IAM 权限

概览

AML AI 使用 Identity and Access Management (IAM) 来 访问权限控制

您可以在项目级层配置 Financial Services API 的访问权限控制。例如,您可以向开发者授予列出和获取 多个数据集。

如需详细了解 IAM 及其功能,请参阅 IAM 文档。尤其应参阅管理 IAM 政策部分。

每种 AML AI 方法都要求调用者拥有必要的权限。如需了解详情,请参阅权限角色

权限

本部分列出了 AML AI 操作及其相关操作 由 IAM 实现的权限。

所需权限

下表列出了与 AML AI 关联的 IAM 权限。

projects.locations 方法名称 所需权限
projects.locations.get 针对特定 Google Cloud 项目的 financialservices.locations.get 权限
projects.locations.list 特定 Google Cloud 项目的 financialservices.locations.list 权限
instances 方法名称 所需权限
instances.create 针对父级位置(特定 Google Cloud 项目和数据位置组合)的 financialservices.v1instances.create 权限
instances.delete 针对实例资源的 financialservices.v1instances.delete 权限
instances.get 针对实例资源的 financialservices.v1instances.get 权限
instances.list 父级位置(即特定 Google Cloud 项目和数据位置组合)上的 financialservices.v1instances.list 权限
instances.patch 针对实例资源的 financialservices.v1instances.update 权限
instances.importRegisteredParties 针对实例资源的 financialservices.v1instances.importRegisteredParties 权限
instances.exportRegisteredParties 针对实例资源的 financialservices.v1instances.exportRegisteredParties 权限
instances.engineConfigs 方法名称 所需权限
instances.engineConfigs.create 父实例上的 financialservices.v1engineconfigs.create 权限
instances.engineConfigs.delete 针对引擎配置资源的 financialservices.v1engineconfigs.delete 权限
instances.engineConfigs.get 引擎配置资源上的 financialservices.v1engineconfigs.get
instances.engineConfigs.list 针对父实例的 financialservices.v1engineconfigs.list 权限
instances.engineConfigs.patch 引擎配置资源上的 financialservices.v1engineconfigs.update
instances.engineConfigs.exportMetadata 针对引擎配置资源的 financialservices.v1engineconfigs.exportMetadata 权限
instances.engineVersions 方法名称 所需权限
instances.engineVersions.get 针对引擎版本资源的 financialservices.v1engineversions.get
instances.engineVersions.list 父实例上的 financialservices.v1engineversions.list
instances.datasets 方法名称 所需权限
instances.datasets.create financialservices.v1datasets.create 在父实例上
instances.datasets.delete 对数据集资源的 financialservices.v1datasets.delete
instances.datasets.get 数据集资源上的 financialservices.v1datasets.get
instances.datasets.list 父实例上的 financialservices.v1datasets.list
instances.datasets.patch financialservices.v1datasets.update 数据集资源
instances.models 方法名称 所需权限
instances.models.create 父实例上的 financialservices.v1models.create 权限
instances.models.delete 针对模型资源的 financialservices.v1models.delete 权限
instances.models.get 针对模型资源的 financialservices.v1models.get 权限
instances.models.list 针对父实例的 financialservices.v1models.list 权限
instances.models.patch 针对模型资源的 financialservices.v1models.update 权限
instances.models.exportMetadata 针对模型资源的 financialservices.v1models.exportMetadata 权限
instances.backtestResults 方法名称 所需权限
instances.backtestResults.create 针对父实例的 financialservices.v1backtests.create 权限
instances.backtestResults.delete 针对回测结果资源的 financialservices.v1backtests.delete
instances.backtestResults.get 针对回测结果资源的 financialservices.v1backtests.get 权限
instances.backtestResults.list 父实例上的 financialservices.v1backtests.list 权限
instances.backtestResults.patch 针对回测结果资源的 financialservices.v1backtests.update
instances.backtestResults.exportMetadata 针对回测结果资源的 financialservices.v1backtests.exportMetadata
instances.predictionResults 方法名称 所需权限
instances.predictionResults.create 父实例上的 financialservices.v1predictions.create 权限
instances.predictionResults.delete 针对预测结果资源的 financialservices.v1predictions.delete 权限
instances.predictionResults.get 针对预测结果资源的 financialservices.v1predictions.get
instances.predictionResults.list 父实例上的 financialservices.v1predictions.list 权限
instances.predictionResults.patch 针对预测结果资源的 financialservices.v1predictions.update 权限
instances.predictionResults.exportMetadata 针对预测结果资源的 financialservices.v1predictions.exportMetadata

