Identity and Access Management (IAM)를 사용하면 프로젝트 리소스에 대한 사용자 및 그룹 액세스를 제어할 수 있습니다. 이 문서에서는 Apache Spark용 서버리스와 관련된 IAM 권한과 해당 권한이 부여된 IAM 역할에 대해 집중적으로 다룹니다.
Apache Spark용 서버리스 권한
Apache Spark용 서버리스 권한은 서비스 계정을 포함한 사용자가 Apache Spark용 서버리스 리소스에서 작업을 수행할 수 있게 해줍니다. 예를 들어 dataproc.batches.create 권한이 있으면 프로젝트에서 Apache Spark용 서버리스 배치를 만들 수 있습니다.
사용자에게 권한을 직접 부여하는 대신 하나 이상의 권한이 번들로 포함된 역할을 부여합니다.
다음 표는 Apache Spark용 서버리스 API (메서드)를 호출하는 데 필요한 권한 목록입니다. 이 표는 각 서버리스 Apache Spark 리소스 (배치, 세션, sessionTemplates, 작업)와 연결된 API에 따라 구성됩니다. 각 역할에 포함된 Google Cloud 권한 목록은 Dataproc 역할을 참고하세요.
권한 범위: 다음 표에 나와 있는 Apache Spark용 서버리스 권한의 범위는 포함된 Google Cloud프로젝트 (cloud-platform 범위)입니다. 서비스 계정 권한을 참고하세요.
예:
dataproc.batches.create는 포함된 프로젝트에서 배치를 만들도록 허용합니다.
dataproc.sessions.create는 포함된 프로젝트에서 대화형 세션을 만들도록 허용합니다.
dataproc.operations.list는 포함된 프로젝트에 Dataproc 작업의 세부정보를 표시하도록 허용합니다.
배치 권한
메서드
필수 권한
projects.locations.batches.create
dataproc.batches.create 1
projects.locations.batches.delete
dataproc.batches.delete
projects.locations.batches.get
dataproc.batches.get
projects.locations.batches.list
dataproc.batches.list
1dataproc.batches.create는 또한 gcloud 명령줄 도구에서 상태 업데이트를 가져오도록 허용하기 위해 dataproc.batches.get 및 dataproc.operations.get 권한이 필요합니다.
세션 권한
메서드
필수 권한
projects.locations.sessions.create
dataproc.sessions.create 1
projects.locations.sessions.delete
dataproc.sessions.delete
projects.locations.sessions.get
dataproc.sessions.get
projects.locations.sessions.list
dataproc.sessions.list
projects.locations.sessions.terminate
dataproc.sessions.terminate
1dataproc.sessions.create는 또한 gcloud 명령줄 도구에서 상태 업데이트를 가져오도록 허용하기 위해 dataproc.sessions.get 및 dataproc.operations.get 권한이 필요합니다.
세션 런타임 템플릿 권한
메서드
필수 권한
projects.locations.sessionTemplates.create
dataproc.sessionTemplates.create 1
projects.locations.sessionTemplates.delete
dataproc.sessionTemplates.delete
projects.locations.sessionTemplates.get
dataproc.sessionTemplates.get
projects.locations.sessionTemplates.list
dataproc.sessionTemplates.list
projects.locations.sessionTemplates.update
dataproc.sessionTemplates.update
1dataproc.sessionTemplates.create는 또한 gcloud 명령줄 도구에서 상태 업데이트를 가져오도록 허용하기 위해 dataproc.sessionTemplates.get 및 dataproc.operations.get 권한이 필요합니다.
작업 권한
메서드
필수 권한
projects.regions.operations.get
dataproc.operations.get
projects.regions.operations.list
dataproc.operations.list
projects.regions.operations.cancel 1
dataproc.operations.cancel
projects.regions.operations.delete
dataproc.operations.delete
projects.regions.operations.getIamPolicy
dataproc.operations.getIamPolicy
projects.regions.operations.setIamPolicy
dataproc.operations.setIamPolicy
1 배치 작업을 취소하려면 dataproc.operations.cancel에 dataproc.batches.cancel 권한도 필요합니다.
Apache Spark용 서버리스 역할
Apache Spark용 서버리스 IAM 역할은 하나 이상의 권한 모음입니다.
프로젝트의 Apache Spark용 서버리스 리소스에서 작업을 수행할 수 있도록 사용자 또는 그룹에 역할을 부여할 수 있습니다. 예를 들어 Dataproc 뷰어 역할에는 dataproc.batches 및 dataproc.sessions 가져오기 및 나열 권한이 포함되며, 이를 통해 프로젝트의 Apache Spark용 서버리스 배치 및 세션을 가져오고 나열할 수 있습니다.
