为了向 Google Cloud 授予在 AWS 账号中创建、更新、删除和管理集群的权限，GKE on AWS 会在 Google Cloud 项目中创建一个服务代理。服务代理是一个使用 GKE Multi-Cloud API AWS IAM 角色的 Google 管理的服务账号。您必须为在其中管理 GKE 集群的每个 Google Cloud 项目中的服务代理创建 AWS IAM 角色。服务代理使用邮箱 service-PROJECT_NUMBER@gcp-sa-gkemulticloud.iam.gserviceaccount.com。如需详细了解 Google Cloud IAM 权限，请参阅 Anthos 多云服务代理。
GKE on AWS 的 AWS IAM 权限
您可以创建使用默认 AWS IAM 角色的角色，或创建符合组织要求的自定义 AWS IAM 政策。
使用默认政策
AWS IAM 政策是一组权限的集合。如需授予创建和管理集群的权限，您必须先为以下角色创建 AWS IAM 政策：
GKE Multi-Cloud API 服务代理角色
GKE Multi-Cloud API 使用此 AWS IAM 角色来通过 AWS API 管理资源。此角色由 Google 管理的服务账号（称为服务代理）使用。
控制平面 AWS IAM 角色
您的集群控制平面使用此角色来控制节点池。
节点池 AWS IAM 角色
控制平面使用此角色来创建节点池虚拟机。
如需使用建议用于 GKE on AWS 的 AWS IAM 角色来管理集群，请参阅创建 AWS IAM 角色。
创建自定义 IAM 政策
如需进一步限制权限，您可以创建允许 GKE on AWS 的自定义 AWS IAM 政策，而不是使用建议的政策。例如，您可以将权限限制为对具有特定标记的资源或特定 AWS VPC 中的资源的权限
使用标记控制访问权限
使用 AWS 标记，您可以将 AWS IAM 政策限制为仅允许对一组有限的资源执行操作。在条件字段中指定了该标记的任何角色，都将限制为对具有相同标记的资源执行操作。您可以使用此选项来限制管理角色对特定集群或节点池中的资源执行操作。
如需将 AWS IAM 政策限制为仅应用于具有特定标记的资源，请在政策的 Condition 字段中添加该标记的值，然后在创建集群和节点池时传递该标记值。GKE on AWS 在创建资源时会应用此标记。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-03。"],[],[],null,["# About AWS IAM roles\n\nThis page describes how Google Cloud manages AWS Identity and Access\nManagement (IAM) permissions and roles for your GKE on AWS.\n\nGKE on AWS uses the AWS API to create resources such as EC2 instances,\nauto-scaling groups, and load balancers for both GKE on AWS components and\nyour workloads. You must provide Google Cloud with AWS IAM permissions to\ncreate these resources.\n\nHow GKE on AWS accesses the AWS API\n-----------------------------------\n\nGKE on AWS uses\n[identity federation in AWS](https://aws.amazon.com/identity/federation/)\nto manage fine-grained access to your AWS account. When GKE on AWS\nneeds to take an action for your cluster, it requests a short-lived token\nfrom AWS. The [GKE Multi-Cloud API role](#api-role) uses this token to authenticate\nto AWS.\n\nService agents\n--------------\n\nIn order to grant Google Cloud access to create, update, delete, and\nmanage clusters in your AWS account, GKE on AWS creates a\n[*Service agent*](/iam/docs/service-agents) in your Google Cloud project. The\nservice agent is a\n[Google-managed service account](/iam/docs/service-account-types#google-managed) that\nuses the [GKE Multi-Cloud API AWS IAM role](#api-role).\nYou must create an AWS IAM role for the\nservice agent in each Google Cloud project where you manage GKE clusters from.\nThe service agent uses the email address\n`service-`\u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e`@gcp-sa-gkemulticloud.iam.gserviceaccount.com`.\nFor more information on the Google Cloud IAM permissions,\nsee\n[Anthos Multi-Cloud Service Agent](/iam/docs/understanding-roles#gkemulticloud.serviceAgent).\n\nAWS IAM permissions for GKE on AWS\n----------------------------------\n\nYou can create roles that use default AWS IAM roles, or create your own\ncustom AWS IAM policies that meet your organization's requirements.\n\n### Use default policies\n\nAn AWS IAM policy is a collection of permissions. To grant permissions to\ncreate and manage clusters, you must first create AWS IAM\npolicies for the following roles:\n\nGKE Multi-Cloud API service agent role\n: The GKE Multi-Cloud API uses this AWS IAM role to manage resources using AWS APIs.\n This role is used by a Google-managed service account known as a\n [service agent](/iam/docs/service-agents).\n\nControl plane AWS IAM role\n: Your cluster control plane uses this role to control node pools.\n\nNode pool AWS IAM role\n: The control plane uses this role to create node pool VMs.\n\nTo use suggested AWS IAM roles for GKE on AWS to manage clusters,\nsee [Create AWS IAM roles](/kubernetes-engine/multi-cloud/docs/aws/how-to/create-aws-iam-roles).\n\n### Create custom IAM policies\n\nTo further restrict permissions, instead of using suggested policies you can\ncreate custom AWS IAM policies that allow GKE on AWS. For example, you can\nrestrict permissions to permissions to resources with a certain tag, or\nresources in a specific AWS VPC\n\n#### Controlling access with tags\n\nYou can restrict AWS IAM policies to allow actions only on a limited set of\nresources, using AWS tags. Any role with that tag specified in its\ncondition field will be restricted to operating on resources with the same tag.\nYou can use this to restrict administrative roles to acting on resources in a\nspecific cluster or node pool.\n\nTo restrict an AWS IAM policy to apply only to resources with a specific tag,\ninclude the tag's value in the `Condition` field of the policy, then pass the\ntag value when you create your cluster and node pools. GKE on AWS\napplies this tag when it creates resources.\n\nFor more information on tags, see\n[Tagging AWS resources](https://docs.aws.amazon.com/general/latest/gr/aws_tagging.html).\nFor more information on using tags with an AWS policy, see\n[Controlling access to AWS resources](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_tags.html#access_tags_control-resources).\n\nFor more on creating cluster resources with a particular tag, see the\n[`gcloud container aws clusters create`](/sdk/gcloud/reference/container/aws/clusters/create#--tags)\nand\n[`gcloud container aws node-pools create`](/sdk/gcloud/reference/container/aws/node-pools/create#--tags)\nreference documentation.\n\nFor a list of specific permissions that GKE on AWS needs for each policy,\nsee the [AWS IAM role list](/kubernetes-engine/multi-cloud/docs/aws/reference/aws-iam-role-list)."]]
