本頁面由 Cloud Translation API 翻譯而成。

控管 Cloud Healthcare API 資源的存取權

本頁說明如何使用 Identity and Access Management (IAM) 權限，控管 Cloud Healthcare API 資料集和資料存放區的存取權。您可以使用 IAM 管理要讓哪些人存取資料集和資料儲存庫。如要進一步瞭解 Cloud Healthcare API 的 IAM，請參閱存取權控管。

IAM 政策總覽

資源的存取權可透過 IAM 政策進行管理。政策包含名為 bindings 的陣列。這個陣列包含一組繫結，也就是主體 (例如使用者帳戶或服務帳戶) 與角色之間的關聯。政策可使用 JSON 或 YAML 來表示。

下列範例政策顯示 user-1@example.com 已獲授 roles/healthcare.datasetAdmin 角色，而 user-2@example.com 和 service-account-13@appspot.gserviceaccount.com 則獲授 roles/healthcare.datasetViewer 角色：

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.datasetAdmin",
      "members": [
        "user:user-1@example.com"
      ]
    },
    {
      "role":"roles/healthcare.datasetViewer",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com",
        "user:user-2@example.com"
      ]
    }
  ]
}

如要更新資源政策，請使用「讀取 - 修改 - 寫入」模式。建立、修改及撤銷使用者存取權的方法相同。

如要更新政策，請完成下列步驟：

呼叫資源的 getIamPolicy() 方法，讀取目前的政策。舉例來說，如要讀取資料集的現行政策，請呼叫 projects.locations.datasets.getIamPolicy。
使用文字編輯器或透過程式來編輯傳回的政策，藉此新增或移除任何適用的主體及其授予的角色。
呼叫資源的 setIamPolicy() 方法，寫入更新的政策。舉例來說，如要寫入資料集的更新政策，請呼叫 projects.locations.datasets.setIamPolicy。

搭配同意聲明儲存庫使用 IAM

以下各節說明如何取得、修改及設定同意聲明存放區的政策。這些章節以以下範例政策為基礎：

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.consentStoreAdmin",
      "members": [
        "user:user-1@example.com"
      ]
    },
    {
      "role":"roles/healthcare.consentReader",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com",
        "user:user-2@example.com"
      ]
    }
  ]
}

取得政策

下列範例說明如何讀取同意聲明存放區層級的 IAM 政策。詳情請參閱 projects.locations.datasets.consentStores.getIamPolicy。

如要查看同意聲明存放區的 IAM 政策：

前往 Google Cloud 控制台的「資料集」頁面。
前往「資料集」頁面
按一下含有同意聲明儲存庫的資料集 ID，然後選取要取得政策的同意聲明儲存庫。
按一下「顯示資訊面板」。
如要查看指派給角色的主體，請展開該角色。

如要查看同意事項商店的 IAM 政策，請執行 gcloud healthcare consent-stores get-iam-policy 指令。指定同意聲明商店名稱、資料集名稱和位置。

gcloud healthcare consent-stores get-iam-policy CONSENT_STORE_ID \
    --dataset=DATASET_ID \
    --location=LOCATION

如果要求成功，系統會顯示繫結。

bindings:
- members:
  - user:user-1@example.com
  role: roles/healthcare.consentStoreAdmin
  - serviceAccount:service-account-13@appspot.gserviceaccount.com
  - user:user-2@example.com
  role: roles/healthcare.consentReader
etag: bytes
version: VERSION_NUMBER

const google = require('@googleapis/healthcare');
const healthcare = google.healthcare({
  version: 'v1',
  auth: new google.auth.GoogleAuth({
    scopes: ['https://www.googleapis.com/auth/cloud-platform'],
  }),
});

const getConsentStoreIamPolicy = async () => {
  // TODO(developer): uncomment these lines before running the sample
  // const cloudRegion = 'us-central1';
  // const projectId = 'adjective-noun-123';
  // const datasetId = 'my-dataset';
  // const consentStoreId = 'my-consent-store';
  const resource_ = `projects/${projectId}/locations/${cloudRegion}/datasets/${datasetId}/consentStores/${consentStoreId}`;
  const request = {resource_};

  const consentStore =
    await healthcare.projects.locations.datasets.consentStores.getIamPolicy(
      request
    );
  console.log(
    'Got consent store IAM policy:',
    JSON.stringify(consentStore.data, null, 2)
  );
};

getConsentStoreIamPolicy();

def get_consent_store_iam_policy(
    project_id: str, location: str, dataset_id: str, consent_store_id: str
):
    """Gets the IAM policy for the specified consent store.
    See https://github.com/GoogleCloudPlatform/python-docs-samples/tree/main/healthcare/api-client/v1/consent
    before running the sample."""
    # Imports the Google API Discovery Service.
    from googleapiclient import discovery

    api_version = "v1"
    service_name = "healthcare"
    # Returns an authorized API client by discovering the Healthcare API
    # and using GOOGLE_APPLICATION_CREDENTIALS environment variable.
    client = discovery.build(service_name, api_version)

    # TODO(developer): Uncomment these lines and replace with your values.
    # project_id = 'my-project'  # replace with your GCP project ID
    # location = 'us-central1'  # replace with the parent dataset's location
    # dataset_id = 'my-dataset'  # replace with the consent store's parent dataset ID
    # consent_store_id = 'my-consent-store'  # replace with the consent store's ID
    consent_store_parent = "projects/{}/locations/{}/datasets/{}".format(
        project_id, location, dataset_id
    )
    consent_store_name = "{}/consentStores/{}".format(
        consent_store_parent, consent_store_id
    )

    request = (
        client.projects()
        .locations()
        .datasets()
        .consentStores()
        .getIamPolicy(resource=consent_store_name)
    )
    response = request.execute()

    print("etag: {}".format(response.get("name")))
    return response

如要讀取同意聲明儲存庫的 IAM 政策，請發出 GET 要求，並指定資料集名稱、同意聲明儲存庫名稱和存取權權杖。

以下範例顯示使用 curl 的 GET 要求：

curl -X GET \
     -H "Authorization: Bearer $(gcloud auth application-default print-access-token)" \
     "https://healthcare.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/datasets/DATASET_ID/consentStores/CONSENT_STORE_ID:getIamPolicy"

回應如下：

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.consentStoreAdmin",
      "members": [
        "user:user-1@example.com"
      ]
    },
    {
      "role":"roles/healthcare.consentReader",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com",
        "user:user-2@example.com"
      ]
    }
  ]
}

如要讀取同意聲明儲存庫的 IAM 政策，請發出 GET 要求，並指定資料集名稱、同意聲明儲存庫名稱和存取權權杖。

下列範例顯示如何使用 Windows PowerShell 提出 GET 要求：

$cred = gcloud auth application-default print-access-token
$headers = @{ Authorization = "Bearer $cred" }

Invoke-WebRequest `
  -Method Get `
  -Headers $headers `
  -Uri "https://healthcare.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/datasets/DATASET_ID/consentStores/CONSENT_STORE_ID:getIamPolicy" | Select-Object -Expand Content

回應如下：

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.consentStoreAdmin",
      "members": [
        "user:user-1@example.com"
      ]
    },
    {
      "role":"roles/healthcare.consentReader",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com",
        "user:user-2@example.com"
      ]
    }
  ]
}

修改政策

下列範例會將 roles/healthcare.consentReader 角色授予新使用者。詳情請參閱 projects.locations.datasets.consentStores.setIamPolicy。

設定政策

如要設定同意聲明存放區層級的 IAM 政策，請完成下列步驟：

前往 Google Cloud 控制台的「資料集」頁面。
前往「資料集」頁面
按一下含有同意聲明儲存庫的資料集 ID，然後選取要設定政策的同意聲明儲存庫。
按一下「顯示資訊面板」。
按一下「新增主體」。
在「New principals」(新增主體) 欄位中，輸入需要存取同意聲明商店的一或多個身分。
在「Select a role」(選取角色) 清單中，選取「Cloud Healthcare」下要授予的權限。例如 Healthcare Consent Store Viewer。
按一下 [儲存]。

透過程式或使用文字編輯器修改擷取的政策，以授予或撤銷使用者的角色。政策變更時，etag 值也會變更，因此您必須指定目前的值。

如要授予新使用者角色，請將他們的電子郵件地址附加至 roles/healthcare.consentReader 繫結下的 members 陣列：

{
  "role":"roles/healthcare.consentReader",
  "members": [
    "serviceAccount:service-account-13@appspot.gserviceaccount.com",
    "user:user-2@example.com",
    "user:NEW_USER_EMAIL_ADDRESS"
  ]
}

如要撤銷主體的存取權，請從 members 陣列中刪除其電子郵件地址。如要撤銷最後一個具有角色的主體存取權，請刪除該角色的 bindings 陣列。政策中不得有空白 bindings 陣列。

修改政策以授予適用的角色後，請執行適當的 set-iam-policy 指令來進行變更。如要設定同意聲明商店層級政策，請執行 gcloud healthcare consent-stores set-iam-policy 指令。指定同意聲明儲存庫名稱、資料集名稱、位置，以及您建立的政策檔案路徑。

gcloud healthcare consent-stores set-iam-policy CONSENT_STORE_ID \
    --dataset=DATASET_ID \
    --location=LOCATION \
    POLICY_FILE_NAME

如果要求成功，系統會顯示同意聲明商店名稱和繫結。

Updated IAM policy for consentStore [CONSENT_STORE_ID].
bindings:
- members:
  - user:user-1@example.com
  role: roles/healthcare.consentStoreAdmin
  - serviceAccount:service-account-13@appspot.gserviceaccount.com
  - user:user-2@example.com
  - user:NEW_USER_EMAIL_ADDRESS
  role: roles/healthcare.consentReader
etag: bytes
version: VERSION_NUMBER

const google = require('@googleapis/healthcare');
const healthcare = google.healthcare({
  version: 'v1',
  auth: new google.auth.GoogleAuth({
    scopes: ['https://www.googleapis.com/auth/cloud-platform'],
  }),
});

const setConsentStoreIamPolicy = async () => {
  // TODO(developer): uncomment these lines before running the sample
  // const cloudRegion = 'us-central1';
  // const projectId = 'adjective-noun-123';
  // const datasetId = 'my-dataset';
  // const consentStoreId = 'my-consent-store';
  // const member = 'user:example@gmail.com';
  // const role = 'roles/healthcare.consentStoreViewer';
  const resource_ = `projects/${projectId}/locations/${cloudRegion}/datasets/${datasetId}/consentStores/${consentStoreId}`;
  const request = {
    resource_,
    resource: {
      policy: {
        bindings: [
          {
            members: member,
            role: role,
          },
        ],
      },
    },
  };

  const consentStore =
    await healthcare.projects.locations.datasets.consentStores.setIamPolicy(
      request
    );
  console.log(
    'Set consent store IAM policy:',
    JSON.stringify(consentStore.data, null, 2)
  );
};

setConsentStoreIamPolicy();

def set_consent_store_iam_policy(
    project_id: str,
    location: str,
    dataset_id: str,
    consent_store_id: str,
    member,
    role,
    etag=None,
):
    """Sets the IAM policy for the specified consent store.
    A single member will be assigned a single role. A member can be any of:
    - allUsers, that is, anyone
    - allAuthenticatedUsers, anyone authenticated with a Google account
    - user:email, as in 'user:somebody@example.com'
    - group:email, as in 'group:admins@example.com'
    - domain:domainname, as in 'domain:example.com'
    - serviceAccount:email,
        as in 'serviceAccount:my-other-app@appspot.gserviceaccount.com'
    A role can be any IAM role, such as 'roles/viewer', 'roles/owner',
    or 'roles/editor'
    See https://github.com/GoogleCloudPlatform/python-docs-samples/tree/main/healthcare/api-client/v1/consent
    before running the sample."""
    # Imports the Google API Discovery Service.
    from googleapiclient import discovery

    api_version = "v1"
    service_name = "healthcare"
    # Returns an authorized API client by discovering the Healthcare API
    # and using GOOGLE_APPLICATION_CREDENTIALS environment variable.
    client = discovery.build(service_name, api_version)

    # TODO(developer): Uncomment these lines and replace with your values.
    # project_id = 'my-project'  # replace with your GCP project ID
    # location = 'us-central1'  # replace with the parent dataset's location
    # dataset_id = 'my-dataset'  # replace with the consent store's parent dataset ID
    # consent_store_id = 'my-consent-store'  # replace with the consent store's ID
    # member = 'myemail@example.com'  # replace with an authorized member
    # role = 'roles/viewer'  # replace with a Healthcare API IAM role
    consent_store_parent = "projects/{}/locations/{}/datasets/{}".format(
        project_id, location, dataset_id
    )
    consent_store_name = "{}/consentStores/{}".format(
        consent_store_parent, consent_store_id
    )

    policy = {"bindings": [{"role": role, "members": [member]}]}

    if etag is not None:
        policy["etag"] = etag

    request = (
        client.projects()
        .locations()
        .datasets()
        .consentStores()
        .setIamPolicy(resource=consent_store_name, body={"policy": policy})
    )
    response = request.execute()

    print("etag: {}".format(response.get("name")))
    print("bindings: {}".format(response.get("bindings")))
    return response

透過程式或使用文字編輯器修改擷取的政策，以授予或撤銷使用者的角色。政策變更時，etag 值也會變更，因此您必須指定目前的值。

如要授予新使用者角色，請將他們的電子郵件地址附加至 roles/healthcare.consentReader 繫結下的 members 陣列：

{
  "role":"roles/healthcare.consentReader",
  "members": [
    "serviceAccount:service-account-13@appspot.gserviceaccount.com",
    "user:user-2@example.com",
    "user:NEW_USER_EMAIL_ADDRESS"
  ]
}

修改政策以授予適用的角色後，請呼叫 projects.locations.datasets.consentStores.setIamPolicy 以進行更新。

如要設定同意事項儲存庫層級的 IAM 政策，請提出 POST 要求，並指定資料集名稱、同意事項儲存庫名稱、政策和存取權杖。

以下範例說明如何使用 curl 提出 POST 要求，將現有的 roles/healthcare.consentReader 角色授予新使用者：

政策可以直接寫在要求中 (如下所示)，也可以 JSON 或 YAML 檔案的形式傳遞。如要瞭解如何將政策格式設為 JSON 或 YAML，請參閱Policy。

curl -X POST \
    -H "Authorization: Bearer $(gcloud auth application-default print-access-token)" \
    -H "Content-Type: application/json; charset=utf-8" \
    --data "{
      'policy': {
        'bindings': [
          {
            'role':'roles/healthcare.consentStoreAdmin',
            'members': [
              'user:user-1@example.com'
            ]
          },
          {
            'role':'roles/healthcare.consentReader',
            'members': [
              'serviceAccount:service-account-13@appspot.gserviceaccount.com',
              'user:user-2@example.com',
              'user:NEW_USER_EMAIL_ADDRESS'
            ]
          }
        ]
      }
    }" "https://healthcare.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/datasets/DATASET_ID/consentStores/CONSENT_STORE_ID:setIamPolicy"

回應如下：

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.consentStoreAdmin",
      "members": [
        "user:user-1@example.com"
      ]
    },
    {
      "role":"roles/healthcare.consentReader",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com",
        "user:user-2@example.com",
        "user:NEW_USER_EMAIL_ADDRESS"
      ]
    }
  ]
}

