為了授予在 AWS 帳戶中建立、更新、刪除及管理叢集的存取權，GKE on AWS 會在您的 Google Cloud 專案中建立服務代理程式。 Google Cloud 服務代理程式是Google 管理的服務帳戶，使用 GKE Multi-Cloud API AWS IAM 角色。您必須在每個 Google Cloud 專案中，為服務代理程式建立 AWS IAM 角色，以便從這些專案管理 GKE 叢集。服務代理會使用電子郵件地址 service-PROJECT_NUMBER@gcp-sa-gkemulticloud.iam.gserviceaccount.com。如要進一步瞭解 Google Cloud IAM 權限，請參閱「Anthos Multi-Cloud 服務代理程式」。
GKE on AWS 的 AWS IAM 權限
您可以建立使用預設 AWS IAM 角色的角色，也可以建立符合貴機構需求的自訂 AWS IAM 政策。
使用預設政策
AWS IAM 政策是一組權限。如要授予建立及管理叢集的權限，您必須先為下列角色建立 AWS IAM 政策：
GKE Multi-cloud API 服務代理人角色
GKE Multi-Cloud API 會使用這個 AWS IAM 角色，透過 AWS API 管理資源。這個角色是由 Google 代管的服務帳戶 (又稱服務代理程式) 使用。
控制層 AWS IAM 角色
叢集控制層會使用這個角色來控制節點集區。
節點集區 AWS IAM 角色
控制層會使用這個角色建立節點集區 VM。
如要使用 GKE on AWS 的建議 AWS IAM 角色管理叢集，請參閱「建立 AWS IAM 角色」。
建立自訂 IAM 政策
如要進一步限制權限，您可以建立允許 GKE on AWS 的自訂 AWS IAM 政策，而非使用建議政策。舉例來說，您可以將權限限制為具有特定標記的資源，或是特定 AWS VPC 中的資源
使用標記控管存取權
您可以使用 AWS 標記，限制 AWS IAM 政策只允許對一組有限的資源執行動作。如果角色的條件欄位中指定了該標記，則只能對具有相同標記的資源執行作業。您可以使用這項功能，將管理角色限制為只能對特定叢集或節點集區中的資源執行動作。
如要限制 AWS IAM 政策僅適用於具有特定標記的資源，請在政策的 Condition 欄位中加入標記的值，然後在建立叢集和節點集區時傳遞標記值。GKE on AWS 會在建立資源時套用這個標記。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-07-31 (世界標準時間)。"],[],[],null,["# About AWS IAM roles\n\nThis page describes how Google Cloud manages AWS Identity and Access\nManagement (IAM) permissions and roles for your GKE on AWS.\n\nGKE on AWS uses the AWS API to create resources such as EC2 instances,\nauto-scaling groups, and load balancers for both GKE on AWS components and\nyour workloads. You must provide Google Cloud with AWS IAM permissions to\ncreate these resources.\n\nHow GKE on AWS accesses the AWS API\n-----------------------------------\n\nGKE on AWS uses\n[identity federation in AWS](https://aws.amazon.com/identity/federation/)\nto manage fine-grained access to your AWS account. When GKE on AWS\nneeds to take an action for your cluster, it requests a short-lived token\nfrom AWS. The [GKE Multi-Cloud API role](#api-role) uses this token to authenticate\nto AWS.\n\nService agents\n--------------\n\nIn order to grant Google Cloud access to create, update, delete, and\nmanage clusters in your AWS account, GKE on AWS creates a\n[*Service agent*](/iam/docs/service-agents) in your Google Cloud project. The\nservice agent is a\n[Google-managed service account](/iam/docs/service-account-types#google-managed) that\nuses the [GKE Multi-Cloud API AWS IAM role](#api-role).\nYou must create an AWS IAM role for the\nservice agent in each Google Cloud project where you manage GKE clusters from.\nThe service agent uses the email address\n`service-`\u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e`@gcp-sa-gkemulticloud.iam.gserviceaccount.com`.\nFor more information on the Google Cloud IAM permissions,\nsee\n[Anthos Multi-Cloud Service Agent](/iam/docs/understanding-roles#gkemulticloud.serviceAgent).\n\nAWS IAM permissions for GKE on AWS\n----------------------------------\n\nYou can create roles that use default AWS IAM roles, or create your own\ncustom AWS IAM policies that meet your organization's requirements.\n\n### Use default policies\n\nAn AWS IAM policy is a collection of permissions. To grant permissions to\ncreate and manage clusters, you must first create AWS IAM\npolicies for the following roles:\n\nGKE Multi-Cloud API service agent role\n: The GKE Multi-Cloud API uses this AWS IAM role to manage resources using AWS APIs.\n This role is used by a Google-managed service account known as a\n [service agent](/iam/docs/service-agents).\n\nControl plane AWS IAM role\n: Your cluster control plane uses this role to control node pools.\n\nNode pool AWS IAM role\n: The control plane uses this role to create node pool VMs.\n\nTo use suggested AWS IAM roles for GKE on AWS to manage clusters,\nsee [Create AWS IAM roles](/kubernetes-engine/multi-cloud/docs/aws/how-to/create-aws-iam-roles).\n\n### Create custom IAM policies\n\nTo further restrict permissions, instead of using suggested policies you can\ncreate custom AWS IAM policies that allow GKE on AWS. For example, you can\nrestrict permissions to permissions to resources with a certain tag, or\nresources in a specific AWS VPC\n\n#### Controlling access with tags\n\nYou can restrict AWS IAM policies to allow actions only on a limited set of\nresources, using AWS tags. Any role with that tag specified in its\ncondition field will be restricted to operating on resources with the same tag.\nYou can use this to restrict administrative roles to acting on resources in a\nspecific cluster or node pool.\n\nTo restrict an AWS IAM policy to apply only to resources with a specific tag,\ninclude the tag's value in the `Condition` field of the policy, then pass the\ntag value when you create your cluster and node pools. GKE on AWS\napplies this tag when it creates resources.\n\nFor more information on tags, see\n[Tagging AWS resources](https://docs.aws.amazon.com/general/latest/gr/aws_tagging.html).\nFor more information on using tags with an AWS policy, see\n[Controlling access to AWS resources](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_tags.html#access_tags_control-resources).\n\nFor more on creating cluster resources with a particular tag, see the\n[`gcloud container aws clusters create`](/sdk/gcloud/reference/container/aws/clusters/create#--tags)\nand\n[`gcloud container aws node-pools create`](/sdk/gcloud/reference/container/aws/node-pools/create#--tags)\nreference documentation.\n\nFor a list of specific permissions that GKE on AWS needs for each policy,\nsee the [AWS IAM role list](/kubernetes-engine/multi-cloud/docs/aws/reference/aws-iam-role-list)."]]
