Nesta página, descrevemos os papéis do IAM e listamos os papéis predefinidos que você pode conceder aos principais.
Um papel contém um conjunto de permissões que permitem realizar ações específicas nos recursos do Google Cloud. Para disponibilizar as permissões aos principais, incluindo usuários, grupos e contas de serviço, conceda papéis aos principais.
Pré-requisito para este guia
- Entenda os conceitos básicos do IAM
Tipos de papel
Existem três tipos de papéis no IAM:
- Papéis básicos, que incluem os de proprietário, editor e visualizador que existiam antes da introdução do IAM.
- Papéis predefinidos, que fornecem acesso granular a um serviço específico e são gerenciados pelo Google Cloud.
- Papéis personalizados, que fornecem acesso granular de acordo com uma lista de permissões especificada pelo usuário.
Para determinar se uma permissão está incluída em um papel básico, predefinido ou personalizado, use um dos métodos a seguir:
- Execute o comando
gcloud iam roles describe
para listar as permissões do papel. - Chame o método da API REST
roles.get()
para listar as permissões do papel. - Apenas para papéis básicos e predefinidos: pesquise a referência de permissões para ver se a permissão foi concedida pelo papel.
- Somente para papéis predefinidos: pesquise as descrições de papel predefinidas nesta página para ver quais permissões o papel inclui.
As seções abaixo descrevem cada tipo de papel e fornecem exemplos de como usá-los.
Papéis básicos
Há vários papéis básicos que existiam antes da introdução do IAM: proprietário, editor e visualizador. Esses papéis são concêntricos, isto é, o de Proprietário inclui as permissões no papel de Editor, e este no de Leitor. Esses papéis eram conhecidos anteriormente como "papéis primários".
A tabela a seguir resume as permissões que os papéis básicos têm em todos os serviços do Google Cloud:
Definições dos papéis básicos
Nome | Título | Permissões |
---|---|---|
roles/viewer |
Leitor | Permissões para ações somente leitura que não afetam o estado, como ver (mas não modificar) recursos ou dados existentes. |
roles/editor |
Editor | Todas as permissões do leitor e as permissões para ações que modificam o estado, como a alteração de recursos atuais. Observação:
o papel de editor contém permissões para criar e excluir recursos
para a maioria dos serviços do Google Cloud. No entanto, ele não contém
permissões para executar todas as ações de todos os serviços. Para mais informações sobre como verificar se um papel tem as permissões necessárias, consulte Tipos de papel nesta página.
|
roles/owner |
Proprietário |
Todas as permissões de editor e também para as seguintes ações:
Observação:
|
É possível conceder papéis básicos com o Console do Google Cloud, a API e a CLI gcloud. Para conceder papéis básicos em um projeto, pasta ou organização, consulte Gerenciar o acesso a projetos, pastas e organizações. Para conceder papéis básicos em outros recursos, consulte Gerenciar o acesso a outros recursos.
Papéis predefinidos
Além dos papéis básicos, o IAM fornece outros papéis predefinidos que dão acesso granular a recursos específicos do Google Cloud e impedem o acesso indesejado a outros recursos. Esses papéis são criados e mantidos pelo Google. O Google atualiza automaticamente as permissões conforme necessário, como quando o Google Cloud adiciona novos recursos ou serviços.
A tabela a seguir lista esses papéis, as respectivas descrições e o tipo de recurso de menor nível em que os papéis podem ser configurados. Um papel específico pode ser concedido a esse tipo de recurso ou, na maioria dos casos, a qualquer tipo acima dele na hierarquia de recursos do Google Cloud.
É possível conceder vários papéis ao mesmo usuário, em qualquer nível da hierarquia de recursos. Por exemplo: é possível que o mesmo usuário tenha os papéis de administrador de rede do Compute e de visualizador de registros em um projeto, além do papel de editor do Pub/Sub em um tópico do Pub/Sub nesse projeto. Para listar as permissões contidas em um papel, consulte Como obter os metadados do papel.
Para receber ajuda para escolher os papéis predefinidos mais apropriados, consulte Escolher papéis predefinidos.
