Control de acceso con IAM

En esta página, se describe cómo puedes controlar el acceso a la API de Discovery Engine y permisos para los recursos de Vertex AI Agent Builder mediante Identity and Access Management (IAM).

Descripción general

Google Cloud ofrece IAM, que te permite brindar un acceso más detallado a recursos específicos de Google Cloud y evita acceso a otros recursos. En esta página, se describe la IAM de Vertex AI Agent Builder roles y permisos. Para obtener una descripción detallada de Google Cloud IAM, consulta la documentación de IAM.

Vertex AI Agent Builder proporciona un conjunto de roles predefinidos diseñados para ayudarte a controlar el acceso a tus recursos de Vertex AI Agent Builder. También puedes crear tus funciones personalizadas, si las funciones predefinidas no proporcionan los conjuntos de permisos que necesitas. Además, la versión anterior los roles básicos (Editor, Visualizador y Propietario) aún están disponibles, aunque no proporcionan el mismo control detallado que Roles de Vertex AI Agent Builder. En particular, los roles básicos proporcionan acceso a recursos en todo Google Cloud, en lugar de solo Vertex AI Agent Builder. Consulta la documentación sobre funciones básicas para obtener más información.

Funciones predefinidas

Vertex AI Agent Builder proporciona algunos roles predefinidos que puedes usar para proporcionar permisos más detallados a los principales. La función que otorgas a un principal controla las acciones que puede realizar. Los principales pueden ser personas, grupos o cuentas de servicios.

Puedes otorgar varias funciones al mismo principal y cambiarlas en cualquier momento, siempre que tengas los permisos para hacerlo.

Las funciones más amplias incluyen las más específicas. Por ejemplo, el El rol de editor de Discovery Engine incluye todos los permisos de Discovery Visualizador de motores de búsqueda, junto con los permisos adicionales de Discovery Engine Editor Del mismo modo, el rol de administrador de Discovery Engine incluye permisos del rol Editor de Discovery Engine, además del permisos.

Las funciones básicas (Propietario, Editor y Visualizador) proporcionan permisos en Google Cloud. Los roles específicos de Vertex AI Agent Builder solo proporcionan permisos de Vertex AI Agent Builder, excepto los siguientes permisos de Google Cloud, que son necesarios para el uso general de Google Cloud:

• resourcemanager.projects.get
• resourcemanager.projects.list
• serviceusage.services.list
• serviceusage.services.get

En la siguiente tabla, se enumeran los roles de IAM de Vertex AI Agent Builder con la lista correspondiente de todos los permisos de cada rol.