透過程式或使用文字編輯器修改擷取的政策，以授予或撤銷使用者的角色。政策變更時，etag 值也會變更，因此您必須指定目前的值。

如要授予新使用者角色，請將他們的電子郵件地址附加至 roles/healthcare.consentReader 繫結下的 members 陣列：

{
  "role":"roles/healthcare.consentReader",
  "members": [
    "serviceAccount:service-account-13@appspot.gserviceaccount.com",
    "user:user-2@example.com",
    "user:NEW_USER_EMAIL_ADDRESS"
  ]
}

修改政策以授予適用的角色後，請呼叫 projects.locations.datasets.consentStores.setIamPolicy 以進行更新。

如要設定同意事項儲存庫層級的 IAM 政策，請提出 POST 要求，並指定資料集名稱、同意事項儲存庫名稱、政策和存取權杖。

下列範例說明如何使用 Windows PowerShell 提出 POST 要求，將現有 roles/healthcare.consentReader 角色授予新使用者：

政策可以直接寫在要求中 (如下所示)，也可以 JSON 或 YAML 檔案的形式傳遞。如要瞭解如何將政策格式設為 JSON 或 YAML，請參閱Policy。

$cred = gcloud auth application-default print-access-token
$headers = @{ Authorization = "Bearer $cred" }

Invoke-WebRequest `
  -Method Post `
  -Headers $headers `
  -ContentType: "application/json; charset=utf-8" `
  -Body "{
    'policy': {
      'bindings': [
        {
          'role': 'roles/healthcare.consentStoreAdmin',
          'members': [
            'user:user-1@example.com',
          ]
        },
        {
          'role': 'roles/healthcare.consentReader',
          'members': [
            'serviceAccount:service-account-13@appspot.gserviceaccount.com',
            'user:user-2@example.com',
            'user:NEW_USER_EMAIL_ADDRESS'
          ]
        }
      ]
    }
  }" `
  -Uri "https://healthcare.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/datasets/DATASET_ID/consentStores/CONSENT_STORE_ID:setIamPolicy" | Select-Object -Expand Content

回應如下：

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.consentStoreAdmin",
      "members": [
        "user:user-1@example.com"
      ]
    },
    {
      "role":"roles/healthcare.consentReader",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com",
        "user:user-2@example.com",
        "user:NEW_USER_EMAIL_ADDRESS"
      ]
    }
  ]
}

搭配資料集使用 IAM

以下各節說明如何取得、修改及設定資料集的政策。這些章節以以下範例政策為基礎：

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.datasetAdmin",
      "members": [
        "user:user-1@example.com"
      ]
    },
    {
      "role":"roles/healthcare.datasetViewer",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com",
        "user:user-2@example.com"
      ]
    }
  ]
}

取得政策

下列範例說明如何讀取資料集層級的 IAM 政策。詳情請參閱 projects.locations.datasets.getIamPolicy。

curl

如要讀取資料集的 IAM 政策，請提出 GET 要求，並指定資料集名稱和存取權權杖。

以下範例顯示使用 curl 的 GET 要求：

curl -X GET \
     -H "Authorization: Bearer $(gcloud auth application-default print-access-token)" \
     "https://healthcare.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/datasets/DATASET_ID:getIamPolicy"

回應如下：

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.datasetAdmin",
      "members": [
        "user:user-1@example.com"
      ]
    },
    {
      "role":"roles/healthcare.datasetViewer",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com",
        "user:user-2@example.com"
      ]
    }
  ]
}

PowerShell

如要查看資料集的 IAM 政策，請發出 GET 要求，並指定資料集名稱和存取權權杖。

下列範例顯示如何使用 Windows PowerShell 提出 GET 要求：

$cred = gcloud auth application-default print-access-token
$headers = @{ Authorization = "Bearer $cred" }

Invoke-WebRequest `
  -Method Get `
  -Headers $headers `
  -Uri "https://healthcare.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/datasets/DATASET_ID:getIamPolicy" | Select-Object -Expand Content

回應如下：

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.datasetAdmin",
      "members": [
        "user:user-1@example.com"
      ]
    },
    {
      "role":"roles/healthcare.datasetViewer",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com",
        "user:user-2@example.com"
      ]
    }
  ]
}

控制台

如要查看資料集的 IAM 政策：

前往 Google Cloud 控制台的「資料集」頁面。
前往「資料集」頁面
選取資料集，然後按一下「顯示資訊面板」。
如要查看指派給角色的主體，請展開該角色。

gcloud

如要查看資料集的 IAM 政策，請執行 gcloud healthcare datasets get-iam-policy 指令。指定資料集名稱和位置。

gcloud healthcare datasets get-iam-policy DATASET_ID \
    --location=LOCATION

如果要求成功，系統會顯示繫結。

bindings:
- members:
  - serviceAccount:service-account-13@appspot.gserviceaccount.com
  - user:user-2@example.com
  role: roles/healthcare.datasetViewer
etag: bytes
version: VERSION_NUMBER

Go

import (
	"context"
	"fmt"
	"io"

	healthcare "google.golang.org/api/healthcare/v1"
)

// datasetIAMPolicy gets the dataset's IAM policy.
func datasetIAMPolicy(w io.Writer, projectID, location, datasetID string) error {
	ctx := context.Background()

	healthcareService, err := healthcare.NewService(ctx)
	if err != nil {
		return fmt.Errorf("healthcare.NewService: %w", err)
	}

	datasetsService := healthcareService.Projects.Locations.Datasets

	name := fmt.Sprintf("projects/%s/locations/%s/datasets/%s", projectID, location, datasetID)

	policy, err := datasetsService.GetIamPolicy(name).Do()
	if err != nil {
		return fmt.Errorf("GetIamPolicy: %w", err)
	}

	fmt.Fprintf(w, "IAM Policy etag: %v\n", policy.Etag)
	return nil
}

Java

import com.google.api.client.http.HttpRequestInitializer;
import com.google.api.client.http.javanet.NetHttpTransport;
import com.google.api.client.json.JsonFactory;
import com.google.api.client.json.gson.GsonFactory;
import com.google.api.services.healthcare.v1.CloudHealthcare;
import com.google.api.services.healthcare.v1.CloudHealthcare.Projects.Locations.Datasets;
import com.google.api.services.healthcare.v1.CloudHealthcareScopes;
import com.google.api.services.healthcare.v1.model.Policy;
import com.google.auth.http.HttpCredentialsAdapter;
import com.google.auth.oauth2.GoogleCredentials;
import java.io.IOException;
import java.util.Collections;

public class DatasetGetIamPolicy {
  private static final String DATASET_NAME = "projects/%s/locations/%s/datasets/%s";
  private static final JsonFactory JSON_FACTORY = new GsonFactory();
  private static final NetHttpTransport HTTP_TRANSPORT = new NetHttpTransport();

  public static void datasetGetIamPolicy(String datasetName) throws IOException {
    // String datasetName =
    //     String.format(DATASET_NAME, "your-project-id", "your-region-id", "your-dataset-id");

    // Initialize the client, which will be used to interact with the service.
    CloudHealthcare client = createClient();

    // Create request and configure any parameters.
    Datasets.GetIamPolicy request =
        client.projects().locations().datasets().getIamPolicy(datasetName);

    // Execute the request and process the results.
    Policy policy = request.execute();
    System.out.println("Dataset IAMPolicy retrieved: \n" + policy.toPrettyString());
  }

  private static CloudHealthcare createClient() throws IOException {
    // Use Application Default Credentials (ADC) to authenticate the requests
    // For more information see https://cloud.google.com/docs/authentication/production
    GoogleCredentials credential =
        GoogleCredentials.getApplicationDefault()
            .createScoped(Collections.singleton(CloudHealthcareScopes.CLOUD_PLATFORM));

    // Create a HttpRequestInitializer, which will provide a baseline configuration to all requests.
    HttpRequestInitializer requestInitializer =
        request -> {
          new HttpCredentialsAdapter(credential).initialize(request);
          request.setConnectTimeout(60000); // 1 minute connect timeout
          request.setReadTimeout(60000); // 1 minute read timeout
        };

    // Build the client for interacting with the service.
    return new CloudHealthcare.Builder(HTTP_TRANSPORT, JSON_FACTORY, requestInitializer)
        .setApplicationName("your-application-name")
        .build();
  }
}

Node.js

const google = require('@googleapis/healthcare');
const healthcare = google.healthcare({
  version: 'v1',
  auth: new google.auth.GoogleAuth({
    scopes: ['https://www.googleapis.com/auth/cloud-platform'],
  }),
});

const getDatasetIamPolicy = async () => {
  // TODO(developer): uncomment these lines before running the sample
  // const cloudRegion = 'us-central1';
  // const projectId = 'adjective-noun-123';
  // const datasetId = 'my-dataset';
  const resource_ = `projects/${projectId}/locations/${cloudRegion}/datasets/${datasetId}`;
  const request = {resource_};

  const dataset =
    await healthcare.projects.locations.datasets.getIamPolicy(request);
  console.log(
    'Got dataset IAM policy:',
    JSON.stringify(dataset.data, null, 2)
  );
};

getDatasetIamPolicy();

Python

# Imports the Dict and Any types for runtime type hints.
from typing import Any, Dict


def get_dataset_iam_policy(
    project_id: str, location: str, dataset_id: str
) -> Dict[str, Any]:
    """Gets the IAM policy for the specified dataset.

    See
    https://github.com/GoogleCloudPlatform/python-docs-samples/tree/main/healthcare/api-client/v1/datasets
    before running the sample.
    See https://googleapis.github.io/google-api-python-client/docs/dyn/healthcare_v1.projects.locations.datasets.html#getIamPolicy
    for the Python API reference.

    Args:
      project_id: The project ID or project number of the Google Cloud project you want
          to use.
      location: The name of the dataset's location.
      dataset_id: The ID of the dataset containing the IAM policy to get.

    Returns:
      A dictionary representing an IAM policy.
    """
    # Imports the Google API Discovery Service.
    from googleapiclient import discovery

    # Imports HttpError from the Google Python API client errors module.
    from googleapiclient.errors import HttpError

    api_version = "v1"
    service_name = "healthcare"
    # Returns an authorized API client by discovering the Healthcare API
    # and using GOOGLE_APPLICATION_CREDENTIALS environment variable.
    client = discovery.build(service_name, api_version)

    # TODO(developer): Uncomment these lines and replace with your values.
    # project_id = 'my-project'
    # location = 'us-central1'
    # dataset_id = 'my-dataset'
    dataset_name = "projects/{}/locations/{}/datasets/{}".format(
        project_id, location, dataset_id
    )

    request = (
        client.projects().locations().datasets().getIamPolicy(resource=dataset_name)
    )

    try:
        response = request.execute()
        print("etag: {}".format(response.get("name")))
        return response
    except HttpError as err:
        raise err

修改政策

下列範例會將 roles/healthcare.datasetViewer 角色授予新使用者：

設定政策

控制台

如要設定資料集層級的身分與存取權管理政策，請完成下列步驟：

前往 Google Cloud 控制台的「資料集」頁面。
前往「資料集」頁面
選取要設定政策的資料集，然後按一下「顯示資訊面板」。
按一下「新增主體」。
在「New principals」(新增主體) 欄位中，輸入需要存取資料集的一或多個身分。
在「Select a role」(選取角色) 清單中，選取「Cloud Healthcare」下要授予的權限。例如 Healthcare 資料集檢視者。
按一下 [儲存]。

gcloud

透過程式或使用文字編輯器修改擷取的政策，以授予或撤銷使用者的角色。政策變更時，etag 值也會變更，因此您必須指定目前的值。

如要授予新使用者角色，請將他們的電子郵件地址附加至 roles/healthcare.datasetViewer 繫結下的 members 陣列：

{
  "role":"roles/healthcare.datasetViewer",
  "members": [
    "serviceAccount:service-account-13@appspot.gserviceaccount.com",
    "user:user-2@example.com",
    "user:NEW_USER_EMAIL_ADDRESS"
  ]
}

修改政策以授予適用的角色後，請執行適當的 set-iam-policy 指令來進行變更。如要設定資料集層級政策，請執行 gcloud healthcare datasets set-iam-policy 指令。指定資料集名稱、位置，以及您建立的政策檔案路徑。

gcloud healthcare datasets set-iam-policy DATASET_ID \
    --location=LOCATION \
    POLICY_FILE_NAME

如果要求成功，系統會顯示資料集名稱和繫結。

Updated IAM policy for dataset [DATASET_ID].
bindings:
- members:
  - serviceAccount:service-account-13@appspot.gserviceaccount.com
  - user:user-2@example.com
  role: roles/healthcare.datasetAdmin
  - user:user-1@example.com
  - user:NEW_USER_EMAIL_ADDRESS
  role: roles/healthcare.datasetViewer
etag: bytes
version: VERSION_NUMBER

curl

透過程式或使用文字編輯器修改擷取的政策，以授予或撤銷使用者的角色。政策變更時，etag 值也會變更，因此您必須指定目前的值。

如要授予新使用者角色，請將他們的電子郵件地址附加至 roles/healthcare.datasetViewer 繫結下的 members 陣列：

{
  "role":"roles/healthcare.datasetViewer",
  "members": [
    "serviceAccount:service-account-13@appspot.gserviceaccount.com",
    "user:user-2@example.com",
    "user:NEW_USER_EMAIL_ADDRESS"
  ]
}

修改政策以授予適用的角色後，請呼叫 projects.locations.datasets.setIamPolicy 以進行更新。

如要設定資料集層級的 IAM 政策，請提出 POST 要求，並指定資料集名稱、政策和存取權權杖。

以下範例說明如何使用 curl 提出 POST 要求，將現有的 roles/healthcare.datasetViewer 角色授予新使用者：

政策可以直接寫在要求中 (如下所示)，也可以 JSON 或 YAML 檔案的形式傳遞。如要瞭解如何將政策格式設為 JSON 或 YAML，請參閱Policy。

curl -X POST \
    -H "Authorization: Bearer $(gcloud auth application-default print-access-token)" \
    -H "Content-Type: application/json; charset=utf-8" \
    --data "{
      'policy': {
        'bindings': [
          {
            'role':'roles/healthcare.datasetAdmin',
            'members': [
              'user:user-1@example.com'
            ]
          },
          {
            'role':'roles/healthcare.datasetViewer',
            'members': [
              'serviceAccount:service-account-13@appspot.gserviceaccount.com',
              'user:user-2@example.com',
              'user:NEW_USER_EMAIL_ADDRESS'
            ]
          }
        ]
      }
    }" "https://healthcare.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/datasets/DATASET_ID:setIamPolicy"

回應如下：

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.datasetAdmin",
      "members": [
        "user:user-1@example.com"
      ]
    },
    {
      "role":"roles/healthcare.datasetViewer",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com",
        "user:user-2@example.com",
        "user:NEW_USER_EMAIL_ADDRESS"
      ]
    }
  ]
}

PowerShell

透過程式或使用文字編輯器修改擷取的政策，以授予或撤銷使用者的角色。政策變更時，etag 值也會變更，因此您必須指定目前的值。

如要授予新使用者角色，請將他們的電子郵件地址附加至 roles/healthcare.datasetViewer 繫結下的 members 陣列：

{
  "role":"roles/healthcare.datasetViewer",
  "members": [
    "serviceAccount:service-account-13@appspot.gserviceaccount.com",
    "user:user-2@example.com",
    "user:NEW_USER_EMAIL_ADDRESS"
  ]
}

