GKE Multi-Cloud API を使用すると、クラスタ管理者はクラスタとノードプールを作成、更新、削除できます。API の権限は、Identity and Access Management（IAM）で管理します。この API を使用するには、適切な権限が必要です。各オペレーションに必要な権限については、API のロールと権限をご覧ください。IAM では、ロールを定義して、プリンシパルに割り当てることができます。ロールは権限の集合体であり、ロールをプリンシパルに割り当てることで、1 つ以上の Google Cloud
リソースへのアクセス権を制御できます。
組織、フォルダ、プロジェクトにクラスタやノードプールを作成すると、その組織、フォルダ、プロジェクトで適切な権限を持つユーザーがそれを変更できます。たとえば、Google Cloud プロジェクト レベルでクラスタの削除権限をユーザーに付与した場合、そのユーザーはそのプロジェクト内のすべてのクラスタを削除できます。詳細については、Google Cloud リソース階層と IAM ポリシーの作成をご覧ください。
Kubernetes API アクセス制御
Kubernetes API を使用すると、Kubernetes オブジェクトを管理できます。Kubernetes API のアクセス制御を管理するには、ロールベース アクセス制御（RBAC）を使用します。詳細については、GKE ドキュメントでロールベース アクセス制御の構成をご覧ください。
管理者ユーザーがプロジェクト オーナーでない場合は、Kubernetes API サーバーにアクセスするための RBAC ポリシーに加えて、特定の IAM ロールを付与し、管理者ユーザーが Google ID を使用して認証できるようにする必要があります。クラスタへの接続方法の詳細については、クラスタに接続して認証するをご覧ください。
[[["わかりやすい","easyToUnderstand","thumb-up"],["問題の解決に役立った","solvedMyProblem","thumb-up"],["その他","otherUp","thumb-up"]],[["わかりにくい","hardToUnderstand","thumb-down"],["情報またはサンプルコードが不正確","incorrectInformationOrSampleCode","thumb-down"],["必要な情報 / サンプルがない","missingTheInformationSamplesINeed","thumb-down"],["翻訳に関する問題","translationIssue","thumb-down"],["その他","otherDown","thumb-down"]],["最終更新日 2025-09-04 UTC。"],[],[],null,["# Authentication overview\n\nThis page describes how GKE on AWS handles authentication to\nGoogle Cloud and user authentication to your clusters.\n\nHow GKE on AWS connects to AWS\n------------------------------\n\nFor more information on how GKE on AWS uses AWS IAM roles to connect to\nAWS, see [AWS IAM roles](/kubernetes-engine/multi-cloud/docs/aws/concepts/aws-iam-roles).\n\nAuthentication\n--------------\n\n### GKE Multi-Cloud API authentication\n\nYou use the GKE Multi-Cloud API to create, update, and delete clusters\nand node pools. As with other Google Cloud APIs, you can use this\nAPI with REST, Google Cloud CLI, or the Google Cloud console.\n\nFor more information, see\n[Google Cloud authentication overview](/docs/authentication)\nand the [GKE Multi-Cloud API](/kubernetes-engine/multi-cloud/docs/reference/rest)\nreference documentation.\n\n### Kubernetes API authentication\n\nYou can use the `kubectl` command-line tool to perform cluster operations such\nas deploying a workload and configuring a load balancer. The `kubectl` tool\nconnects to the Kubernetes API on your cluster's control plane. To call this\nAPI, you need to authenticate with authorized credentials.\n\nTo get credentials, you can use one of the following methods:\n\n- [Google Identity](/kubernetes-engine/multi-cloud/docs/aws/how-to/connect-and-authenticate-to-your-cluster#google-identity),\n which lets users log in using their Google Cloud identity. Use this option if\n your users already have access to Google Cloud with a Google Identity.\n\n- [GKE Identity Service](/kubernetes-engine/multi-cloud/docs/aws/how-to/anthos-identity-service),\n which lets users log in using OpenID Connect\n (OIDC) or AWS IAM.\n\nGKE Identity Service lets you use identity providers such as\n[Okta](https://www.okta.com/),\n[Active Directory Federation Services (ADFS)](https://docs.microsoft.com/windows-server/identity/active-directory-federation-services),\nor any\n[OIDC](https://openid.net/connect/)\ncompliant identity provider.\n\nAuthorization\n-------------\n\nGKE on AWS has two methods for access control, the GKE Multi-Cloud API and\n[role-based access control (RBAC)](https://kubernetes.io/docs/reference/access-authn-authz/rbac/).\nThis section describes the differences between these methods.\n\nIt's best to take a layered approach to protecting your clusters and workloads.\nYou can apply the\n[principle of least privilege](https://wikipedia.org/wiki/Principle_of_least_privilege)\nto the level of access that you provide to your users and workloads. You might\nneed to make tradeoffs to allow the right level of flexibility and security.