다음 표는 Apache Spark용 서버리스 IAM 역할과 각 역할과 관련된 권한 목록입니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-04(UTC)"],[[["\u003cp\u003eIdentity and Access Management (IAM) controls user and group access to project resources, including Dataproc Serverless.\u003c/p\u003e\n"],["\u003cp\u003eDataproc Serverless permissions allow users, including service accounts, to perform specific actions, such as creating batches or sessions, on Dataproc Serverless resources.\u003c/p\u003e\n"],["\u003cp\u003eUsers are granted roles, not individual permissions, and these roles bundle one or more permissions necessary for specific actions on Dataproc Serverless.\u003c/p\u003e\n"],["\u003cp\u003eTo perform certain operations, like creating batches or sessions, additional permissions, such as getting status updates, are often required.\u003c/p\u003e\n"],["\u003cp\u003eIAM policies can be managed through the Google Cloud console, the IAM API, or the \u003ccode\u003egcloud\u003c/code\u003e command-line tool to define access to Dataproc Serverless resources.\u003c/p\u003e\n"]]],[],null,["# Serverless for Apache Spark permissions and IAM roles\n\n[Identity and Access Management (IAM)](/iam) lets you control\nuser and group access to your project's resources. This document focuses on\nthe IAM permissions relevant to Serverless for Apache Spark and the IAM roles\nthat grant those permissions.\n\nServerless for Apache Spark permissions\n---------------------------------------\n\n| **Note:** Security requirement: You are required to have [service account `ActAs` permission](/iam/docs/service-accounts-actas) to deploy Serverless for Apache Spark resources, for example, to create clusters, submit jobs, and instantiate workflows. See [Roles for service account\n| authentication](/iam/docs/service-account-permissions) for detailed information.\n\nServerless for Apache Spark permissions allow users, including\n[service accounts](/compute/docs/access/service-accounts),\nto perform actions on Serverless for Apache Spark\nresources. For example, the `dataproc.batches.create`\npermission lets you create Serverless for Apache Spark batches in your project.\nYou don't directly give users permissions; instead, you grant them\n[roles](#roles), which have one or more permissions bundled within\nthem.\n\nThe following tables list the permissions necessary to call Serverless for Apache Spark\nAPIs (methods). The tables are organized according to the APIs associated with\neach Serverless for Apache Spark resource (batches, sessions, sessionTemplates, and\noperations). For a listing of the Google Cloud permissions included in each role, see\n[Dataproc roles](/iam/docs/understanding-roles#dataproc-roles).\n\n\n**Permission Scope:** The scope of Serverless for Apache Spark\npermissions listed in the following tables is the containing Google Cloud\nproject (`cloud-platform` scope). See\n[Service account permissions](/compute/docs/access/service-accounts#service_account_permissions).\n\nExamples:\n\n- `dataproc.batches.create` permits the creation of batches in the containing project.\n- `dataproc.sessions.create` permits the creation of an interactive session in the containing project.\n- `dataproc.operations.list` permits the listing of details of Dataproc operations in the containing project.\n\n### Batch permissions\n\n^1^ `dataproc.batches.create` also requires `dataproc.batches.get` and\n`dataproc.operations.get` permissions to allow it to get status updates\nfrom the `gcloud` command-line tool.\n\n### Session permissions\n\n^1^ `dataproc.sessions.create` also requires `dataproc.sessions.get` and\n`dataproc.operations.get` permissions to allow it to get status updates\nfrom the `gcloud` command-line tool.\n\n### Session runtime template permissions\n\n^1^ `dataproc.sessionTemplates.create` also requires `dataproc.sessionTemplates.get` and\n`dataproc.operations.get` permissions to allow it to get status updates\nfrom the `gcloud` command-line tool.\n\n### Operations permissions\n\n^1^ To cancel batch operations, `dataproc.operations.cancel` also requires\n`dataproc.batches.cancel` permission.\n\nServerless for Apache Spark roles\n---------------------------------\n\n[Serverless for Apache Spark IAM roles](/iam/docs/understanding-roles#dataproc-roles)\nare a bundle of one or more [permissions](#permissions).\nYou grant roles to users or groups to allow them to perform actions on the\nServerless for Apache Spark resources in your\nproject. For example, the **Dataproc Viewer** role contains the\n`dataproc.batches` and `dataproc.sessions` get and list permissions, which\nallow you to get and list Serverless for Apache Spark batches and sessions in a project.\n\nThe following table lists the Serverless for Apache Spark IAM roles and\nthe permissions associated with each role:\n\nProject roles\n-------------\n\nYou can also set permissions at the project level by using the IAM\n**Project** roles. Here is a summary of the permissions associated with\nIAM Project roles:\n\nCustom Roles\n------------\n\nDataproc batch permissions can be added to custom roles through\nthe Google Cloud console or the `gcloud` command-line tool.\n\nManaging IAM policies\n---------------------\n\nYou can get and set IAM policies using the Google Cloud console, the IAM API, or the\n`gcloud` command-line tool.\n\n- For the Google Cloud console, see [Access control using the Google Cloud console](/iam/docs/managing-policies#access_control_via_console).\n- For the API, see [Access control using the API](/iam/docs/managing-policies#access_control_via_api).\n- For the `gcloud` command-line tool, see [Access control using the Google Cloud CLI command-line tool](/iam/docs/managing-policies#access_control_via_the_gcloud_tool).\n\nWhat's next\n-----------\n\n- [Learn more about IAM](/iam)."]]