修改政策以授予適用的角色後，請呼叫 projects.locations.datasets.setIamPolicy 以進行更新。

如要設定資料集層級的 IAM 政策，請提出 POST 要求，並指定資料集名稱、政策和存取權權杖。

下列範例說明如何使用 Windows PowerShell 提出 POST 要求，將現有 roles/healthcare.datasetViewer 角色授予新使用者：

政策可以直接寫在要求中 (如下所示)，也可以 JSON 或 YAML 檔案的形式傳遞。如要瞭解如何將政策格式設為 JSON 或 YAML，請參閱Policy。

$cred = gcloud auth application-default print-access-token
$headers = @{ Authorization = "Bearer $cred" }

Invoke-WebRequest `
  -Method Post `
  -Headers $headers `
  -ContentType: "application/json; charset=utf-8" `
  -Body "{
    'policy': {
      'bindings': [
        {
          'role': 'roles/healthcare.datasetAdmin',
          'members': [
            'user:user-1@example.com'
          ]
        },
        {
          'role': 'roles/healthcare.datasetViewer',
          'members': [
            'serviceAccount:service-account-13@appspot.gserviceaccount.com',
            'user:user-2@example.com',
            'user:NEW_USER_EMAIL_ADDRESS'
          ]
        }
      ]
    }
  }" `
  -Uri "https://healthcare.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/datasets/DATASET_ID:setIamPolicy" | Select-Object -Expand Content

回應如下：

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.datasetAdmin",
      "members": [
        "user:user-1@example.com"
      ]
    },
    {
      "role":"roles/healthcare.datasetViewer",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com",
        "user:user-2@example.com",
        "user:NEW_USER_EMAIL_ADDRESS"
      ]
    }
  ]
}

Go

import (
	"context"
	"fmt"
	"io"

	healthcare "google.golang.org/api/healthcare/v1"
)

// setDatasetIAMPolicy sets an IAM policy for the dataset.
func setDatasetIAMPolicy(w io.Writer, projectID, location, datasetID string) error {
	ctx := context.Background()

	healthcareService, err := healthcare.NewService(ctx)
	if err != nil {
		return fmt.Errorf("healthcare.NewService: %w", err)
	}

	datasetsService := healthcareService.Projects.Locations.Datasets

	name := fmt.Sprintf("projects/%s/locations/%s/datasets/%s", projectID, location, datasetID)

	policy, err := datasetsService.GetIamPolicy(name).Do()
	if err != nil {
		return fmt.Errorf("GetIamPolicy: %w", err)
	}

	policy.Bindings = append(policy.Bindings, &healthcare.Binding{
		Members: []string{"user:example@example.com"},
		Role:    "roles/viewer",
	})

	req := &healthcare.SetIamPolicyRequest{
		Policy: policy,
	}

	policy, err = datasetsService.SetIamPolicy(name, req).Do()
	if err != nil {
		return fmt.Errorf("SetIamPolicy: %w", err)
	}

	fmt.Fprintf(w, "IAM Policy etag: %v", policy.Etag)
	return nil
}

Java

import com.google.api.client.http.HttpRequestInitializer;
import com.google.api.client.http.javanet.NetHttpTransport;
import com.google.api.client.json.JsonFactory;
import com.google.api.client.json.gson.GsonFactory;
import com.google.api.services.healthcare.v1.CloudHealthcare;
import com.google.api.services.healthcare.v1.CloudHealthcare.Projects.Locations.Datasets;
import com.google.api.services.healthcare.v1.CloudHealthcareScopes;
import com.google.api.services.healthcare.v1.model.Binding;
import com.google.api.services.healthcare.v1.model.Policy;
import com.google.api.services.healthcare.v1.model.SetIamPolicyRequest;
import com.google.auth.http.HttpCredentialsAdapter;
import com.google.auth.oauth2.GoogleCredentials;
import java.io.IOException;
import java.util.Arrays;
import java.util.Collections;

public class DatasetSetIamPolicy {
  private static final String DATASET_NAME = "projects/%s/locations/%s/datasets/%s";
  private static final JsonFactory JSON_FACTORY = new GsonFactory();
  private static final NetHttpTransport HTTP_TRANSPORT = new NetHttpTransport();

  public static void datasetSetIamPolicy(String datasetName) throws IOException {
    // String datasetName =
    //     String.format(DATASET_NAME, "your-project-id", "your-region-id", "your-dataset-id");

    // Initialize the client, which will be used to interact with the service.
    CloudHealthcare client = createClient();

    // Configure the IAMPolicy to apply to the dataset.
    // For more information on understanding IAM roles, see the following:
    // https://cloud.google.com/iam/docs/understanding-roles
    Binding binding =
        new Binding()
            .setRole("roles/healthcare.datasetViewer")
            .setMembers(Arrays.asList("domain:google.com"));
    Policy policy = new Policy().setBindings(Arrays.asList(binding));
    SetIamPolicyRequest policyRequest = new SetIamPolicyRequest().setPolicy(policy);

    // Create request and configure any parameters.
    Datasets.SetIamPolicy request =
        client.projects().locations().datasets().setIamPolicy(datasetName, policyRequest);

    // Execute the request and process the results.
    Policy updatedPolicy = request.execute();
    System.out.println("Dataset policy has been updated: " + updatedPolicy.toPrettyString());
  }

  private static CloudHealthcare createClient() throws IOException {
    // Use Application Default Credentials (ADC) to authenticate the requests
    // For more information see https://cloud.google.com/docs/authentication/production
    GoogleCredentials credential =
        GoogleCredentials.getApplicationDefault()
            .createScoped(Collections.singleton(CloudHealthcareScopes.CLOUD_PLATFORM));

    // Create a HttpRequestInitializer, which will provide a baseline configuration to all requests.
    HttpRequestInitializer requestInitializer =
        request -> {
          new HttpCredentialsAdapter(credential).initialize(request);
          request.setConnectTimeout(60000); // 1 minute connect timeout
          request.setReadTimeout(60000); // 1 minute read timeout
        };

    // Build the client for interacting with the service.
    return new CloudHealthcare.Builder(HTTP_TRANSPORT, JSON_FACTORY, requestInitializer)
        .setApplicationName("your-application-name")
        .build();
  }
}

Node.js

const google = require('@googleapis/healthcare');
const healthcare = google.healthcare({
  version: 'v1',
  auth: new google.auth.GoogleAuth({
    scopes: ['https://www.googleapis.com/auth/cloud-platform'],
  }),
});

const setDatasetIamPolicy = async () => {
  // TODO(developer): uncomment these lines before running the sample
  // const cloudRegion = 'us-central1';
  // const projectId = 'adjective-noun-123';
  // const datasetId = 'my-dataset';
  // const member = 'user:example@gmail.com';
  // const role = 'roles/healthcare.datasetViewer';
  const resource_ = `projects/${projectId}/locations/${cloudRegion}/datasets/${datasetId}`;
  const request = {
    resource_,
    resource: {
      policy: {
        bindings: [
          {
            members: member,
            role: role,
          },
        ],
      },
    },
  };

  const dataset =
    await healthcare.projects.locations.datasets.setIamPolicy(request);
  console.log(
    'Set dataset IAM policy:',
    JSON.stringify(dataset.data, null, 2)
  );
};

setDatasetIamPolicy();

Python

# Imports the Dict and Any types for runtime type hints.
from typing import Any, Dict

def set_dataset_iam_policy(
    project_id: str,
    location: str,
    dataset_id: str,
    member: str,
    role: str,
    etag: str = None,
) -> Dict[str, Any]:
    """Sets the IAM policy for the specified dataset.

        A single member will be assigned a single role. A member can be any of:

        - allUsers, that is, anyone
        - allAuthenticatedUsers, anyone authenticated with a Google account
        - user:email, as in 'user:somebody@example.com'
        - group:email, as in 'group:admins@example.com'
        - domain:domainname, as in 'domain:example.com'
        - serviceAccount:email,
            as in 'serviceAccount:my-other-app@appspot.gserviceaccount.com'

        A role can be any IAM role, such as 'roles/viewer', 'roles/owner',
        or 'roles/editor'

    See
    https://github.com/GoogleCloudPlatform/python-docs-samples/tree/main/healthcare/api-client/v1/datasets
    before running the sample.
    See https://googleapis.github.io/google-api-python-client/docs/dyn/healthcare_v1.projects.locations.datasets.html#setIamPolicy
    for the Python API reference.

    Args:
      project_id: The project ID or project number of the Google Cloud project you want
          to use.
      location: The name of the dataset's location.
      dataset_id: The ID of the dataset containing the IAM policy to set.
      member: The principals to grant access for a Google Cloud resource.
      role: The role to assign to the list of 'members'.
      etag: The 'etag' returned in a previous getIamPolicy request to ensure that
        setIamPolicy changes apply to the same policy version.

    Returns:
      A dictionary representing an IAM policy.
    """
    # Imports the Google API Discovery Service.
    from googleapiclient import discovery

    # Imports HttpError from the Google Python API client errors module.
    from googleapiclient.errors import HttpError

    api_version = "v1"
    service_name = "healthcare"
    # Returns an authorized API client by discovering the Healthcare API
    # and using GOOGLE_APPLICATION_CREDENTIALS environment variable.
    client = discovery.build(service_name, api_version)

    # TODO(developer): Uncomment these lines and replace with your values.
    # project_id = 'my-project'
    # location = 'us-central1'
    # dataset_id = 'my-dataset'
    dataset_name = "projects/{}/locations/{}/datasets/{}".format(
        project_id, location, dataset_id
    )

    # TODO(developer): Uncomment these lines and replace with your values.
    # role = 'roles/viewer'
    # member = 'serviceAccount:group@example.com'
    policy = {"bindings": [{"role": role, "members": [member]}]}

    if etag is not None:
        policy["etag"] = etag

    request = (
        client.projects()
        .locations()
        .datasets()
        .setIamPolicy(resource=dataset_name, body={"policy": policy})
    )
    try:
        response = request.execute()
        print("etag: {}".format(response.get("name")))
        print("bindings: {}".format(response.get("bindings")))
        return response
    except HttpError as err:
        raise err

搭配 DICOM 儲存區使用 IAM

以下各節說明如何取得、修改及設定 DICOM 存放區的政策。這些章節以以下範例政策為基礎：

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.dicomStoreAdmin",
      "members": [
        "user:user-1@example.com"
      ]
    },
    {
      "role":"roles/healthcare.dicomViewer",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com",
        "user:user-2@example.com"
      ]
    }
  ]
}

取得政策

下列範例說明如何讀取 DICOM 儲存庫層級的 IAM 政策。詳情請參閱 projects.locations.datasets.dicomStores.getIamPolicy。

控制台

如要查看 DICOM 儲存庫的身分與存取權管理政策：

前往 Google Cloud 控制台的「資料集」頁面。
前往「資料集」頁面
按一下含有 DICOM 儲存庫的資料集 ID，然後選取要取得政策的 DICOM 儲存庫。
按一下「顯示資訊面板」。
如要查看指派給角色的主體，請展開該角色。

gcloud

如要查看 DICOM 儲存庫的 IAM 政策，請執行 gcloud healthcare dicom-stores get-iam-policy 指令。指定 DICOM 儲存庫名稱、資料集名稱和位置。

gcloud healthcare dicom-stores get-iam-policy DICOM_STORE_ID \
    --dataset=DATASET_ID \
    --location=LOCATION

如果要求成功，系統會顯示繫結。

bindings:
- members:
  - user:user-1@example.com
  role: roles/healthcare.dicomStoreAdmin
  - serviceAccount:service-account-13@appspot.gserviceaccount.com
  - user:user-2@example.com
  role: roles/healthcare.dicomViewer
etag: bytes
version: VERSION_NUMBER

Go

import (
	"context"
	"fmt"
	"io"

	healthcare "google.golang.org/api/healthcare/v1"
)

// getDICOMIAMPolicy gets the DICOM store's IAM policy.
func getDICOMIAMPolicy(w io.Writer, projectID, location, datasetID, dicomStoreID string) error {
	ctx := context.Background()

	healthcareService, err := healthcare.NewService(ctx)
	if err != nil {
		return fmt.Errorf("healthcare.NewService: %w", err)
	}

	dicomService := healthcareService.Projects.Locations.Datasets.DicomStores

	name := fmt.Sprintf("projects/%s/locations/%s/datasets/%s/dicomStores/%s", projectID, location, datasetID, dicomStoreID)

	policy, err := dicomService.GetIamPolicy(name).Do()
	if err != nil {
		return fmt.Errorf("GetIamPolicy: %w", err)
	}

	fmt.Fprintf(w, "IAM Policy etag: %v\n", policy.Etag)
	return nil
}

Java

import com.google.api.client.http.HttpRequestInitializer;
import com.google.api.client.http.javanet.NetHttpTransport;
import com.google.api.client.json.JsonFactory;
import com.google.api.client.json.gson.GsonFactory;
import com.google.api.services.healthcare.v1.CloudHealthcare;
import com.google.api.services.healthcare.v1.CloudHealthcare.Projects.Locations.Datasets.DicomStores;
import com.google.api.services.healthcare.v1.CloudHealthcareScopes;
import com.google.api.services.healthcare.v1.model.Policy;
import com.google.auth.http.HttpCredentialsAdapter;
import com.google.auth.oauth2.GoogleCredentials;
import java.io.IOException;
import java.util.Collections;

public class DicomStoreGetIamPolicy {
  private static final String DICOM_NAME = "projects/%s/locations/%s/datasets/%s/dicomStores/%s";
  private static final JsonFactory JSON_FACTORY = new GsonFactory();
  private static final NetHttpTransport HTTP_TRANSPORT = new NetHttpTransport();

  public static void dicomStoreGetIamPolicy(String dicomStoreName) throws IOException {
    // String dicomStoreName =
    //    String.format(
    //        DICOM_NAME, "your-project-id", "your-region-id", "your-dataset-id", "your-dicom-id");

    // Initialize the client, which will be used to interact with the service.
    CloudHealthcare client = createClient();

    // Create request and configure any parameters.
    DicomStores.GetIamPolicy request =
        client.projects().locations().datasets().dicomStores().getIamPolicy(dicomStoreName);

    // Execute the request and process the results.
    Policy policy = request.execute();
    System.out.println("DICOM store IAMPolicy retrieved: \n" + policy.toPrettyString());
  }

  private static CloudHealthcare createClient() throws IOException {
    // Use Application Default Credentials (ADC) to authenticate the requests
    // For more information see https://cloud.google.com/docs/authentication/production
    GoogleCredentials credential =
        GoogleCredentials.getApplicationDefault()
            .createScoped(Collections.singleton(CloudHealthcareScopes.CLOUD_PLATFORM));

    // Create a HttpRequestInitializer, which will provide a baseline configuration to all requests.
    HttpRequestInitializer requestInitializer =
        request -> {
          new HttpCredentialsAdapter(credential).initialize(request);
          request.setConnectTimeout(60000); // 1 minute connect timeout
          request.setReadTimeout(60000); // 1 minute read timeout
        };

    // Build the client for interacting with the service.
    return new CloudHealthcare.Builder(HTTP_TRANSPORT, JSON_FACTORY, requestInitializer)
        .setApplicationName("your-application-name")
        .build();
  }
}

Node.js

const google = require('@googleapis/healthcare');
const healthcare = google.healthcare({
  version: 'v1',
  auth: new google.auth.GoogleAuth({
    scopes: ['https://www.googleapis.com/auth/cloud-platform'],
  }),
});

const getDicomStoreIamPolicy = async () => {
  // TODO(developer): uncomment these lines before running the sample
  // const cloudRegion = 'us-central1';
  // const projectId = 'adjective-noun-123';
  // const datasetId = 'my-dataset';
  // const dicomStoreId = 'my-dicom-store';
  const resource_ = `projects/${projectId}/locations/${cloudRegion}/datasets/${datasetId}/dicomStores/${dicomStoreId}`;
  const request = {resource_};

  const dicomStore =
    await healthcare.projects.locations.datasets.dicomStores.getIamPolicy(
      request
    );
  console.log(
    'Got DICOM store IAM policy:',
    JSON.stringify(dicomStore.data, null, 2)
  );
};

getDicomStoreIamPolicy();

Python

def get_dicom_store_iam_policy(project_id, location, dataset_id, dicom_store_id):
    """Gets the IAM policy for the specified DICOM store.