Rol	Permisos
Administrador de Discovery Engine (roles/discoveryengine.admin) Otorga acceso completo a todos los recursos de Discovery Engine.	discoveryengine.* discoveryengine.aclConfigs.get discoveryengine.aclConfigs.update discoveryengine.analytics.acquireDashboardSession discoveryengine.analytics.refreshDashboardSessionTokens discoveryengine.answers.get discoveryengine.branches.get discoveryengine.branches.list discoveryengine.cmekConfigs.get discoveryengine.cmekConfigs.list discoveryengine.cmekConfigs.update discoveryengine.collections.delete discoveryengine.collections.get discoveryengine.collections.list discoveryengine.completionConfigs.completeQuery discoveryengine.completionConfigs.get discoveryengine.completionConfigs.update discoveryengine.controls.create discoveryengine.controls.delete discoveryengine.controls.get discoveryengine.controls.list discoveryengine.controls.update discoveryengine.conversations.converse discoveryengine.conversations.create discoveryengine.conversations.delete discoveryengine.conversations.get discoveryengine.conversations.list discoveryengine.conversations.update discoveryengine.dataStores.completeQuery discoveryengine.dataStores.create discoveryengine.dataStores.delete discoveryengine.dataStores.enrollSolutions discoveryengine.dataStores.get discoveryengine.dataStores.list discoveryengine.dataStores.trainCustomModel discoveryengine.dataStores.update discoveryengine.documentProcessingConfigs.get discoveryengine.documentProcessingConfigs.update discoveryengine.documents.batchGetDocumentsMetadata discoveryengine.documents.create discoveryengine.documents.delete discoveryengine.documents.get discoveryengine.documents.import discoveryengine.documents.list discoveryengine.documents.purge discoveryengine.documents.update discoveryengine.engines.create discoveryengine.engines.delete discoveryengine.engines.get discoveryengine.engines.list discoveryengine.engines.pause discoveryengine.engines.resume discoveryengine.engines.tune discoveryengine.engines.update discoveryengine.evaluations.create discoveryengine.evaluations.get discoveryengine.evaluations.list discoveryengine.groundingConfigs.check discoveryengine.locations.estimateDataSize discoveryengine.models.create discoveryengine.models.delete discoveryengine.models.get discoveryengine.models.list discoveryengine.models.pause discoveryengine.models.resume discoveryengine.models.tune discoveryengine.models.update discoveryengine.operations.get discoveryengine.operations.list discoveryengine.projects.get discoveryengine.projects.provision discoveryengine.projects.reportConsentChange discoveryengine.rankingConfigs.rank discoveryengine.sampleQueries.create discoveryengine.sampleQueries.delete discoveryengine.sampleQueries.get discoveryengine.sampleQueries.import discoveryengine.sampleQueries.list discoveryengine.sampleQueries.update discoveryengine.sampleQuerySets.create discoveryengine.sampleQuerySets.delete discoveryengine.sampleQuerySets.get discoveryengine.sampleQuerySets.list discoveryengine.sampleQuerySets.update discoveryengine.schemas.create discoveryengine.schemas.delete discoveryengine.schemas.get discoveryengine.schemas.list discoveryengine.schemas.preview discoveryengine.schemas.update discoveryengine.schemas.validate discoveryengine.servingConfigs.answer discoveryengine.servingConfigs.create discoveryengine.servingConfigs.delete discoveryengine.servingConfigs.get discoveryengine.servingConfigs.list discoveryengine.servingConfigs.recommend discoveryengine.servingConfigs.search discoveryengine.servingConfigs.update discoveryengine.sessions.create discoveryengine.sessions.delete discoveryengine.sessions.get discoveryengine.sessions.list discoveryengine.sessions.update discoveryengine.siteSearchEngines.batchVerifyTargetSites discoveryengine.siteSearchEngines.disableAdvancedSiteSearch discoveryengine.siteSearchEngines.enableAdvancedSiteSearch discoveryengine.siteSearchEngines.fetchDomainVerificationStatus discoveryengine.siteSearchEngines.get discoveryengine.siteSearchEngines.recrawlUris discoveryengine.suggestionDenyListEntries.import discoveryengine.suggestionDenyListEntries.purge discoveryengine.targetSites.batchCreate discoveryengine.targetSites.create discoveryengine.targetSites.delete discoveryengine.targetSites.get discoveryengine.targetSites.list discoveryengine.targetSites.update discoveryengine.userEvents.create discoveryengine.userEvents.fetchStats discoveryengine.userEvents.import discoveryengine.userEvents.purge discoveryengine.widgetConfigs.get discoveryengine.widgetConfigs.update resourcemanager.projects.get resourcemanager.projects.list
Editor de Discovery Engine (roles/discoveryengine.editor) Otorga acceso de lectura y escritura a todos los recursos de Discovery Engine.	discoveryengine.aclConfigs.get discoveryengine.analytics.* discoveryengine.analytics.acquireDashboardSession discoveryengine.analytics.refreshDashboardSessionTokens discoveryengine.answers.get discoveryengine.branches.* discoveryengine.branches.get discoveryengine.branches.list discoveryengine.cmekConfigs.get discoveryengine.cmekConfigs.list discoveryengine.collections.get discoveryengine.collections.list discoveryengine.completionConfigs.completeQuery discoveryengine.completionConfigs.get discoveryengine.controls.get discoveryengine.controls.list discoveryengine.conversations.