Dataplex IAM ロール

Dataplex では、いくつかの Identity and Access Management（IAM）ロールが定義されています。各事前定義ロールには、プリンシパルが特定のアクションを実行できる一連の IAM 権限が含まれています。IAM ポリシーを使用して、プリンシパルに 1 つ以上の IAM ロールを付与できます。

Identity and Access Management（IAM）では、カスタマイズされた IAM ロールを作成することもできます。カスタムの IAM の役割を作成し、この役割に 1 つ以上の権限を割り当てることができます。その後、新しいロールをプリンシパルに付与できます。カスタムロールを使用して、使用可能な事前定義ロールとともにニーズに直接対応するアクセス制御モデルを作成します。

このドキュメントでは、Dataplex に関連する IAM ロールについて主に説明します。

始める前に

• IAM のドキュメントをお読みください。

Dataplex のロール

Identity and Access Management（IAM）の Dataplex ロールは、1 つ以上の権限の集まりです。プリンシパルがプロジェクトの Dataplex リソースを操作できるようにロールを付与します。たとえば、Dataplex 閲覧者ロールには、dataplex.*.get と dataplex.*.list の権限が含まれています。これらによって、ユーザーはプロジェクトの Dataplex のサービス、リソース、オペレーションを取得して一覧表示できます。

Dataplex のロールは、プロジェクト、レイク、データゾーンなど、サービス階層の任意のリソースに適用できます。

基本ロール

IAM の Project ロールを使用すると、基本ロールをプロジェクト レベルで割り当てることができます。IAM の Project ロールに関連付けられた権限の概要は、次のとおりです。

プロジェクトの役割	権限
プロジェクト所有者	すべてのプロジェクト編集者権限＋プロジェクトに対するアクセス制御を管理（get/set IamPolicy）し、プロジェクト課金をセットアップするための権限
プロジェクト編集者	プロジェクト閲覧者のすべての権限に加え、状態を変更するアクション（create、delete、update、use）に関するすべてのプロジェクト権限
プロジェクト閲覧者	状態を変更しない読み取り専用アクション（get、list）に関するすべてのプロジェクト権限

