舉例來說，假設您有一個附加儲存空間磁碟區的 VM。由於磁碟區可跨越兩個區域，如要允許 VM 存取磁碟區，VM 必須在磁碟區所在的所有區域中擁有存取權限。使用全域服務帳戶，您只需提供一次 VM 對儲存空間磁碟區的存取權，該權限就會傳播至磁碟區所在的所有區域。這項功能可讓您設定通用規模的存取權，無須管理區域專屬的存取權。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[],[],null,["# Permissions control for a multi-zone universe\n\nThis document explains how you can manage permissions effectively across a\nmulti-zone Google Distributed Cloud (GDC) air-gapped universe. To maintain access to\nresources that can span multiple zones, you must implement global permissions\nthat consistently apply to them. GDC provides\nIdentity and Access Management (IAM) features to control your global permissions scheme\nwithout having to track and maintain zone-level access.\n\nThis document is for IT administrators within the platform administrator group\nwho are responsible for developing and maintaining access control for resources\nthat span across multiple zones in a GDC universe.\n\nFor more information, see\n[Audiences for GDC air-gapped documentation](/distributed-cloud/hosted/docs/latest/gdch/resources/audiences).\n\nAccess that spans a universe\n----------------------------\n\nGDC offers several key IAM capabilities\nto help control access to your zones and the resources within each zone.\n\n### Streamline role management\n\nGDC provides built-in global permissions control that\nlets you apply and manage IAM roles that span all zones\nautomatically. Global control over your permissions removes segmented use cases\nwhere you must manually apply roles in each zone. *Role-based access control\n(RBAC)* is global by default, but provides fine-tuned zonal permission\nallocation, when necessary.\n\nFor example, consider you have a new developer that needs to access your\nproject's resources. Since a project is global by default, it spans all zones in\nyour universe. Instead of manually applying and maintaining the roles necessary\nto access the project in each zone, you apply a global access role for the\nproject, which applies to all zones the project resides within automatically.\nThe new developer's project access now evolves with your universe, and is\npropagated to new zones automatically if your universe grows.\n\nFor more information about role bindings in GDC, see\n[Grant and revoke access](/distributed-cloud/hosted/docs/latest/gdch/platform/pa-user/iam/set-up-role-bindings).\n\n### Sign in once and propagate your existing credentials\n\nGDC offers *identity providers (IdP)* to streamline\nauthenticating users in your universe, without the hassle of signing in to each\nzone separately. An IdP is a system that centrally manages and secures user\nidentities, providing authentication services. Connecting to an existing IdP\nlets users access GDC using their organization's\ncredentials, without needing to create or manage separate accounts within\nGDC. Since an IdP is a global resource that is\nconfigured to span multiple zones by default, you can access\nGDC through the same IdP regardless of the zone you work\nin. For more information about IdPs in GDC, see\n[Connect to an identity provider](/distributed-cloud/hosted/docs/latest/gdch/platform/pa-user/iam/connect-identity).\n\n### Global workload and service permissions control\n\nJust as human users benefit from\n[IdPs to streamline authentication across zones](#idp),\nyour workloads and services can also benefit from global authentication in your\nuniverse with *service accounts*. Service accounts are the accounts that\nworkloads and services use to programmatically consume resources and access\nmicroservices securely. Since a service account is a global resource that is\nconfigured to span multiple zones by default, your workloads and services can\naccess resources that span a universe uniformly with a single set of global\npermissions.\n\nAs an example, consider you have a VM that has an attached storage volume.\nBecause a volume can span two zones, if you want to allow the VM to access the\nvolume, it must have access permissions in all zones where the volume resides.\nWith global service accounts, you can provide the VM access to the storage\nvolume once, which propagates to all zones where the volume resides. This\ncapability lets you configure access on a universal scale, without managing\nzone-specific access.\n\nFor more information about service accounts in GDC, see\n[Authenticate with service accounts](/distributed-cloud/hosted/docs/latest/gdch/platform/pa-user/service-identity).\n\nWhat's next\n-----------\n\n- [Zones in GDC air-gapped](/distributed-cloud/hosted/docs/latest/gdch/resources/multi-zone/mz-overview)\n- [Manage resources across zones](/distributed-cloud/hosted/docs/latest/gdch/resources/multi-zone/manage-mz-resources)\n- [Sign in](/distributed-cloud/hosted/docs/latest/gdch/platform/pa-user/iam/sign-in)"]]
