身分與存取權管理角色和權限

本頁面說明 Cloud Deploy 服務帳戶、角色和權限。

Cloud Deploy 的存取權是透過身分與存取權管理 (IAM) 控管。 IAM 可讓您建立及管理 Google Cloud 資源的權限。Cloud Deploy 提供一組特定的預先定義 IAM 角色，每個角色都包含一組權限。您可以使用這些角色，以更精細的方式授予特定 Google Cloud 資源的存取權限，避免其他資源遭到未經授權者擅自存取。IAM 能讓您採用最低權限安全性原則，僅授予必要的資源存取權限給使用者。

如要瞭解進階存取權控管安全功能，請參閱使用 IAM 限制 Cloud Deploy 存取權。

Cloud Deploy 中的服務帳戶

根據預設，Cloud Deploy 會使用預設的 Compute Engine 服務帳戶運作。如要進一步瞭解如何設定這個服務帳戶以搭配 Cloud Deploy 使用，或選擇其他帳戶，請參閱 Cloud Deploy 執行服務帳戶文件。

進一步瞭解 Cloud Deploy 如何使用服務帳戶。

預先定義的 Cloud Deploy 角色

若使用 IAM，Cloud Deploy API 中的每個 API 方法都要求提出 API 要求的身分具備使用該資源的適當權限。只要設定政策將角色授予專案主體 (使用者、群組或服務帳戶)，即可授予權限。您可以將多個角色授予相同資源中的主體。

IAM 說明文件提供所有預先定義角色的可搜尋參考資料。

下表列出 Cloud Deploy IAM 角色及這些角色所具備的權限：

Role Permissions

(roles/clouddeploy.admin)

Full control of Cloud Deploy resources.

clouddeploy.*

  • clouddeploy.automationRuns.cancel
  • clouddeploy.automationRuns.get
  • clouddeploy.automationRuns.list
  • clouddeploy.automations.create
  • clouddeploy.automations.delete
  • clouddeploy.automations.get
  • clouddeploy.automations.list
  • clouddeploy.automations.update
  • clouddeploy.config.get
  • clouddeploy.customTargetTypes.create
  • clouddeploy.customTargetTypes.delete
  • clouddeploy.customTargetTypes.get
  • clouddeploy.customTargetTypes.getIamPolicy
  • clouddeploy.customTargetTypes.list
  • clouddeploy.customTargetTypes.setIamPolicy
  • clouddeploy.customTargetTypes.update
  • clouddeploy.deliveryPipelines.create
  • clouddeploy.deliveryPipelines.createTagBinding
  • clouddeploy.deliveryPipelines.delete
  • clouddeploy.deliveryPipelines.deleteTagBinding
  • clouddeploy.deliveryPipelines.get
  • clouddeploy.deliveryPipelines.getIamPolicy
  • clouddeploy.deliveryPipelines.list
  • clouddeploy.deliveryPipelines.listEffectiveTags
  • clouddeploy.deliveryPipelines.listTagBindings
  • clouddeploy.deliveryPipelines.setIamPolicy
  • clouddeploy.deliveryPipelines.update
  • clouddeploy.deployPolicies.create
  • clouddeploy.deployPolicies.delete
  • clouddeploy.deployPolicies.get
  • clouddeploy.deployPolicies.getIamPolicy
  • clouddeploy.deployPolicies.list
  • clouddeploy.deployPolicies.override
  • clouddeploy.deployPolicies.setIamPolicy
  • clouddeploy.deployPolicies.update
  • clouddeploy.jobRuns.get
  • clouddeploy.jobRuns.list
  • clouddeploy.jobRuns.terminate
  • clouddeploy.locations.get
  • clouddeploy.locations.list
  • clouddeploy.operations.cancel
  • clouddeploy.operations.delete
  • clouddeploy.operations.get
  • clouddeploy.operations.list
  • clouddeploy.releases.abandon
  • clouddeploy.releases.create
  • clouddeploy.releases.get
  • clouddeploy.releases.list
  • clouddeploy.rollouts.advance
  • clouddeploy.rollouts.approve
  • clouddeploy.rollouts.cancel
  • clouddeploy.rollouts.create
  • clouddeploy.rollouts.get
  • clouddeploy.rollouts.ignoreJob
  • clouddeploy.rollouts.list
  • clouddeploy.rollouts.retryJob
  • clouddeploy.rollouts.rollback
  • clouddeploy.targets.create
  • clouddeploy.targets.createTagBinding
  • clouddeploy.targets.delete
  • clouddeploy.targets.deleteTagBinding
  • clouddeploy.targets.get
  • clouddeploy.targets.getIamPolicy
  • clouddeploy.targets.list
  • clouddeploy.targets.listEffectiveTags
  • clouddeploy.targets.listTagBindings
  • clouddeploy.targets.setIamPolicy
  • clouddeploy.targets.update

resourcemanager.projects.get

resourcemanager.projects.list

(roles/clouddeploy.approver)