Papéis do Access Approval
Papel | Permissões |
---|---|
Aprovador de acesso( Capacidade de visualizar ou agir em solicitações de aprovação de acesso e ver as configurações |
accessapproval.requests.*
accessapproval. accessapproval.settings.get resourcemanager.projects.get resourcemanager.projects.list |
Editor de configuração da aprovação de acesso( Capacidade de atualizar a configuração de aprovação de acesso |
accessapproval. accessapproval.settings.*
resourcemanager.projects.get resourcemanager.projects.list |
Invalidador de aprovação de acesso( Poder para invalidar atuais solicitações de aprovação confirmadas |
accessapproval. accessapproval. accessapproval.settings.get resourcemanager.projects.get resourcemanager.projects.list |
Leitor de aprovação de acesso( Capacidade de visualizar solicitações de aprovação de acesso e a configuração |
accessapproval.requests.get accessapproval.requests.list accessapproval. accessapproval.settings.get resourcemanager.projects.get resourcemanager.projects.list |
Papéis do Access Context Manager
Role | Permissions |
---|---|
Cloud Access Binding Admin( Create, edit, and change Cloud access bindings. |
accesscontextmanager.
|
Cloud Access Binding Reader( Read access to Cloud access bindings. |
accesscontextmanager. accesscontextmanager. |
Access Context Manager Admin( Full access to policies, access levels, access zones and authorized orgs descs. |
accesscontextmanager.
accesscontextmanager.
accesscontextmanager.
accesscontextmanager.
accesscontextmanager.
accesscontextmanager.
cloudasset. resourcemanager. resourcemanager.projects.get resourcemanager.projects.list |
Access Context Manager Editor( Edit access to policies. Create, edit, and change access levels, access zones and authorized orgs descs. |
accesscontextmanager.
accesscontextmanager. accesscontextmanager. accesscontextmanager. accesscontextmanager. accesscontextmanager. accesscontextmanager.
accesscontextmanager.
accesscontextmanager.
accesscontextmanager. accesscontextmanager. accesscontextmanager. accesscontextmanager. accesscontextmanager. accesscontextmanager.
accesscontextmanager.
cloudasset. resourcemanager. resourcemanager.projects.get resourcemanager.projects.list |
Access Context Manager Reader( Read access to policies, access levels, access zones and authorized orgs descs. |
accesscontextmanager. accesscontextmanager. accesscontextmanager. accesscontextmanager. accesscontextmanager. accesscontextmanager. accesscontextmanager. accesscontextmanager. accesscontextmanager. accesscontextmanager. accesscontextmanager. accesscontextmanager. accesscontextmanager. accesscontextmanager. resourcemanager. resourcemanager.projects.get resourcemanager.projects.list |
VPC Service Controls Troubleshooter Viewer(
|
accesscontextmanager. accesscontextmanager. accesscontextmanager. accesscontextmanager. accesscontextmanager. accesscontextmanager. accesscontextmanager. accesscontextmanager. accesscontextmanager. logging.exclusions.get logging.exclusions.list logging.logEntries.list logging.logMetrics.get logging.logMetrics.list logging.logServiceIndexes.list logging.logServices.list logging.logs.list logging.sinks.get logging.sinks.list logging.usage.get resourcemanager. resourcemanager.projects.get resourcemanager.projects.list |
Papéis de ações
Role | Permissions |
---|---|
Actions Admin( Access to edit and deploy an action |
actions.*
firebase.projects.get firebase.projects.update resourcemanager.projects.get resourcemanager.projects.list serviceusage.services.use |
Actions Viewer( Access to view an action |
actions.agent.get actions.agentVersions.get actions.agentVersions.list firebase.projects.get resourcemanager.projects.get resourcemanager.projects.list serviceusage.services.use |
Papéis dos notebooks de IA
Role | Permissions |
---|---|
Notebooks Admin( Full access to Notebooks, all resources. Lowest-level resources where you can grant this role:
|
compute.acceleratorTypes.*
compute.addresses.get compute.addresses.list compute.autoscalers.get compute.autoscalers.list compute.backendBuckets.get compute. compute.backendBuckets.list compute. compute. compute.backendServices.get compute. compute.backendServices.list compute. compute. compute.commitments.get compute.commitments.list compute.diskTypes.*
compute.disks.get compute.disks.getIamPolicy compute.disks.list compute. compute.disks.listTagBindings compute. compute. compute.firewallPolicies.get compute. compute.firewallPolicies.list compute. compute. compute.firewalls.get compute.firewalls.list compute. compute. compute.forwardingRules.get compute.forwardingRules.list compute. compute. compute.futureReservations.get compute. compute. compute.globalAddresses.get compute.globalAddresses.list compute. compute. compute. compute. compute. compute. compute. compute. compute. compute.globalOperations.get compute. compute.globalOperations.list compute. compute. compute.healthChecks.get compute.healthChecks.list compute. compute. compute.httpHealthChecks.get compute.httpHealthChecks.list compute. compute. compute.httpsHealthChecks.get compute.httpsHealthChecks.list compute. compute. compute.images.get compute.images.getFromFamily compute.images.getIamPolicy compute.images.list compute. compute.images.listTagBindings compute. compute. compute.instanceGroups.get compute.instanceGroups.list compute.instanceTemplates.get compute. compute.instanceTemplates.list compute.instances.get compute. compute. compute.instances.getIamPolicy compute. compute. compute. compute. compute.instances.list compute. compute. compute. compute.instantSnapshots.get compute. compute.instantSnapshots.list compute. compute.
