API에 대한 액세스 권한 부여 대상을 제어하는 것은 개발 과정의 핵심입니다. 예를 들어 API를 테스트할 때 권한이 있는 서비스 계정을 사용하여 업데이트된 Cloud Endpoints 구성 재배치를 자동화하려고 할 수 있습니다. 기본적으로 프로젝트 소유자만 API 액세스를 관리할 수 있습니다. 이 페이지에서는 Google Cloud Console 또는 Google Cloud CLI를 사용하여 API에 대한 액세스 권한을 부여하고 취소하는 방법을 보여줍니다.
Google 그룹스를 사용하면 편리하게 여러 사용자에게 액세스 권한을 부여하거나 취소할 수 있습니다. 개별 사용자 또는 서비스 계정에 대해 한 번에 하나씩 액세스 권한을 부여하거나 취소하는 대신 전체 그룹에 대한 액세스 권한을 한 번에 부여하거나 취소할 수 있습니다. 또한 각 구성원에 대한 IAM 역할을 부여하거나 취소하는 대신 Google 그룹에 구성원을 쉽게 추가하고 삭제할 수 있습니다.
액세스 권한 부여
Google Cloud Console
Google Cloud Console에서 프로젝트의 Endpoints > 서비스 페이지로 이동합니다.
구성원 추가 상자에 사용자, 서비스 계정 또는 Google 그룹스의 이메일 주소를 입력합니다.
역할 선택 드롭다운에서 Service Management를 클릭하고 다음 역할 중 하나를 선택합니다.
서비스 소비자: 이 역할은 프로젝트 구성원이 아닌 사용자가 자신의 고유 프로젝트에서 API를 보고 사용 설정할 수 있는 권한을 포함합니다. API용 포털을 만든 경우 API 사용자는 이 역할을 통해 포털에 액세스할 수 있습니다.
서비스 컨트롤러:이 역할에는 런타임 중에 서비스 인프라 API에서 check 및
report 메서드를 호출할 수 있는 권한이 포함됩니다.
서비스 구성 편집자: 이 역할에는 Service Management가 Endpoints 구성을 기존 서비스에 배포하는 데 필요한 최소한의 권한이 포함되어 있습니다.
Service Management 관리자: 이 역할에는 서비스 구성 편집자, 서비스 소비자, 서비스 컨트롤러 역할의 권한과 리소스에 대한 액세스 권한 부여, 변경, 취소에 설명된 gcloud 또는 프로그래매틱 메서드를 사용하여 이 API에 대한 액세스 권한을 부여하는 데 필요한 권한이 포함되어 있습니다.
이 역할에 대한 자세한 내용은 Service Management API 액세스 제어 항목을 참조하세요. Google Cloud Console에서 다른 역할을 선택할 수 있지만 이러한 역할은 API 관리에 유용하지 않습니다.
지정된 IAM 역할에 구성원을 추가하려면 추가를 클릭합니다.
필요에 따라 구성원 추가와 역할 선택을 반복합니다.
Service Management 역할에서는 사용자가 Google Cloud Console의 Endpoints > 서비스 페이지에 액세스하는 것을 허용하지 않습니다. 사용자가 Endpoints > 서비스 페이지에 액세스할 수 있게 하려면 프로젝트에 대한 프로젝트 뷰어 이상의 역할을 부여해야 합니다. 자세한 내용은 리소스에 대한 액세스 권한 부여, 변경, 취소를 참조하세요.
gcloud
Cloud Shell을 열거나, Google Cloud CLI가 설치된 경우 터미널 창을 엽니다.
roles/servicemanagement.configEditor: 이 역할에는 Service Management에서 Endpoints 구성을 기존 서비스에 배포하는 데 필요한 최소 권한이 포함됩니다.
roles/servicemanagement.admin: 이 역할에는 roles/servicemanagement.configEditor, roles/servicemanagement.serviceConsumer, roles/servicemanagement.serviceController, 리소스에 대한 액세스 권한 부여, 변경, 취소에 설명된 gcloud 또는 프로그래매틱 메서드를 사용하여 이 API에 대한 액세스 권한을 부여하는 데 필요한 권한이 포함되어 있습니다.
Service Management 역할에서는 사용자가 Google Cloud Console의 Endpoints > 서비스 페이지에 액세스하는 것을 허용하지 않습니다. 사용자가 Endpoints > 서비스 페이지에 액세스할 수 있게 하려면 프로젝트에 대한 프로젝트 뷰어 이상의 역할을 부여해야 합니다. 자세한 내용은 리소스에 대한 액세스 권한 부여, 변경, 취소를 참조하세요.
액세스 권한 취소
API에 대한 액세스 권한을 취소하려면 이전에 해당 역할을 갖고 있던 구성원에서 IAM 역할을 삭제합니다.