以下方法继承自 google.longrunning.Operations

operations 方法名称 所需权限
operations.cancel 特定 Google Cloud 项目上的 financialservices.operations.cancel
operations.delete financialservices.operations.delete 特定 Google Cloud 项目
operations.get 特定 Google Cloud 项目的 financialservices.operations.get
operations.list financialservices.operations.list 特定 Google Cloud 项目

角色

下表列出了 AML AI IAM 角色,包括与每个角色关联的权限:

IAM 角色 权限

roles/financialservices.viewer

拥有对所有 Financial Services API 资源的查看权限。

financialservices.locations.*

  • financialservices.locations.get
  • financialservices.locations.list

financialservices.operations.get

financialservices.operations.list

financialservices.v1backtests.exportMetadata

financialservices.v1backtests.get

financialservices.v1backtests.list

financialservices.v1datasets.get

financialservices.v1datasets.list

financialservices.v1engineconfigs.exportMetadata

financialservices.v1engineconfigs.get

financialservices.v1engineconfigs.list

financialservices.v1engineversions.*

  • financialservices.v1engineversions.get
  • financialservices.v1engineversions.list

financialservices.v1instances.exportRegisteredParties

financialservices.v1instances.get

financialservices.v1instances.list

financialservices.v1models.exportMetadata

financialservices.v1models.get

financialservices.v1models.list

financialservices.v1predictions.exportMetadata

financialservices.v1predictions.get

financialservices.v1predictions.list

resourcemanager.projects.get

resourcemanager.projects.list

roles/financialservices.admin

拥有对所有 Financial Services API 资源的完整访问权限。

financialservices.*

  • financialservices.locations.get
  • financialservices.locations.list
  • financialservices.operations.cancel
  • financialservices.operations.delete
  • financialservices.operations.get
  • financialservices.operations.list
  • financialservices.v1backtests.create
  • financialservices.v1backtests.delete
  • financialservices.v1backtests.exportMetadata
  • financialservices.v1backtests.get
  • financialservices.v1backtests.list
  • financialservices.v1backtests.update
  • financialservices.v1datasets.create
  • financialservices.v1datasets.delete
  • financialservices.v1datasets.get
  • financialservices.v1datasets.list
  • financialservices.v1datasets.update
  • financialservices.v1engineconfigs.create
  • financialservices.v1engineconfigs.delete
  • financialservices.v1engineconfigs.exportMetadata
  • financialservices.v1engineconfigs.get
  • financialservices.v1engineconfigs.list
  • financialservices.v1engineconfigs.update
  • financialservices.v1engineversions.get
  • financialservices.v1engineversions.list
  • financialservices.v1instances.create
  • financialservices.v1instances.delete
  • financialservices.v1instances.exportRegisteredParties
  • financialservices.v1instances.get
  • financialservices.v1instances.importRegisteredParties
  • financialservices.v1instances.list
  • financialservices.v1instances.update
  • financialservices.v1models.create
  • financialservices.v1models.delete
  • financialservices.v1models.exportMetadata
  • financialservices.v1models.get
  • financialservices.v1models.list
  • financialservices.v1models.update
  • financialservices.v1predictions.create
  • financialservices.v1predictions.delete
  • financialservices.v1predictions.exportMetadata
  • financialservices.v1predictions.get
  • financialservices.v1predictions.list
  • financialservices.v1predictions.update

resourcemanager.projects.get

resourcemanager.projects.list

有关角色的详细信息,请参阅 IAM 基本角色和预定义角色参考文档

自定义角色

如果 AML AI 的预定义 IAM 角色不符合您的需求,您可以定义自定义角色。自定义角色可让您选择一组 创建具有这些权限的专属角色,然后将该角色授予 用户。如需了解详情,请参阅了解 IAM 自定义角色