compute.
compute.
compute.interconnects.get compute.interconnects.list compute.licenseCodes.get compute. compute.licenseCodes.list compute.licenses.get compute.licenses.getIamPolicy compute.licenses.list compute.machineImages.get compute. compute.machineImages.list compute.machineTypes.*
compute. compute. compute. compute.networkAttachments.get compute. compute. compute. compute. compute. compute. compute. compute. compute. compute.networks.get compute. compute. compute.networks.list compute. compute. compute. compute.nodeGroups.get compute. compute.nodeGroups.list compute.nodeTemplates.get compute. compute.nodeTemplates.list compute.nodeTypes.*
compute. compute.packetMirrorings.get compute.packetMirrorings.list compute.projects.get compute. compute. compute. compute. compute. compute. compute. compute. compute. compute. compute. compute. compute. compute. compute. compute. compute.regionHealthChecks.get compute. compute. compute. compute. compute. compute. compute. compute. compute. compute.regionOperations.get compute. compute.regionOperations.list compute. compute. compute. compute. compute. compute. compute. compute. compute.regionSslPolicies.get compute.regionSslPolicies.list compute. compute. compute. compute. compute. compute. compute. compute. compute. compute. compute. compute.regionUrlMaps.get compute.regionUrlMaps.list compute. compute. compute.regionUrlMaps.validate compute.regions.*
compute.reservations.get compute.reservations.list compute.resourcePolicies.get compute. compute.resourcePolicies.list compute.routers.get compute.routers.list compute.routes.get compute.routes.list compute. compute.routes.listTagBindings compute.securityPolicies.get compute. compute.securityPolicies.list compute. compute. compute.serviceAttachments.get compute. compute. compute.snapshots.get compute.snapshots.getIamPolicy compute.snapshots.list compute. compute. compute.sslCertificates.get compute.sslCertificates.list compute. compute. compute.sslPolicies.get compute.sslPolicies.list compute. compute. compute. compute.subnetworks.get compute. compute.subnetworks.list compute. compute. compute.targetGrpcProxies.get compute.targetGrpcProxies.list compute.targetHttpProxies.get compute.targetHttpProxies.list compute. compute. compute.targetHttpsProxies.get compute. compute. compute. compute.targetInstances.get compute.targetInstances.list compute. compute. compute.targetPools.get compute.targetPools.list compute. compute. compute.targetSslProxies.get compute.targetSslProxies.list compute. compute. compute.targetTcpProxies.get compute.targetTcpProxies.list compute. compute. compute.targetVpnGateways.get compute.targetVpnGateways.list compute.urlMaps.get compute.urlMaps.list compute. compute. compute.urlMaps.validate compute.vpnGateways.get compute.vpnGateways.list compute.vpnTunnels.get compute.vpnTunnels.list compute.zoneOperations.get compute. compute.zoneOperations.list compute.zones.*
notebooks.*
resourcemanager.projects.get resourcemanager.projects.list serviceusage.quotas.get serviceusage.services.get serviceusage.services.list |
Notebooks Legacy Admin( Full access to Notebooks all resources through compute API. |
compute.*
notebooks.*
resourcemanager.projects.get resourcemanager.projects.list serviceusage.quotas.get serviceusage.services.get serviceusage.services.list |
Notebooks Legacy Viewer( Read-only access to Notebooks all resources through compute API. |
compute.acceleratorTypes.*
compute.addresses.get compute.addresses.list compute.autoscalers.get compute.autoscalers.list compute.backendBuckets.get compute. compute.backendBuckets.list compute. compute. compute.backendServices.get compute. compute.backendServices.list compute. compute. compute.commitments.get compute.commitments.list compute.diskTypes.*
compute.disks.get compute.disks.getIamPolicy compute.disks.list compute. compute.disks.listTagBindings compute. compute. compute.firewallPolicies.get compute. compute.firewallPolicies.list compute. compute. compute.firewalls.get compute.firewalls.list compute. compute. compute.forwardingRules.get compute.forwardingRules.list compute. compute. compute.futureReservations.get compute. compute. compute.globalAddresses.get compute.globalAddresses.list compute. compute. compute. compute. compute. compute. compute. compute. compute. compute.globalOperations.get compute. compute.globalOperations.list compute. compute. compute.healthChecks.get compute.healthChecks.list compute. compute. compute.httpHealthChecks.get compute.httpHealthChecks.list compute. compute. compute.httpsHealthChecks.get compute.httpsHealthChecks.list compute. compute. compute.images.get compute.images.getFromFamily compute.images.getIamPolicy compute.images.list compute. compute.images.listTagBindings compute. compute. compute.instanceGroups.get compute.instanceGroups.list compute.instanceTemplates.get compute. compute.instanceTemplates.list compute.instances.get compute. compute. compute.instances.getIamPolicy compute. compute. compute. compute. compute.instances.list compute. compute. compute. compute.instantSnapshots.get compute. compute.instantSnapshots.list compute. compute.
