스토리지 버킷을 사용하여 Infra Manager에서 배포한 Terraform 구성을 저장할 수 있습니다.
구성에 스토리지 버킷을 사용하고 이 스토리지 버킷이 Infra Manager를 실행하는 프로젝트와 다른 프로젝트에 있는 경우 Infra Manager를 호출하는 데 사용하는 서비스 계정에 버킷에 대한 읽기 권한이 있는지 확인해야 합니다. Cloud Storage 권한에 대한 자세한 내용은 Cloud Storage의 IAM 권한을 참고하세요.
스토리지 버킷이 Infra Manager와 동일한 프로젝트에 있고 서비스 계정에 roles/config.agent를 부여한 경우 버킷에 대한 읽기 권한이 이미 사용 설정되어 있습니다.
SERVICE_ACCOUNT_PROJECT_ID: 서비스 계정이 포함된 프로젝트의 프로젝트 ID입니다.
INFRA_MANAGER_PROJECT_NUMBER: 배포를 만들려는 프로젝트의 프로젝트 번호입니다. 이렇게 하면 서비스 에이전트의 이메일 ID가 생성됩니다.
service-INFRA_MANAGER_PROJECT_NUMBER@gcp-sa-config.iam.gserviceaccount.com
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-05(UTC)"],[[["\u003cp\u003eA service account is required to create, update, or delete deployments using Infrastructure Manager, as it executes Terraform under the service account's identity.\u003c/p\u003e\n"],["\u003cp\u003eTo use Infrastructure Manager, an individual user needs the Service Account User role for the service account, and the service account itself needs the Infra Manager Agent role.\u003c/p\u003e\n"],["\u003cp\u003eIf using a storage bucket for Terraform configurations in a different project than Infra Manager, the service account must have read permission for that bucket.\u003c/p\u003e\n"],["\u003cp\u003eThe service account requires permissions specific to the Google Cloud resources defined in the Terraform configuration, including those for creating and deleting resources.\u003c/p\u003e\n"],["\u003cp\u003eIf the service account and Infra Manager are in different projects, additional permissions are required, including disabling the \u003ccode\u003eiam.disableCrossProjectServiceAccountUsage\u003c/code\u003e policy and granting the Infra Manager service agent the Service Account User role, and \u003ccode\u003eroles/iam.serviceAccountTokenCreator\u003c/code\u003e for cloud build.\u003c/p\u003e\n"]]],[],null,["# Configure the service account\n\nTo use Infrastructure Manager to create, update, or delete a deployment, you must use\na service account. Infra Manager executes Terraform using the identity\nof this service account.\n\nYou do not need a service account to view information about\nInfra Manager deployments.\n\nThis page explains how to configure a service account so that you can deploy\nresources with Infrastructure Manager.\n\nBefore you begin\n----------------\n\n1. [Enable the Infra Manager](/infrastructure-manager/docs/enable-service) service.\n2. [Create a service account](/iam/docs/creating-managing-service-accounts) or identify an existing service account to use with Infra Manager.\n\nGrant access to the service account\n-----------------------------------\n\nTo use Infrastructure Manager to create, update, or delete a deployment, an\nindividual user needs access to the service account.\n\nGrant the user the\n[Service Account User (`roles/iam.serviceAccountUser`)](/iam/docs/understanding-roles#service-accounts-roles)\nIAM role for the service account.\n\nGrant permissions for Infra Manager\n-----------------------------------\n\nTo work with Infra Manager, the service account needs the\n[Infra Manager Agent (`roles/config.agent`) role](/infrastructure-manager/docs/access-control).\nThis grants permissions for Infra Manager to create, update, and\ndelete resources: \n\n gcloud projects add-iam-policy-binding \u003cvar translate=\"no\"\u003eINFRA_MANAGER_PROJECT_ID\u003c/var\u003e \\\n --member=\"serviceAccount:\u003cvar translate=\"no\"\u003eSERVICE_ACCOUNT_EMAIL\u003c/var\u003e\" \\\n --role=\"roles/config.agent\"\n\nReplace:\n\n- \u003cvar translate=\"no\"\u003eINFRA_MANAGER_PROJECT_ID\u003c/var\u003e: The project ID of the project where\n you're creating deployments.\n\n- \u003cvar translate=\"no\"\u003eSERVICE_ACCOUNT_EMAIL\u003c/var\u003e: The email of the service account.\n\nFor details about how to grant permissions to service accounts, see\n[Manage access to service accounts](/iam/docs/manage-access-service-accounts).\n\nGrant read permission for the storage bucket\n--------------------------------------------\n\nYou can use a storage bucket to store the Terraform configurations that are\ndeployed by Infra Manager.\n\nIf you use a storage bucket for the configurations, and this storage bucket\nis in a different project from the project where you are running\nInfra Manager, then you need to ensure that the\nservice account that you use to call Infra Manager has read permission\nfor the bucket. For details about Cloud Storage permissions, see\n[IAM permissions for Cloud Storage](/storage/docs/access-control/iam-permissions).\n\nIf the storage bucket is in the same project as Infra Manager, and you\nhave granted `roles/config.agent` to the service account, then read permission\nto the bucket is already enabled.\n\nFor details about uploading a configuration to a storage bucket, see\n[Upload a Terraform configuration](/infrastructure-manager/docs/upload-terraform-configuration).