Google Cloud Console
Google Cloud Console에서 프로젝트의 Endpoints > 서비스 페이지로 이동합니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2024-12-21(UTC)"],[[["\u003cp\u003eThis document details how to manage API access using Google Cloud's Identity and Access Management (IAM) roles for users, service accounts, or Google Groups.\u003c/p\u003e\n"],["\u003cp\u003eAPI access can be granted through the Google Cloud console by navigating to the Endpoints Services page and selecting from the Service Management roles available, such as Service Consumer, Service Controller, Service Config Editor, and Service Management Administrator.\u003c/p\u003e\n"],["\u003cp\u003eAccess can also be granted or revoked using the \u003ccode\u003egcloud\u003c/code\u003e CLI by employing the \u003ccode\u003egcloud endpoints services add-iam-policy-binding\u003c/code\u003e and \u003ccode\u003egcloud endpoints services remove-iam-policy-binding\u003c/code\u003e commands, respectively.\u003c/p\u003e\n"],["\u003cp\u003eGranting Service Management roles alone does not allow users to access the Endpoints > Services page; for this, users need the Project Viewer role or higher.\u003c/p\u003e\n"],["\u003cp\u003eRevoking API access involves removing the assigned IAM role from the member either through the Google Cloud console or by utilizing \u003ccode\u003egcloud\u003c/code\u003e CLI commands, effectively removing their permissions.\u003c/p\u003e\n"]]],[],null,["# Granting and revoking access to the API\n\nOpenAPI \\| [gRPC](/endpoints/docs/grpc/control-api-access \"View this page for the Cloud Endpoints gRPC docs\")\n\n\u003cbr /\u003e\n\nControlling who has access to an API is an integral part of development. For\nexample, as you test your API, you might want to automate redeploying updated\nCloud Endpoints configurations by using a service account that has the\npermission to do so. By default, only the project owner can manage access to an\nAPI. This page shows you how to grant and revoke access to your API by using the\nGoogle Cloud console or the Google Cloud CLI.\n\nEndpoints uses\n[Identity and Access Management](/iam/docs/overview)\nroles to grant and revoke access at the API level. You can grant and revoke\naccess to a user, service account, or to a\n[Google Group](https://support.google.com/groups/answer/2464926).\n\nGoogle Groups are a convenient way to grant or revoke access to a collection of\nusers. You can grant or revoke access for a whole group at once, instead of\ngranting or revoking access one at a time for individual users or service\naccounts. You can also easily add members to and remove members from a\nGoogle Group instead of granting or revoking the IAM role for\neach member.\n\nGranting access\n---------------\n\n### Google Cloud console\n\n1. In the Google Cloud console, go to the **Endpoints \\\u003e Services** page for your project.\n\n [Go to the Endpoints Services page](https://console.cloud.google.com/endpoints)\n2. If you have more than one API, click the name of the API.\n3. If the **Permissions** side panel isn't open, click **addPermissions**.\n4. In the **Add members** box, enter the email address of a user, service account, or Google Group.\n5. In the **Select a role** drop-down, click **Service Management** , and select one of the following roles:\n - **Service Consumer:** This role contains the permissions for a non-project member to view and enable the API in their own project. If you have created a [portal](/endpoints/docs/openapi/dev-portal-overview) for your API, this role lets your API users access the portal.\n - **Service Controller:** This role contains the permissions to make calls to the `check` and `\n report` methods in the [Service Infrastructure](/service-infrastructure/docs/checking-status) API during runtime.\n - **Service Config Editor:** This role contains the minimum permissions that Service Management requires to deploy an Endpoints configuration to an existing service.\n - **Service Management Administrator:** This role contains the permissions in the Service Config Editor, Service Consumer, and Service Controller roles, plus the permissions required to grant access to this API by using `gcloud` or the programmatic methods described in [Granting, changing, and revoking access to resources](/iam/docs/granting-changing-revoking-access).\n\n\n See the [Service Management API access control](/service-infrastructure/docs/service-management/access-control#roles)\n topic for information about this role. Although the Google Cloud console allows you to select other roles,\n those roles aren't useful for managing your API.\n6. To add the member to the specified IAM role, click **Add**.\n7. Repeat adding members and selecting the role, as needed.\n8. The Service Management roles don't allow users to access the **Endpoints** \\\u003e **Services** page in the Google Cloud console. If you want users to be able access the **Endpoints** \\\u003e **Services** page, you must grant them the **Project Viewer** role or a higher role on the project. See [Granting, changing,\n and revoking access to resources](/iam/docs/granting-changing-revoking-access) for details.\n\n### gcloud\n\n1. Open Cloud Shell, or if you have the Google Cloud CLI installed, open a terminal window.