compute.
compute.
compute.interconnects.get compute.interconnects.list compute.licenseCodes.get compute. compute.licenseCodes.list compute.licenses.get compute.licenses.getIamPolicy compute.licenses.list compute.machineImages.get compute. compute.machineImages.list compute.machineTypes.*
compute. compute. compute. compute.networkAttachments.get compute. compute. compute. compute. compute. compute. compute. compute. compute. compute.networks.get compute. compute. compute.networks.list compute. compute. compute. compute.nodeGroups.get compute. compute.nodeGroups.list compute.nodeTemplates.get compute. compute.nodeTemplates.list compute.nodeTypes.*
compute. compute.packetMirrorings.get compute.packetMirrorings.list compute.projects.get compute. compute. compute. compute. compute. compute. compute. compute. compute. compute. compute. compute. compute. compute. compute. compute. compute.regionHealthChecks.get compute. compute. compute. compute. compute. compute. compute. compute. compute. compute.regionOperations.get compute. compute.regionOperations.list compute. compute. compute. compute. compute. compute. compute. compute. compute.regionSslPolicies.get compute.regionSslPolicies.list compute. compute. compute. compute. compute. compute. compute. compute. compute. compute. compute. compute.regionUrlMaps.get compute.regionUrlMaps.list compute. compute. compute.regionUrlMaps.validate compute.regions.*
compute.reservations.get compute.reservations.list compute.resourcePolicies.get compute. compute.resourcePolicies.list compute.routers.get compute.routers.list compute.routes.get compute.routes.list compute. compute.routes.listTagBindings compute.securityPolicies.get compute. compute.securityPolicies.list compute. compute. compute.serviceAttachments.get compute. compute. compute.snapshots.get compute.snapshots.getIamPolicy compute.snapshots.list compute. compute. compute.sslCertificates.get compute.sslCertificates.list compute. compute. compute.sslPolicies.get compute.sslPolicies.list compute. compute. compute. compute.subnetworks.get compute. compute.subnetworks.list compute. compute. compute.targetGrpcProxies.get compute.targetGrpcProxies.list compute.targetHttpProxies.get compute.targetHttpProxies.list compute. compute. compute.targetHttpsProxies.get compute. compute. compute. compute.targetInstances.get compute.targetInstances.list compute. compute. compute.targetPools.get compute.targetPools.list compute. compute. compute.targetSslProxies.get compute.targetSslProxies.list compute. compute. compute.targetTcpProxies.get compute.targetTcpProxies.list compute. compute. compute.targetVpnGateways.get compute.targetVpnGateways.list compute.urlMaps.get compute.urlMaps.list compute. compute. compute.urlMaps.validate compute.vpnGateways.get compute.vpnGateways.list compute.vpnTunnels.get compute.vpnTunnels.list compute.zoneOperations.get compute. compute.zoneOperations.list compute.zones.*
notebooks.environments.get notebooks. notebooks.environments.list notebooks.executions.get notebooks. notebooks.executions.list notebooks. notebooks.instances.get notebooks.instances.getHealth notebooks. notebooks.instances.list notebooks.locations.*
notebooks.operations.get notebooks.operations.list notebooks.runtimes.get notebooks. notebooks.runtimes.list notebooks.schedules.get notebooks. notebooks.schedules.list resourcemanager.projects.get resourcemanager.projects.list serviceusage.quotas.get serviceusage.services.get serviceusage.services.list |
Notebooks Runner( Restricted access for running scheduled Notebooks. |
compute.acceleratorTypes.*
compute.addresses.get compute.addresses.list compute.autoscalers.get compute.autoscalers.list compute.backendBuckets.get compute. compute.backendBuckets.list compute. compute. compute.backendServices.get compute. compute.backendServices.list compute. compute. compute.commitments.get compute.commitments.list compute.diskTypes.*
compute.disks.get compute.disks.getIamPolicy compute.disks.list compute. compute.disks.listTagBindings compute. compute. compute.firewallPolicies.get compute. compute.firewallPolicies.list compute. compute. compute.firewalls.get compute.firewalls.list compute. compute. compute.forwardingRules.get compute.forwardingRules.list compute. compute. compute.futureReservations.get compute. compute. compute.globalAddresses.get compute.globalAddresses.list compute. compute. compute. compute. compute. compute. compute. compute. compute. compute.globalOperations.get compute. compute.globalOperations.list compute. compute. compute.healthChecks.get compute.healthChecks.list compute. compute. compute.httpHealthChecks.get compute.httpHealthChecks.list compute. compute. compute.httpsHealthChecks.get compute.httpsHealthChecks.list compute. compute. compute.images.get compute.images.getFromFamily compute.images.getIamPolicy compute.images.list compute. compute.images.listTagBindings compute. compute. compute.instanceGroups.get compute.instanceGroups.list compute.instanceTemplates.get compute. compute.instanceTemplates.list compute.instances.get compute. compute. compute.instances.getIamPolicy compute. compute. compute. compute. compute.instances.list compute. compute. compute. compute.instantSnapshots.get compute. compute.instantSnapshots.list compute. compute.