Permission to approve or reject rollouts.

clouddeploy.config.get

clouddeploy.jobRuns.get

clouddeploy.jobRuns.list

clouddeploy.locations.*

  • clouddeploy.locations.get
  • clouddeploy.locations.list

clouddeploy.operations.*

  • clouddeploy.operations.cancel
  • clouddeploy.operations.delete
  • clouddeploy.operations.get
  • clouddeploy.operations.list

clouddeploy.rollouts.approve

clouddeploy.rollouts.get

clouddeploy.rollouts.list

resourcemanager.projects.get

resourcemanager.projects.list

(roles/clouddeploy.customTargetTypeAdmin)

Permission to manage CustomTargetType resources

clouddeploy.config.get

clouddeploy.customTargetTypes.*

  • clouddeploy.customTargetTypes.create
  • clouddeploy.customTargetTypes.delete
  • clouddeploy.customTargetTypes.get
  • clouddeploy.customTargetTypes.getIamPolicy
  • clouddeploy.customTargetTypes.list
  • clouddeploy.customTargetTypes.setIamPolicy
  • clouddeploy.customTargetTypes.update

resourcemanager.projects.get

resourcemanager.projects.list

(roles/clouddeploy.developer)

Permission to manage deployment configuration without permission to access operational resources, such as targets.

clouddeploy.automationRuns.get

clouddeploy.automationRuns.list

clouddeploy.automations.get

clouddeploy.automations.list

clouddeploy.config.get

clouddeploy.deliveryPipelines.create

clouddeploy.deliveryPipelines.createTagBinding

clouddeploy.deliveryPipelines.delete

clouddeploy.deliveryPipelines.deleteTagBinding

clouddeploy.deliveryPipelines.get

clouddeploy.deliveryPipelines.getIamPolicy

clouddeploy.deliveryPipelines.list

clouddeploy.deliveryPipelines.listEffectiveTags

clouddeploy.deliveryPipelines.listTagBindings

clouddeploy.deliveryPipelines.update

clouddeploy.deployPolicies.get

clouddeploy.deployPolicies.list

clouddeploy.jobRuns.get

clouddeploy.jobRuns.list

clouddeploy.locations.*

  • clouddeploy.locations.get
  • clouddeploy.locations.list

clouddeploy.operations.*

  • clouddeploy.operations.cancel
  • clouddeploy.operations.delete
  • clouddeploy.operations.get
  • clouddeploy.operations.list

clouddeploy.releases.*

  • clouddeploy.releases.abandon
  • clouddeploy.releases.create
  • clouddeploy.releases.get
  • clouddeploy.releases.list

clouddeploy.rollouts.get

clouddeploy.rollouts.list

resourcemanager.projects.get

resourcemanager.projects.list

(roles/clouddeploy.jobRunner)

Permission to execute Cloud Deploy work without permission to deliver to a target.

clouddeploy.config.get

logging.logEntries.create

storage.objects.create

storage.objects.get

storage.objects.list

(roles/clouddeploy.operator)

Permission to manage deployment configuration.

clouddeploy.automationRuns.*

  • clouddeploy.automationRuns.cancel
  • clouddeploy.automationRuns.get
  • clouddeploy.automationRuns.list

clouddeploy.automations.*

  • clouddeploy.automations.create
  • clouddeploy.automations.delete
  • clouddeploy.automations.get
  • clouddeploy.automations.list
  • clouddeploy.automations.update

clouddeploy.config.get

clouddeploy.customTargetTypes.get

clouddeploy.customTargetTypes.getIamPolicy

clouddeploy.customTargetTypes.list

clouddeploy.deliveryPipelines.create

clouddeploy.deliveryPipelines.createTagBinding

clouddeploy.deliveryPipelines.delete

clouddeploy.deliveryPipelines.deleteTagBinding

clouddeploy.deliveryPipelines.get

clouddeploy.deliveryPipelines.getIamPolicy

clouddeploy.deliveryPipelines.list

clouddeploy.deliveryPipelines.listEffectiveTags

clouddeploy.deliveryPipelines.listTagBindings

clouddeploy.deliveryPipelines.update

clouddeploy.deployPolicies.get

clouddeploy.deployPolicies.getIamPolicy

clouddeploy.deployPolicies.list

clouddeploy.jobRuns.*

  • clouddeploy.jobRuns.get
  • clouddeploy.jobRuns.list
  • clouddeploy.jobRuns.terminate

