使用 IAM 进行访问权限控制

本页介绍了如何控制 Discovery Engine API 访问权限和 使用 Identity and Access Management (IAM) 的 Vertex AI Agent Builder 资源的权限。

概览

Google Cloud 提供 IAM 对特定 Google Cloud 资源进行更精细的访问，并防止不必要的 访问其他资源本页面介绍 Vertex AI Agent Builder IAM 角色和权限如需详细了解 Google Cloud IAM，请参阅 IAM 文档。

Vertex AI Agent Builder 提供了一组预定义角色，这些角色为 可帮助您控制对 Vertex AI Agent Builder 资源的访问权限。 您也可以创建自己的自定义角色（如果预定义的 角色并未提供您所需的权限集。此外，旧版基本角色（Editor、Viewer 和 Owner）仍可供您使用，但这些角色提供的控制不如 Vertex AI Agent Builder 角色那样精细。具体而言，基本角色提供的是对整个 Google Cloud 资源的访问权限，而不仅仅是对 Vertex AI Agent Builder 的访问权限。如需了解详情，请参阅基本角色文档。

预定义角色

Vertex AI Agent Builder 提供了一些预定义角色，您可以使用这些角色来提供 为主账号授予更精细的权限。您授予主账号的角色决定了主账号可以执行的操作。主账号可以是个人、群组或服务账号。

如果您拥有相关权限，可向同一主账号授予多个角色，还可随时更改授予主账号的角色。

权限范围较广的角色拥有权限范围较窄的角色的所有权限。例如，Discovery Engine Editor 角色包含 Discovery Engine Viewer 角色的所有权限，还在其基础上添加了一些额外的 Discovery Engine Editor 角色权限。同样，Discovery Engine Admin 角色包含 Discovery Engine Editor 角色的权限，以及其他 权限。

基本角色（Owner、Editor、Viewer）提供对整个 Google Cloud 的权限。Vertex AI Agent Builder 专有角色仅提供 Vertex AI Agent Builder 权限，但以下 Google Cloud 权限除外，因为这些是 Google Cloud 常规使用所需的权限：

• resourcemanager.projects.get
• resourcemanager.projects.list
• serviceusage.services.list
• serviceusage.services.get