compute.
compute.
compute.interconnects.get compute.interconnects.list compute.licenseCodes.get compute. compute.licenseCodes.list compute.licenses.get compute.licenses.getIamPolicy compute.licenses.list compute.machineImages.get compute. compute.machineImages.list compute.machineTypes.*
compute. compute. compute. compute.networkAttachments.get compute. compute. compute. compute. compute. compute. compute. compute. compute. compute.networks.get compute. compute. compute.networks.list compute. compute. compute. compute.nodeGroups.get compute. compute.nodeGroups.list compute.nodeTemplates.get compute. compute.nodeTemplates.list compute.nodeTypes.*
compute. compute.packetMirrorings.get compute.packetMirrorings.list compute.projects.get compute. compute. compute. compute. compute. compute. compute. compute. compute. compute. compute. compute. compute. compute. compute. compute. compute.regionHealthChecks.get compute. compute. compute. compute. compute. compute. compute. compute. compute. compute.regionOperations.get compute. compute.regionOperations.list compute. compute. compute. compute. compute. compute. compute. compute. compute.regionSslPolicies.get compute.regionSslPolicies.list compute. compute. compute. compute. compute. compute. compute. compute. compute. compute. compute. compute.regionUrlMaps.get compute.regionUrlMaps.list compute. compute. compute.regionUrlMaps.validate compute.regions.*
compute.reservations.get compute.reservations.list compute.resourcePolicies.get compute. compute.resourcePolicies.list compute.routers.get compute.routers.list compute.routes.get compute.routes.list compute. compute.routes.listTagBindings compute.securityPolicies.get compute. compute.securityPolicies.list compute. compute. compute.serviceAttachments.get compute. compute. compute.snapshots.get compute.snapshots.getIamPolicy compute.snapshots.list compute. compute. compute.sslCertificates.get compute.sslCertificates.list compute. compute. compute.sslPolicies.get compute.sslPolicies.list compute. compute. compute. compute.subnetworks.get compute. compute.subnetworks.list compute. compute. compute.targetGrpcProxies.get compute.targetGrpcProxies.list compute.targetHttpProxies.get compute.targetHttpProxies.list compute. compute. compute.targetHttpsProxies.get compute. compute. compute. compute.targetInstances.get compute.targetInstances.list compute. compute. compute.targetPools.get compute.targetPools.list compute. compute. compute.targetSslProxies.get compute.targetSslProxies.list compute. compute. compute.targetTcpProxies.get compute.targetTcpProxies.list compute. compute. compute.targetVpnGateways.get compute.targetVpnGateways.list compute.urlMaps.get compute.urlMaps.list compute. compute. compute.urlMaps.validate compute.vpnGateways.get compute.vpnGateways.list compute.vpnTunnels.get compute.vpnTunnels.list compute.zoneOperations.get compute. compute.zoneOperations.list compute.zones.*
notebooks.environments.get notebooks. notebooks.environments.list notebooks.executions.create notebooks.executions.get notebooks. notebooks.executions.list notebooks. notebooks.instances.create notebooks.instances.get notebooks.instances.getHealth notebooks. notebooks.instances.list notebooks.locations.*
notebooks.operations.get notebooks.operations.list notebooks.runtimes.create notebooks.runtimes.get notebooks. notebooks.runtimes.list notebooks.schedules.create notebooks.schedules.get notebooks. notebooks.schedules.list resourcemanager.projects.get resourcemanager.projects.list serviceusage.quotas.get serviceusage.services.get serviceusage.services.list |
Notebooks Viewer( Read-only access to Notebooks, all resources. Lowest-level resources where you can grant this role:
|
compute.acceleratorTypes.*
compute.addresses.get compute.addresses.list compute.autoscalers.get compute.autoscalers.list compute.backendBuckets.get compute. compute.backendBuckets.list compute. compute. compute.backendServices.get compute. compute.backendServices.list compute. compute. compute.commitments.get compute.commitments.list compute.diskTypes.*
compute.disks.get compute.disks.getIamPolicy compute.disks.list compute. compute.disks.listTagBindings compute. compute. compute.firewallPolicies.get compute. compute.firewallPolicies.list compute. compute. compute.firewalls.get compute.firewalls.list compute. compute. compute.forwardingRules.get compute.forwardingRules.list compute. compute. compute.futureReservations.get compute. compute. compute.globalAddresses.get compute.globalAddresses.list compute. compute. compute. compute. compute. compute. compute. compute. compute. compute.globalOperations.get compute. compute.globalOperations.list compute. compute. compute.healthChecks.get compute.healthChecks.list compute. compute. compute.httpHealthChecks.get compute.httpHealthChecks.list compute. compute. compute.httpsHealthChecks.get compute.httpsHealthChecks.list compute. compute. compute.images.get compute.images.getFromFamily compute.images.getIamPolicy compute.images.list compute. compute.images.listTagBindings compute. compute. compute.instanceGroups.get compute.instanceGroups.list compute.instanceTemplates.get compute. compute.instanceTemplates.list compute.instances.get compute. compute. compute.instances.getIamPolicy compute. compute. compute. compute. compute.instances.list compute. compute. compute. compute.instantSnapshots.get compute. compute.instantSnapshots.list compute. compute.