\n2. Enter the applicable `gcloud` command:\n - If you are granting access to a user, run the following: \n\n ```transact-sql\n gcloud endpoints services add-iam-policy-binding [SERVICE-NAME] \\\n --member='user:[EMAIL-ADDRESS]' \\\n --role='[ROLE]'\n ```\n\n For the role, specify one of the following IAM roles:\n - `roles/servicemanagement.configEditor`: This role contains the minimum permissions that Service Management requires to deploy an Endpoints configuration to an existing service.\n - `roles/servicemanagement.admin`: This role contains the permissions in `roles/servicemanagement.configEditor`, `roles/servicemanagement.serviceConsumer`, and `roles/servicemanagement.serviceController`, plus the permissions required to grant access to this API by using `gcloud` or the programmatic methods described in [Granting,\n changing, and revoking access to resources](/iam/docs/granting-changing-revoking-access).\n\n \u003cbr /\u003e\n\n For example: \n\n ```transact-sql\n gcloud endpoints services add-iam-policy-binding example-service-name \\\n --member='user:example-user@gmail.com' \\\n --role='roles/servicemanagement.admin'\n ```\n\n \u003cbr /\u003e\n\n - If you are granting access to a service account, run the following: \n\n ```transact-sql\n gcloud endpoints services add-iam-policy-binding [SERVICE-NAME] \\\n --member='serviceAccount:[EMAIL-ADDRESS]' \\\n --role='[ROLE]'\n ```\n\n For example: \n\n ```transact-sql\n gcloud endpoints services add-iam-policy-binding example-service-name \\\n --member='serviceAccount:example-service-account@example-project.iam.gserviceaccount.com' \\\n --role='roles/servicemanagement.configEditor'\n ```\n\n \u003cbr /\u003e\n\n - If you are granting access to a Google Group, run the following: \n\n ```transact-sql\n gcloud endpoints services add-iam-policy-binding [SERVICE-NAME] \\\n --member='group:[GROUP-NAME]@googlegroups.com' \\\n --role='[ROLE]'\n ```\n\n For example: \n\n ```transact-sql\n gcloud endpoints services add-iam-policy-binding example-service-name \\\n --member='group:example-group@googlegroups.com' \\\n --role='roles/servicemanagement.configEditor'\n ```\n\n \u003cbr /\u003e\n\n3. The Service Management roles don't allow users to access the **Endpoints** \\\u003e **Services** page in the Google Cloud console. If you want users to be able access the **Endpoints** \\\u003e **Services** page, you must grant them the **Project Viewer** role or a higher role on the project. See [Granting, changing,\n and revoking access to resources](/iam/docs/granting-changing-revoking-access) for details.\n\nRevoking access\n---------------\n\nTo revoke access to your API, remove the IAM role from the member\nwho previously had the role. \n\n### Google Cloud console\n\n1. In the Google Cloud console, go to the **Endpoints** \\\u003e **Services** page for your project.\n\n [Go to the Endpoints Services page](https://console.cloud.google.com/endpoints)\n2. If you have more than one API, click the name of the API.\n3. If the **Permissions** side panel isn't open, click **addPermissions**.\n4. Locate the member for whom you want to revoke access. You can either click the applicable **Role** card to see a list of members, or you can enter a name or role in the **Search members** box.\n5. Click **Delete** delete.\n6. If you also want to revoke a user's access to your Google Cloud project, see [Granting,\n changing, and revoking access to resources](/iam/docs/granting-changing-revoking-access) for details.\n\n### gcloud\n\n1. Open Cloud Shell, or, if you have the gcloud CLI installed, open a terminal window.\n2. Enter the applicable `gcloud` command:\n - If you are revoking access for a user, run the following: \n\n ```text\n gcloud endpoints services remove-iam-policy-binding [SERVICE-NAME] \\\n --member='user:[EMAIL-ADDRESS]' \\\n --role='[ROLE-NAME]'\n ```\n\n For example: \n\n ```transact-sql\n gcloud endpoints services remove-iam-policy-binding example-service-name \\\n --member='user:example-user@gmail.com' \\\n --role='roles/editor'\n ```\n - If you are revoking access for a service account, run the following: \n\n ```text\n gcloud endpoints services remove-iam-policy-binding [SERVICE-NAME] \\\n --member='serviceAccount:[EMAIL-ADDRESS]' \\\n --role='[ROLE-NAME]'\n ```\n\n For example: \n\n ```transact-sql\n gcloud endpoints services remove-iam-policy-binding example-service-name \\\n --member='serviceAccount:example-service-account@example-project.iam.gserviceaccount.com' \\\n --role='roles/servicemanagement.configEditor'\n ```\n - If you are revoking access for a Google Group, run the following: \n\n ```transact-sql\n gcloud endpoints services remove-iam-policy-binding [SERVICE-NAME] \\\n --member='group:[GROUP-NAME]@googlegroups.com' \\\n --role='[ROLE-NAME]'\n ```\n\n For example: \n\n ```transact-sql\n gcloud endpoints services remove-iam-policy-binding example-service-name \\\n --member='group:example-group@googlegroups.com' \\\n --role='roles/viewer'\n ```\n3. If you also want to revoke a user's access to your Google Cloud project, see [Granting,\n changing, and revoking access to resources](/iam/docs/granting-changing-revoking-access) for details.\n\nWhat's next\n-----------\n\nLearn about:\n\n- [Creating a service account](/iam/docs/creating-managing-service-accounts#creating_a_service_account)\n- [`gcloud` commands](/sdk/gcloud/reference) referenced on this page."]]
