예를 들어 기본 제공 ID가 있는 Parameter Manager 파라미터를 고려해 보세요. 파라미터는 경우에 따라 올바른 작동을 위해 Secret Manager에 액세스할 필요가 있습니다. 파라미터가 Secret Manager에 액세스하도록 허용하려면 해당 식별자를 사용해서 여기에 Secret Manager 보안 비밀 접근자 역할(roles/secretmanager.secretAccessor)을 부여합니다. 그러면 파라미터가 자동으로 Secret Manager 보안 비밀에 액세스할 수 있습니다.
리소스의 기본 제공 ID를 사용해서는 Compute Engine 인스턴스에서 실행되는 워크로드와 같은 고객 관리 워크로드를 인증할 수 없습니다. 워크로드를 인증해야 할 경우에는 Google의 인증 방법에 설명된 방법 중 하나를 따르세요.
기본 제공 ID가 있는 리소스에 대한 역할 부여
리소스에 기본 제공 ID가 있으면 허용 정책에 리소스의 주 구성원 식별자를 포함하여 리소스에 역할을 부여할 수 있습니다. 각 리소스의 주 구성원 식별자에 사용할 형식을 보려면 단일 리소스의 주 구성원 식별자를 참조하세요.
IAM은 또한 기본 제공 ID가 있는 리소스 집합 중 유형 또는 상위 요소와 같은 특성을 공유하는 그룹에 대해 식별자를 제공합니다. 허용 정책에서 이러한 식별자를 사용하여 여러 리소스에 동일한 역할을 부여할 수 있습니다. 지원되는 형식을 보려면 리소스 집합의 주 구성원 식별자를 참조하세요.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-04(UTC)"],[[["\u003cp\u003eBuilt-in identities allow resources to act as principals, enabling them to be granted IAM roles.\u003c/p\u003e\n"],["\u003cp\u003eResources with built-in identities can access other resources without the need for service agents.\u003c/p\u003e\n"],["\u003cp\u003eYou can grant roles to resources with built-in identities by using the resource's principal identifier in your allow policies.\u003c/p\u003e\n"],["\u003cp\u003eIAM provides principal identifiers for both single resources and sets of resources with built-in identities, allowing for flexible role granting.\u003c/p\u003e\n"],["\u003cp\u003eYou can't use built-in identities for authenticating customer-managed workloads.\u003c/p\u003e\n"]]],[],null,["# Built-in identities for resources\n\nThis page describes built-in identities for resources, which let you grant\nroles to resources in your IAM allow policies.\n\nBuilt-in identities\n-------------------\n\nSome resources have built-in identities. These identities let the resources act\nlike [principals](/iam/docs/principals-overview). As a result, resources with built-in identities\ncan do the following:\n\n- Be [granted IAM roles](/iam/docs/granting-changing-revoking-access) using the [resource's\n principal identifier](/iam/docs/resources-with-built-in-identities)\n- Access other resources without using [service agents](/iam/docs/service-account-types#service-agents)\n\nFor example, consider Parameter Manager parameters, which have built-in\nidentities. Parameters sometimes need access to Secret Manager to\nfunction properly. To let a parameter access Secret Manager, you use\nits identifier to grant it the Secret Manager Secret Accessor role\n(`roles/secretmanager.secretAccessor`). Then, the parameter can access\nSecret Manager secrets on your behalf.\n\nFor a list of resources with built-in identities, see [Resources with built-in\nidentities](/iam/docs/resources-with-built-in-identities).\n\nYou can't use a resource's built-in identity to authenticate customer-managed\nworkloads, like workloads running on Compute Engine instances. If you\nneed to authenticate a workload, use one of the methods described in\n[Authentication methods at Google](/docs/authentication).\n\nGranting roles to resources with built-in identities\n----------------------------------------------------\n\nIf a resource has a built-in identity, you can grant roles to the resource by\nincluding the resource's *principal identifier* in your allow policies. To see\nwhat format to use for each resource's principal identifier, see [Principal\nidentifiers for single resources](/iam/docs/resources-with-built-in-identities#single-resources).\n\nIAM also offers identifiers for sets of resources with built-in\nidentities that share certain characteristics, such as type or ancestor. You can\nuse these identifiers in your allow policies to grant the same role to multiple\nresources. To see what formats are supported, see [Principal identifiers for\nsets of resources](/iam/docs/resources-with-built-in-identities#resource-sets)."]]