compute.
compute.
compute.interconnects.get compute.interconnects.list compute.licenseCodes.get compute. compute.licenseCodes.list compute.licenses.get compute.licenses.getIamPolicy compute.licenses.list compute.machineImages.get compute. compute.machineImages.list compute.machineTypes.*
compute. compute. compute. compute.networkAttachments.get compute. compute. compute. compute. compute. compute. compute. compute. compute. compute.networks.get compute. compute. compute.networks.list compute. compute. compute. compute.nodeGroups.get compute. compute.nodeGroups.list compute.nodeTemplates.get compute. compute.nodeTemplates.list compute.nodeTypes.*
compute. compute.packetMirrorings.get compute.packetMirrorings.list compute.projects.get compute. compute. compute. compute. compute. compute. compute. compute. compute. compute. compute. compute. compute. compute. compute. compute. compute.regionHealthChecks.get compute. compute. compute. compute. compute. compute. compute. compute. compute. compute.regionOperations.get compute. compute.regionOperations.list compute. compute. compute. compute. compute. compute. compute. compute. compute.regionSslPolicies.get compute.regionSslPolicies.list compute. compute. compute. compute. compute. compute. compute. compute. compute. compute. compute. compute.regionUrlMaps.get compute.regionUrlMaps.list compute. compute. compute.regionUrlMaps.validate compute.regions.*
compute.reservations.get compute.reservations.list compute.resourcePolicies.get compute. compute.resourcePolicies.list compute.routers.get compute.routers.list compute.routes.get compute.routes.list compute. compute.routes.listTagBindings compute.securityPolicies.get compute. compute.securityPolicies.list compute. compute. compute.serviceAttachments.get compute. compute. compute.snapshots.get compute.snapshots.getIamPolicy compute.snapshots.list compute. compute. compute.sslCertificates.get compute.sslCertificates.list compute. compute. compute.sslPolicies.get compute.sslPolicies.list compute. compute. compute. compute.subnetworks.get compute. compute.subnetworks.list compute. compute. compute.targetGrpcProxies.get compute.targetGrpcProxies.list compute.targetHttpProxies.get compute.targetHttpProxies.list compute. compute. compute.targetHttpsProxies.get compute. compute. compute. compute.targetInstances.get compute.targetInstances.list compute. compute. compute.targetPools.get compute.targetPools.list compute. compute. compute.targetSslProxies.get compute.targetSslProxies.list compute. compute. compute.targetTcpProxies.get compute.targetTcpProxies.list compute. compute. compute.targetVpnGateways.get compute.targetVpnGateways.list compute.urlMaps.get compute.urlMaps.list compute. compute. compute.urlMaps.validate compute.vpnGateways.get compute.vpnGateways.list compute.vpnTunnels.get compute.vpnTunnels.list compute.zoneOperations.get compute. compute.zoneOperations.list compute.zones.*
notebooks.environments.get notebooks. notebooks.environments.list notebooks.executions.get notebooks. notebooks.executions.list notebooks. notebooks.instances.get notebooks.instances.getHealth notebooks. notebooks.instances.list notebooks.locations.*
notebooks.operations.get notebooks.operations.list notebooks.runtimes.get notebooks. notebooks.runtimes.list notebooks.schedules.get notebooks. notebooks.schedules.list resourcemanager.projects.get resourcemanager.projects.list serviceusage.quotas.get serviceusage.services.get serviceusage.services.list |
Papéis do AI Platform
Role | Permissions |
---|---|
AI Platform Admin( Provides full access to AI Platform resources, and its jobs, operations, models, and versions. Lowest-level resources where you can grant this role:
|
ml.*
resourcemanager.projects.get |
AI Platform Developer( Provides ability to use AI Platform resources for creating models, versions, jobs for training and prediction, and sending online prediction requests. Lowest-level resources where you can grant this role:
|
ml.jobs.create ml.jobs.get ml.jobs.getIamPolicy ml.jobs.list ml.locations.*
ml.models.create ml.models.get ml.models.getIamPolicy ml.models.list ml.models.predict ml.operations.get ml.operations.list ml.projects.getConfig ml.studies.*