    See https://github.com/GoogleCloudPlatform/python-docs-samples/tree/main/healthcare/api-client/v1/dicom
    before running the sample."""
    # Imports the Google API Discovery Service.
    from googleapiclient import discovery

    api_version = "v1"
    service_name = "healthcare"
    # Returns an authorized API client by discovering the Healthcare API
    # and using GOOGLE_APPLICATION_CREDENTIALS environment variable.
    client = discovery.build(service_name, api_version)

    # TODO(developer): Uncomment these lines and replace with your values.
    # project_id = 'my-project'  # replace with your GCP project ID
    # location = 'us-central1'  # replace with the parent dataset's location
    # dataset_id = 'my-dataset'  # replace with the DICOM store's parent dataset ID
    # dicom_store_id = 'my-dicom-store'  # replace with the DICOM store's ID
    dicom_store_parent = "projects/{}/locations/{}/datasets/{}".format(
        project_id, location, dataset_id
    )
    dicom_store_name = f"{dicom_store_parent}/dicomStores/{dicom_store_id}"

    request = (
        client.projects()
        .locations()
        .datasets()
        .dicomStores()
        .getIamPolicy(resource=dicom_store_name)
    )
    response = request.execute()

    print("etag: {}".format(response.get("name")))
    return response

curl

如要讀取 DICOM 儲存庫的 IAM 政策，請發出 GET 要求，並指定資料集名稱、DICOM 儲存庫名稱和存取權權杖。

以下範例顯示使用 curl 的 GET 要求：

curl -X GET \
     -H "Authorization: Bearer $(gcloud auth application-default print-access-token)" \
     "https://healthcare.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/datasets/DATASET_ID/dicomStores/DICOM_STORE_ID:getIamPolicy"

回應如下：

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.dicomStoreAdmin",
      "members": [
        "user:user-1@example.com"
      ]
    },
    {
      "role":"roles/healthcare.dicomViewer",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com",
        "user:user-2@example.com"
      ]
    }
  ]
}

PowerShell

如要讀取 DICOM 儲存庫的 IAM 政策，請發出 GET 要求，並指定資料集名稱、DICOM 儲存庫名稱和存取權權杖。

下列範例顯示如何使用 Windows PowerShell 提出 GET 要求：

$cred = gcloud auth application-default print-access-token
$headers = @{ Authorization = "Bearer $cred" }

Invoke-WebRequest `
  -Method Get `
  -Headers $headers `
  -Uri "https://healthcare.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/datasets/DATASET_ID/dicomStores/DICOM_STORE_ID:getIamPolicy" | Select-Object -Expand Content

回應如下：

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.dicomStoreAdmin",
      "members": [
        "user:user-1@example.com"
      ]
    },
    {
      "role":"roles/healthcare.dicomViewer",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com",
        "user:user-2@example.com"
      ]
    }
  ]
}

修改政策

下列範例會將 roles/healthcare.dicomViewer 角色授予新使用者。詳情請參閱 projects.locations.datasets.dicomStores.setIamPolicy。

設定政策

控制台

如要設定 DICOM 儲存庫層級的身分與存取權管理政策，請完成下列步驟：

前往 Google Cloud 控制台的「資料集」頁面。
前往「資料集」頁面
按一下含有 DICOM 儲存庫的資料集 ID，然後選取要設定政策的 DICOM 儲存庫。
按一下「顯示資訊面板」。
按一下「新增主體」。
在「新增主體」欄位中，輸入需要存取 DICOM 存放區的一或多個身分。
在「Select a role」(選取角色) 清單中，選取「Cloud Healthcare」下要授予的權限。例如 Healthcare DICOM Store 檢視者。
按一下 [儲存]。

gcloud

透過程式或使用文字編輯器修改擷取的政策，以授予或撤銷使用者的角色。政策變更時，etag 值也會變更，因此您必須指定目前的值。

如要授予新使用者角色，請將他們的電子郵件地址附加至 roles/healthcare.dicomViewer 繫結下的 members 陣列：

{
  "role":"roles/healthcare.dicomViewer",
  "members": [
    "serviceAccount:service-account-13@appspot.gserviceaccount.com",
    "user:user-2@example.com",
    "user:NEW_USER_EMAIL_ADDRESS"
  ]
}

修改政策以授予適用的角色後，請執行適當的 set-iam-policy 指令來進行變更。如要設定 DICOM 商店層級政策，請執行 gcloud healthcare dicom-stores set-iam-policy 指令。指定 DICOM 儲存庫名稱、資料集名稱、位置，以及您建立的政策檔案路徑。

gcloud healthcare dicom-stores set-iam-policy DICOM_STORE_ID \
    --dataset=DATASET_ID \
    --location=LOCATION \
    POLICY_FILE_NAME

如果要求成功，系統會顯示 DICOM 儲存名稱和繫結。

Updated IAM policy for dicomStore [DICOM_STORE_ID].
bindings:
- members:
  - user:user-1@example.com
  role: roles/healthcare.dicomStoreAdmin
  - serviceAccount:service-account-13@appspot.gserviceaccount.com
  - user:user-2@example.com
  - user:NEW_USER_EMAIL_ADDRESS
  role: roles/healthcare.dicomViewer
etag: bytes
version: VERSION_NUMBER

Go

import (
	"context"
	"fmt"
	"io"

	healthcare "google.golang.org/api/healthcare/v1"
)

// setDICOMIAMPolicy sets the DICOM store's IAM policy.
func setDICOMIAMPolicy(w io.Writer, projectID, location, datasetID, dicomStoreID string) error {
	ctx := context.Background()

	healthcareService, err := healthcare.NewService(ctx)
	if err != nil {
		return fmt.Errorf("healthcare.NewService: %w", err)
	}

	dicomService := healthcareService.Projects.Locations.Datasets.DicomStores

	name := fmt.Sprintf("projects/%s/locations/%s/datasets/%s/dicomStores/%s", projectID, location, datasetID, dicomStoreID)

	policy, err := dicomService.GetIamPolicy(name).Do()
	if err != nil {
		return fmt.Errorf("GetIamPolicy: %w", err)
	}

	policy.Bindings = append(policy.Bindings, &healthcare.Binding{
		Members: []string{"user:example@example.com"},
		Role:    "roles/viewer",
	})

	req := &healthcare.SetIamPolicyRequest{
		Policy: policy,
	}

	policy, err = dicomService.SetIamPolicy(name, req).Do()
	if err != nil {
		return fmt.Errorf("SetIamPolicy: %w", err)
	}

	fmt.Fprintf(w, "IAM Policy etag: %v\n", policy.Etag)
	return nil
}

Java

import com.google.api.client.http.HttpRequestInitializer;
import com.google.api.client.http.javanet.NetHttpTransport;
import com.google.api.client.json.JsonFactory;
import com.google.api.client.json.gson.GsonFactory;
import com.google.api.services.healthcare.v1.CloudHealthcare;
import com.google.api.services.healthcare.v1.CloudHealthcare.Projects.Locations.Datasets.DicomStores;
import com.google.api.services.healthcare.v1.CloudHealthcareScopes;
import com.google.api.services.healthcare.v1.model.Binding;
import com.google.api.services.healthcare.v1.model.Policy;
import com.google.api.services.healthcare.v1.model.SetIamPolicyRequest;
import com.google.auth.http.HttpCredentialsAdapter;
import com.google.auth.oauth2.GoogleCredentials;
import java.io.IOException;
import java.util.Arrays;
import java.util.Collections;

public class DicomStoreSetIamPolicy {
  private static final String DICOM_NAME = "projects/%s/locations/%s/datasets/%s/dicomStores/%s";
  private static final JsonFactory JSON_FACTORY = new GsonFactory();
  private static final NetHttpTransport HTTP_TRANSPORT = new NetHttpTransport();

  public static void dicomStoreSetIamPolicy(String dicomStoreName) throws IOException {
    // String dicomStoreName =
    //    String.format(
    //        DICOM_NAME, "your-project-id", "your-region-id", "your-dataset-id", "your-dicom-id");

    // Initialize the client, which will be used to interact with the service.
    CloudHealthcare client = createClient();

    // Configure the IAMPolicy to apply to the store.
    // For more information on understanding IAM roles, see the following:
    // https://cloud.google.com/iam/docs/understanding-roles
    Binding binding =
        new Binding()
            .setRole("roles/healthcare.dicomStoreAdmin")
            .setMembers(Arrays.asList("domain:google.com"));
    Policy policy = new Policy().setBindings(Arrays.asList(binding));
    SetIamPolicyRequest policyRequest = new SetIamPolicyRequest().setPolicy(policy);

    // Create request and configure any parameters.
    DicomStores.SetIamPolicy request =
        client
            .projects()
            .locations()
            .datasets()
            .dicomStores()
            .setIamPolicy(dicomStoreName, policyRequest);

    // Execute the request and process the results.
    Policy updatedPolicy = request.execute();
    System.out.println("DICOM policy has been updated: " + updatedPolicy.toPrettyString());
  }

  private static CloudHealthcare createClient() throws IOException {
    // Use Application Default Credentials (ADC) to authenticate the requests
    // For more information see https://cloud.google.com/docs/authentication/production
    GoogleCredentials credential =
        GoogleCredentials.getApplicationDefault()
            .createScoped(Collections.singleton(CloudHealthcareScopes.CLOUD_PLATFORM));

    // Create a HttpRequestInitializer, which will provide a baseline configuration to all requests.
    HttpRequestInitializer requestInitializer =
        request -> {
          new HttpCredentialsAdapter(credential).initialize(request);
          request.setConnectTimeout(60000); // 1 minute connect timeout
          request.setReadTimeout(60000); // 1 minute read timeout
        };

    // Build the client for interacting with the service.
    return new CloudHealthcare.Builder(HTTP_TRANSPORT, JSON_FACTORY, requestInitializer)
        .setApplicationName("your-application-name")
        .build();
  }
}

Node.js

const google = require('@googleapis/healthcare');
const healthcare = google.healthcare({
  version: 'v1',
  auth: new google.auth.GoogleAuth({
    scopes: ['https://www.googleapis.com/auth/cloud-platform'],
  }),
});

const setDicomStoreIamPolicy = async () => {
  // TODO(developer): uncomment these lines before running the sample
  // const cloudRegion = 'us-central1';
  // const projectId = 'adjective-noun-123';
  // const datasetId = 'my-dataset';
  // const dicomStoreId = 'my-dicom-store';
  // const member = 'user:example@gmail.com';
  // const role = 'roles/healthcare.dicomStoreViewer';
  const resource_ = `projects/${projectId}/locations/${cloudRegion}/datasets/${datasetId}/dicomStores/${dicomStoreId}`;
  const request = {
    resource_,
    resource: {
      policy: {
        bindings: [
          {
            members: member,
            role: role,
          },
        ],
      },
    },
  };

  const dicomStore =
    await healthcare.projects.locations.datasets.dicomStores.setIamPolicy(
      request
    );
  console.log(
    'Set DICOM store IAM policy:',
    JSON.stringify(dicomStore.data, null, 2)
  );
};

setDicomStoreIamPolicy();

Python

def set_dicom_store_iam_policy(
    project_id, location, dataset_id, dicom_store_id, member, role, etag=None
):
    """Sets the IAM policy for the specified DICOM store.

    A single member will be assigned a single role. A member can be any of:

    - allUsers, that is, anyone
    - allAuthenticatedUsers, anyone authenticated with a Google account
    - user:email, as in 'user:somebody@example.com'
    - group:email, as in 'group:admins@example.com'
    - domain:domainname, as in 'domain:example.com'
    - serviceAccount:email,
        as in 'serviceAccount:my-other-app@appspot.gserviceaccount.com'

    A role can be any IAM role, such as 'roles/viewer', 'roles/owner',
    or 'roles/editor'

    See https://github.com/GoogleCloudPlatform/python-docs-samples/tree/main/healthcare/api-client/v1/dicom
    before running the sample."""
    # Imports the Google API Discovery Service.
    from googleapiclient import discovery

    api_version = "v1"
    service_name = "healthcare"
    # Returns an authorized API client by discovering the Healthcare API
    # and using GOOGLE_APPLICATION_CREDENTIALS environment variable.
    client = discovery.build(service_name, api_version)

    # TODO(developer): Uncomment these lines and replace with your values.
    # project_id = 'my-project'  # replace with your GCP project ID
    # location = 'us-central1'  # replace with the parent dataset's location
    # dataset_id = 'my-dataset'  # replace with the DICOM store's parent dataset ID
    # dicom_store_id = 'my-dicom-store'  # replace with the DICOM store's ID
    # member = 'myemail@example.com'  # replace with an authorized member
    # role = 'roles/viewer'  # replace with a Healthcare API IAM role
    dicom_store_parent = "projects/{}/locations/{}/datasets/{}".format(
        project_id, location, dataset_id
    )
    dicom_store_name = f"{dicom_store_parent}/dicomStores/{dicom_store_id}"

    policy = {"bindings": [{"role": role, "members": [member]}]}

    if etag is not None:
        policy["etag"] = etag

    request = (
        client.projects()
        .locations()
        .datasets()
        .dicomStores()
        .setIamPolicy(resource=dicom_store_name, body={"policy": policy})
    )
    response = request.execute()

    print("etag: {}".format(response.get("name")))
    print("bindings: {}".format(response.get("bindings")))
    return response

curl

透過程式或使用文字編輯器修改擷取的政策，以授予或撤銷使用者的角色。政策變更時，etag 值也會變更，因此您必須指定目前的值。

如要授予新使用者角色，請將他們的電子郵件地址附加至 roles/healthcare.dicomViewer 繫結下的 members 陣列：

{
  "role":"roles/healthcare.dicomViewer",
  "members": [
    "serviceAccount:service-account-13@appspot.gserviceaccount.com",
    "user:user-2@example.com",
    "user:NEW_USER_EMAIL_ADDRESS"
  ]
}