事前定義されたロール

次の表に、Dataplex の事前定義された（またはキュレートされた）ロールと、各ロールに関連付けられた権限を示します。

Role	Permissions
Dataplex Administrator (roles/dataplex.admin) Full access to Dataplex resources, except Dataplex Catalog.	cloudasset.assets.analyzeIamPolicy cloudasset.assets.searchAllIamPolicies cloudasset.assets.searchAllResources dataplex.assetActions.list dataplex.assets.create dataplex.assets.delete dataplex.assets.get dataplex.assets.getIamPolicy dataplex.assets.list dataplex.assets.setIamPolicy dataplex.assets.update dataplex.content.* dataplex.content.create dataplex.content.delete dataplex.content.get dataplex.content.getIamPolicy dataplex.content.list dataplex.content.setIamPolicy dataplex.content.update dataplex.dataAttributeBindings.* dataplex.dataAttributeBindings.create dataplex.dataAttributeBindings.delete dataplex.dataAttributeBindings.get dataplex.dataAttributeBindings.getIamPolicy dataplex.dataAttributeBindings.list dataplex.dataAttributeBindings.setIamPolicy dataplex.dataAttributeBindings.update dataplex.dataAttributes.* dataplex.dataAttributes.bind dataplex.dataAttributes.create dataplex.dataAttributes.delete dataplex.dataAttributes.get dataplex.dataAttributes.getIamPolicy dataplex.dataAttributes.list dataplex.dataAttributes.setIamPolicy dataplex.dataAttributes.update dataplex.dataTaxonomies.* dataplex.dataTaxonomies.configureDataAccess dataplex.dataTaxonomies.configureResourceAccess dataplex.dataTaxonomies.create dataplex.dataTaxonomies.delete dataplex.dataTaxonomies.get dataplex.dataTaxonomies.getIamPolicy dataplex.dataTaxonomies.list dataplex.dataTaxonomies.setIamPolicy dataplex.dataTaxonomies.update dataplex.datascans.* dataplex.datascans.create dataplex.datascans.delete dataplex.datascans.get dataplex.datascans.getData dataplex.datascans.getIamPolicy dataplex.datascans.list dataplex.datascans.run dataplex.datascans.setIamPolicy dataplex.datascans.update dataplex.entities.* dataplex.entities.create dataplex.entities.delete dataplex.entities.get dataplex.entities.list dataplex.entities.update dataplex.environments.* dataplex.environments.create dataplex.environments.delete dataplex.environments.execute dataplex.environments.get dataplex.environments.getIamPolicy dataplex.environments.list dataplex.environments.setIamPolicy dataplex.environments.update dataplex.lakeActions.list dataplex.lakes.* dataplex.lakes.create dataplex.lakes.delete dataplex.lakes.get dataplex.lakes.getIamPolicy dataplex.lakes.list dataplex.lakes.setIamPolicy dataplex.lakes.update dataplex.locations.* dataplex.locations.get dataplex.locations.list dataplex.operations.* dataplex.operations.cancel dataplex.operations.delete dataplex.operations.get dataplex.operations.list dataplex.partitions.* dataplex.partitions.create dataplex.partitions.delete dataplex.partitions.get dataplex.partitions.list dataplex.partitions.update dataplex.tasks.* dataplex.tasks.cancel dataplex.tasks.create dataplex.tasks.delete dataplex.tasks.get dataplex.tasks.getIamPolicy dataplex.tasks.list dataplex.tasks.run dataplex.tasks.setIamPolicy dataplex.tasks.update dataplex.zoneActions.list dataplex.zones.* dataplex.zones.create dataplex.zones.delete dataplex.zones.get dataplex.zones.getIamPolicy dataplex.zones.list dataplex.zones.setIamPolicy dataplex.zones.update resourcemanager.projects.get resourcemanager.projects.list
Dataplex Aspect Type Owner (roles/dataplex.aspectTypeOwner) Grants access to creating and managing Aspect Types. Does not give the right to create/modify Entries.	dataplex.aspectTypes.* dataplex.aspectTypes.create dataplex.aspectTypes.delete dataplex.aspectTypes.get dataplex.aspectTypes.getIamPolicy dataplex.aspectTypes.list dataplex.aspectTypes.setIamPolicy dataplex.aspectTypes.update dataplex.aspectTypes.use resourcemanager.projects.get resourcemanager.projects.list
Dataplex Aspect Type User (roles/dataplex.aspectTypeUser) Grants access to use Aspect Types to create/modify Entries with the corresponding aspects.	dataplex.aspectTypes.get dataplex.aspectTypes.list dataplex.aspectTypes.use resourcemanager.projects.get resourcemanager.projects.list
Dataplex Binding Administrator (roles/dataplex.bindingAdmin) Full access on DataAttribute Bindig resources.	dataplex.dataAttributeBindings.* dataplex.dataAttributeBindings.create dataplex.dataAttributeBindings.delete dataplex.dataAttributeBindings.get dataplex.dataAttributeBindings.getIamPolicy dataplex.dataAttributeBindings.list dataplex.dataAttributeBindings.setIamPolicy dataplex.dataAttributeBindings.update
