准备工作
创建 Google Cloud 项目
在此快速入门中,您需要一个新的 Google Cloud 项目。
-
登录您的 Google 帐号。
如果您还没有 Google 帐号,请注册新帐号。
-
在 Google Cloud Console 的项目选择器页面上,点击创建以开始创建新的 Google Cloud 项目。
- 启用 Resource Manager API。
- 设置身份验证:
-
在 Cloud Console 中,转到创建服务帐号密钥页面。
转到“创建服务帐号密钥”页面 - 从服务帐号列表中,选择新的服务帐号。
- 在服务帐号名称字段中,输入一个名称。
从角色列表中,选择 Project > Owner。
- 点击创建。包含密钥的 JSON 文件就会下载到计算机。
-
-
将环境变量
GOOGLE_APPLICATION_CREDENTIALS
设置为包含您的服务帐号密钥的 JSON 文件的路径。 此变量仅适用于当前的 shell 会话,因此,如果您打开新的会话,请重新设置该变量。示例:Linux 或 macOS
将 [PATH] 替换为包含您的服务帐号密钥的 JSON 文件的路径。
export GOOGLE_APPLICATION_CREDENTIALS="[PATH]"
例如:
export GOOGLE_APPLICATION_CREDENTIALS="/home/user/Downloads/service-account-file.json"
示例:Windows
将 [PATH] 替换为包含您的服务帐号密钥的 JSON 文件的路径。
使用 PowerShell:
$env:GOOGLE_APPLICATION_CREDENTIALS="[PATH]"
例如:
$env:GOOGLE_APPLICATION_CREDENTIALS="C:\Users\username\Downloads\my-key.json"
使用命令提示符:
set GOOGLE_APPLICATION_CREDENTIALS=[PATH]
安装客户端库
C#
如需详细了解如何设置 C# 开发环境,请参阅 C# 开发环境设置指南。
install-package Google.Apis.Iam.v1 install-package Google.Apis.CloudResourceManager.v1
Go
go get -u golang.org/x/oauth2/google go get -u google.golang.org/api/cloudresourcemanager/v1
Java
如需详细了解如何设置 Java 开发环境,请参阅 Java 开发环境设置指南。
如果您使用的是 Maven,请将其添加到您的pom.xml
文件中。
<dependency>
<groupId>com.google.apis</groupId>
<artifactId>google-api-services-cloudresourcemanager</artifactId>
<version>v1-rev20210215-1.31.0</version><!-- v1 required here, v2 is different - DO NOT UPDATE to v2 -->
</dependency>
<dependency>
<groupId>com.google.auth</groupId>
<artifactId>google-auth-library-oauth2-http</artifactId>
<version>0.23.0</version>
</dependency>
<dependency>
<groupId>com.google.apis</groupId>
<artifactId>google-api-services-iam</artifactId>
<version>v1-rev20210211-1.31.0</version>
</dependency>
Python
如需详细了解如何设置 Python 开发环境,请参阅 Python 开发环境设置指南。
pip install --upgrade google-api-python-client google-auth google-auth-httplib2
读取、修改和编写 IAM 政策
本快速入门中的代码段会执行以下操作:
- 初始化用于管理 Google Cloud 项目的 Resource Manager 服务。
- 读取项目的 IAM 政策。
- 通过将 Log Writer 角色 (
roles/logging.logWriter
) 授予您的 Google 帐号来修改 IAM 政策。 - 写入更新后的 IAM 政策。
- 输出项目中具有 Log Writer 角色 (
roles/logging.logWriter
) 的所有成员。 - 撤消 Log Writer 角色。
在运行代码段之前替换以下值:
your-project
:您的项目的 ID。your-member
:您的 Google 帐号的电子邮件地址和前缀user:
的组合。例如user:tanya@example.com
。
C#
如需了解详情,请参阅 Resource Manager C# API 参考文档。
using Google.Apis.Auth.OAuth2;
using Google.Apis.CloudResourceManager.v1;
using Google.Apis.CloudResourceManager.v1.Data;
using Google.Apis.Iam.v1;
using System;
using System.Collections.Generic;
using System.Linq;
public class QuickStart
{
public static void Main(string[] args)
{
// TODO: Replace with your project ID
var projectId = "your-project";
// TODO: Replace with the ID of your member in the form "user:member@example.com"
var member = "your-member";
// Role to be granted
var role = "roles/logging.logWriter";
// Initialize service
CloudResourceManagerService crmService = InitializeService();
// Grant your member the "Log Writer" role for your project
AddBinding(crmService, projectId, member, role);
// Get the project's policy and print all members with the the "Log Writer" role
var policy = GetPolicy(crmService, projectId);
var binding = policy.Bindings.FirstOrDefault(x => x.Role == role);
Console.WriteLine("Role: " + binding.Role);
Console.Write("Members: ");
foreach (var m in binding.Members)
{
Console.Write("[" + m + "] ");
}
Console.WriteLine();
