Dataproc Metastore IAM 角色

Dataproc Metastore 定义了多个 Identity and Access Management (IAM) 角色。每个预定义角色都包含一组允许主账号执行特定操作的 IAM 权限。您可以使用 IAM 政策为主账号指定一个或多个 IAM 角色。

Identity and Access Management (IAM) 还提供创建自定义 IAM 角色的功能。您可以创建自定义 IAM 角色，并为该角色分配一项或多项权限。然后，您可以将新创建的角色授予主账号。使用自定义角色可创建访问权限控制模型，该模型将直接映射到您的需求以及可用的预定义角色。

本页面重点介绍与 Dataproc Metastore 相关的 IAM 角色。

准备工作

• 阅读 IAM 文档。

Dataproc Metastore 角色

IAM Dataproc Metastore 角色是一项或多项权限。您为主账号授予角色，以允许他们对项目中的 Dataproc Metastore 资源执行操作。例如，Dataproc Metastore User 角色包含 metastore.*.get 和 metastore.*.list 权限，这些权限允许用户获取和列出 Dataproc Metastore 服务、元数据导入、备份和项目中的操作。

下表列出了所有 Dataproc Metastore 角色以及与每个角色关联的权限：

注意 ：数据库和表权限用于启用了 gRPC 的 Dataproc Metastore 服务。它们在与使用 Thrift 端点的服务一起使用时没有任何影响。

Role	Permissions
Dataproc Metastore Admin (roles/metastore.admin) Full access to all Dataproc Metastore resources.	metastore.backups.* metastore.backups.create metastore.backups.delete metastore.backups.get metastore.backups.getIamPolicy metastore.backups.list metastore.backups.setIamPolicy metastore.backups.use metastore.federations.* metastore.federations.create metastore.federations.delete metastore.federations.get metastore.federations.getIamPolicy metastore.federations.list metastore.federations.setIamPolicy metastore.federations.update metastore.federations.use metastore.imports.* metastore.imports.create metastore.imports.get metastore.imports.list metastore.imports.update metastore.locations.* metastore.locations.get metastore.locations.list metastore.migrations.* metastore.migrations.cancel metastore.migrations.complete metastore.migrations.delete metastore.migrations.get metastore.migrations.list metastore.migrations.start metastore.operations.* metastore.operations.cancel metastore.operations.delete metastore.operations.get metastore.operations.list metastore.services.create metastore.services.delete metastore.services.export metastore.services.get metastore.services.getIamPolicy metastore.services.list metastore.services.restore metastore.services.setIamPolicy metastore.services.update resourcemanager.projects.get resourcemanager.projects.list
Dataproc Metastore Editor (roles/metastore.editor) Read and write access to all Dataproc Metastore resources.	metastore.backups.create metastore.backups.delete metastore.backups.get metastore.backups.list metastore.backups.use metastore.federations.create metastore.federations.delete metastore.federations.get metastore.federations.list metastore.federations.update metastore.imports.* metastore.imports.create metastore.imports.get metastore.imports.list metastore.imports.update metastore.locations.* metastore.locations.get metastore.locations.list metastore.migrations.* metastore.migrations.cancel metastore.migrations.complete metastore.migrations.delete metastore.migrations.get metastore.migrations.list metastore.migrations.start metastore.operations.* metastore.operations.cancel metastore.operations.delete metastore.operations.get metastore.operations.list metastore.services.create metastore.services.delete metastore.services.export metastore.services.get metastore.services.getIamPolicy metastore.services.list metastore.services.restore metastore.services.update resourcemanager.projects.get resourcemanager.projects.list
Metastore Federation Accessor (roles/metastore.federationAccessor) Access to the Metastore Federation resource.	metastore.federations.use
Dataproc Metastore Metadata Editor (roles/metastore.metadataEditor) Access to read and modify the metadata of databases and tables under those databases.	metastore.databases.create metastore.databases.delete metastore.databases.get metastore.databases.getIamPolicy metastore.databases.list metastore.databases.update metastore.services.get metastore.services.use metastore.tables.create metastore.tables.delete metastore.tables.get metastore.tables.getIamPolicy metastore.tables.list metastore.tables.update
Dataproc Metastore Metadata Mutate Admin (roles/metastore.metadataMutateAdmin) Access to mutate metadata from a Dataproc Metastore service's underlying metadata store.	metastore.services.mutateMetadata