* discoveryengine.conversations.converse discoveryengine.conversations.create discoveryengine.conversations.delete discoveryengine.conversations.get discoveryengine.conversations.list discoveryengine.conversations.update discoveryengine.dataStores.completeQuery discoveryengine.dataStores.get discoveryengine.dataStores.list discoveryengine.documentProcessingConfigs.get discoveryengine.documents.batchGetDocumentsMetadata discoveryengine.documents.create discoveryengine.documents.delete discoveryengine.documents.get discoveryengine.documents.import discoveryengine.documents.list discoveryengine.documents.update discoveryengine.engines.get discoveryengine.engines.list discoveryengine.engines.pause discoveryengine.engines.resume discoveryengine.engines.tune discoveryengine.evaluations.get discoveryengine.evaluations.list discoveryengine.groundingConfigs.check discoveryengine.models.* discoveryengine.models.create discoveryengine.models.delete discoveryengine.models.get discoveryengine.models.list discoveryengine.models.pause discoveryengine.models.resume discoveryengine.models.tune discoveryengine.models.update discoveryengine.operations.* discoveryengine.operations.get discoveryengine.operations.list discoveryengine.projects.get discoveryengine.rankingConfigs.rank discoveryengine.sampleQueries.* discoveryengine.sampleQueries.create discoveryengine.sampleQueries.delete discoveryengine.sampleQueries.get discoveryengine.sampleQueries.import discoveryengine.sampleQueries.list discoveryengine.sampleQueries.update discoveryengine.sampleQuerySets.* discoveryengine.sampleQuerySets.create discoveryengine.sampleQuerySets.delete discoveryengine.sampleQuerySets.get discoveryengine.sampleQuerySets.list discoveryengine.sampleQuerySets.update discoveryengine.schemas.get discoveryengine.schemas.list discoveryengine.schemas.preview discoveryengine.schemas.validate discoveryengine.servingConfigs.answer discoveryengine.servingConfigs.get discoveryengine.servingConfigs.list discoveryengine.servingConfigs.recommend discoveryengine.servingConfigs.search discoveryengine.sessions.* discoveryengine.sessions.create discoveryengine.sessions.delete discoveryengine.sessions.get discoveryengine.sessions.list discoveryengine.sessions.update discoveryengine.siteSearchEngines.get discoveryengine.targetSites.get discoveryengine.targetSites.list discoveryengine.userEvents.create discoveryengine.userEvents.fetchStats discoveryengine.userEvents.import discoveryengine.widgetConfigs.* discoveryengine.widgetConfigs.get discoveryengine.widgetConfigs.update resourcemanager.projects.get resourcemanager.projects.list
Usuario de Discovery Engine ^Versión beta (roles/discoveryengine.user) Otorga acceso a nivel de usuario a los recursos de Discovery Engine.	discoveryengine.answers.get discoveryengine.servingConfigs.answer discoveryengine.servingConfigs.search discoveryengine.sessions.get
Visualizador de Discovery Engine (roles/discoveryengine.viewer) Otorga acceso de lectura a todos los recursos de Discovery Engine.	discoveryengine.aclConfigs.get discoveryengine.analytics.* discoveryengine.analytics.acquireDashboardSession discoveryengine.analytics.refreshDashboardSessionTokens discoveryengine.answers.get discoveryengine.branches.* discoveryengine.branches.get discoveryengine.branches.list discoveryengine.cmekConfigs.get discoveryengine.cmekConfigs.list discoveryengine.collections.get discoveryengine.collections.list discoveryengine.completionConfigs.completeQuery discoveryengine.completionConfigs.get discoveryengine.controls.get discoveryengine.controls.list discoveryengine.conversations.converse discoveryengine.conversations.get discoveryengine.conversations.list discoveryengine.dataStores.completeQuery discoveryengine.dataStores.get discoveryengine.dataStores.list discoveryengine.documentProcessingConfigs.get discoveryengine.documents.batchGetDocumentsMetadata discoveryengine.documents.get discoveryengine.documents.list discoveryengine.engines.get discoveryengine.engines.list discoveryengine.evaluations.get discoveryengine.evaluations.list discoveryengine.groundingConfigs.check discoveryengine.models.get discoveryengine.models.list discoveryengine.operations.* discoveryengine.operations.get discoveryengine.operations.list discoveryengine.projects.get discoveryengine.rankingConfigs.rank discoveryengine.sampleQueries.get discoveryengine.sampleQueries.list discoveryengine.sampleQuerySets.get discoveryengine.sampleQuerySets.list discoveryengine.schemas.get discoveryengine.schemas.list discoveryengine.schemas.preview discoveryengine.schemas.validate discoveryengine.servingConfigs.answer discoveryengine.servingConfigs.get discoveryengine.servingConfigs.list discoveryengine.servingConfigs.recommend discoveryengine.servingConfigs.search discoveryengine.sessions.get discoveryengine.sessions.list discoveryengine.siteSearchEngines.get discoveryengine.targetSites.get discoveryengine.targetSites.list discoveryengine.userEvents.fetchStats discoveryengine.widgetConfigs.get resourcemanager.projects.get resourcemanager.projects.list

Administrar la IAM de Vertex AI Agent Builder

Puedes obtener y configurar políticas de permisos y roles de IAM con Google Cloud de Cloud. Para obtener más información, consulta Administra el acceso a proyectos, carpetas y organizaciones.

¿Qué sigue?

• Obtén más información para administrar el acceso a proyectos, carpetas y organizaciones.
• Obtén más información sobre IAM.
• Obtén más información sobre las funciones básicas.
• Obtén más información sobre las funciones personalizadas.