// Remove member from the "Log Writer" role
RemoveMember(crmService, projectId, member, role);
}
public static CloudResourceManagerService InitializeService()
{
// Get credentials
var credential = GoogleCredential.GetApplicationDefault()
.CreateScoped(IamService.Scope.CloudPlatform);
// Create the Cloud Resource Manager service object
CloudResourceManagerService crmService = new CloudResourceManagerService(
new CloudResourceManagerService.Initializer
{
HttpClientInitializer = credential
});
return crmService;
}
public static Policy GetPolicy(CloudResourceManagerService crmService, String projectId)
{
// Get the project's policy by calling the
// Cloud Resource Manager Projects API
var policy = crmService.Projects.GetIamPolicy(
new GetIamPolicyRequest(),
projectId).Execute();
return policy;
}
public static void SetPolicy(CloudResourceManagerService crmService, String projectId, Policy policy)
{
// Set the project's policy by calling the
// Cloud Resource Manager Projects API
crmService.Projects.SetIamPolicy(
new SetIamPolicyRequest
{
Policy = policy
}, projectId).Execute();
}
public static void AddBinding(
CloudResourceManagerService crmService,
string projectId,
string member,
string role)
{
// Get the project's policy
var policy = GetPolicy(crmService, projectId);
// Find binding in policy
var binding = policy.Bindings.FirstOrDefault(x => x.Role == role);
// If binding already exists, add member to binding
if (binding != null)
{
binding.Members.Add(member);
}
// If binding does not exist, add binding to policy
else
{
binding = new Binding
{
Role = role,
Members = new List<string> { member }
};
policy.Bindings.Add(binding);
}
// Set the updated policy
SetPolicy(crmService, projectId, policy);
}
public static void RemoveMember(
CloudResourceManagerService crmService,
string projectId,
string member,
string role)
{
// Get the project's policy
var policy = GetPolicy(crmService, projectId);
// Remove the member from the role
var binding = policy.Bindings.FirstOrDefault(x => x.Role == role);
if (binding == null)
{
Console.WriteLine("Role does not exist in policy.");
}
else
{
if (binding.Members.Contains(member))
{
binding.Members.Remove(member);
}
else
{
Console.WriteLine("The member has not been granted this role.");
}
if (binding.Members.Count == 0)
{
policy.Bindings.Remove(binding);
}
}
// Set the updated policy
SetPolicy(crmService, projectId, policy);
}
}
Go
如需了解详情,请参阅 Resource Manager Go API 参考文档。
package main
import (
"context"
"flag"
"fmt"
"log"
"strings"
"time"
"google.golang.org/api/cloudresourcemanager/v1"
)
func main() {
// TODO: Add your project ID
projectID := flag.String("project_id", "", "Cloud Project ID")
// TODO: Add the ID of your member in the form "user:member@example.com"
member := flag.String("member_id", "", "Your member ID")
flag.Parse()
// The role to be granted
var role string = "roles/logging.logWriter"
// Initializes the Cloud Resource Manager service
ctx := context.Background()
crmService, err := cloudresourcemanager.NewService(ctx)
if err != nil {
log.Fatalf("cloudresourcemanager.NewService: %v", err)
}
// Grants your member the "Log writer" role for your project
addBinding(crmService, *projectID, *member, role)
// Gets the project's policy and prints all members with the "Log Writer" role
policy := getPolicy(crmService, *projectID)
// Find the policy binding for role. Only one binding can have the role.