修改政策以授予適用的角色後，請呼叫 projects.locations.datasets.dicomStores.setIamPolicy 以進行更新。

如要設定 DICOM 儲存庫層級的身分與存取權管理政策，請提出 POST 要求，並指定資料集名稱、DICOM 儲存庫名稱、政策和存取權權杖。

以下範例說明如何使用 curl 提出 POST 要求，將現有的 roles/healthcare.dicomViewer 角色授予新使用者：

政策可以直接寫在要求中 (如下所示)，也可以 JSON 或 YAML 檔案的形式傳遞。如要瞭解如何將政策格式設為 JSON 或 YAML，請參閱Policy。

curl -X POST \
    -H "Authorization: Bearer $(gcloud auth application-default print-access-token)" \
    -H "Content-Type: application/json; charset=utf-8" \
    --data "{
      'policy': {
        'bindings': [
          {
            'role':'roles/healthcare.dicomStoreAdmin',
            'members': [
              'user:user-1@example.com'
            ]
          },
          {
            'role':'roles/healthcare.dicomViewer',
            'members': [
              'serviceAccount:service-account-13@appspot.gserviceaccount.com',
              'user:user-2@example.com',
              'user:NEW_USER_EMAIL_ADDRESS'
            ]
          }
        ]
      }
    }" "https://healthcare.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/datasets/DATASET_ID/dicomStores/DICOM_STORE_ID:setIamPolicy"

回應如下：

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.dicomStoreAdmin",
      "members": [
        "user:user-1@example.com"
      ]
    },
    {
      "role":"roles/healthcare.dicomViewer",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com",
        "user:user-2@example.com",
        "user:NEW_USER_EMAIL_ADDRESS"
      ]
    }
  ]
}

PowerShell

透過程式或使用文字編輯器修改擷取的政策，以授予或撤銷使用者的角色。政策變更時，etag 值也會變更，因此您必須指定目前的值。

如要授予新使用者角色，請將他們的電子郵件地址附加至 roles/healthcare.dicomViewer 繫結下的 members 陣列：

{
  "role":"roles/healthcare.dicomViewer",
  "members": [
    "serviceAccount:service-account-13@appspot.gserviceaccount.com",
    "user:user-2@example.com",
    "user:NEW_USER_EMAIL_ADDRESS"
  ]
}

修改政策以授予適用的角色後，請呼叫 projects.locations.datasets.dicomStores.setIamPolicy 以進行更新。

如要設定 DICOM 儲存庫層級的身分與存取權管理政策，請提出 POST 要求，並指定資料集名稱、DICOM 儲存庫名稱、政策和存取權權杖。

下列範例說明如何使用 Windows PowerShell 提出 POST 要求，將現有 roles/healthcare.dicomViewer 角色授予新使用者：

政策可以直接寫在要求中 (如下所示)，也可以 JSON 或 YAML 檔案的形式傳遞。如要瞭解如何將政策格式設為 JSON 或 YAML，請參閱Policy。

$cred = gcloud auth application-default print-access-token
$headers = @{ Authorization = "Bearer $cred" }

Invoke-WebRequest `
  -Method Post `
  -Headers $headers `
  -ContentType: "application/json; charset=utf-8" `
  -Body "{
    'policy': {
      'bindings': [
        {
          'role': 'roles/healthcare.dicomStoreAdmin',
          'members': [
            'user:user-1@example.com',
          ]
        },
        {
          'role': 'roles/healthcare.dicomViewer',
          'members': [
            'serviceAccount:service-account-13@appspot.gserviceaccount.com',
            'user:user-2@example.com',
            'user:NEW_USER_EMAIL_ADDRESS'
          ]
        }
      ]
    }
  }" `
  -Uri "https://healthcare.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/datasets/DATASET_ID/dicomStores/DICOM_STORE_ID:setIamPolicy" | Select-Object -Expand Content

回應如下：

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.dicomStoreAdmin",
      "members": [
        "user:user-1@example.com"
      ]
    },
    {
      "role":"roles/healthcare.dicomViewer",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com",
        "user:user-2@example.com",
        "user:NEW_USER_EMAIL_ADDRESS"
      ]
    }
  ]
}

搭配 FHIR 儲存庫使用 IAM

以下各節說明如何取得、修改及設定 FHIR 存放區的政策。這些章節以以下範例政策為基礎：

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.fhirStoreAdmin",
      "members": [
        "user:user-1@example.com"
      ]
    },
    {
      "role":"roles/healthcare.fhirResourceReader",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com",
        "user:user-2@example.com"
      ]
    }
  ]
}

取得政策

下列範例說明如何讀取 FHIR 儲存庫層級的 IAM 政策。詳情請參閱 projects.locations.datasets.fhirStores.getIamPolicy。

控制台

如要查看 FHIR 儲存庫的身分與存取權管理政策：

前往 Google Cloud 控制台的「資料集」頁面。
前往「資料集」頁面
按一下包含 FHIR 儲存庫的資料集 ID，然後選取要取得政策的 FHIR 儲存庫。
按一下「顯示資訊面板」。
如要查看指派給角色的主體，請展開該角色。

gcloud

如要查看 FHIR 儲存庫的 IAM 政策，請執行 gcloud healthcare fhir-stores get-iam-policy 指令。指定 FHIR 儲存庫名稱、資料集名稱和位置。

gcloud healthcare fhir-stores get-iam-policy FHIR_STORE_ID \
    --dataset=DATASET_ID \
    --location=LOCATION

如果要求成功，系統會顯示繫結。

bindings:
- members:
  - user:user-1@example.com
  role: roles/healthcare.fhirStoreAdmin
  - serviceAccount:service-account-13@appspot.gserviceaccount.com
  - user:user-2@example.com
  role: roles/healthcare.fhirResourceReader
etag: bytes
version: VERSION_NUMBER

Go

import (
	"context"
	"fmt"
	"io"

	healthcare "google.golang.org/api/healthcare/v1"
)

// getFHIRIAMPolicy gets the FHIR store's IAM policy.
func getFHIRIAMPolicy(w io.Writer, projectID, location, datasetID, fhirStoreID string) error {
	ctx := context.Background()

	healthcareService, err := healthcare.NewService(ctx)
	if err != nil {
		return fmt.Errorf("healthcare.NewService: %w", err)
	}

	fhirService := healthcareService.Projects.Locations.Datasets.FhirStores

	name := fmt.Sprintf("projects/%s/locations/%s/datasets/%s/fhirStores/%s", projectID, location, datasetID, fhirStoreID)

	policy, err := fhirService.GetIamPolicy(name).Do()
	if err != nil {
		return fmt.Errorf("GetIamPolicy: %w", err)
	}

	fmt.Fprintf(w, "IAM Policy etag: %v\n", policy.Etag)
	return nil
}

Java

import com.google.api.client.http.HttpRequestInitializer;
import com.google.api.client.http.javanet.NetHttpTransport;
import com.google.api.client.json.JsonFactory;
import com.google.api.client.json.gson.GsonFactory;
import com.google.api.services.healthcare.v1.CloudHealthcare;
import com.google.api.services.healthcare.v1.CloudHealthcare.Projects.Locations.Datasets.FhirStores;
import com.google.api.services.healthcare.v1.CloudHealthcareScopes;
import com.google.api.services.healthcare.v1.model.Policy;
import com.google.auth.http.HttpCredentialsAdapter;
import com.google.auth.oauth2.GoogleCredentials;
import java.io.IOException;
import java.util.Collections;

public class FhirStoreGetIamPolicy {
  private static final String FHIR_NAME = "projects/%s/locations/%s/datasets/%s/fhirStores/%s";
  private static final JsonFactory JSON_FACTORY = new GsonFactory();
  private static final NetHttpTransport HTTP_TRANSPORT = new NetHttpTransport();

  public static void fhirStoreGetIamPolicy(String fhirStoreName) throws IOException {
    // String fhirStoreName =
    //    String.format(
    //        FHIR_NAME, "your-project-id", "your-region-id", "your-dataset-id", "your-fhir-id");

    // Initialize the client, which will be used to interact with the service.
    CloudHealthcare client = createClient();

    // Create request and configure any parameters.
    FhirStores.GetIamPolicy request =
        client.projects().locations().datasets().fhirStores().getIamPolicy(fhirStoreName);

    // Execute the request and process the results.
    Policy policy = request.execute();
    System.out.println("FHIR store IAMPolicy retrieved: \n" + policy.toPrettyString());
  }

  private static CloudHealthcare createClient() throws IOException {
    // Use Application Default Credentials (ADC) to authenticate the requests
    // For more information see https://cloud.google.com/docs/authentication/production
    GoogleCredentials credential =
        GoogleCredentials.getApplicationDefault()
            .createScoped(Collections.singleton(CloudHealthcareScopes.CLOUD_PLATFORM));

    // Create a HttpRequestInitializer, which will provide a baseline configuration to all requests.
    HttpRequestInitializer requestInitializer =
        request -> {
          new HttpCredentialsAdapter(credential).initialize(request);
          request.setConnectTimeout(60000); // 1 minute connect timeout
          request.setReadTimeout(60000); // 1 minute read timeout
        };

    // Build the client for interacting with the service.
    return new CloudHealthcare.Builder(HTTP_TRANSPORT, JSON_FACTORY, requestInitializer)
        .setApplicationName("your-application-name")
        .build();
  }
}

Node.js

const google = require('@googleapis/healthcare');
const healthcare = google.healthcare({
  version: 'v1',
  auth: new google.auth.GoogleAuth({
    scopes: ['https://www.googleapis.com/auth/cloud-platform'],
  }),
});

const getFhirStoreIamPolicy = async () => {
  // TODO(developer): uncomment these lines before running the sample
  // const cloudRegion = 'us-central1';
  // const projectId = 'adjective-noun-123';
  // const datasetId = 'my-dataset';
  // const fhirStoreId = 'my-fhir-store';
  const resource_ = `projects/${projectId}/locations/${cloudRegion}/datasets/${datasetId}/fhirStores/${fhirStoreId}`;
  const request = {resource_};

  const fhirStore =
    await healthcare.projects.locations.datasets.fhirStores.getIamPolicy(
      request
    );
  console.log(
    'Got FHIR store IAM policy:',
    JSON.stringify(fhirStore.data, null, 2)
  );
};

getFhirStoreIamPolicy();

Python

def get_fhir_store_iam_policy(project_id, location, dataset_id, fhir_store_id):
    """Gets the IAM policy for the specified FHIR store.

    See https://github.com/GoogleCloudPlatform/python-docs-samples/tree/main/healthcare/api-client/v1/fhir
    before running the sample."""
    # Imports the Google API Discovery Service.
    from googleapiclient import discovery

    api_version = "v1"
    service_name = "healthcare"
    # Instantiates an authorized API client by discovering the Healthcare API
    # and using GOOGLE_APPLICATION_CREDENTIALS environment variable.
    client = discovery.build(service_name, api_version)

    # TODO(developer): Uncomment these lines and replace with your values.
    # project_id = 'my-project'  # replace with your GCP project ID
    # location = 'us-central1'  # replace with the parent dataset's location
    # dataset_id = 'my-dataset'  # replace with the parent dataset's ID
    # fhir_store_id = 'my-fhir-store' # replace with the FHIR store ID
    fhir_store_parent = "projects/{}/locations/{}/datasets/{}".format(
        project_id, location, dataset_id
    )
    fhir_store_name = f"{fhir_store_parent}/fhirStores/{fhir_store_id}"

    request = (
        client.projects()
        .locations()
        .datasets()
        .fhirStores()
        .getIamPolicy(resource=fhir_store_name)
    )
    response = request.execute()

    print("etag: {}".format(response.get("name")))
    return response

curl

如要讀取 FHIR 儲存庫的 IAM 政策，請發出 POST 要求，並指定資料集名稱、FHIR 儲存庫名稱和存取權權杖。

以下範例顯示使用 curl 的 POST 要求：

curl -X GET \
     -H "Authorization: Bearer $(gcloud auth application-default print-access-token)" \
     "https://healthcare.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/datasets/DATASET_ID/fhirStores/FHIR_STORE_ID:getIamPolicy"

回應如下：

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.fhirStoreAdmin",
      "members": [
        "user:user-1@example.com"
      ]
    },
    {
      "role":"roles/healthcare.fhirResourceReader",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com",
        "user:user-2@example.com"
      ]
    }
  ]
}

PowerShell

如要讀取 FHIR 儲存庫的 IAM 政策，請發出 POST 要求，並指定資料集名稱、FHIR 儲存庫名稱和存取權權杖。

下列範例顯示如何使用 Windows PowerShell 提出 POST 要求：

$cred = gcloud auth application-default print-access-token
$headers = @{ Authorization = "Bearer $cred" }

Invoke-WebRequest `
  -Method Post `
  -Headers $headers `
  -ContentType: "application/json; charset=utf-8" `
  -Uri "https://healthcare.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/datasets/DATASET_ID/fhirStores/FHIR_STORE_ID:getIamPolicy" | Select-Object -Expand Content

回應如下：

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.fhirStoreAdmin",
      "members": [
        "user:user-1@example.com"
      ]
    },
    {
      "role":"roles/healthcare.fhirResourceReader",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com",
        "user:user-2@example.com"
      ]
    }
  ]
}

修改政策

下列範例會將 roles/healthcare.fhirResourceReader 角色授予新使用者。詳情請參閱 projects.locations.datasets.fhirStores.setIamPolicy。

設定政策

控制台

如要設定 FHIR 儲存庫層級的身分與存取權管理政策，請完成下列步驟：

前往 Google Cloud 控制台的「資料集」頁面。
前往「資料集」頁面
按一下包含 FHIR 儲存庫的資料集 ID，然後選取要設定政策的 FHIR 儲存庫。
按一下「顯示資訊面板」。
按一下「新增主體」。
在「New principals」(新增主體) 欄位中，輸入需要存取 FHIR 存放區的一或多個身分。
在「Select a role」(選取角色) 清單中，選取「Cloud Healthcare」下要授予的權限。例如 Healthcare FHIR 資源讀取者。
按一下 [儲存]。

gcloud

透過程式或使用文字編輯器修改擷取的政策，以授予或撤銷使用者的角色。政策變更時，etag 值也會變更，因此您必須指定目前的值。

如要授予新使用者角色，請將對方的電子郵件地址附加到 roles/healthcare.fhirResourceReader 繫結下的 members 陣列：

{
  "role":"roles/healthcare.fhirResourceReader",
  "members": [
    "serviceAccount:service-account-13@appspot.gserviceaccount.com",
    "user:user-2@example.com",
    "user:NEW_USER_EMAIL_ADDRESS"
  ]
}

修改政策以授予適用的角色後，請執行適當的 set-iam-policy 指令來進行變更。如要設定 FHIR 儲存庫層級的政策，請執行 gcloud healthcare fhir-stores set-iam-policy 指令。指定 FHIR 儲存庫名稱、資料集名稱、位置，以及您建立的政策檔案路徑。

gcloud healthcare fhir-stores set-iam-policy FHIR_STORE_ID \
    --dataset=DATASET_ID \
    --location=LOCATION \
    POLICY_FILE_NAME

如果要求成功，系統會顯示 FHIR 存放區名稱和繫結。

Updated IAM policy for fhirStore [FHIR_STORE_ID].
bindings:
- members:
  - serviceAccount:service-account-13@appspot.gserviceaccount.com
  - user:user-2@example.com
  - user:NEW_USER_EMAIL_ADDRESS
  role: roles/healthcare.fhirResourceReader
etag: bytes
version: VERSION_NUMBER

Go

import (
	"context"
	"fmt"
	"io"

	healthcare "google.golang.org/api/healthcare/v1"
)