下表列出了 Vertex AI Agent Builder IAM 角色及其包含的所有权限的列表。

角色	权限
Discovery Engine Admin （roles/discoveryengine.admin） 授予对所有 Discovery Engine 资源的完整访问权限。	discoveryengine.* discoveryengine.aclConfigs.get discoveryengine.aclConfigs.update discoveryengine.analytics.acquireDashboardSession discoveryengine.analytics.refreshDashboardSessionTokens discoveryengine.answers.get discoveryengine.branches.get discoveryengine.branches.list discoveryengine.cmekConfigs.get discoveryengine.cmekConfigs.list discoveryengine.cmekConfigs.update discoveryengine.collections.delete discoveryengine.collections.get discoveryengine.collections.list discoveryengine.completionConfigs.completeQuery discoveryengine.completionConfigs.get discoveryengine.completionConfigs.update discoveryengine.controls.create discoveryengine.controls.delete discoveryengine.controls.get discoveryengine.controls.list discoveryengine.controls.update discoveryengine.conversations.converse discoveryengine.conversations.create discoveryengine.conversations.delete discoveryengine.conversations.get discoveryengine.conversations.list discoveryengine.conversations.update discoveryengine.dataStores.completeQuery discoveryengine.dataStores.create discoveryengine.dataStores.delete discoveryengine.dataStores.enrollSolutions discoveryengine.dataStores.get discoveryengine.dataStores.list discoveryengine.dataStores.trainCustomModel discoveryengine.dataStores.update discoveryengine.documentProcessingConfigs.get discoveryengine.documentProcessingConfigs.update discoveryengine.documents.batchGetDocumentsMetadata discoveryengine.documents.create discoveryengine.documents.delete discoveryengine.documents.get discoveryengine.documents.import discoveryengine.documents.list discoveryengine.documents.purge discoveryengine.documents.update discoveryengine.engines.create discoveryengine.engines.delete discoveryengine.engines.get discoveryengine.engines.list discoveryengine.engines.pause discoveryengine.engines.resume discoveryengine.engines.tune discoveryengine.engines.update discoveryengine.evaluations.create discoveryengine.evaluations.get discoveryengine.evaluations.list discoveryengine.groundingConfigs.check discoveryengine.locations.estimateDataSize discoveryengine.models.create discoveryengine.models.delete discoveryengine.models.get discoveryengine.models.list discoveryengine.models.pause discoveryengine.models.resume discoveryengine.models.tune discoveryengine.models.update discoveryengine.operations.get discoveryengine.operations.list discoveryengine.projects.get discoveryengine.projects.provision discoveryengine.projects.reportConsentChange discoveryengine.rankingConfigs.rank discoveryengine.sampleQueries.create discoveryengine.sampleQueries.delete discoveryengine.sampleQueries.get discoveryengine.sampleQueries.import discoveryengine.sampleQueries.list discoveryengine.sampleQueries.update discoveryengine.sampleQuerySets.create discoveryengine.sampleQuerySets.delete discoveryengine.sampleQuerySets.get discoveryengine.sampleQuerySets.list discoveryengine.sampleQuerySets.update discoveryengine.schemas.create discoveryengine.schemas.delete discoveryengine.schemas.get discoveryengine.schemas.list discoveryengine.schemas.preview discoveryengine.schemas.update discoveryengine.schemas.validate discoveryengine.servingConfigs.answer discoveryengine.servingConfigs.create discoveryengine.servingConfigs.delete discoveryengine.servingConfigs.get discoveryengine.servingConfigs.list discoveryengine.servingConfigs.recommend discoveryengine.servingConfigs.search discoveryengine.servingConfigs.update discoveryengine.sessions.create discoveryengine.sessions.delete discoveryengine.sessions.get discoveryengine.sessions.list discoveryengine.sessions.update discoveryengine.siteSearchEngines.batchVerifyTargetSites discoveryengine.siteSearchEngines.disableAdvancedSiteSearch discoveryengine.siteSearchEngines.enableAdvancedSiteSearch discoveryengine.siteSearchEngines.fetchDomainVerificationStatus discoveryengine.siteSearchEngines.get discoveryengine.siteSearchEngines.recrawlUris discoveryengine.suggestionDenyListEntries.import discoveryengine.suggestionDenyListEntries.purge discoveryengine.targetSites.batchCreate discoveryengine.targetSites.create discoveryengine.targetSites.delete discoveryengine.targetSites.get discoveryengine.targetSites.list discoveryengine.targetSites.update discoveryengine.userEvents.create discoveryengine.userEvents.fetchStats discoveryengine.userEvents.import discoveryengine.userEvents.purge discoveryengine.widgetConfigs.get discoveryengine.widgetConfigs.update resourcemanager.projects.get resourcemanager.projects.list