Dataplex Catalog Admin (roles/dataplex.catalogAdmin) Has full access to Catalog resources: Entry Groups, Entry Types, Aspect Types and Entries.	dataplex.aspectTypes.* dataplex.aspectTypes.create dataplex.aspectTypes.delete dataplex.aspectTypes.get dataplex.aspectTypes.getIamPolicy dataplex.aspectTypes.list dataplex.aspectTypes.setIamPolicy dataplex.aspectTypes.update dataplex.aspectTypes.use dataplex.entries.* dataplex.entries.create dataplex.entries.delete dataplex.entries.get dataplex.entries.list dataplex.entries.update dataplex.entryGroups.* dataplex.entryGroups.create dataplex.entryGroups.delete dataplex.entryGroups.get dataplex.entryGroups.getIamPolicy dataplex.entryGroups.list dataplex.entryGroups.setIamPolicy dataplex.entryGroups.update dataplex.entryGroups.useContactsAspect dataplex.entryGroups.useGenericAspect dataplex.entryGroups.useGenericEntry dataplex.entryGroups.useOverviewAspect dataplex.entryGroups.useSchemaAspect dataplex.entryTypes.* dataplex.entryTypes.create dataplex.entryTypes.delete dataplex.entryTypes.get dataplex.entryTypes.getIamPolicy dataplex.entryTypes.list dataplex.entryTypes.setIamPolicy dataplex.entryTypes.update dataplex.entryTypes.use resourcemanager.projects.get resourcemanager.projects.list
Dataplex Catalog Editor (roles/dataplex.catalogEditor) Has write access to Catalog resources: Entry Groups, Entry Types, Aspect Types and Entries. Cannot set IAM policies on resources	dataplex.aspectTypes.create dataplex.aspectTypes.delete dataplex.aspectTypes.get dataplex.aspectTypes.getIamPolicy dataplex.aspectTypes.list dataplex.aspectTypes.update dataplex.aspectTypes.use dataplex.entries.* dataplex.entries.create dataplex.entries.delete dataplex.entries.get dataplex.entries.list dataplex.entries.update dataplex.entryGroups.create dataplex.entryGroups.delete dataplex.entryGroups.get dataplex.entryGroups.getIamPolicy dataplex.entryGroups.list dataplex.entryGroups.update dataplex.entryGroups.useContactsAspect dataplex.entryGroups.useGenericAspect dataplex.entryGroups.useGenericEntry dataplex.entryGroups.useOverviewAspect dataplex.entryGroups.useSchemaAspect dataplex.entryTypes.create dataplex.entryTypes.delete dataplex.entryTypes.get dataplex.entryTypes.getIamPolicy dataplex.entryTypes.list dataplex.entryTypes.update dataplex.entryTypes.use resourcemanager.projects.get resourcemanager.projects.list
Dataplex Catalog Viewer (roles/dataplex.catalogViewer) Has read access to Catalog resources: Entry Groups, Entry Types, Aspect Types and Entries. Can view IAM policies on Catalog resources.	dataplex.aspectTypes.get dataplex.aspectTypes.getIamPolicy dataplex.aspectTypes.list dataplex.entries.get dataplex.entries.list dataplex.entryGroups.get dataplex.entryGroups.getIamPolicy dataplex.entryGroups.list dataplex.entryTypes.get dataplex.entryTypes.getIamPolicy dataplex.entryTypes.list resourcemanager.projects.get resourcemanager.projects.list
Dataplex Data Owner (roles/dataplex.dataOwner) Owner access to data. To be granted to Dataplex resources Lake, Zone or Asset only.	dataplex.assets.ownData dataplex.assets.readData dataplex.assets.writeData
Dataplex Data Reader (roles/dataplex.dataReader) Read only access to data. To be granted to Dataplex resources Lake, Zone or Asset only.	dataplex.assets.readData
Dataplex DataScan Administrator (roles/dataplex.dataScanAdmin) Full access to DataScan resources.	dataplex.datascans.* dataplex.datascans.create dataplex.datascans.delete dataplex.datascans.get dataplex.datascans.getData dataplex.datascans.getIamPolicy dataplex.datascans.list dataplex.datascans.run dataplex.datascans.setIamPolicy dataplex.datascans.update dataplex.operations.get dataplex.operations.list
Dataplex DataScan Creator (roles/dataplex.dataScanCreator) Access to create new DataScan resources.	dataplex.datascans.create dataplex.datascans.get dataplex.datascans.list dataplex.operations.get
Dataplex DataScan DataViewer (roles/dataplex.dataScanDataViewer) Read access to DataScan resources and additional contents.	dataplex.datascans.get dataplex.datascans.getData dataplex.datascans.getIamPolicy dataplex.datascans.list
Dataplex DataScan Editor (roles/dataplex.dataScanEditor) Write access to DataScan resources.	dataplex.datascans.create dataplex.datascans.delete dataplex.datascans.get dataplex.datascans.getData dataplex.datascans.getIamPolicy dataplex.datascans.list dataplex.datascans.run dataplex.datascans.update dataplex.operations.get dataplex.operations.list
Dataplex DataScan Viewer (roles/dataplex.dataScanViewer) Read access to DataScan resources.	dataplex.datascans.get dataplex.datascans.getIamPolicy dataplex.datascans.list
Dataplex Data Writer (roles/dataplex.dataWriter) Write access to data. To be granted to Dataplex resources Lake, Zone or Asset only.	dataplex.assets.writeData