ml.trials.*
ml.versions.get ml.versions.list ml.versions.predict resourcemanager.projects.get |
AI Platform Job Owner( Provides full access to all permissions for a particular job resource. This role is automatically granted to the user who creates the job. Lowest-level resources where you can grant this role:
|
ml.jobs.*
|
AI Platform Model Owner( Provides full access to the model and its versions. This role is automatically granted to the user who creates the model. Lowest-level resources where you can grant this role:
|
ml.models.*
ml.versions.*
|
AI Platform Model User( Provides permissions to read the model and its versions, and use them for prediction. Lowest-level resources where you can grant this role:
|
ml.models.get ml.models.predict ml.versions.get ml.versions.list ml.versions.predict |
AI Platform Operation Owner( Provides full access to all permissions for a particular operation resource. Lowest-level resources where you can grant this role:
|
ml.operations.*
|
AI Platform Viewer( Provides read-only access to AI Platform resources. Lowest-level resources where you can grant this role:
|
ml.jobs.get ml.jobs.list ml.locations.*
ml.models.get ml.models.list ml.operations.get ml.operations.list ml.projects.getConfig ml.studies.get ml.studies.getIamPolicy ml.studies.list ml.trials.get ml.trials.list ml.versions.get ml.versions.list resourcemanager.projects.get |
Papéis do Analytics Hub
Role | Permissions |
---|---|
Analytics Hub Admin( Administer Data Exchanges and Listings |
analyticshub. analyticshub. analyticshub.dataExchanges.get analyticshub. analyticshub. analyticshub. analyticshub. analyticshub. analyticshub.listings.create analyticshub.listings.delete analyticshub.listings.get analyticshub. analyticshub.listings.list analyticshub. analyticshub.listings.update analyticshub. analyticshub.subscriptions.*
resourcemanager.projects.get resourcemanager.projects.list |
Analytics Hub Listing Admin( Grants full control over the Listing, including updating, deleting and setting ACLs |
analyticshub.dataExchanges.get analyticshub. analyticshub. analyticshub.listings.delete analyticshub.listings.get analyticshub. analyticshub.listings.list analyticshub. analyticshub.listings.update analyticshub. resourcemanager.projects.get resourcemanager.projects.list |
Analytics Hub Publisher( Can publish to Data Exchanges thus creating Listings |
analyticshub.dataExchanges.get analyticshub. analyticshub. analyticshub.listings.create analyticshub.listings.get analyticshub. analyticshub.listings.list resourcemanager.projects.get resourcemanager.projects.list |
Analytics Hub Subscriber( Can browse Data Exchanges and subscribe to Listings |
analyticshub.dataExchanges.get analyticshub. analyticshub. analyticshub. analyticshub.listings.get analyticshub. analyticshub.listings.list analyticshub. resourcemanager.projects.get resourcemanager.projects.list |
Analytics Hub Subscription Owner( Grants full control over the Subscription, including updating and deleting |
analyticshub.dataExchanges.get analyticshub. analyticshub. analyticshub.listings.get analyticshub. analyticshub.listings.list analyticshub.subscriptions.*
resourcemanager.projects.get resourcemanager.projects.list |
Analytics Hub Viewer( Can browse Data Exchanges and Listings |
analyticshub.dataExchanges.get analyticshub. analyticshub. analyticshub.listings.get analyticshub. analyticshub.listings.list resourcemanager.projects.get resourcemanager.projects.list |
Papéis de gerenciamento do Android
Role | Permissions |
---|---|
Android Management User( Full access to manage devices. |
androidmanagement. serviceusage.quotas.get serviceusage.services.get serviceusage.services.list |
Papéis do Anthos para várias nuvens
Role | Permissions |
---|---|
Anthos Multi-cloud Admin( Admin access to Anthos Multi-cloud resources. |
gkemulticloud.*
resourcemanager.projects.get resourcemanager.projects.list |
Anthos Multi-cloud Telemetry Writer( Grant access to write cluster telemetry data such as logs, metrics, and resource metadata. |
logging.logEntries.create logging.logEntries.route monitoring. monitoring. monitoring.
monitoring.