\n\n### GKE Multi-Cloud API access control\n\nThe GKE Multi-Cloud API lets cluster administrators create, update, and delete clusters\nand node pools. You manage permissions for the API with\nIdentity and Access Management (IAM). To use the API, users must have the appropriate\npermissions. For the permissions necessary for each\noperation, see [API roles and permissions](/kubernetes-engine/multi-cloud/docs/aws/reference/api-permissions).\nIAM lets you define [roles](/iam/docs/understanding-roles)\nand assign them to\n[principals](/iam/docs/overview#concepts_related_identity).\nA role is a collection of permissions, and when assigned to a principal, controls\naccess to one or more Google Cloud\n[resources](/iam/docs/overview#resource).\n\nWhen you create a cluster or node pool in an organization, folder, or project,\nusers with appropriate permissions in that organization, folder, or project can\nmodify it. For example, if you give a user a cluster deletion permission at a\nGoogle Cloud project level, that user can delete any cluster in that\nproject. For more information, see\n[Google Cloud resource hierarchy](/resource-manager/docs/cloud-platform-resource-hierarchy) and\n[Creating IAM policies](/kubernetes-engine/docs/how-to/iam).\n\n### Kubernetes API access control\n\nThe Kubernetes API lets you manage\n[Kubernetes objects](https://kubernetes.io/docs/concepts/overview/working-with-objects/kubernetes-objects/).\nTo manage access control on the Kubernetes API, you use role-based access\ncontrol (RBAC). For more information, see\n[Configuring role-based access control](/kubernetes-engine/docs/how-to/role-based-access-control)\nin the GKE documentation.\n\n#### Administrator access\n\nWhen you use the gcloud CLI to create a cluster, by default the\nGKE Multi-Cloud API adds your user account as an administrator and creates\nappropriate RBAC policies that grant you full administrative access to the\ncluster. To configure different users, pass the\n[`--admin-users`](/sdk/gcloud/reference/container/aws/clusters/create#--admin-users)\nflag when you create or update a cluster. When you use the `--admin-users` flag,\nyou must include all users that can administer the cluster. The\ngcloud CLI doesn't include the user that creates the cluster.\n\nYou can also add admin users using the Google Cloud console. For more\ninformation, see\n[Update your cluster](/kubernetes-engine/multi-cloud/docs/aws/how-to/update-cluster#update_your_cluster).\n| **Note:** When you add admin users, the GKE Multi-Cloud API applies the Kubernetes RBAC policies to the cluster to grant the users the same administrative access that you were granted when you created the cluster. These policies grant users the Kubernetes `clusterrole/cluster-admin` role, which provides full access to every resource in the cluster in all namespaces.\n\nTo see the configuration of your cluster's access, run the following command: \n\n kubectl describe clusterrolebinding gke-multicloud-cluster-admin\n\nIn addition to the RBAC policies to access the Kubernetes API server, if an\nadmin user isn't a project owner, you need to grant specific IAM\nroles that let the admin users authenticate using their Google identity. For\nmore information about how to connect to the cluster, see\n[Connect and authenticate to your cluster](/kubernetes-engine/multi-cloud/docs/aws/how-to/connect-and-authenticate-to-your-cluster).\n\nWhat's next\n-----------\n\n- To set up OIDC, see [Manage identity with GKE Identity Service](/kubernetes-engine/multi-cloud/docs/aws/how-to/anthos-identity-service).\n- [Connect and authenticate to your cluster](/kubernetes-engine/multi-cloud/docs/aws/how-to/connect-and-authenticate-to-your-cluster)."]]