clouddeploy.locations.*

  • clouddeploy.locations.get
  • clouddeploy.locations.list

clouddeploy.operations.*

  • clouddeploy.operations.cancel
  • clouddeploy.operations.delete
  • clouddeploy.operations.get
  • clouddeploy.operations.list

clouddeploy.releases.*

  • clouddeploy.releases.abandon
  • clouddeploy.releases.create
  • clouddeploy.releases.get
  • clouddeploy.releases.list

clouddeploy.rollouts.advance

clouddeploy.rollouts.cancel

clouddeploy.rollouts.create

clouddeploy.rollouts.get

clouddeploy.rollouts.ignoreJob

clouddeploy.rollouts.list

clouddeploy.rollouts.retryJob

clouddeploy.rollouts.rollback

clouddeploy.targets.create

clouddeploy.targets.createTagBinding

clouddeploy.targets.delete

clouddeploy.targets.deleteTagBinding

clouddeploy.targets.get

clouddeploy.targets.getIamPolicy

clouddeploy.targets.list

clouddeploy.targets.listEffectiveTags

clouddeploy.targets.listTagBindings

clouddeploy.targets.update

resourcemanager.projects.get

resourcemanager.projects.list

(roles/clouddeploy.policyAdmin)

Permission to manage Deploy Policies.

clouddeploy.deployPolicies.*

  • clouddeploy.deployPolicies.create
  • clouddeploy.deployPolicies.delete
  • clouddeploy.deployPolicies.get
  • clouddeploy.deployPolicies.getIamPolicy
  • clouddeploy.deployPolicies.list
  • clouddeploy.deployPolicies.override
  • clouddeploy.deployPolicies.setIamPolicy
  • clouddeploy.deployPolicies.update

clouddeploy.locations.*

  • clouddeploy.locations.get
  • clouddeploy.locations.list

clouddeploy.operations.*

  • clouddeploy.operations.cancel
  • clouddeploy.operations.delete
  • clouddeploy.operations.get
  • clouddeploy.operations.list

resourcemanager.projects.get

resourcemanager.projects.list

(roles/clouddeploy.policyOverrider)

Permission to override Deploy Policies.

clouddeploy.deployPolicies.get

clouddeploy.deployPolicies.list

clouddeploy.deployPolicies.override

clouddeploy.locations.*

  • clouddeploy.locations.get
  • clouddeploy.locations.list

clouddeploy.operations.*

  • clouddeploy.operations.cancel
  • clouddeploy.operations.delete
  • clouddeploy.operations.get
  • clouddeploy.operations.list

resourcemanager.projects.get

resourcemanager.projects.list

(roles/clouddeploy.releaser)

Permission to create Cloud Deploy releases and rollouts.

clouddeploy.config.get

clouddeploy.customTargetTypes.get

clouddeploy.deliveryPipelines.get

clouddeploy.jobRuns.get

clouddeploy.jobRuns.list

clouddeploy.locations.*

  • clouddeploy.locations.get
  • clouddeploy.locations.list

clouddeploy.operations.*

  • clouddeploy.operations.cancel
  • clouddeploy.operations.delete
  • clouddeploy.operations.get
  • clouddeploy.operations.list

clouddeploy.releases.create

clouddeploy.releases.get

clouddeploy.releases.list

clouddeploy.rollouts.advance

clouddeploy.rollouts.cancel

clouddeploy.rollouts.create

clouddeploy.rollouts.get

clouddeploy.rollouts.list

clouddeploy.rollouts.rollback

clouddeploy.targets.get

resourcemanager.projects.get

resourcemanager.projects.list

(roles/clouddeploy.serviceAgent)

Gives Cloud Deploy Service Account access to managed resources.

cloudbuild.builds.create

cloudbuild.builds.get

cloudbuild.builds.list

cloudbuild.builds.update

cloudbuild.workerpools.use

iam.serviceAccounts.actAs

iam.serviceAccounts.getAccessToken

logging.logEntries.create

pubsub.topics.get

pubsub.topics.publish

servicemanagement.services.report

serviceusage.services.use

storage.buckets.create

storage.buckets.get

storage.objects.get

(roles/clouddeploy.viewer)