monitoring.timeSeries.create opsconfigmonitoring. |
Anthos Multi-cloud Viewer( Viewer access to Anthos Multi-cloud resources. |
gkemulticloud. gkemulticloud. gkemulticloud. gkemulticloud. gkemulticloud. gkemulticloud.awsClusters.get gkemulticloud.awsClusters.list gkemulticloud.awsNodePools.get gkemulticloud. gkemulticloud. gkemulticloud.azureClients.get gkemulticloud. gkemulticloud. gkemulticloud. gkemulticloud. gkemulticloud. gkemulticloud. gkemulticloud. gkemulticloud.operations.get gkemulticloud.operations.list gkemulticloud.operations.wait resourcemanager.projects.get resourcemanager.projects.list |
Papéis da API Gateway
Role | Permissions |
---|---|
ApiGateway Admin( Full access to ApiGateway and related resources. |
apigateway.*
monitoring. monitoring. monitoring.timeSeries.list resourcemanager.projects.get resourcemanager.projects.list servicemanagement.services.get serviceusage.services.list |
ApiGateway Viewer( Read-only access to ApiGateway and related resources. |
apigateway.apiconfigs.get apigateway. apigateway.apiconfigs.list apigateway.apis.get apigateway.apis.getIamPolicy apigateway.apis.list apigateway.gateways.get apigateway. apigateway.gateways.list apigateway.locations.*
apigateway.operations.get apigateway.operations.list monitoring. monitoring. monitoring.timeSeries.list resourcemanager.projects.get resourcemanager.projects.list servicemanagement.services.get serviceusage.services.list |
Papéis do Apigee
Role | Permissions |
---|---|
Apigee Organization Admin( Full access to all apigee resource features |
apigee.*
monitoring.timeSeries.list resourcemanager.projects.get resourcemanager. resourcemanager.projects.list |
Apigee Analytics Agent( Curated set of permissions for Apigee Universal Data Collection Agent to manage analytics for an Apigee Organization |
apigee.datalocation.get apigee. apigee.runtimeconfigs.get |
Apigee Analytics Editor( Analytics editor for an Apigee Organization |
apigee.datacollectors.*
apigee.datastores.*
apigee.entitlements.get apigee.envgroupattachments.get apigee. apigee.envgroups.get apigee.envgroups.list apigee.environments.get apigee.environments.getStats apigee.environments.list apigee.exports.*
apigee.hostqueries.*
apigee.hoststats.get apigee.organizations.get apigee.organizations.list apigee. apigee.queries.*
apigee.reports.*
resourcemanager.projects.get resourcemanager.projects.list |
Apigee Analytics Viewer( Analytics viewer for an Apigee Organization |
apigee.datacollectors.get apigee.datacollectors.list apigee.datastores.get apigee.datastores.list apigee.entitlements.get apigee.envgroupattachments.get apigee. apigee.envgroups.get apigee.envgroups.list apigee.environments.get apigee.environments.getStats apigee.environments.list apigee.exports.get apigee.exports.list apigee.hostqueries.get apigee.hostqueries.list apigee.hoststats.get apigee.organizations.get apigee.organizations.list apigee. apigee.queries.get apigee.queries.list apigee.reports.get apigee.reports.list resourcemanager.projects.get resourcemanager.projects.list |
Apigee API Admin( Full read/write access to all apigee API resources |
apigee.apiproductattributes.*
apigee.apiproducts.*
apigee.entitlements.get apigee.envgroupattachments.get apigee. apigee.envgroups.get apigee.envgroups.list apigee.environments.get apigee.environments.getStats apigee.environments.list apigee.keyvaluemapentries.*
apigee.keyvaluemaps.*
apigee.organizations.get apigee.organizations.list apigee. apigee.proxies.*
apigee.proxyrevisions.*
apigee.sharedflowrevisions.*
apigee.sharedflows.*
resourcemanager.projects.get resourcemanager.projects.list |
Apigee API Reader( Reader of apigee resources |
apigee. apigee. apigee.apiproducts.get apigee.apiproducts.list apigee.entitlements.get apigee.envgroupattachments.get apigee. apigee.envgroups.get apigee.envgroups.list apigee.environments.get apigee.environments.getStats apigee.environments.list apigee.keyvaluemapentries.get apigee.keyvaluemapentries.list apigee.keyvaluemaps.list apigee.organizations.get apigee.organizations.list apigee. apigee.proxies.get apigee.proxies.list apigee.proxyrevisions.deploy apigee.proxyrevisions.get apigee.proxyrevisions.list apigee.proxyrevisions.undeploy apigee. apigee.sharedflowrevisions.get apigee. apigee. apigee.sharedflows.get apigee.sharedflows.list resourcemanager.projects.get resourcemanager.projects.list |
Apigee Developer Admin( Developer admin of apigee resources |
apigee. apigee. apigee.apiproducts.get apigee.apiproducts.list apigee.appgroupapps.*
apigee.appgroups.*
apigee.appkeys.*
apigee.apps.*
apigee.datacollectors.*
apigee.
apigee.developerapps.*
|