Dataplex Developer (roles/dataplex.developer) Allows running data analytics workloads in a lake.	dataplex.content.* dataplex.content.create dataplex.content.delete dataplex.content.get dataplex.content.getIamPolicy dataplex.content.list dataplex.content.setIamPolicy dataplex.content.update dataplex.environments.execute dataplex.environments.get dataplex.environments.list dataplex.tasks.cancel dataplex.tasks.create dataplex.tasks.delete dataplex.tasks.get dataplex.tasks.list dataplex.tasks.run dataplex.tasks.update
Dataplex Editor (roles/dataplex.editor) Write access to Dataplex resources.	cloudasset.assets.analyzeIamPolicy dataplex.assetActions.list dataplex.assets.create dataplex.assets.delete dataplex.assets.get dataplex.assets.getIamPolicy dataplex.assets.list dataplex.assets.update dataplex.content.delete dataplex.content.get dataplex.content.getIamPolicy dataplex.content.list dataplex.dataAttributeBindings.create dataplex.dataAttributeBindings.delete dataplex.dataAttributeBindings.get dataplex.dataAttributeBindings.getIamPolicy dataplex.dataAttributeBindings.list dataplex.dataAttributeBindings.update dataplex.dataAttributes.bind dataplex.dataAttributes.create dataplex.dataAttributes.delete dataplex.dataAttributes.get dataplex.dataAttributes.getIamPolicy dataplex.dataAttributes.list dataplex.dataAttributes.update dataplex.dataTaxonomies.configureDataAccess dataplex.dataTaxonomies.configureResourceAccess dataplex.dataTaxonomies.create dataplex.dataTaxonomies.delete dataplex.dataTaxonomies.get dataplex.dataTaxonomies.getIamPolicy dataplex.dataTaxonomies.list dataplex.dataTaxonomies.update dataplex.datascans.create dataplex.datascans.delete dataplex.datascans.get dataplex.datascans.getIamPolicy dataplex.datascans.list dataplex.datascans.run dataplex.datascans.update dataplex.environments.create dataplex.environments.delete dataplex.environments.get dataplex.environments.getIamPolicy dataplex.environments.list dataplex.environments.update dataplex.lakeActions.list dataplex.lakes.create dataplex.lakes.delete dataplex.lakes.get dataplex.lakes.getIamPolicy dataplex.lakes.list dataplex.lakes.update dataplex.operations.* dataplex.operations.cancel dataplex.operations.delete dataplex.operations.get dataplex.operations.list dataplex.tasks.cancel dataplex.tasks.create dataplex.tasks.delete dataplex.tasks.get dataplex.tasks.getIamPolicy dataplex.tasks.list dataplex.tasks.run dataplex.tasks.update dataplex.zoneActions.list dataplex.zones.create dataplex.zones.delete dataplex.zones.get dataplex.zones.getIamPolicy dataplex.zones.list dataplex.zones.update
Dataplex Entry Group Owner (roles/dataplex.entryGroupOwner) Owns Entry Groups and Entries inside of them.	dataplex.aspectTypes.get dataplex.aspectTypes.list dataplex.aspectTypes.use dataplex.entries.* dataplex.entries.create dataplex.entries.delete dataplex.entries.get dataplex.entries.list dataplex.entries.update dataplex.entryGroups.* dataplex.entryGroups.create dataplex.entryGroups.delete dataplex.entryGroups.get dataplex.entryGroups.getIamPolicy dataplex.entryGroups.list dataplex.entryGroups.setIamPolicy dataplex.entryGroups.update dataplex.entryGroups.useContactsAspect dataplex.entryGroups.useGenericAspect dataplex.entryGroups.useGenericEntry dataplex.entryGroups.useOverviewAspect dataplex.entryGroups.useSchemaAspect dataplex.entryTypes.get dataplex.entryTypes.list dataplex.entryTypes.use resourcemanager.projects.get resourcemanager.projects.list
Dataplex Entry Owner (roles/dataplex.entryOwner) Owns Metadata Entries.	dataplex.aspectTypes.get dataplex.aspectTypes.list dataplex.aspectTypes.use dataplex.entries.* dataplex.entries.create dataplex.entries.delete dataplex.entries.get dataplex.entries.list dataplex.entries.update dataplex.entryGroups.get dataplex.entryGroups.useContactsAspect dataplex.entryGroups.useGenericAspect dataplex.entryGroups.useGenericEntry dataplex.entryGroups.useOverviewAspect dataplex.entryGroups.useSchemaAspect dataplex.entryTypes.get dataplex.entryTypes.list dataplex.entryTypes.use resourcemanager.projects.get resourcemanager.projects.list
Dataplex Entry Type Owner (roles/dataplex.entryTypeOwner) Grants access to creating and managing Entry Types. Does not give the right to create/modify Entries.	dataplex.entryTypes.* dataplex.entryTypes.create dataplex.entryTypes.delete dataplex.entryTypes.get dataplex.entryTypes.getIamPolicy dataplex.entryTypes.list dataplex.entryTypes.setIamPolicy dataplex.entryTypes.update dataplex.entryTypes.use resourcemanager.projects.get resourcemanager.projects.list
Dataplex Entry Type User (roles/dataplex.entryTypeUser) Grants access to use Entry Types to create/modify Entries of those types.	dataplex.entryTypes.get dataplex.entryTypes.list dataplex.entryTypes.use resourcemanager.projects.get resourcemanager.projects.list