\n\nGrant permissions for resources defined in the configuration\n------------------------------------------------------------\n\nTo create and manage Google Cloud resources that are defined in the\nTerraform configuration, the service account needs permissions specific to these\nresources.\n\n- Permissions specific to the Google Cloud resources that are\n defined in the Terraform configuration you are deploying.\n For example, the permission for creating a Compute Engine VM\n instance is `compute.instances.create`.\n\n- Permissions specific to the Google Cloud resources that are\n defined in the Terraform configuration of the deployment that\n you are updating.\n\n For example, let's say your deployment provisions a Compute Engine VM\n and then you update the deployment using a configuration that does not include\n a Compute Engine VM. In this case, when you update the revision, the\n service account needs:\n - Permissions for the resources defined in the new\n configuration.\n\n - Permissions for the resources being\n deleted, such as the Compute Engine VM in this example.\n\nFor help identifying the permissions needed for the resources in the\nTerraform configurations, see\n[Choose predefined roles](/iam/docs/choose-predefined-roles).\n\nFor details about how to grant permissions to service accounts, see\n[Manage access to service accounts](/iam/docs/manage-access-service-accounts).\n\nGrant access across multiple projects\n-------------------------------------\n\nAdditional permissions are required if the given service account is in a\ndifferent project than the project where the Infra Manager service is\nrun.\n\nTo grant these additional permissions:\n\n1. Ensure that the service account has the [Infra Manager Agent (`roles/config.agent`) role](/infrastructure-manager/docs/access-control)\n in the project running Infra Manager. See [Grant permissions for Infra Manager](#byosa-permissions) for\n instructions on granting permissions.\n\n2. In the project that has the service account, ensure that the\n `iam.disableCrossProjectServiceAccountUsage` organization policy constraint\n is not enforced. This constraint is enforced by default.\n\n To disable this organization policy constraint, run: \n\n gcloud resource-manager org-policies disable-enforce iam.disableCrossProjectServiceAccountUsage\n --project=\u003cvar translate=\"no\"\u003eSERVICE_ACCOUNT_PROJECT_ID\u003c/var\u003e\n\n Replace \u003cvar translate=\"no\"\u003eSERVICE_ACCOUNT_PROJECT_ID\u003c/var\u003e with the ID of the project that\n contains the service account.\n3. In the project that has the service account, grant the\n `roles/iam.serviceAccountUser` role for the\n Infra Manager service agent of the project where you're creating\n deployments:\n\n gcloud projects add-iam-policy-binding \u003cvar translate=\"no\"\u003eSERVICE_ACCOUNT_PROJECT_ID\u003c/var\u003e \\\n --member=\"serviceAccount:service-\u003cvar translate=\"no\"\u003eINFRA_MANAGER_PROJECT_NUMBER\u003c/var\u003e@gcp-sa-config.iam.gserviceaccount.com\" \\\n --role=\"roles/iam.serviceAccountUser\"\n\n Replace:\n - \u003cvar translate=\"no\"\u003eSERVICE_ACCOUNT_PROJECT_ID\u003c/var\u003e: The project ID of the project that contains the service account.\n - \u003cvar translate=\"no\"\u003eINFRA_MANAGER_PROJECT_NUMBER\u003c/var\u003e: The project number of the project where you're creating deployments. This forms the email ID of the service agent: `service-`\u003cvar translate=\"no\"\u003eINFRA_MANAGER_PROJECT_NUMBER\u003c/var\u003e`@gcp-sa-config.iam.gserviceaccount.com`\n4. Grant the [Service Account Token Creator (`roles/iam.serviceAccountTokenCreator`)](/iam/docs/service-account-permissions#token-creator-role)\n role to the Cloud Build service agent in the project where you're\n creating deployments. To allow Infra Manager to execute Terraform\n using Cloud Build, the Cloud Build service agent in the project\n containing the service account needs additional permissions as part of the\n [cross-project set up](/build/docs/securing-builds/configure-user-specified-service-accounts#cross-project_set_up):\n\n gcloud projects add-iam-policy-binding \u003cvar translate=\"no\"\u003eSERVICE_ACCOUNT_PROJECT_ID\u003c/var\u003e \\\n --member=\"serviceAccount:service-\u003cvar translate=\"no\"\u003eINFRA_MANAGER_PROJECT_NUMBER\u003c/var\u003e@gcp-sa-cloudbuild.iam.gserviceaccount.com\" \\\n --role=\"roles/iam.serviceAccountTokenCreator\"\n\nWhat's next\n-----------\n\n- Learn about [IAM](/iam/docs).\n- Learn more about [Terraform with Google Cloud](/docs/terraform).\n- [Deploy infrastructure using Infra Manager](/infrastructure-manager/docs/deploy-resources).\n- [Update a deployment](/infrastructure-manager/docs/update-deployment).\n- [View the state of a deployment](/infrastructure-manager/docs/view-deployments)."]]