Can view Cloud Deploy resources.

clouddeploy.automationRuns.get

clouddeploy.automationRuns.list

clouddeploy.automations.get

clouddeploy.automations.list

clouddeploy.config.get

clouddeploy.customTargetTypes.get

clouddeploy.customTargetTypes.getIamPolicy

clouddeploy.customTargetTypes.list

clouddeploy.deliveryPipelines.get

clouddeploy.deliveryPipelines.getIamPolicy

clouddeploy.deliveryPipelines.list

clouddeploy.deliveryPipelines.listEffectiveTags

clouddeploy.deliveryPipelines.listTagBindings

clouddeploy.deployPolicies.get

clouddeploy.deployPolicies.getIamPolicy

clouddeploy.deployPolicies.list

clouddeploy.jobRuns.get

clouddeploy.jobRuns.list

clouddeploy.locations.*

  • clouddeploy.locations.get
  • clouddeploy.locations.list

clouddeploy.operations.get

clouddeploy.operations.list

clouddeploy.releases.get

clouddeploy.releases.list

clouddeploy.rollouts.get

clouddeploy.rollouts.list

clouddeploy.targets.get

clouddeploy.targets.getIamPolicy

clouddeploy.targets.list

clouddeploy.targets.listEffectiveTags

clouddeploy.targets.listTagBindings

resourcemanager.projects.get

resourcemanager.projects.list

除了 Cloud Deploy 預先定義的角色外，基本的檢視者、編輯者和擁有者角色也包含與 Cloud Deploy 相關的權限。不過，我們建議您盡可能授予預先定義的角色，以符合最低權限安全原則。