Dataplex Metadata Reader (roles/dataplex.metadataReader) Read only access to metadata.	dataplex.assets.get dataplex.assets.list dataplex.entities.get dataplex.entities.list dataplex.partitions.get dataplex.partitions.list dataplex.zones.get dataplex.zones.list resourcemanager.projects.get resourcemanager.projects.list
Dataplex Metadata Writer (roles/dataplex.metadataWriter) Write and Read access to metadata.	dataplex.assets.get dataplex.assets.list dataplex.entities.* dataplex.entities.create dataplex.entities.delete dataplex.entities.get dataplex.entities.list dataplex.entities.update dataplex.partitions.* dataplex.partitions.create dataplex.partitions.delete dataplex.partitions.get dataplex.partitions.list dataplex.partitions.update dataplex.zones.get dataplex.zones.list resourcemanager.projects.get resourcemanager.projects.list
Dataplex Security Administrator (roles/dataplex.securityAdmin) Permissions configure ResourceAccess and DataAccess Specs on Data Attributes.	dataplex.dataTaxonomies.configureDataAccess dataplex.dataTaxonomies.configureResourceAccess
Dataplex Storage Data Owner (roles/dataplex.storageDataOwner) Owner access to data. Should not be used directly. This role is granted by Dataplex to managed resources like Cloud Storage buckets, BigQuery datasets etc.	bigquery.datasets.get bigquery.models.create bigquery.models.delete bigquery.models.export bigquery.models.getData bigquery.models.getMetadata bigquery.models.list bigquery.models.updateData bigquery.models.updateMetadata bigquery.routines.create bigquery.routines.delete bigquery.routines.get bigquery.routines.list bigquery.routines.update bigquery.tables.create bigquery.tables.createSnapshot bigquery.tables.delete bigquery.tables.deleteSnapshot bigquery.tables.export bigquery.tables.get bigquery.tables.getData bigquery.tables.list bigquery.tables.restoreSnapshot bigquery.tables.update bigquery.tables.updateData storage.buckets.get storage.objects.create storage.objects.delete storage.objects.get storage.objects.list storage.objects.update
Dataplex Storage Data Reader (roles/dataplex.storageDataReader) Read only access to data. Should not be used directly. This role is granted by Dataplex to managed resources like Cloud Storage buckets, BigQuery datasets etc.	bigquery.datasets.get bigquery.models.export bigquery.models.getData bigquery.models.getMetadata bigquery.models.list bigquery.routines.get bigquery.routines.list bigquery.tables.export bigquery.tables.get bigquery.tables.getData bigquery.tables.list storage.buckets.get storage.objects.get storage.objects.list
Dataplex Storage Data Writer (roles/dataplex.storageDataWriter) Write access to data. Should not be used directly. This role is granted by Dataplex to managed resources like Cloud Storage buckets, BigQuery datasets etc.	bigquery.tables.updateData storage.objects.create storage.objects.delete storage.objects.update
Dataplex Taxonomy Administrator (roles/dataplex.taxonomyAdmin) Full access to DataTaxonomy, DataAttribute resources.	dataplex.dataAttributes.* dataplex.dataAttributes.bind dataplex.dataAttributes.create dataplex.dataAttributes.delete dataplex.dataAttributes.get dataplex.dataAttributes.getIamPolicy dataplex.dataAttributes.list dataplex.dataAttributes.setIamPolicy dataplex.dataAttributes.update dataplex.dataTaxonomies.create dataplex.dataTaxonomies.delete dataplex.dataTaxonomies.get dataplex.dataTaxonomies.getIamPolicy dataplex.dataTaxonomies.list dataplex.dataTaxonomies.setIamPolicy dataplex.dataTaxonomies.update
Dataplex Taxonomy Viewer (roles/dataplex.taxonomyViewer) Read access on DataTaxonomy, DataAttribute resources.	dataplex.dataAttributes.get dataplex.dataAttributes.getIamPolicy dataplex.dataAttributes.list dataplex.dataTaxonomies.get dataplex.dataTaxonomies.getIamPolicy dataplex.dataTaxonomies.list
Dataplex Viewer (roles/dataplex.viewer) Read access to Dataplex resources.	cloudasset.assets.analyzeIamPolicy dataplex.assetActions.list dataplex.assets.get dataplex.assets.getIamPolicy dataplex.assets.list dataplex.content.get dataplex.content.getIamPolicy dataplex.content.list dataplex.dataAttributeBindings.get dataplex.dataAttributeBindings.getIamPolicy dataplex.dataAttributeBindings.list dataplex.dataAttributes.get dataplex.dataAttributes.getIamPolicy dataplex.dataAttributes.list dataplex.dataTaxonomies.get dataplex.dataTaxonomies.getIamPolicy dataplex.dataTaxonomies.list dataplex.datascans.get dataplex.datascans.getIamPolicy dataplex.datascans.list dataplex.environments.get dataplex.environments.getIamPolicy dataplex.environments.list dataplex.lakeActions.list dataplex.lakes.get dataplex.lakes.getIamPolicy dataplex.lakes.list dataplex.operations.get dataplex.operations.list dataplex.tasks.get dataplex.tasks.getIamPolicy dataplex.tasks.list dataplex.zoneActions.list dataplex.zones.get dataplex.zones.getIamPolicy dataplex.zones.list