var binding *cloudresourcemanager.Binding
for _, b := range policy.Bindings {
if b.Role == role {
binding = b
break
}
}
fmt.Println("Role: ", binding.Role)
fmt.Print("Members: ", strings.Join(binding.Members, ", "))
// Removes member from the "Log writer" role
removeMember(crmService, *projectID, *member, role)
}
// addBinding adds the member to the project's IAM policy
func addBinding(crmService *cloudresourcemanager.Service, projectID, member, role string) {
policy := getPolicy(crmService, projectID)
// Find the policy binding for role. Only one binding can have the role.
var binding *cloudresourcemanager.Binding
for _, b := range policy.Bindings {
if b.Role == role {
binding = b
break
}
}
if binding != nil {
// If the binding exists, adds the member to the binding
binding.Members = append(binding.Members, member)
} else {
// If the binding does not exist, adds a new binding to the policy
binding = &cloudresourcemanager.Binding{
Role: role,
Members: []string{member},
}
policy.Bindings = append(policy.Bindings, binding)
}
setPolicy(crmService, projectID, policy)
}
// removeMember removes the member from the project's IAM policy
func removeMember(crmService *cloudresourcemanager.Service, projectID, member, role string) {
policy := getPolicy(crmService, projectID)
// Find the policy binding for role. Only one binding can have the role.
var binding *cloudresourcemanager.Binding
var bindingIndex int
for i, b := range policy.Bindings {
if b.Role == role {
binding = b
bindingIndex = i
break
}
}
// Order doesn't matter for bindings or members, so to remove, move the last item
// into the removed spot and shrink the slice.
if len(binding.Members) == 1 {
// If the member is the only member in the binding, removes the binding
last := len(policy.Bindings) - 1
policy.Bindings[bindingIndex] = policy.Bindings[last]
policy.Bindings = policy.Bindings[:last]
} else {
// If there is more than one member in the binding, removes the member
var memberIndex int
for i, mm := range binding.Members {
if mm == member {
memberIndex = i
}
}
last := len(policy.Bindings[bindingIndex].Members) - 1
binding.Members[memberIndex] = binding.Members[last]
binding.Members = binding.Members[:last]
}
setPolicy(crmService, projectID, policy)
}
// getPolicy gets the project's IAM policy
func getPolicy(crmService *cloudresourcemanager.Service, projectID string) *cloudresourcemanager.Policy {
ctx := context.Background()
ctx, cancel := context.WithTimeout(ctx, time.Second*10)
defer cancel()
request := new(cloudresourcemanager.GetIamPolicyRequest)
policy, err := crmService.Projects.GetIamPolicy(projectID, request).Do()
if err != nil {
log.Fatalf("Projects.GetIamPolicy: %v", err)
}
return policy
}
// setPolicy sets the project's IAM policy
func setPolicy(crmService *cloudresourcemanager.Service, projectID string, policy *cloudresourcemanager.Policy) {
ctx := context.Background()
ctx, cancel := context.WithTimeout(ctx, time.Second*10)
defer cancel()
request := new(cloudresourcemanager.SetIamPolicyRequest)
request.Policy = policy
policy, err := crmService.Projects.SetIamPolicy(projectID, request).Do()
if err != nil {
log.Fatalf("Projects.SetIamPolicy: %v", err)
}
}
Java
如需了解详情,请参阅 Resource Manager Java API 参考文档。
import com.google.api.client.googleapis.javanet.GoogleNetHttpTransport;
import com.google.api.client.json.jackson2.JacksonFactory;
import com.google.api.services.cloudresourcemanager.CloudResourceManager;
import com.google.api.services.cloudresourcemanager.model.Binding;
import com.google.api.services.cloudresourcemanager.model.GetIamPolicyRequest;
import com.google.api.services.cloudresourcemanager.model.Policy;
import com.google.api.services.cloudresourcemanager.model.SetIamPolicyRequest;
import com.google.api.services.iam.v1.IamScopes;
import com.google.auth.http.HttpCredentialsAdapter;
import com.google.auth.oauth2.GoogleCredentials;
import java.io.IOException;
import java.security.GeneralSecurityException;
import java.util.Collections;
import java.util.List;
public class Quickstart {
public static void main(String[] args) {
// TODO: Replace with your project ID.