權限

下表列出了呼叫者在呼叫每個方法時必須具備的權限：

API 方法 必要權限 說明
automations.create() clouddeploy.automations.create 建立新的自動化資源。
automations.delete() clouddeploy.automations.delete 刪除現有的自動化資源。
automations.get() clouddeploy.automations.get 擷取個別自動化資源的詳細資料。
automations.list() clouddeploy.automations.list 列出自動化資源及其相關中繼資料。
automations.update() clouddeploy.automations.update 更新現有的自動化資源。
automationRuns.cancel() clouddeploy.automationRuns.cancel 取消正在執行的自動化作業。
automationRuns.get() clouddeploy.automationRuns.get 擷取個別自動化執行作業的詳細資料。
automationRuns.list() clouddeploy.automationRuns.list 列出自動化執行作業及其相關中繼資料。
customTargetTypes.create() clouddeploy.customTargetTypes.create 建立自訂目標類型資源。
customTargetTypes.delete() clouddeploy.customTargetTypes.delete 刪除自訂目標類型資源。
customTargetTypes.get() clouddeploy.customTargetTypes.get 擷取自訂目標類型的詳細資料。
customTargetTypes.getIamPolicy() clouddeploy.customTargetTypes.getIamPolicy 取得自訂目標類型資源的身分與存取權管理政策。
customTargetTypes.list() clouddeploy.customTargetTypes.list 列出可用的自訂目標類型及其中繼資料。
customTargetTypes.patch() clouddeploy.customTargetTypes.patch 更新現有自訂目標類型。
customTargetTypes.setIamPolicy() clouddeploy.customTargetTypes.setIamPolicy 為自訂目標類型資源設定 IAM 政策。
deliveryPipelines.create() clouddeploy.deliveryPipelines.create 建立新的推送管道資源。
deliveryPipelines.delete() clouddeploy.deliveryPipelines.delete 刪除現有的推送 pipeline 資源。
deliveryPipelines.get() clouddeploy.deliveryPipelines.get 擷取個別推送管道的詳細資料。
deliveryPipelines.getIamPolicy() clouddeploy.deliveryPipelines.getIamPolicy 取得交付管道資源的身分與存取權管理政策。
deliveryPipelines.list() clouddeploy.deliveryPipelines.list 列出交付管道及其相關中繼資料。
deliveryPipelines.rollbackTarget() clouddeploy.rollouts.rollback 復原目標。
deliveryPipelines.setIamPolicy() clouddeploy.deliveryPipelines.setIamPolicy 設定交付管道資源的身分與存取權管理政策。
deliveryPipelines.update() clouddeploy.deliveryPipelines.update 更新現有的交付管道資源。
deployPolicies.create() clouddeploy.deployPolicies.create 建立部署政策資源。
deployPolicies.delete() clouddeploy.deployPolicies.delete 刪除部署政策資源。
deployPolicies.get() clouddeploy.deployPolicies.get 擷取部署政策資源的詳細資料。
deployPolicies.list() clouddeploy.deployPolicies.list 列出可用的部署政策及其相關中繼資料。
jobRuns.get() clouddeploy.jobRuns.get 擷取 JobRuns 資源。
jobRuns.list() clouddeploy.jobRuns.list 列出 JobRuns 資源及其相關中繼資料。
jobRuns.terminate() clouddeploy.jobRuns.terminate 終止執行中的工作。
operations.cancel() clouddeploy.operations.cancel 取消長時間執行的作業。
operation.delete() clouddeploy.operations.delete 刪除一個長時間執行的作業。
operations.get() clouddeploy.operations.get 取得特定長時間執行的作業 (例如，傳回發行內容建立作業的狀態)。
operations.list() clouddeploy.operations.list 列出長時間執行的作業。
releases.abandon() clouddeploy.releases.abandon 捨棄版本，並防止針對該版本進一步推出。
releases.create() clouddeploy.releases.create 建立新的發行資源。呼叫方也必須具備用來轉譯資訊清單的服務帳戶 iam.serviceAccounts.actAs 權限。
releases.get() clouddeploy.releases.get 擷取個別發行內容的詳細資料。
releases.list() clouddeploy.releases.list 列出發行內容和中繼資料。
rollouts.advance() clouddeploy.rollouts.advance 讓推出作業進展至下一階段。
rollouts.approve() clouddeploy.rollouts.approve 核准或拒絕核准狀態為 required 的推出作業。
rollouts.cancel() clouddeploy.rollouts.cancel 取消推出作業。
rollouts.create() clouddeploy.rollouts.create 建立新的推出作業資源或升級版本。呼叫者也必須具備專案或用於部署的服務帳戶的 iam.serviceAccounts.actAs 權限。
rollouts.get() clouddeploy.rollouts.get 擷取個別推出作業的詳細資料。
rollouts.ignoreJob() clouddeploy.rollouts.ignoreJob 忽略失敗的工作。
rollouts.list() clouddeploy.rollouts.list 列出推出作業和中繼資料。
rollouts.retryJob() clouddeploy.rollouts.retryJob 重試失敗的工作。
rollouts.advance()、rollouts.approve()、rollouts.cancel()、rollouts.create()、rollouts.ignoreJob()、rollouts.retryJob()、deliveryPipelines.rollbackTarget()、jobRuns.terminate() clouddeploy.deployPolicies.override 覆寫部署政策資源。
deployPolicies.update() clouddeploy.deployPolicies.update 更新現有的部署政策資源。
targets.create() clouddeploy.targets.create 建立新的目標資源。
targets.delete() clouddeploy.targets.delete 刪除現有目標資源。
targets.get() clouddeploy.targets.get 擷取個別目標的詳細資料。
targets.getIamPolicy() clouddeploy.targets.getIamPolicy 取得目標資源的 IAM 政策。
targets.list() clouddeploy.targets.list 列出目標及其相關中繼資料。
targets.setIamPolicy() clouddeploy.targets.setIamPolicy 為目標資源設定 IAM 政策。
targets.update() clouddeploy.targets.update 更新現有的目標資源。

使用 IAM 限制對 Cloud Deploy 資源執行的動作

您可以透過下列方式，使用 IAM 保護 Cloud Deploy 資源：

  • IAM 中繼 API

    使用 Cloud Deploy 資源上的 setIamPolicy，限制對這些資源執行的動作。

  • 有條件的 IAM

    以程式輔助方式套用存取政策，包括授予或拒絕存取權的條件。

您可以使用這些政策和條件，限制對 Cloud Deploy 資源執行的下列動作：

  • 建立推送管道或目標

    您可以將這項存取權授予特定使用者或群組。

  • 更新或刪除特定推送 pipeline

    您可以將這項存取權授予特定使用者或群組。

  • 為特定推送管道建立版本

    您可以將這項存取權授予特定使用者或群組。

  • 更新或刪除特定目標

    您可以將這項存取權授予特定使用者或群組。

  • 建立或核准推出作業，或升級版本

    您可以將這項存取權授予特定使用者或群組，讓他們存取特定目標或放送管道。

    您也可以設定條件，將存取權限制在指定時間範圍內。

後續步驟