (`roles/datamigration.admin`)\n - [Storage Admin](/iam/docs/roles-permissions/storage#storage.admin) (`roles/storage.admin`)\n - [Cloud SQL Editor](/iam/docs/roles-permissions/cloudsql#cloudsql.editor) (`roles/cloudsql.editor`)\n - [Cloud SQL Studio User](/iam/docs/roles-permissions/cloudsql#cloudsql.studioUser) (`roles/cloudsql.studioUser`)\n- Cloud SQL instance service account: [Storage Object Viewer](/iam/docs/roles-permissions/storage#storage.objectViewer) (`roles/storage.objectViewer`)\n\nFor more information about granting roles, see\n[Manage access](/iam/docs/granting-changing-revoking-access).\n\nThese predefined roles contain the permissions required to perform homogeneous\nSQL Server migrations with Database Migration Service. To see the exact permissions\nthat are required, expand the **Required permissions** section: \n\n#### Required permissions\n\nThe following permissions are required to perform homogeneous SQL Server\nmigrations with Database Migration Service:\n\n- User account that performs the migration:\n - `datamigration.* `\n - `resourcemanager.projects.get`\n - `resourcemanager.projects.list`\n - `cloudsql.operations.get`\n - `cloudsql.instances.create`\n - `cloudsql.instances.get`\n - `cloudsql.instances.list`\n - `cloudsql.instances.import`\n - `cloudsql.databases.get`\n - `cloudsql.databases.list`\n - `cloudsql.databases.delete`\n - `compute.machineTypes.list`\n - `compute.machineTypes.get`\n - `compute.projects.get`\n - `storage.buckets.create`\n - `storage.buckets.list`\n- Database Migration Service service account:\n - `datamigration.* `\n - `resourcemanager.projects.get`\n - `resourcemanager.projects.list`\n - `cloudsql.instances.create`\n - `cloudsql.instances.get`\n - `cloudsql.instances.list`\n - `cloudsql.instances.executeSql`\n - `storage.objects.create`\n - `storage.objects.list`\n- Cloud SQL instance service account:\n - `storage.objects.list`\n - `storage.objects.get`\n\nYou might also be able to get these permissions with\n[custom roles](/iam/docs/creating-custom-roles) or other\n[predefined roles](/iam/docs/roles-permissions)."]]