データのロール

Dataplex では、Dataplex によって管理されるあらゆるリソースに適用されることを目的とした次の 3 つの IAM ロールを定義します。 各ロールに関連付けられている権限の詳細については、このドキュメントの事前定義ロールのセクションをご覧ください。

データのロール	機能	理由
Dataplex データオーナー（roles/dataplex.dataOwner）	マネージド リソースに対するすべての権限。および、すべての子リソースに対するすべての権限（リソースタイプに関係なく）。	データオーナーは、他のさまざまな権限に加えて、リソース メタデータの更新、より細かい粒度の権限（たとえば、BigQuery データセットの子テーブル）の付与、子リソースの作成を行うことができます。データオーナーは、リソースの完全な所有権を持っています。
Dataplex データリーダー（roles/dataplex.dataReader）	マネージド リソースとその子のデータを読み取る能力。そして、マネージド リソースとその子のメタデータを読み取る能力。	データとメタデータを読み取る能力を有効にします。
Dataplex データライター（roles/dataplex.dataWriter）	データを作成 / 更新 / 削除する機能（メタデータではない）。	Dataplex の主要なユーザー ジャーニーを可能にします。

次のステップ

• カスタムの IAM ロールを作成する方法を確認する。
• ロールを付与して管理する方法を確認する。
• Dataplex IAM 権限マッピングを確認する。