Dataproc Metastore Metadata Operator (roles/metastore.metadataOperator) Read-only access to Dataproc Metastore resources with additional metadata operations permission.	metastore.backups.create metastore.backups.delete metastore.backups.get metastore.backups.list metastore.backups.use metastore.imports.* metastore.imports.create metastore.imports.get metastore.imports.list metastore.imports.update metastore.locations.* metastore.locations.get metastore.locations.list metastore.operations.get metastore.operations.list metastore.services.export metastore.services.get metastore.services.getIamPolicy metastore.services.list metastore.services.restore resourcemanager.projects.get resourcemanager.projects.list
Dataproc Metastore Data Owner (roles/metastore.metadataOwner) Full access to the metadata of databases and tables under those databases.	metastore.databases.* metastore.databases.create metastore.databases.delete metastore.databases.get metastore.databases.getIamPolicy metastore.databases.list metastore.databases.setIamPolicy metastore.databases.update metastore.services.get metastore.services.getIamPolicy metastore.services.list metastore.services.use metastore.tables.* metastore.tables.create metastore.tables.delete metastore.tables.get metastore.tables.getIamPolicy metastore.tables.list metastore.tables.setIamPolicy metastore.tables.update
Dataproc Metastore Metadata Query Admin (roles/metastore.metadataQueryAdmin) Access to query metadata from a Dataproc Metastore service's underlying metadata store.	metastore.services.queryMetadata
Dataproc Metastore Metadata User (roles/metastore.metadataUser) Access to the Dataproc Metastore gRPC endpoint	metastore.databases.get metastore.databases.list metastore.services.get metastore.services.use
Dataproc Metastore Metadata Viewer (roles/metastore.metadataViewer) Access to read the metadata of databases and tables under those databases	metastore.databases.get metastore.databases.getIamPolicy metastore.databases.list metastore.services.get metastore.services.use metastore.tables.get metastore.tables.getIamPolicy metastore.tables.list
Dataproc Metastore Managed Migration Admin ^Beta (roles/metastore.migrationAdmin) Access to Dataproc Metastore Managed Migration resources and workflow.	cloudsql.instances.connect cloudsql.instances.get cloudsql.instances.login compute.autoscalers.create compute.autoscalers.delete compute.disks.create compute.disks.delete compute.forwardingRules.create compute.forwardingRules.delete compute.forwardingRules.use compute.instanceGroupManagers.create compute.instanceGroupManagers.delete compute.instanceGroupManagers.use compute.instanceGroups.delete compute.instanceGroups.use compute.instanceTemplates.create compute.instanceTemplates.delete compute.instanceTemplates.get compute.instanceTemplates.useReadOnly compute.instances.create compute.instances.delete compute.instances.get compute.instances.setMetadata compute.machineTypes.list compute.regionBackendServices.create compute.regionBackendServices.delete compute.regionBackendServices.use compute.regionHealthChecks.create compute.regionHealthChecks.delete compute.regionHealthChecks.useReadOnly compute.serviceAttachments.create compute.serviceAttachments.delete compute.subnetworks.get compute.subnetworks.use compute.zones.list datastream.connectionProfiles.create datastream.connectionProfiles.delete datastream.operations.get datastream.privateConnections.create datastream.privateConnections.delete datastream.streams.create datastream.streams.delete datastream.streams.get datastream.streams.update
Dataproc Metastore Viewer (roles/metastore.user) Read-only access to all Dataproc Metastore resources.	metastore.backups.get metastore.backups.list metastore.federations.get metastore.federations.getIamPolicy metastore.federations.list metastore.imports.get metastore.imports.list metastore.locations.* metastore.locations.get metastore.locations.list metastore.operations.get metastore.operations.list metastore.services.export metastore.services.get metastore.services.getIamPolicy metastore.services.list resourcemanager.projects.get resourcemanager.projects.list

后续步骤

• 了解如何创建自定义 IAM 角色。
• 了解如何授予和管理角色。
• 参阅 Dataproc Metastore IAM 权限映射。