IAM 條件支援條件運算式，可用於檢查轉送規則的負載平衡配置方案。舉例來說，您可以有條件地授予 IAM 使用者主體建立內部負載平衡器的權限，但不授予建立外部負載平衡器的權限。如果該 IAM 使用者嘗試為外部負載平衡器建立轉送規則，Google Cloud 會拒絕該動作，並傳回類似以下的錯誤：
ERROR: (gcloud.compute.forwarding-rules.create) Could not fetch resource:
- Required 'compute.forwardingRules.create' permission for
'projects/PROJECT_ID/regions/REGION/forwardingRules/FORWARDING_RULE_NAME'
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[],[],null,["# IAM Conditions for forwarding rules\n\n[Identity and Access Management (IAM) Conditions](/iam/docs/conditions-overview) let you define\nIAM policies with conditional grants. You specify conditions in\nthe [role bindings](/iam/docs/reference/rest/v1/Binding) of a resource's IAM policy. If a\ncondition exists, the role is granted only when the condition expression\nevaluates to `true`. Each condition expression is a set of logic statements,\nletting you specify one or many attributes. For more information, see the\n[Attribute reference for IAM Conditions](/iam/docs/conditions-attribute-reference).\n\nWhen used with Cloud Load Balancing, IAM Conditions let you\nconditionally grant predefined roles --- such as Load Balancer Admin or\nNetwork Admin --- or custom roles.\n\nIAM Conditions supports a condition expression to check the [load\nbalancing scheme of a forwarding\nrule](/load-balancing/docs/forwarding-rule-concepts). For example, you can\nconditionally grant an IAM principal the ability to create\ninternal load balancers, but not external ones. If that IAM\nprincipal attempts to create a forwarding rule for an external load balancer,\nGoogle Cloud denies the action and returns an error like the following: \n\n```sh\nERROR: (gcloud.compute.forwarding-rules.create) Could not fetch resource:\n\n - Required 'compute.forwardingRules.create' permission for\n 'projects/PROJECT_ID/regions/REGION/forwardingRules/FORWARDING_RULE_NAME'\n```\n\n### Using IAM Conditions on Google Cloud load balancers\n\nThe load balancing scheme of a forwarding rule determines which type or types of\nload balancer can use the forwarding rule. In other words, the load balancing\nscheme corresponds to the load balancer type, as shown in the following table.\n| **Note:** Forwarding rules are also used for [protocol\n| forwarding](/load-balancing/docs/protocol-forwarding) and [Classic VPN\n| gateways](/network-connectivity/docs/vpn/concepts/overview) to provide forwarding information in the control plane. This page only discusses forwarding rules in the context of Cloud Load Balancing and [Traffic Director](/traffic-director/docs). However, IAM Conditions affect protocol forwarding and Classic VPN gateways as well.\n\nYou specify the `loadBalancingScheme` field when you create the load balancer.\nBy checking the `loadBalancingScheme` field in an IAM condition,\nyou can grant principals the ability to create certain types of load balancers.\n\n### Specifying IAM Conditions\n\nYou can set conditional role bindings using the same `setIamPolicy` method that\nyou use to configure any other role bindings. To set a role binding with a\ncondition on a project, you can use the REST API, the `gcloud` command-line\ntool, or the IAM page in the Google Cloud console.\n\nFor more information, see [Managing conditional policies](/iam/docs/managing-conditional-policies).\n\nExample condition expressions for load balancing\n------------------------------------------------\n\nThe following condition expression, which can be used in an IAM\npolicy, permits an API request only if one of the following is true:\n\n- The request doesn't involve creating a forwarding rule.\n- The request is to create a forwarding rule that has one of the internal\n load balancing schemes.\n\n !compute.isForwardingRuleCreationOperation() || (\n compute.isForwardingRuleCreationOperation() &&\n compute.matchLoadBalancingSchemes(['INTERNAL', 'INTERNAL_MANAGED'])\n )\n\nThe load balancing scheme `EXTERNAL` is omitted.\nIf a principal tries to create a forwarding rule with the `EXTERNAL` load\nbalancing scheme, a permissions error message appears.\n\n### Example policy\n\nThis example IAM policy for a project grants the\nIAM principal `jane@example.com` the Load Balancer Admin\npredefined role, excluding the ability to create external load balancers\n(because the load balancing scheme `EXTERNAL` is omitted). `jane@example.com`\ncan create internal load balancers, and can manage, modify, and delete any load\nbalancer. \n\n {\n \"bindings\": [\n {\n \"role\": \"roles/compute.loadBalancerAdmin\",\n \"members\": [\"user:jane@example.com\"],\n \"condition\": {\n \"title\": \"only_internal_lb_schemes\",\n \"description\": \"Internal LB creation only permitted\",\n \"expression\": \"\n !compute.isForwardingRuleCreationOperation() || (\n compute.isForwardingRuleCreationOperation() &&\n compute.matchLoadBalancingSchemes(['INTERNAL', 'INTERNAL_MANAGED'])\n )\n \"\n }\n }\n ]\n }\n\n### Granting GKE service account permissions for specific types of forwarding rules\n\nYou can also use IAM Conditions to limit access to the\nGKE service account to create only specific types of forwarding\nrules.\n\nThis JSON example demonstrates a complete IAM policy to grant the\nGKE service account\n(`service-`\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e`@container-engine-robot.iam.gserviceaccount.com`) the\nKubernetes Engine Service Agent role. This role allows the service account to\ncreate, modify, and delete load balancer components, except for external\nforwarding rules.\n\nUsing this conditional grant, the GKE service account can\nonly create *new* internal forwarding rules, but can manage all existing\nforwarding rules. \n\n {\n \"bindings\": [\n {\n \"role\": \"roles/container.serviceAgent\",\n \"members\": [\"serviceAccount:service-\u003cvar\u003ePROJECT_ID\u003c/var\u003e@container-engine-robot.iam.gserviceaccount.com\"],\n \"condition\": {\n \"title\": \"only_internal_lb_schemes\",\n \"description\": \"Internal LB Creation Only Permitted\",\n \"expression\": \"(\n compute.isForwardingRuleCreationOperation()\n &&\n compute.matchLoadBalancingSchemes(['INTERNAL', 'INTERNAL_MANAGED'])\n )\n ||\n !compute.isForwardingRuleCreationOperation()\n \"\n }\n }\n ]\n }\n\nAbsent other grants, attempting to create a new GKE Service of\ntype LoadBalancer, without the [annotation for an\ninternal passthrough Network Load Balancer](/kubernetes-engine/docs/how-to/internal-load-balancing),\nresults in an error message like the following: \n\n```\nError creating load balancer (will retry): failed to ensure load balancer for\nservice default/SERVICE-NAME: failed to create forwarding rule for load balancer\n(a01d427111c7011ea96e142010a80006(default/SERVICE-NAME)): googleapi: Error 403:\nRequired 'compute.forwardingRules.create' permission for\n'projects/PROJECT_ID/regions/[region]/forwardingRules/FORWARDING_RULE_NAME',\nforbidden\n```\n\nAlso, without other grants, attempting to create a new Ingress object\ncauses a similar error message because the Cloud Load Balancing Ingress\ncontroller needs to create an [external Application Load Balancer](/load-balancing/docs/https).\n\nGKE error messages are available using the\n`kubectl describe` and `kubectl get events -w` commands.\n\nWhat's next\n-----------\n\n- Learn more about [IAM](/iam/docs).\n- [Grant IAM roles](/iam/docs/granting-changing-revoking-access)."]]