// setFHIRIAMPolicy sets the FHIR store's IAM policy.
func setFHIRIAMPolicy(w io.Writer, projectID, location, datasetID, fhirStoreID string) error {
	ctx := context.Background()

	healthcareService, err := healthcare.NewService(ctx)
	if err != nil {
		return fmt.Errorf("healthcare.NewService: %w", err)
	}

	fhirService := healthcareService.Projects.Locations.Datasets.FhirStores

	name := fmt.Sprintf("projects/%s/locations/%s/datasets/%s/fhirStores/%s", projectID, location, datasetID, fhirStoreID)

	policy, err := fhirService.GetIamPolicy(name).Do()
	if err != nil {
		return fmt.Errorf("GetIamPolicy: %w", err)
	}

	policy.Bindings = append(policy.Bindings, &healthcare.Binding{
		Members: []string{"user:example@example.com"},
		Role:    "roles/viewer",
	})

	req := &healthcare.SetIamPolicyRequest{
		Policy: policy,
	}

	policy, err = fhirService.SetIamPolicy(name, req).Do()
	if err != nil {
		return fmt.Errorf("SetIamPolicy: %w", err)
	}

	fmt.Fprintf(w, "IAM Policy version: %v\n", policy.Version)
	return nil
}

Java

import com.google.api.client.http.HttpRequestInitializer;
import com.google.api.client.http.javanet.NetHttpTransport;
import com.google.api.client.json.JsonFactory;
import com.google.api.client.json.gson.GsonFactory;
import com.google.api.services.healthcare.v1.CloudHealthcare;
import com.google.api.services.healthcare.v1.CloudHealthcare.Projects.Locations.Datasets.FhirStores;
import com.google.api.services.healthcare.v1.CloudHealthcareScopes;
import com.google.api.services.healthcare.v1.model.Binding;
import com.google.api.services.healthcare.v1.model.Policy;
import com.google.api.services.healthcare.v1.model.SetIamPolicyRequest;
import com.google.auth.http.HttpCredentialsAdapter;
import com.google.auth.oauth2.GoogleCredentials;
import java.io.IOException;
import java.util.Arrays;
import java.util.Collections;

public class FhirStoreSetIamPolicy {
  private static final String FHIR_NAME = "projects/%s/locations/%s/datasets/%s/fhirStores/%s";
  private static final JsonFactory JSON_FACTORY = new GsonFactory();
  private static final NetHttpTransport HTTP_TRANSPORT = new NetHttpTransport();

  public static void fhirStoreSetIamPolicy(String fhirStoreName) throws IOException {
    // String fhirStoreName =
    //    String.format(
    //        FHIR_NAME, "your-project-id", "your-region-id", "your-dataset-id", "your-fhir-id");

    // Initialize the client, which will be used to interact with the service.
    CloudHealthcare client = createClient();

    // Configure the IAMPolicy to apply to the store.
    // For more information on understanding IAM roles, see the following:
    // https://cloud.google.com/iam/docs/understanding-roles
    Binding binding =
        new Binding()
            .setRole("roles/healthcare.fhirResourceReader")
            .setMembers(Arrays.asList("domain:google.com"));
    Policy policy = new Policy().setBindings(Arrays.asList(binding));
    SetIamPolicyRequest policyRequest = new SetIamPolicyRequest().setPolicy(policy);

    // Create request and configure any parameters.
    FhirStores.SetIamPolicy request =
        client
            .projects()
            .locations()
            .datasets()
            .fhirStores()
            .setIamPolicy(fhirStoreName, policyRequest);

    // Execute the request and process the results.
    Policy updatedPolicy = request.execute();
    System.out.println("FHIR policy has been updated: " + updatedPolicy.toPrettyString());
  }

  private static CloudHealthcare createClient() throws IOException {
    // Use Application Default Credentials (ADC) to authenticate the requests
    // For more information see https://cloud.google.com/docs/authentication/production
    GoogleCredentials credential =
        GoogleCredentials.getApplicationDefault()
            .createScoped(Collections.singleton(CloudHealthcareScopes.CLOUD_PLATFORM));

    // Create a HttpRequestInitializer, which will provide a baseline configuration to all requests.
    HttpRequestInitializer requestInitializer =
        request -> {
          new HttpCredentialsAdapter(credential).initialize(request);
          request.setConnectTimeout(60000); // 1 minute connect timeout
          request.setReadTimeout(60000); // 1 minute read timeout
        };

    // Build the client for interacting with the service.
    return new CloudHealthcare.Builder(HTTP_TRANSPORT, JSON_FACTORY, requestInitializer)
        .setApplicationName("your-application-name")
        .build();
  }
}

Node.js

const google = require('@googleapis/healthcare');
const healthcare = google.healthcare({
  version: 'v1',
  auth: new google.auth.GoogleAuth({
    scopes: ['https://www.googleapis.com/auth/cloud-platform'],
  }),
});

const setFhirStoreIamPolicy = async () => {
  // TODO(developer): uncomment these lines before running the sample
  // const cloudRegion = 'us-central1';
  // const projectId = 'adjective-noun-123';
  // const datasetId = 'my-dataset';
  // const fhirStoreId = 'my-fhir-store';
  // const member = 'user:example@gmail.com';
  // const role = 'roles/healthcare.fhirStoreViewer';
  const resource_ = `projects/${projectId}/locations/${cloudRegion}/datasets/${datasetId}/fhirStores/${fhirStoreId}`;
  const request = {
    resource_,
    resource: {
      policy: {
        bindings: [
          {
            members: member,
            role: role,
          },
        ],
      },
    },
  };

  const fhirStore =
    await healthcare.projects.locations.datasets.fhirStores.setIamPolicy(
      request
    );
  console.log(
    'Set FHIR store IAM policy:',
    JSON.stringify(fhirStore.data, null, 2)
  );
};

setFhirStoreIamPolicy();

Python

def set_fhir_store_iam_policy(
    project_id,
    location,
    dataset_id,
    fhir_store_id,
    member,
    role,
    etag=None,
):
    """Sets the IAM policy for the specified FHIR store.
        A single member will be assigned a single role. A member can be any of:
        - allUsers, that is, anyone
        - allAuthenticatedUsers, anyone authenticated with a Google account
        - user:email, as in 'user:somebody@example.com'
        - group:email, as in 'group:admins@example.com'
        - domain:domainname, as in 'domain:example.com'
        - serviceAccount:email,
            as in 'serviceAccount:my-other-app@appspot.gserviceaccount.com'
        A role can be any IAM role, such as 'roles/viewer', 'roles/owner',
        or 'roles/editor'

    See https://github.com/GoogleCloudPlatform/python-docs-samples/tree/main/healthcare/api-client/v1/fhir
    before running the sample."""
    # Imports the Google API Discovery Service.
    from googleapiclient import discovery

    api_version = "v1"
    service_name = "healthcare"
    # Instantiates an authorized API client by discovering the Healthcare API
    # and using GOOGLE_APPLICATION_CREDENTIALS environment variable.
    client = discovery.build(service_name, api_version)

    # TODO(developer): Uncomment these lines and replace with your values.
    # project_id = 'my-project'  # replace with your GCP project ID
    # location = 'us-central1'  # replace with the parent dataset's location
    # dataset_id = 'my-dataset'  # replace with the parent dataset's ID
    # fhir_store_id = 'my-fhir-store' # replace with the FHIR store ID
    # member = 'myemail@example.com'  # replace with an authorized member
    # role = 'roles/viewer'  # replace with a Healthcare API IAM role
    fhir_store_parent = "projects/{}/locations/{}/datasets/{}".format(
        project_id, location, dataset_id
    )
    fhir_store_name = f"{fhir_store_parent}/fhirStores/{fhir_store_id}"

    policy = {"bindings": [{"role": role, "members": [member]}]}

    if etag is not None:
        policy["etag"] = etag

    request = (
        client.projects()
        .locations()
        .datasets()
        .fhirStores()
        .setIamPolicy(resource=fhir_store_name, body={"policy": policy})
    )
    response = request.execute()

    print("etag: {}".format(response.get("name")))
    print("bindings: {}".format(response.get("bindings")))
    return response

curl

透過程式或使用文字編輯器修改擷取的政策，以授予或撤銷使用者的角色。政策變更時，etag 值也會變更，因此您必須指定目前的值。

如要授予新使用者角色，請將對方的電子郵件地址附加到 roles/healthcare.fhirResourceReader 繫結下的 members 陣列：

{
  "role":"roles/healthcare.fhirResourceReader",
  "members": [
    "serviceAccount:service-account-13@appspot.gserviceaccount.com",
    "user:user-2@example.com",
    "user:NEW_USER_EMAIL_ADDRESS"
  ]
}

修改政策以授予適用的角色後，請呼叫 projects.locations.datasets.fhirStores.setIamPolicy 以進行更新。

如要設定 FHIR 儲存庫層級的身分與存取權管理政策，請提出 POST要求，並指定資料集名稱、FHIR 儲存庫名稱、政策和存取權杖。

以下範例說明如何使用 curl 提出 POST 要求，將現有的 roles/healthcare.fhirResourceReader 角色授予新使用者：

政策可以直接寫在要求中 (如下所示)，也可以 JSON 或 YAML 檔案的形式傳遞。如要瞭解如何將政策格式設為 JSON 或 YAML，請參閱Policy。

curl -X POST \
    -H "Authorization: Bearer $(gcloud auth application-default print-access-token)" \
    -H "Content-Type: application/json; charset=utf-8" \
    --data "{
      'policy': {
        'bindings': [
          {
            'role':'roles/healthcare.fhirStoreAdmin',
            'members': [
              'user:user-1@example.com'
            ]
          },
          {
            'role':'roles/healthcare.fhirResourceReader',
            'members': [
              'serviceAccount:service-account-13@appspot.gserviceaccount.com',
              'user:user-2@example.com',
              'user:NEW_USER_EMAIL_ADDRESS'
            ]
          }
        ]
      }
    }" "https://healthcare.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/datasets/DATASET_ID/fhirStores/FHIR_STORE_ID:setIamPolicy"

回應如下：

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.fhirStoreAdmin",
      "members": [
        "user:user-1@example.com"
      ]
    },
    {
      "role":"roles/healthcare.fhirResourceViewer",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com",
        "user:user-2@example.com",
        "user:NEW_USER_EMAIL_ADDRESS"
      ]
    }
  ]
}

PowerShell

透過程式或使用文字編輯器修改擷取的政策，以授予或撤銷使用者的角色。政策變更時，etag 值也會變更，因此您必須指定目前的值。

如要授予新使用者角色，請將對方的電子郵件地址附加到 roles/healthcare.fhirResourceReader 繫結下的 members 陣列：

{
  "role":"roles/healthcare.fhirResourceReader",
  "members": [
    "serviceAccount:service-account-13@appspot.gserviceaccount.com",
    "user:user-2@example.com",
    "user:NEW_USER_EMAIL_ADDRESS"
  ]
}

修改政策以授予適用的角色後，請呼叫 projects.locations.datasets.fhirStores.setIamPolicy 以進行更新。

如要設定 FHIR 儲存庫層級的身分與存取權管理政策，請提出 POST要求，並指定資料集名稱、FHIR 儲存庫名稱、政策和存取權杖。

下列範例說明如何使用 Windows PowerShell 提出 POST 要求，將現有 roles/healthcare.fhirResourceReader 角色授予新使用者：

政策可以直接寫在要求中 (如下所示)，也可以 JSON 或 YAML 檔案的形式傳遞。如要瞭解如何將政策格式設為 JSON 或 YAML，請參閱Policy。

$cred = gcloud auth application-default print-access-token
$headers = @{ Authorization = "Bearer $cred" }

Invoke-WebRequest `
  -Method Post `
  -Headers $headers `
  -ContentType: "application/json; charset=utf-8" `
  -Body "{
    'policy': {
      'bindings': [
        {
          'role': 'roles/healthcare.fhirStoreAdmin',
          'members': [
            'user:user-1@example.com',
          ]
        },
        {
          'role': 'roles/healthcare.fhirResourceReader',
          'members': [
            'serviceAccount:service-account-13@appspot.gserviceaccount.com',
            'user:user-2@example.com',
            'user:NEW_USER_EMAIL_ADDRESS'
          ]
        }
      ]
    }
  }" `
  -Uri "https://healthcare.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/datasets/DATASET_ID/fhirStores/FHIR_STORE_ID:setIamPolicy" | Select-Object -Expand Content

回應如下：

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.fhirStoreAdmin",
      "members": [
        "user:user-1@example.com"
      ]
    },
    {
      "role":"roles/healthcare.fhirResourceViewer",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com",
        "user:user-2@example.com",
        "user:NEW_USER_EMAIL_ADDRESS"
      ]
    }
  ]
}

搭配 HL7v2 儲存庫使用 IAM

以下各節說明如何取得、修改及設定 HL7v2 存放區的政策。這些章節以以下範例政策為基礎：

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.hl7V2StoreAdmin",
      "members": [
        "user:user-1@example.com"
      ]
    },
    {
      "role":"roles/healthcare.hl7V2Consumer",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com",
        "user:user-2@example.com"
      ]
    }
  ]
}

取得政策

下列範例說明如何讀取 HL7v2 儲存庫層級的 IAM 政策。詳情請參閱 projects.locations.datasets.hl7V2Stores.getIamPolicy。

控制台

如要查看 HL7v2 儲存庫的身分與存取權管理政策：

前往 Google Cloud 控制台的「資料集」頁面。
前往「資料集」頁面
按一下含有 HL7v2 儲存庫的資料集 ID，然後選取要取得政策的 HL7v2 儲存庫。
按一下「顯示資訊面板」。
如要查看指派給角色的主體，請展開該角色。

gcloud

如要查看 HL7v2 儲存庫的身分與存取權管理政策，請執行 hl7v2-stores get-iam-policy 指令。指定 HL7v2 商店名稱、資料集名稱和位置。

gcloud healthcare hl7v2-stores get-iam-policy HL7V2_STORE_ID \
    --dataset=DATASET_ID \
    --location=LOCATION

如果要求成功，系統會顯示繫結。

bindings:
- members:
  - user:user-1@example.com
  role: roles/healthcare.hl7v2StoreAdmin
  - serviceAccount:service-account-13@appspot.gserviceaccount.com
  - user:user-2@example.com
  role: roles/healthcare.hl7v2Consumer
etag: bytes
version: VERSION_NUMBER

curl

如要讀取 HL7v2 儲存庫的 IAM 政策，請發出 GET 要求，並指定資料集名稱、HL7v2 儲存庫名稱和存取權權杖。

以下範例顯示使用 curl 的 GET 要求：

curl -X GET \
     -H "Authorization: Bearer $(gcloud auth application-default print-access-token)" \
     "https://healthcare.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/datasets/DATASET_ID/hl7V2Stores/HL7V2_STORE_ID:getIamPolicy"

回應如下：

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.hl7V2StoreAdmin",
      "members": [
        "user:user-1@example.com"
      ]
    },
    {
      "role":"roles/healthcare.hl7V2Consumer",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com",
        "user:user-2@example.com"
      ]
    }
  ]
}

PowerShell

如要讀取 HL7v2 儲存庫的 IAM 政策，請發出 GET 要求，並指定資料集名稱、HL7v2 儲存庫名稱和存取權權杖。

下列範例顯示如何使用 Windows PowerShell 提出 GET 要求：

$cred = gcloud auth application-default print-access-token
$headers = @{ Authorization = "Bearer $cred" }

Invoke-WebRequest `
  -Method Get `
  -Headers $headers `
  -Uri "https://healthcare.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/datasets/DATASET_ID/hl7V2Stores/HL7V2_STORE_ID:getIamPolicy" | Select-Object -Expand Content

