Google Cloud 提供身分與存取權管理 (IAM) 功能，可讓您以更精細的方式授予特定 Google Cloud 資源的存取權，避免其他資源遭到未經授權者擅自存取。IAM 能讓您採用最低權限安全性原則，僅授予必要的資源存取權限給使用者。
您也可以設定 IAM 政策，控管哪些身分具備哪些資源的哪些權限 (角色)。身分與存取權管理政策可將特定角色授予專案成員，讓對方擁有特定權限。舉例來說，您可以將某個特定資源 (例如專案) 的 roles/metastore.admin 角色指派給一個 Google 帳戶，該帳戶即可控管專案中的 Dataproc Metastore 資源，但無法管理其他資源。您也可以使用 IAM 管理授予專案團隊成員的基本角色。
使用者的存取權控制選項
如要讓使用者建立和管理 Dataproc Metastore 資源，您可以將使用者新增為專案或特定資源的團隊成員，並使用 IAM 角色來授予權限。
團隊成員可以是具備有效 Google 帳戶的個別使用者、Google 群組、服務帳戶或 Google Workspace 網域。新增專案或資源團隊成員時，您必須指定要授予他們的角色。
IAM 提供三種角色類型：預先定義的角色、基本角色和自訂角色。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[[["\u003cp\u003eBy default, only the original project creator has access to a new Google Cloud project and its Dataproc Metastore resources.\u003c/p\u003e\n"],["\u003cp\u003eIdentity and Access Management (IAM) allows for granular control over who can access Google Cloud resources, adhering to the principle of least privilege.\u003c/p\u003e\n"],["\u003cp\u003eUsers can be added as team members to a project or specific resources, and they can be granted permissions via predefined, basic, or custom IAM roles.\u003c/p\u003e\n"],["\u003cp\u003eIAM policies can be applied at the project level or directly to individual Dataproc Metastore resources, with resources inheriting policies from their parent resources.\u003c/p\u003e\n"],["\u003cp\u003eDataproc Metastore utilizes a service agent service account to perform actions on behalf of the user, requiring appropriate permissions, like the \u003ccode\u003estorage.objectAdmin\u003c/code\u003e role for Hive metastore warehouse directories.\u003c/p\u003e\n"]]],[],null,["# Dataproc Metastore: Access control with IAM\n\nBy default, all Google Cloud projects come with a single user, the\noriginal project creator. No other users have access to the project, and\ntherefore, access to Dataproc Metastore resources, until a user\nis added as a project member or is bound to a specific resource.\n\nThis page explains the ways you can add new users to your project and how to\nset access control for your Dataproc Metastore resources.\n\nWhat is IAM?\n------------\n\nGoogle Cloud offers [Identity and Access Management (IAM)](/iam), which lets you\ngive more granular access to specific Google Cloud resources and prevents\nunwanted access to other resources. IAM lets you adopt the\n[security principle of least privilege](https://en.wikipedia.org/wiki/Principle_of_least_privilege),\nso you grant only the necessary access to your resources.\n\nIAM also lets you control who (identity) has what (roles)\npermission to which resources by setting IAM policies. IAM\npolicies grant specific roles to a project member, giving the identity certain\npermissions. For example, for a given resource, such as a project, you can\nassign the `roles/metastore.admin` role to a Google Account and that account can\ncontrol Dataproc Metastore resources in the project, but cannot\nmanage other resources. You can also use IAM to manage the basic\nroles granted to project team members.\n\nAccess control options for users\n--------------------------------\n\nTo give users the ability to create and manage your Dataproc Metastore\nresources, you can add users as *team members* to your project or to specific\nresources and grant them permissions using IAM *roles*.\n\nA team member can be an individual user with a valid Google Account, a Google\nGroup, a service account, or a Google Workspace domain. When you add a team\nmember to a project or to a resource, you specify which roles to grant them.\nIAM provides three types of roles: [predefined roles](/iam/docs/overview#roles),\n[basic roles](/iam/docs/overview#roles), and [custom roles](/iam/docs/understanding-custom-roles).\n\nTo see a list of capabilities of each Dataproc Metastore role\nand API methods that a specific role grants permission to, review\n[Dataproc Metastore IAM roles](/dataproc-metastore/docs/iam-roles).\n\nFor other member types, such as service accounts and groups, refer to the [Policy\nbinding reference](/iam/docs/reference/rest/v1/Policy#binding).\n\nService accounts\n----------------\n\nWhen you call Dataproc Metastore APIs to perform actions in a project\nwhere your service is located, Dataproc Metastore performs these\nactions on your behalf by using a Service Agent service account that has the permissions required\nto perform the actions.\n\nThe following service accounts have the permissions\nrequired to perform Dataproc Metastore actions in the project where\nyour service is located:\n\n- `service-`\u003cvar translate=\"no\"\u003eCUSTOMER_PROJECT_NUMBER\u003c/var\u003e`@gcp-sa-metastore.iam.gserviceaccount.com`.\n\n | **Note:** You may need to grant [`storage.objectAdmin`](/storage/docs/access-control/iam-roles) role to this service account for your Dataproc Metastore service to have access to its Hive metastore warehouse directory, if a non-default warehouse directory is provided. For more information, see [Hive Metastore](/dataproc-metastore/docs/hive-metastore).\n\nIAM policies for resources\n--------------------------\n\nYou can grant access to Dataproc Metastore resources by\nattaching IAM policies directly to those resources, such as a\nDataproc Metastore service. An IAM\npolicy lets you manage IAM roles on those resources\ninstead of, or in addition to, managing roles at the project level. This gives\nyou flexibility to apply the principle of least privilege, which is to grant\naccess only to the specific resources that collaborators need to do their work.\n\nResources also inherit the policies of their parent resources. If you set a\npolicy at the project level, it's inherited by all its child resources. The\neffective policy for a resource is the union of the policy set at that resource\nand the policy inherited from higher up in the hierarchy. For more information,\nread about the [IAM policy hierarchy](/iam/docs/overview#policy_hierarchy).\n\nYou can get and set IAM policies using the Google Cloud console, the\nIAM API, or the Google Cloud CLI.\n\n- For the Google Cloud console, see [Access control via the Google Cloud console](/iam/docs/grant-role-console).\n- For the API, see [Access control via the API](/iam/docs/reference/rest).\n- For the Google Cloud CLI, see [Access control via the Google Cloud CLI](/sdk/gcloud/reference/iam).\n\nWhat's next\n-----------\n\n- Learn how to grant [fine-grained access to metadata when using gRPC](/dataproc-metastore/docs/grpc-endpoints)\n- Learn more about [IAM roles](/dataproc-metastore/docs/iam-roles).\n- Learn more about [IAM permissions](/dataproc-metastore/docs/iam-permissions).\n- Learn how to set [policies at a project level](/iam/docs/managing-policies)."]]