String projectId = "your-project";
// TODO: Replace with the ID of your member in the form "user:member@example.com"
String member = "your-member";
// The role to be granted.
String role = "roles/logging.logWriter";
// Initializes the Cloud Resource Manager service.
CloudResourceManager crmService = null;
try {
crmService = initializeService();
} catch (IOException | GeneralSecurityException e) {
System.out.println("Unable to initialize service: \n" + e.getMessage() + e.getStackTrace());
}
// Grants your member the "Log writer" role for your project.
addBinding(crmService, projectId, member, role);
// Get the project's policy and print all members with the "Log Writer" role
Policy policy = getPolicy(crmService, projectId);
Binding binding = null;
List<Binding> bindings = policy.getBindings();
for (Binding b : bindings) {
if (b.getRole().equals(role)) {
binding = b;
break;
}
}
System.out.println("Role: " + binding.getRole());
System.out.print("Members: ");
for (String m : binding.getMembers()) {
System.out.print("[" + m + "] ");
}
System.out.println();
// Removes member from the "Log writer" role.
removeMember(crmService, projectId, member, role);
}
public static CloudResourceManager initializeService()
throws IOException, GeneralSecurityException {
// Use the Application Default Credentials strategy for authentication. For more info, see:
// https://cloud.google.com/docs/authentication/production#finding_credentials_automatically
GoogleCredentials credential =
GoogleCredentials.getApplicationDefault()
.createScoped(Collections.singleton(IamScopes.CLOUD_PLATFORM));
// Creates the Cloud Resource Manager service object.
CloudResourceManager service =
new CloudResourceManager.Builder(
GoogleNetHttpTransport.newTrustedTransport(),
JacksonFactory.getDefaultInstance(),
new HttpCredentialsAdapter(credential))
.setApplicationName("iam-quickstart")
.build();
return service;
}
public static void addBinding(
CloudResourceManager crmService, String projectId, String member, String role) {
// Gets the project's policy.
Policy policy = getPolicy(crmService, projectId);
// Finds binding in policy, if it exists
Binding binding = null;
for (Binding b : policy.getBindings()) {
if (b.getRole().equals(role)) {
binding = b;
break;
}
}
if (binding != null) {
// If binding already exists, adds member to binding.
binding.getMembers().add(member);
} else {
// If binding does not exist, adds binding to policy.
binding = new Binding();
binding.setRole(role);
binding.setMembers(Collections.singletonList(member));
policy.getBindings().add(binding);
}
// Sets the updated policy
setPolicy(crmService, projectId, policy);
}
public static void removeMember(
CloudResourceManager crmService, String projectId, String member, String role) {
// Gets the project's policy.
Policy policy = getPolicy(crmService, projectId);
// Removes the member from the role.
Binding binding = null;
for (Binding b : policy.getBindings()) {
if (b.getRole().equals(role)) {
binding = b;
break;
}
}
if (binding.getMembers().contains(member)) {
binding.getMembers().remove(member);
if (binding.getMembers().isEmpty()) {
policy.getBindings().remove(binding);
}
}
// Sets the updated policy.
setPolicy(crmService, projectId, policy);
}
public static Policy getPolicy(CloudResourceManager crmService, String projectId) {
// Gets the project's policy by calling the
// Cloud Resource Manager Projects API.