回應如下：

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.hl7V2StoreAdmin",
      "members": [
        "user:user-1@example.com"
      ]
    },
    {
      "role":"roles/healthcare.hl7V2Consumer",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com",
        "user:user-2@example.com"
      ]
    }
  ]
}

Go

import (
	"context"
	"fmt"
	"io"

	healthcare "google.golang.org/api/healthcare/v1"
)

// hl7V2IAMPolicy gets the IAM policy.
func hl7V2IAMPolicy(w io.Writer, projectID, location, datasetID, hl7V2StoreID string) error {
	ctx := context.Background()

	healthcareService, err := healthcare.NewService(ctx)
	if err != nil {
		return fmt.Errorf("healthcare.NewService: %w", err)
	}

	storesService := healthcareService.Projects.Locations.Datasets.Hl7V2Stores

	name := fmt.Sprintf("projects/%s/locations/%s/datasets/%s/hl7V2Stores/%s", projectID, location, datasetID, hl7V2StoreID)

	policy, err := storesService.GetIamPolicy(name).Do()
	if err != nil {
		return fmt.Errorf("GetIamPolicy: %w", err)
	}

	fmt.Fprintf(w, "IAM policy etag: %q\n", policy.Etag)
	return nil
}

Java

import com.google.api.client.http.HttpRequestInitializer;
import com.google.api.client.http.javanet.NetHttpTransport;
import com.google.api.client.json.JsonFactory;
import com.google.api.client.json.gson.GsonFactory;
import com.google.api.services.healthcare.v1.CloudHealthcare;
import com.google.api.services.healthcare.v1.CloudHealthcare.Projects.Locations.Datasets.Hl7V2Stores;
import com.google.api.services.healthcare.v1.CloudHealthcareScopes;
import com.google.api.services.healthcare.v1.model.Policy;
import com.google.auth.http.HttpCredentialsAdapter;
import com.google.auth.oauth2.GoogleCredentials;
import java.io.IOException;
import java.util.Collections;

public class Hl7v2StoreGetIamPolicy {
  private static final String HL7v2_NAME = "projects/%s/locations/%s/datasets/%s/hl7V2Stores/%s";
  private static final JsonFactory JSON_FACTORY = new GsonFactory();
  private static final NetHttpTransport HTTP_TRANSPORT = new NetHttpTransport();

  public static void hl7v2StoreGetIamPolicy(String hl7v2StoreName) throws IOException {
    // String hl7v2StoreName =
    //    String.format(
    //        HL7v2_NAME, "your-project-id", "your-region-id", "your-dataset-id", "your-hl7v2-id");

    // Initialize the client, which will be used to interact with the service.
    CloudHealthcare client = createClient();

    // Create request and configure any parameters.
    Hl7V2Stores.GetIamPolicy request =
        client.projects().locations().datasets().hl7V2Stores().getIamPolicy(hl7v2StoreName);

    // Execute the request and process the results.
    Policy policy = request.execute();
    System.out.println("HL7v2 store IAMPolicy retrieved: \n" + policy.toPrettyString());
  }

  private static CloudHealthcare createClient() throws IOException {
    // Use Application Default Credentials (ADC) to authenticate the requests
    // For more information see https://cloud.google.com/docs/authentication/production
    GoogleCredentials credential =
        GoogleCredentials.getApplicationDefault()
            .createScoped(Collections.singleton(CloudHealthcareScopes.CLOUD_PLATFORM));

    // Create a HttpRequestInitializer, which will provide a baseline configuration to all requests.
    HttpRequestInitializer requestInitializer =
        request -> {
          new HttpCredentialsAdapter(credential).initialize(request);
          request.setConnectTimeout(60000); // 1 minute connect timeout
          request.setReadTimeout(60000); // 1 minute read timeout
        };

    // Build the client for interacting with the service.
    return new CloudHealthcare.Builder(HTTP_TRANSPORT, JSON_FACTORY, requestInitializer)
        .setApplicationName("your-application-name")
        .build();
  }
}

Node.js

const google = require('@googleapis/healthcare');
const healthcare = google.healthcare({
  version: 'v1',
  auth: new google.auth.GoogleAuth({
    scopes: ['https://www.googleapis.com/auth/cloud-platform'],
  }),
});

const getHl7v2StoreIamPolicy = async () => {
  // TODO(developer): uncomment these lines before running the sample
  // const cloudRegion = 'us-central1';
  // const projectId = 'adjective-noun-123';
  // const datasetId = 'my-dataset';
  // const hl7v2StoreId = 'my-hl7v2-store';
  const resource_ = `projects/${projectId}/locations/${cloudRegion}/datasets/${datasetId}/hl7V2Stores/${hl7v2StoreId}`;
  const request = {resource_};

  const hl7v2Store =
    await healthcare.projects.locations.datasets.hl7V2Stores.getIamPolicy(
      request
    );
  console.log(
    'Got HL7v2 store IAM policy:',
    JSON.stringify(hl7v2Store.data, null, 2)
  );
};

getHl7v2StoreIamPolicy();

Python

def get_hl7v2_store_iam_policy(project_id, location, dataset_id, hl7v2_store_id):
    """Gets the IAM policy for the specified HL7v2 store.

    See https://github.com/GoogleCloudPlatform/python-docs-samples/tree/main/healthcare/api-client/v1/hl7v2
    before running the sample."""
    # Imports the Google API Discovery Service.
    from googleapiclient import discovery

    api_version = "v1"
    service_name = "healthcare"
    # Returns an authorized API client by discovering the Healthcare API
    # and using GOOGLE_APPLICATION_CREDENTIALS environment variable.
    client = discovery.build(service_name, api_version)

    # TODO(developer): Uncomment these lines and replace with your values.
    # project_id = 'my-project'  # replace with your GCP project ID
    # location = 'us-central1'  # replace with the parent dataset's location
    # dataset_id = 'my-dataset'  # replace with the HL7v2 store's parent dataset
    # hl7v2_store_id = 'my-hl7v2-store'  # replace with the HL7v2 store's ID
    hl7v2_store_parent = "projects/{}/locations/{}/datasets/{}".format(
        project_id, location, dataset_id
    )
    hl7v2_store_name = f"{hl7v2_store_parent}/hl7V2Stores/{hl7v2_store_id}"

    request = (
        client.projects()
        .locations()
        .datasets()
        .hl7V2Stores()
        .getIamPolicy(resource=hl7v2_store_name)
    )
    response = request.execute()

    print("etag: {}".format(response.get("name")))
    return response

修改政策

下列範例會將 roles/healthcare.hl7V2Consumer 角色授予新使用者。詳情請參閱 projects.locations.datasets.hl7V2Stores.setIamPolicy。

設定政策

控制台

如要設定 HL7v2 儲存庫層級的身分與存取權管理政策，請完成下列步驟：

前往 Google Cloud 控制台的「資料集」頁面。
前往「資料集」頁面
按一下含有 HL7v2 儲存庫的資料集 ID，然後選取要設定政策的 HL7v2 儲存庫。
按一下「顯示資訊面板」。
按一下「新增主體」。
在「New principals」(新增主體) 欄位中，輸入需要存取 HL7v2 儲存區的一或多個身分。
在「Select a role」(選取角色) 清單中，選取「Cloud Healthcare」下要授予的權限。例如：Healthcare HL7v2 訊息使用者。
按一下 [儲存]。

gcloud

透過程式或使用文字編輯器修改擷取的政策，以授予或撤銷使用者的角色。政策變更時，etag 值也會變更，因此您必須指定目前的值。

如要授予新使用者角色，請將對方的電子郵件地址附加到 roles/healthcare.hl7V2Consumer 繫結下的 members 陣列：

{
  "role":"roles/healthcare.hl7V2Consumer",
  "members": [
    "serviceAccount:service-account-13@appspot.gserviceaccount.com",
    "user:user-2@example.com",
    "user:NEW_USER_EMAIL_ADDRESS"
  ]
}

修改政策以授予適用的角色後，請執行適當的 set-iam-policy 指令來進行變更。如要設定 HL7v2 儲存庫層級的政策，請執行 gcloud healthcare hl7v2-stores set-iam-policy 指令。指定 HL7v2 存放區名稱、資料集名稱、位置，以及您建立的政策檔案路徑。

gcloud healthcare hl7v2-stores set-iam-policy HL7V2_STORE_ID \
    --dataset=DATASET_ID \
    --location=LOCATION \
    POLICY_FILE_NAME

如果要求成功，系統會顯示 HL7v2 存放區名稱和繫結。

Updated IAM policy for hl7v2Store [HL7V2_STORE_ID].
bindings:
- members:
  - user:user-1@example.com
  role: roles/healthcare.hl7v2StoreAdmin
  - serviceAccount:service-account-13@appspot.gserviceaccount.com
  - user:user-2@example.com
  - user:NEW_USER_EMAIL_ADDRESS
  role: roles/healthcare.hl7v2Consumer
etag: bytes
version: VERSION_NUMBER

curl

透過程式或使用文字編輯器修改擷取的政策，以授予或撤銷使用者的角色。政策變更時，etag 值也會變更，因此您必須指定目前的值。

如要授予新使用者角色，請將對方的電子郵件地址附加到 roles/healthcare.hl7V2Consumer 繫結下的 members 陣列：

{
  "role":"roles/healthcare.hl7V2Consumer",
  "members": [
    "serviceAccount:service-account-13@appspot.gserviceaccount.com",
    "user:user-2@example.com",
    "user:NEW_USER_EMAIL_ADDRESS"
  ]
}

修改政策以授予適用的角色後，請呼叫 projects.locations.datasets.hl7V2Stores.setIamPolicy 以進行更新。

如要設定 HL7v2 儲存庫層級的身分與存取權管理政策，請提出 POST 要求，並指定資料集名稱、HL7v2 儲存庫名稱、政策和存取權權杖。

以下範例顯示如何使用 curl 提出 POST 要求，授予新使用者現有的 roles/healthcare.hl7V2Consumer 角色。

政策可以直接寫在要求中 (如下所示)，也可以 JSON 或 YAML 檔案的形式傳遞。如要瞭解如何將政策格式設為 JSON 或 YAML，請參閱Policy。

curl -X POST \
    -H "Authorization: Bearer $(gcloud auth application-default print-access-token)" \
    -H "Content-Type: application/json; charset=utf-8" \
    --data "{
      'policy': {
        'bindings': [
          {
            'role':'roles/healthcare.hl7V2StoreAdmin',
            'members': [
              'user:user-1@example.com'
            ]
          },
          {
            'role':'roles/healthcare.hl7V2Consumer',
            'members': [
              'serviceAccount:service-account-13@appspot.gserviceaccount.com',
              'user:user-2@example.com',
              'user:NEW_USER_EMAIL_ADDRESS'
            ]
          }
        ]
      }
    }" "https://healthcare.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/datasets/DATASET_ID/hl7V2Stores/HL7V2_STORE_ID:setIamPolicy"

回應如下：

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.hl7V2StoreAdmin",
      "members": [
        "user:user-1@example.com"
      ]
    },
    {
      "role":"roles/healthcare.hl7V2Consumer",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com",
        "user:user-2@example.com",
        "user:NEW_USER_EMAIL_ADDRESS"
      ]
    }
  ]
}

PowerShell

透過程式或使用文字編輯器修改擷取的政策，以授予或撤銷使用者的角色。政策變更時，etag 值也會變更，因此您必須指定目前的值。

如要授予新使用者角色，請將對方的電子郵件地址附加到 roles/healthcare.hl7V2Consumer 繫結下的 members 陣列：

{
  "role":"roles/healthcare.hl7V2Consumer",
  "members": [
    "serviceAccount:service-account-13@appspot.gserviceaccount.com",
    "user:user-2@example.com",
    "user:NEW_USER_EMAIL_ADDRESS"
  ]
}

修改政策以授予適用的角色後，請呼叫 projects.locations.datasets.hl7V2Stores.setIamPolicy 以進行更新。

如要設定 HL7v2 儲存庫層級的身分與存取權管理政策，請提出 POST 要求，並指定資料集名稱、HL7v2 儲存庫名稱、政策和存取權權杖。

以下範例說明如何使用 curl 提出 POST 要求，將現有的 roles/healthcare.hl7V2Consumer 角色授予新使用者：

政策可以直接寫在要求中 (如下所示)，也可以 JSON 或 YAML 檔案的形式傳遞。如要瞭解如何將政策格式設為 JSON 或 YAML，請參閱Policy。

$cred = gcloud auth application-default print-access-token
$headers = @{ Authorization = "Bearer $cred" }

Invoke-WebRequest `
  -Method Post `
  -Headers $headers `
  -ContentType: "application/json; charset=utf-8" `
  -Body "{
    'policy': {
      'bindings': [
        {
          'role': 'roles/healthcare.hl7V2StoreAdmin',
          'members': [
            'user:user-1@example.com',
          ]
        },
        {
          'role': 'roles/healthcare.hl7V2Consumer',
          'members': [
            'serviceAccount:service-account-13@appspot.gserviceaccount.com',
            'user:user-2@example.com',
            'user:NEW_USER_EMAIL_ADDRESS'
          ]
        }
      ]
    }
  }" `
  -Uri "https://healthcare.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/datasets/DATASET_ID/hl7V2Stores/HL7V2_STORE_ID:setIamPolicy" | Select-Object -Expand Content

回應如下：

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.hl7V2StoreAdmin",
      "members": [
        "user:user-1@example.com"
      ]
    },
    {
      "role":"roles/healthcare.hl7V2Consumer",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com",
        "user:user-2@example.com",
        "user:NEW_USER_EMAIL_ADDRESS"
      ]
    }
  ]
}

Go

import (
	"context"
	"fmt"
	"io"

	healthcare "google.golang.org/api/healthcare/v1"
)

// setHL7V2IAMPolicy sets an IAM policy.
func setHL7V2IAMPolicy(w io.Writer, projectID, location, datasetID, hl7V2StoreID string) error {
	ctx := context.Background()

	healthcareService, err := healthcare.NewService(ctx)
	if err != nil {
		return fmt.Errorf("healthcare.NewService: %w", err)
	}

	storesService := healthcareService.Projects.Locations.Datasets.Hl7V2Stores

	name := fmt.Sprintf("projects/%s/locations/%s/datasets/%s/hl7V2Stores/%s", projectID, location, datasetID, hl7V2StoreID)

	policy, err := storesService.GetIamPolicy(name).Do()
	if err != nil {
		return fmt.Errorf("GetIamPolicy: %w", err)
	}

	policy.Bindings = append(policy.Bindings, &healthcare.Binding{
		Members: []string{"user:example@example.com"},
		Role:    "roles/viewer",
	})

	req := &healthcare.SetIamPolicyRequest{
		Policy: policy,
	}

	policy, err = storesService.SetIamPolicy(name, req).Do()
	if err != nil {
		return fmt.Errorf("SetIamPolicy: %w", err)
	}

	fmt.Fprintf(w, "Sucessfully set IAM Policy.\n")
	return nil
}

Java

import com.google.api.client.http.HttpRequestInitializer;
import com.google.api.client.http.javanet.NetHttpTransport;
import com.google.api.client.json.JsonFactory;
import com.google.api.client.json.gson.GsonFactory;
import com.google.api.services.healthcare.v1.CloudHealthcare;
import com.google.api.services.healthcare.v1.CloudHealthcare.Projects.Locations.Datasets.Hl7V2Stores;
import com.google.api.services.healthcare.v1.CloudHealthcareScopes;
import com.google.api.services.healthcare.v1.model.Binding;
import com.google.api.services.healthcare.v1.model.Policy;
import com.google.api.services.healthcare.v1.model.SetIamPolicyRequest;
import com.google.auth.http.HttpCredentialsAdapter;
import com.google.auth.oauth2.GoogleCredentials;
import java.io.IOException;
import java.util.Arrays;
import java.util.Collections;

public class Hl7v2StoreSetIamPolicy {
  private static final String HL7v2_NAME = "projects/%s/locations/%s/datasets/%s/hl7V2Stores/%s";
  private static final JsonFactory JSON_FACTORY = new GsonFactory();
  private static final NetHttpTransport HTTP_TRANSPORT = new NetHttpTransport();

  public static void hl7v2StoreSetIamPolicy(String hl7v2StoreName) throws IOException {
    // String hl7v2StoreName =
    //    String.format(
    //        HL7v2_NAME, "your-project-id", "your-region-id", "your-dataset-id", "your-hl7v2-id");