Discovery Engine 编辑器 （roles/discoveryengine.editor） 授予对所有 Discovery Engine 资源的读写权限。	discoveryengine.aclConfigs.get discoveryengine.analytics.* discoveryengine.analytics.acquireDashboardSession discoveryengine.analytics.refreshDashboardSessionTokens discoveryengine.answers.get discoveryengine.branches.* discoveryengine.branches.get discoveryengine.branches.list discoveryengine.cmekConfigs.get discoveryengine.cmekConfigs.list discoveryengine.collections.get discoveryengine.collections.list discoveryengine.completionConfigs.completeQuery discoveryengine.completionConfigs.get discoveryengine.controls.get discoveryengine.controls.list discoveryengine.conversations.* discoveryengine.conversations.converse discoveryengine.conversations.create discoveryengine.conversations.delete discoveryengine.conversations.get discoveryengine.conversations.list discoveryengine.conversations.update discoveryengine.dataStores.completeQuery discoveryengine.dataStores.get discoveryengine.dataStores.list discoveryengine.documentProcessingConfigs.get discoveryengine.documents.batchGetDocumentsMetadata discoveryengine.documents.create discoveryengine.documents.delete discoveryengine.documents.get discoveryengine.documents.import discoveryengine.documents.list discoveryengine.documents.update discoveryengine.engines.get discoveryengine.engines.list discoveryengine.engines.pause discoveryengine.engines.resume discoveryengine.engines.tune discoveryengine.evaluations.get discoveryengine.evaluations.list discoveryengine.groundingConfigs.check discoveryengine.models.* discoveryengine.models.create discoveryengine.models.delete discoveryengine.models.get discoveryengine.models.list discoveryengine.models.pause discoveryengine.models.resume discoveryengine.models.tune discoveryengine.models.update discoveryengine.operations.* discoveryengine.operations.get discoveryengine.operations.list discoveryengine.projects.get discoveryengine.rankingConfigs.rank discoveryengine.sampleQueries.* discoveryengine.sampleQueries.create discoveryengine.sampleQueries.delete discoveryengine.sampleQueries.get discoveryengine.sampleQueries.import discoveryengine.sampleQueries.list discoveryengine.sampleQueries.update discoveryengine.sampleQuerySets.* discoveryengine.sampleQuerySets.create discoveryengine.sampleQuerySets.delete discoveryengine.sampleQuerySets.get discoveryengine.sampleQuerySets.list discoveryengine.sampleQuerySets.update discoveryengine.schemas.get discoveryengine.schemas.list discoveryengine.schemas.preview discoveryengine.schemas.validate discoveryengine.servingConfigs.answer discoveryengine.servingConfigs.get discoveryengine.servingConfigs.list discoveryengine.servingConfigs.recommend discoveryengine.servingConfigs.search discoveryengine.sessions.* discoveryengine.sessions.create discoveryengine.sessions.delete discoveryengine.sessions.get discoveryengine.sessions.list discoveryengine.sessions.update discoveryengine.siteSearchEngines.get discoveryengine.targetSites.get discoveryengine.targetSites.list discoveryengine.userEvents.create discoveryengine.userEvents.fetchStats discoveryengine.userEvents.import discoveryengine.widgetConfigs.* discoveryengine.widgetConfigs.get discoveryengine.widgetConfigs.update resourcemanager.projects.get resourcemanager.projects.list
发现引擎用户 ^Beta 版 （roles/discoveryengine.user） 授予对 Discovery Engine 资源的用户级访问权限。	discoveryengine.answers.get discoveryengine.servingConfigs.answer discoveryengine.servingConfigs.search discoveryengine.sessions.get
Discovery Engine Viewer （roles/discoveryengine.viewer） 授予对所有 Discovery Engine 资源的读取权限。	discoveryengine.aclConfigs.get discoveryengine.analytics.* discoveryengine.analytics.acquireDashboardSession discoveryengine.analytics.refreshDashboardSessionTokens discoveryengine.answers.get discoveryengine.branches.* discoveryengine.branches.get discoveryengine.branches.list discoveryengine.cmekConfigs.get discoveryengine.cmekConfigs.list discoveryengine.collections.get discoveryengine.collections.list discoveryengine.completionConfigs.completeQuery discoveryengine.completionConfigs.get discoveryengine.controls.get discoveryengine.controls.list discoveryengine.conversations.converse discoveryengine.conversations.get discoveryengine.conversations.list discoveryengine.dataStores.completeQuery discoveryengine.dataStores.get discoveryengine.dataStores.list discoveryengine.documentProcessingConfigs.get discoveryengine.documents.batchGetDocumentsMetadata discoveryengine.documents.get discoveryengine.documents.list discoveryengine.engines.get discoveryengine.engines.list discoveryengine.evaluations.get discoveryengine.evaluations.list discoveryengine.groundingConfigs.check discoveryengine.models.get discoveryengine.models.list discoveryengine.operations.* discoveryengine.operations.get discoveryengine.operations.list discoveryengine.projects.get discoveryengine.rankingConfigs.rank discoveryengine.sampleQueries.get discoveryengine.sampleQueries.list discoveryengine.sampleQuerySets.get discoveryengine.sampleQuerySets.list discoveryengine.schemas.get discoveryengine.schemas.list discoveryengine.schemas.preview discoveryengine.schemas.validate discoveryengine.servingConfigs.answer discoveryengine.servingConfigs.get discoveryengine.servingConfigs.list discoveryengine.servingConfigs.recommend discoveryengine.servingConfigs.search discoveryengine.sessions.get discoveryengine.sessions.list discoveryengine.siteSearchEngines.get discoveryengine.targetSites.get discoveryengine.targetSites.list discoveryengine.userEvents.fetchStats discoveryengine.widgetConfigs.get resourcemanager.projects.get resourcemanager.projects.list

管理 Vertex AI Agent Builder IAM

您可以使用 Google Cloud 控制台获取和设置 IAM 允许政策和 IAM 角色。如需了解详情，请参阅管理对项目、文件夹和组织的访问权限。

后续步骤

• 了解如何管理对项目、文件夹和组织的访问权限。
• 详细了解 IAM。
• 详细了解基本角色。
• 详细了解自定义角色。