Policy policy = null;
try {
GetIamPolicyRequest request = new GetIamPolicyRequest();
policy = crmService.projects().getIamPolicy(projectId, request).execute();
} catch (IOException e) {
System.out.println("Unable to get policy: \n" + e.getMessage() + e.getStackTrace());
}
return policy;
}
private static void setPolicy(CloudResourceManager crmService, String projectId, Policy policy) {
// Sets the project's policy by calling the
// Cloud Resource Manager Projects API.
try {
SetIamPolicyRequest request = new SetIamPolicyRequest();
request.setPolicy(policy);
crmService.projects().setIamPolicy(projectId, request).execute();
} catch (IOException e) {
System.out.println("Unable to set policy: \n" + e.getMessage() + e.getStackTrace());
}
}
}
Python
如需了解详情,请参阅 Resource Manager Python API 参考文档。
import os
from google.oauth2 import service_account
import googleapiclient.discovery
def quickstart(project_id, member):
"""Gets a policy, adds a member, prints their permissions, and removes the member."""
# Role to be granted.
role = "roles/logging.logWriter"
# Initializes service.
crm_service = initialize_service()
# Grants your member the 'Log Writer' role for the project.
modify_policy_add_role(crm_service, project_id, role, member)
# Gets the project's policy and prints all members with the 'Log Writer' role.
policy = get_policy(crm_service, project_id)
binding = next(b for b in policy["bindings"] if b["role"] == role)
print(f'Role: {(binding["role"])}')
print("Members: ")
for m in binding["members"]:
print(f'[{m}]')
# Removes the member from the 'Log Writer' role.
modify_policy_remove_member(crm_service, project_id, role, member)
def initialize_service():
"""Initializes a Cloud Resource Manager service."""
credentials = service_account.Credentials.from_service_account_file(
filename=os.environ["GOOGLE_APPLICATION_CREDENTIALS"],
scopes=["https://www.googleapis.com/auth/cloud-platform"],
)
crm_service = googleapiclient.discovery.build(
"cloudresourcemanager", "v1", credentials=credentials
)
return crm_service
def modify_policy_add_role(crm_service, project_id, role, member):
"""Adds a new role binding to a policy."""
policy = get_policy(crm_service, project_id)
binding = None
for b in policy["bindings"]:
if b["role"] == role:
binding = b
break
if binding is not None:
binding["members"].append(member)
else:
binding = {"role": role, "members": [member]}
policy["bindings"].append(binding)
set_policy(crm_service, project_id, policy)
def modify_policy_remove_member(crm_service, project_id, role, member):
"""Removes a member from a role binding."""
policy = get_policy(crm_service, project_id)
binding = next(b for b in policy["bindings"] if b["role"] == role)
if "members" in binding and member in binding["members"]:
binding["members"].remove(member)
set_policy(crm_service, project_id, policy)
def get_policy(crm_service, project_id, version=3):
"""Gets IAM policy for a project."""
policy = (
crm_service.projects()
.getIamPolicy(
resource=project_id,
body={"options": {"requestedPolicyVersion": version}},
)
.execute()
)
return policy
def set_policy(crm_service, project_id, policy):
"""Sets IAM policy for a project."""
policy = (
crm_service.projects()
.setIamPolicy(resource=project_id, body={"policy": policy})
.execute()
)
return policy
if __name__ == '__main__':
# TODO: replace with your project ID
project_id = "your-project-id"
# TODO: Replace with the ID of your member in the form 'user:member@example.com'.
member = "your-member"
quickstart(project_id, member)
恭喜!您使用了 Resource Manager API 中的 IAM 方法来修改项目的访问权限。
结果怎么样?
清理
- 使用 Cloud Console 删除不需要的项目。
后续步骤
- 了解 IAM 的工作原理。
- 详细了解如何授予、更改和撤消访问权限。
- 使用政策问题排查工具排查访问权限问题。