    // Initialize the client, which will be used to interact with the service.
    CloudHealthcare client = createClient();

    // Configure the IAMPolicy to apply to the store.
    // For more information on understanding IAM roles, see the following:
    // https://cloud.google.com/iam/docs/understanding-roles
    Binding binding =
        new Binding()
            .setRole("roles/healthcare.hl7V2Consumer")
            .setMembers(Arrays.asList("domain:google.com"));
    Policy policy = new Policy().setBindings(Arrays.asList(binding));
    SetIamPolicyRequest policyRequest = new SetIamPolicyRequest().setPolicy(policy);

    // Create request and configure any parameters.
    Hl7V2Stores.SetIamPolicy request =
        client
            .projects()
            .locations()
            .datasets()
            .hl7V2Stores()
            .setIamPolicy(hl7v2StoreName, policyRequest);

    // Execute the request and process the results.
    Policy updatedPolicy = request.execute();
    System.out.println("HL7v2 policy has been updated: " + updatedPolicy.toPrettyString());
  }

  private static CloudHealthcare createClient() throws IOException {
    // Use Application Default Credentials (ADC) to authenticate the requests
    // For more information see https://cloud.google.com/docs/authentication/production
    GoogleCredentials credential =
        GoogleCredentials.getApplicationDefault()
            .createScoped(Collections.singleton(CloudHealthcareScopes.CLOUD_PLATFORM));

    // Create a HttpRequestInitializer, which will provide a baseline configuration to all requests.
    HttpRequestInitializer requestInitializer =
        request -> {
          new HttpCredentialsAdapter(credential).initialize(request);
          request.setConnectTimeout(60000); // 1 minute connect timeout
          request.setReadTimeout(60000); // 1 minute read timeout
        };

    // Build the client for interacting with the service.
    return new CloudHealthcare.Builder(HTTP_TRANSPORT, JSON_FACTORY, requestInitializer)
        .setApplicationName("your-application-name")
        .build();
  }
}

Node.js

const google = require('@googleapis/healthcare');
const healthcare = google.healthcare({
  version: 'v1',
  auth: new google.auth.GoogleAuth({
    scopes: ['https://www.googleapis.com/auth/cloud-platform'],
  }),
});

const setHl7v2StoreIamPolicy = async () => {
  // TODO(developer): uncomment these lines before running the sample
  // const cloudRegion = 'us-central1';
  // const projectId = 'adjective-noun-123';
  // const datasetId = 'my-dataset';
  // const dicomStoreId = 'my-dicom-store';
  // const member = 'user:example@gmail.com';
  // const role = 'roles/healthcare.hl7V2StoreViewer';
  const resource_ = `projects/${projectId}/locations/${cloudRegion}/datasets/${datasetId}/hl7V2Stores/${hl7v2StoreId}`;
  const request = {
    resource_,
    resource: {
      policy: {
        bindings: [
          {
            members: member,
            role: role,
          },
        ],
      },
    },
  };

  const hl7v2Store =
    await healthcare.projects.locations.datasets.hl7V2Stores.setIamPolicy(
      request
    );
  console.log(
    'Set HL7v2 store IAM policy:',
    JSON.stringify(hl7v2Store.data, null, 2)
  );
};

setHl7v2StoreIamPolicy();

Python

def set_hl7v2_store_iam_policy(
    project_id, location, dataset_id, hl7v2_store_id, member, role, etag=None
):
    """Sets the IAM policy for the specified HL7v2 store.
        A single member will be assigned a single role. A member can be any of:
        - allUsers, that is, anyone
        - allAuthenticatedUsers, anyone authenticated with a Google account
        - user:email, as in 'user:somebody@example.com'
        - group:email, as in 'group:admins@example.com'
        - domain:domainname, as in 'domain:example.com'
        - serviceAccount:email,
            as in 'serviceAccount:my-other-app@appspot.gserviceaccount.com'
        A role can be any IAM role, such as 'roles/viewer', 'roles/owner',
        or 'roles/editor'.

    See https://github.com/GoogleCloudPlatform/python-docs-samples/tree/main/healthcare/api-client/v1/hl7v2
    before running the sample."""
    # Imports the Google API Discovery Service.
    from googleapiclient import discovery

    api_version = "v1"
    service_name = "healthcare"
    # Returns an authorized API client by discovering the Healthcare API
    # and using GOOGLE_APPLICATION_CREDENTIALS environment variable.
    client = discovery.build(service_name, api_version)

    # TODO(developer): Uncomment these lines and replace with your values.
    # project_id = 'my-project'  # replace with your GCP project ID
    # location = 'us-central1'  # replace with the parent dataset's location
    # dataset_id = 'my-dataset'  # replace with the HL7v2 store's parent dataset
    # hl7v2_store_id = 'my-hl7v2-store'  # replace with the HL7v2 store's ID
    # member = 'myemail@example.com'  # replace with an authorized member
    # role = 'roles/viewer'  # replace with a Healthcare API IAM role
    hl7v2_store_parent = "projects/{}/locations/{}/datasets/{}".format(
        project_id, location, dataset_id
    )
    hl7v2_store_name = f"{hl7v2_store_parent}/hl7V2Stores/{hl7v2_store_id}"

    policy = {"bindings": [{"role": role, "members": [member]}]}

    if etag is not None:
        policy["etag"] = etag

    request = (
        client.projects()
        .locations()
        .datasets()
        .hl7V2Stores()
        .setIamPolicy(resource=hl7v2_store_name, body={"policy": policy})
    )
    response = request.execute()

    print("etag: {}".format(response.get("name")))
    print("bindings: {}".format(response.get("bindings")))
    return response

搭配 Healthcare Natural Language API 使用 IAM

以下各節說明如何取得、修改及設定 Healthcare Natural Language API 的政策。這些章節以以下範例政策為起點：

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.nlpServiceViewer",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com"
      ]
    }
  ]
}

取得政策

下列範例說明如何讀取專案層級的 IAM 政策。詳情請參閱 projects.getIamPolicy 方法。

curl

如要讀取專案的 IAM 政策，請發出 POST 要求，並指定專案名稱和存取權權杖。

以下範例顯示使用 curl 的 POST 要求：

curl -X GET \
     -H "Authorization: Bearer $(gcloud auth application-default print-access-token)" \
     "https://cloudresourcemanager.googleapis.com/v1/projects/PROJECT_ID:getIamPolicy"

回應如下：

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.nlpServiceViewer",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com"
      ]
    }
  ]
}

PowerShell

如要查看專案的 IAM 政策，請發出 POST 要求，並指定專案名稱和存取權權杖。

下列範例顯示如何使用 Windows PowerShell 提出 POST 要求：

$cred = gcloud auth application-default print-access-token
$headers = @{ Authorization = "Bearer $cred" }

Invoke-WebRequest `
  -Method POST `
  -Headers $headers `
  -Uri "https://cloudresourcemanager.googleapis.com/v1/projects/PROJECT_ID:getIamPolicy" | Select-Object -Expand Content

回應如下：

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.nlpServiceViewer",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com"
      ]
    }
  ]
}

控制台

如要查看專案的 IAM 政策，請完成下列步驟：

前往 Google Cloud 控制台的「IAM」頁面。
前往 IAM
如要查看指派給角色的主體，請按一下「角色」，然後展開角色。

gcloud

如要查看專案的 IAM 政策，請執行 gcloud projects get-iam-policy 指令。在要求中指定專案名稱。

gcloud projects get-iam-policy PROJECT_ID

如果要求成功，系統會顯示繫結。

bindings:
- members:
  - serviceAccount:service-account-13@appspot.gserviceaccount.com
  role: roles/healthcare.nlpServiceViewer
etag: bytes
version: VERSION_NUMBER

修改政策

下列範例會將 roles/healthcare.nlpServiceViewer 角色授予服務。詳情請參閱 projects.setIamPolicy 的說明。

設定政策

控制台

如要設定專案層級的 IAM 政策，請完成下列步驟：

前往 Google Cloud 控制台的「IAM」頁面。
前往 IAM
按一下主體旁的「編輯」按鈕，或按一下「新增主體」，然後在「新增主體」欄位中，輸入一或多個需要存取專案的身分。
在「Select a role」(請選擇角色) 清單中，依序選取「Cloud Healthcare」(Cloud Healthcare) 和「Healthcare Natural Language Service Viewer」(Healthcare Natural Language Service 檢視者)。
按一下 [儲存]。

gcloud

透過程式或使用文字編輯器修改擷取的政策，以授予或撤銷使用者的角色。政策變更時，etag 值也會變更，因此您必須指定目前的值。

如要將角色授予新服務帳戶，請將服務帳戶的電子郵件地址新增至 roles/healthcare.nlpServiceViewer 繫結下方的 members 陣列：

{
  "role":"roles/healthcare.nlpServiceViewer",
  "members": [
      "serviceAccount:service-account-13@appspot.gserviceaccount.com",
      "serviceAccount:NEW_SERVICE_ACCOUNT_EMAIL_ADDRESS"
  ]
}

修改政策以授予適用的角色後，請執行 gcloud projects set-iam-policy 指令來進行變更。指定專案和您建立的政策檔案路徑。

gcloud projects set-iam-policy PROJECT_STORE_ID \
    POLICY_FILE_NAME

如果要求成功，系統會顯示專案名稱和繫結。

Updated IAM policy for project [PROJECT_ID].
bindings:
- members:
  - serviceAccount:service-account-13@appspot.gserviceaccount.com
  - serviceAccount:NEW_USER_EMAIL_ADDRESS
  role: roles/healthcare.nlpServiceViewer
etag: bytes
version: VERSION_NUMBER

curl

透過程式或使用文字編輯器修改擷取的政策，以授予或撤銷使用者的角色。政策變更時，etag 值也會變更，因此您必須指定目前的值。

如要將角色授予新服務帳戶，請將服務帳戶的電子郵件地址新增至 roles/healthcare.nlpServiceViewer 繫結下方的 members 陣列：

{
  "role":"roles/healthcare.nlpServiceViewer",
  "members": [
      "serviceAccount:service-account-13@appspot.gserviceaccount.com",
      "serviceAccount:NEW_SERVICE_ACCOUNT_EMAIL_ADDRESS"
  ]
}

修改政策以授予適用的角色後，請呼叫 projects.setIamPolicy 以進行更新。

如要設定專案層級的 IAM 政策，請提出 POST 要求，並指定專案名稱、政策和存取權權杖。

以下範例說明如何使用 curl 提出 POST 要求，將現有的 roles/healthcare.nlpServiceViewer 角色授予新使用者：

政策可以直接寫在要求中 (如下所示)，也可以 JSON 或 YAML 檔案的形式傳遞。如要瞭解如何將政策格式設為 JSON 或 YAML，請參閱Policy。

curl -X POST \
    -H "Authorization: Bearer $(gcloud auth application-default print-access-token)" \
    -H "Content-Type: application/json; charset=utf-8" \
    --data "{
      'policy': {
        'bindings': [
          {
            'role':'roles/healthcare.nlpServiceViewer',
            'members': [
              'serviceAccount:service-account-13@appspot.gserviceaccount.com'
            ]
          }
        ]
      }
    }" "https://cloudresourcemanager.googleapis.com/v1/projects/PROJECT_ID:setIamPolicy"

回應如下：

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.nlpServiceViewer",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com"
      ]
    }
  ]
}

PowerShell

透過程式或使用文字編輯器修改擷取的政策，以授予或撤銷使用者的角色。政策變更時，etag 值也會變更，因此您必須指定目前的值。

如要將角色授予新服務帳戶，請將服務帳戶的電子郵件地址新增至 roles/healthcare.nlpServiceViewer 繫結下方的 members 陣列：

{
  "role":"roles/healthcare.nlpServiceViewer",
  "members": [
      "serviceAccount:service-account-13@appspot.gserviceaccount.com",
      "serviceAccount:NEW_SERVICE_ACCOUNT_EMAIL_ADDRESS"
  ]
}

修改政策以授予適用的角色後，請呼叫 projects.setIamPolicy 以進行更新。

如要設定專案層級的 IAM 政策，請提出 POST 要求，並指定專案名稱、政策和存取權權杖。

以下範例說明如何使用 curl 提出 POST 要求，將現有的 roles/healthcare.nlpServiceViewer 角色授予新使用者：

政策可以直接寫在要求中 (如下所示)，也可以 JSON 或 YAML 檔案的形式傳遞。如要瞭解如何將政策格式設為 JSON 或 YAML，請參閱Policy。

$cred = gcloud auth application-default print-access-token
$headers = @{ Authorization = "Bearer $cred" }

Invoke-WebRequest `
  -Method Post `
  -Headers $headers `
  -ContentType: "application/json; charset=utf-8" `
  -Body "{
    'policy': {
      'bindings': [
        {
          'role': 'roles/healthcare.nlpServiceViewer',
          'members': [
            'serviceAccount:service-account-13@appspot.gserviceaccount.com',
            'serviceAccount:NEW_USER_EMAIL_ADDRESS'
          ]
        }
      ]
    }
  }" `
  -Uri "https://cloudresourcemanager.googleapis.com/v1/projects/PROJECT_ID:setIamPolicy" | Select-Object -Expand Content

回應如下：

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.nlpServiceViewer",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com",
        "serviceAccount:NEW_USER_EMAIL_ADDRESS"
      ]
    }
  ]
}

控管 Cloud Healthcare API 資源的存取權 透過集合功能整理內容 你可以依據偏好儲存及分類內容。

IAM 政策總覽

搭配同意聲明儲存庫使用 IAM

取得政策

控制台

gcloud

Node.js

Python

curl

PowerShell

修改政策

設定政策

控制台

gcloud

Node.js

Python

curl

PowerShell

搭配資料集使用 IAM

取得政策

curl

PowerShell

控制台

gcloud

Go

Java

Node.js

Python

修改政策

設定政策

控制台

gcloud

curl

PowerShell

Go

Java

Node.js

Python

搭配 DICOM 儲存區使用 IAM

取得政策

控制台

gcloud

Go

Java

Node.js

Python

curl

PowerShell

修改政策

設定政策

控制台

gcloud

Go

Java

Node.js

Python

curl

PowerShell

搭配 FHIR 儲存庫使用 IAM

取得政策

控制台

gcloud

Go

Java

Node.js

Python

curl

PowerShell

修改政策

設定政策

控制台

gcloud

Go

Java

Node.js

Python

curl

PowerShell

搭配 HL7v2 儲存庫使用 IAM

取得政策

控管 Cloud Healthcare API 資源的存取權