本頁說明 Cloud Domains API 角色，以及 Cloud Domains 提供的存取權控管選項。
Google Cloud 提供「身分與存取權管理」(IAM) 功能，可讓您以更精細的方式授予使用者特定 Google Cloud 資源的存取權限，避免其他資源遭到未經授權者擅自存取。IAM 能讓您採用最低權限安全性原則，僅授予必要的資源存取權限給使用者。設定 IAM 政策後，即可控管「哪些人」具備「何種」權限，可以存取「哪些」資源。身分與存取權管理政策可將特定角色授予使用者，讓該使用者擁有特定權限。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[[["\u003cp\u003eCloud Domains uses Identity and Access Management (IAM) to control who has what permissions to which resources, ensuring the security principle of least privilege is enforced.\u003c/p\u003e\n"],["\u003cp\u003eThere are two primary roles within Cloud Domains: Admin, which provides full access to domain registrations and related resources, and Viewer, which allows read-only access.\u003c/p\u003e\n"],["\u003cp\u003eTo manage Cloud Domains IAM roles, you must enable the Cloud Domains API for your project, after which you will be able to see these roles within the Google Cloud console.\u003c/p\u003e\n"],["\u003cp\u003eThe Admin role can register new domains, update domain registration settings, while the Viewer role can view existing domains and their registration details, including DNS and expiry information.\u003c/p\u003e\n"],["\u003cp\u003eThe page provides detailed tables listing the permissions included with each role and the specific permissions required to perform different methods related to domain registrations.\u003c/p\u003e\n"]]],[],null,["# Roles and permissions\n\n| **Note:** On September 7, 2023 Squarespace acquired all domain registrations and related customer accounts from Google Domains. For more information about how this change affects Cloud Domains, see [Cloud Domains feature deprecations](/domains/docs/deprecations/feature-deprecations), [Renew an expired domain registration](https://support.google.com/a/answer/6152355), and [Squarespace purchase of Google Domains FAQ](/domains/docs/faq).\n\n\u003cbr /\u003e\n\nThis page describes the Cloud Domains API roles and the access control options that\nare available to you in Cloud Domains.\n\nGoogle Cloud offers Identity and Access Management (IAM), which lets you give\nmore granular access to specific Google Cloud resources and prevents\nunwanted access to other resources. IAM lets you adopt the\n[security principle of least privilege](https://wikipedia.org/wiki/Principle_of_least_privilege)\nso that you grant only the necessary access to your resources.\nIAM lets you control *who* has *what* permissions to\n*which* resources by setting IAM policies.\nIAM policies grant specific roles to a user, which gives the user\ncertain permissions.\n\nFor example, a particular user might need to create and modify the contact\nsettings for a domain, so you would give that user the\nCloud Domains Admin role (`roles/domains.admin`). On the other hand,\na user might need to only view existing resource domains, so they would get a\nCloud Domains Viewer role (`roles/domains.viewer`). For\nCloud Domains, you can configure both project-level and\nresource-level access.\n\nFollowing are some examples of permissions for the Viewer role:\n\n- View all domains registered in a project.\n- View registration details such as DNS or expiry time.\n- Search domain availability and get registration parameters.\n\nFollowing are some examples of permissions for the Admin role:\n\n- Register a new domain.\n- Update registration settings, including DNS settings and contact settings.\n\nTo understand role types, see the\n[IAM basic and predefined roles reference](/iam/docs/understanding-roles).\n\nEnable the Cloud Domains API\n----------------------------\n\nTo view and assign Cloud Domains IAM roles,\nyou must enable the Cloud Domains API for your project. You cannot see the\nCloud Domains roles in the Google Cloud console until you\nenable the API.\n\n[Enable the API](https://console.cloud.google.com/apis/library/domains.googleapis.com)\n\nFor lists of the roles and permissions that Cloud Domains\nsupports, see the following sections.\n\nRoles\n-----\n\nThe following table lists the Cloud Domains API\nIAM roles with a corresponding list of all the permissions that\neach role includes. Each permission is applicable to a particular resource\ntype. For more details about each permission, see the\n[Permissions](#permissions) section.\n\nPermissions\n-----------\n\nThe following table lists the permissions that the caller must have to call\neach method.\n\nAccess control using the Google Cloud console\n---------------------------------------------\n\nYou can use the Google Cloud console to manage access control for your\nprojects.\n\nFor detailed instructions, see\n[Manage access to projects, folders, and organizations](/iam/docs/granting-changing-revoking-access).\n\nWhat's next\n-----------\n\n- To get started using Cloud Domains, see the [Quickstart](/domains/docs/buy-register-domain).\n- To improve the security of your Cloud Domains configuration, see [VPC Service Controls support](/domains/docs/vpc-sc-support).\n- To find solutions for common issues that you might encounter when using Cloud Domains, see [Troubleshooting](/domains/docs/troubleshooting)."]]
