設定 Policy API

本頁面說明如何設定 Cloud Identity Policy API，然後列出及取得政策。

安裝 Python 用戶端程式庫

如要安裝 Python 用戶端程式庫，請執行下列指令：

  pip install --upgrade google-api-python-client google-auth \
    google-auth-oauthlib google-auth-httplib2

如要進一步瞭解如何設定 Python 開發環境，請參閱 Python 開發環境設定指南。

啟用 API 並設定服務帳戶憑證

Sign in to your Google Cloud account. If you're new to Google Cloud, create an account to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.
In the Google Cloud console, on the project selector page, select or create a Google Cloud project.
Note: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.
Go to project selector
Verify that billing is enabled for your Google Cloud project.
Enable the Cloud Identity API.
Enable the API
Create a service account:
1. In the Google Cloud console, go to the Create service account page.

   Go to Create service account
2. Select your project.

3. In the Service account name field, enter a name. The Google Cloud console fills in the Service account ID field based on this name.

   In the Service account description field, enter a description. For example, Service account for quickstart.

4. Click Create and continue.

5. Grant the Project > Owner role to the service account.

   To grant the role, find the Select a role list, then select Project > Owner.

   Note: The Role field affects which resources the service account can access in your project. You can revoke these roles or grant additional roles later. In production environments, do not grant the Owner, Editor, or Viewer roles. Instead, grant a predefined role or custom role that meets your needs.
6. Click Continue.

7. Click Done to finish creating the service account.

   Do not close your browser window. You will use it in the next step.
Create a service account key:
1. In the Google Cloud console, click the email address for the service account that you created.
2. Click Keys.
3. Click Add key, and then click Create new key.
4. Click Create. A JSON key file is downloaded to your computer.
5. Click Close.

In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

Note: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.

Go to project selector

Verify that billing is enabled for your Google Cloud project.

Enable the Cloud Identity API.

Enable the API

Create a service account:

1. In the Google Cloud console, go to the Create service account page.

   Go to Create service account
2. Select your project.

3. In the Service account name field, enter a name. The Google Cloud console fills in the Service account ID field based on this name.

   In the Service account description field, enter a description. For example, Service account for quickstart.

4. Click Create and continue.

5. Grant the Project > Owner role to the service account.

   To grant the role, find the Select a role list, then select Project > Owner.

   Note: The Role field affects which resources the service account can access in your project. You can revoke these roles or grant additional roles later. In production environments, do not grant the Owner, Editor, or Viewer roles. Instead, grant a predefined role or custom role that meets your needs.
6. Click Continue.

7. Click Done to finish creating the service account.

   Do not close your browser window. You will use it in the next step.

Create a service account key:

1. In the Google Cloud console, click the email address for the service account that you created.
2. Click Keys.
3. Click Add key, and then click Create new key.
4. Click Create. A JSON key file is downloaded to your computer.
5. Click Close.

以設定全網域委派功能的服務帳戶進行驗證

如果您是管理身分政策的管理員，或是想為帳戶提供全網域權限，以便代表管理員管理 Google 政策，請以服務帳戶身分進行驗證，然後將全網域權限授予服務帳戶。

注意： 全網域委派功能可讓服務帳戶模擬管理員使用者，因此系統會將服務帳戶執行的動作記錄為使用者所為。

如要瞭解如何設定全網域委派功能，請參閱「使用全網域委派功能控管 API 存取權」。

如要以服務帳戶進行驗證，請參閱「針對伺服器對伺服器應用程式使用 OAuth 2.0」。在程式碼中初始化憑證時，請在憑證上呼叫 with_subject()，指定服務帳戶採取的電子郵件地址。例如：

Python

credentials = service_account.Credentials.from_service_account_file(
  SERVICE_ACCOUNT_FILE, scopes=SCOPES).with_subject(ADMIN_EMAIL)

如要呼叫 Policy API，請參閱「列出及取得政策」一文，其中提供詳細的程式碼範例，包括驗證程式碼。