Looker(Google Cloud 핵심 서비스)는 Identity and Access Management(IAM)를 사용하여 IAM 역할 집합을 통해 사용자 및 관리 액세스를 프로비저닝합니다. Google Cloud IAM에 대한 자세한 내용은 IAM 문서를 참조하세요.
Identity and Access Management(IAM)란 무엇인가요?
IAM을 사용하면 Google Cloud 프로젝트의 리소스에 액세스할 수 있는 사용자를 제어할 수 있습니다. IAM은 최소 권한의 보안 원칙을 채택하여 리소스에 대해 필요한 액세스 권한만 부여할 수 있게 해줍니다.
주 구성원은 IAM의 '주체'입니다. 주 구성원은 개별 사용자, 그룹 또는 Workspace 도메인일 수 있습니다. 주 구성원에게는 역할이 부여되어 Looker(Google Cloud 핵심 서비스)는 물론 Google Cloud에서도 작업을 수행할 수 있습니다. 각 역할은 권한 하나 이상의 모음입니다. 권한은 IAM의 기본 단위입니다. 각 권한을 통해 주 구성원이 특정 작업을 수행할 수 있습니다.
예를 들어 looker.instances.login 권한이 있으면 주 구성원이 Looker(Google Cloud 핵심 서비스) 인스턴스에 로그인할 수 있습니다. 이 권한은 Looker 관리자 역할(roles/looker.admin) 및 Looker 인스턴스 사용자 역할(roles/looker.instanceUser)을 포함하여 여러 사전 정의된 역할에 포함되어 있습니다.
필요한 역할
Looker(Google Cloud 핵심 서비스) IAM 역할을 할당하는 데 필요한 권한을 얻으려면 관리자에게 인스턴스가 생성된 프로젝트의 프로젝트 IAM 관리자(roles/resourcemanager.projectIamAdmin)IAM 역할을 부여해 달라고 요청하세요.
역할 부여에 대한 자세한 내용은 프로젝트, 폴더, 조직에 대한 액세스 관리를 참조하세요.
Looker 역할: 이러한 종류의 역할은 사용자가 Looker(Google Cloud 핵심 서비스) 인스턴스에 로그인한 후 수행할 수 있는 작업을 제어합니다. Looker 역할을 부여하는 방법은 역할 및 그룹 문서 페이지를 참조하세요.
Looker(Google Cloud 핵심 서비스) 인스턴스 내에서 Looker 역할이 할당되면 IAM에서 부여하는 기본 Looker 역할을 재정의합니다.
Looker(Google Cloud 핵심 서비스) IAM 역할
Looker(Google Cloud 핵심 서비스) 사용자를 위해 사전 정의된 세 가지 역할을 사용할 수 있습니다. 이러한 역할은 Google Cloud 프로젝트 수준에서 부여되며 Google Cloud 프로젝트 내의 모든 Looker(Google Cloud 핵심 서비스) 인스턴스에 대한 액세스를 동일하게 제어합니다.
역할 이름
권한
Looker 뷰어
(roles/looker.viewer)
모든 Looker(Google Cloud 핵심 서비스) 리소스에 대한 읽기 전용 액세스 권한입니다.
looker.backups.get
looker.backups.list
looker.instances.get
looker.instances.list
looker.instances.login
looker.locations.get
looker.locations.list
looker.operations.get
looker.operations.list
resourcemanager.projects.get
resourcemanager.projects.list
Looker 인스턴스 사용자
roles/looker.instanceUser
Looker(Google Cloud 핵심 서비스) 인스턴스에 로그인할 수 있는 액세스 권한입니다.
looker.instances.get
looker.instances.login
resourcemanager.projects.get
resourcemanager.projects.list
Looker 관리자
roles/looker.admin
모든 Looker(Google Cloud 핵심 서비스) 리소스에 대한 전체 액세스 권한입니다.
looker.backups.create
looker.backups.delete
looker.backups.get
looker.backups.list
looker.instances.create
looker.instances.delete
looker.instances.export
looker.instances.get
looker.instances.import
looker.instances.list
looker.instances.login
looker.instances.update
looker.locations.get
looker.locations.list
looker.operations.cancel
looker.operations.delete
looker.operations.get
looker.operations.list
resourcemanager.projects.get
resourcemanager.projects.list
주 구성원 최소 한 명 이상에게 Looker 관리자(roles/looker.admin) IAM 역할이 있어야 합니다.
사전 정의된 역할이 원하는 권한 집합을 제공하지 못하는 경우 자체 맞춤 역할을 만들 수도 있습니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2024-12-22(UTC)"],[],[],null,["# Looker (Google Cloud core) access control with IAM\n\nLooker (Google Cloud core) uses Identity and Access Management (IAM) to provision user and admin access through a set of [IAM roles](#iam-roles). For a detailed description of Google Cloud IAM, see the [IAM documentation](/iam/docs).\n\nWhat is Identity and Access Management (IAM)\n--------------------------------------------\n\nIAM lets you control who has access to the resources in your Google Cloud project. IAM lets you adopt the\n[security principle of least privilege](https://en.wikipedia.org/wiki/Principle_of_least_privilege),\nso you grant only the necessary access to your resources.\n\nPrincipals are the \"who\" of IAM. Principals can be individual users, groups, or Workspace domains. Principals are granted roles, which give them the ability to perform actions with Looker (Google Cloud core) as well as Google Cloud more generally. Each role is a collection of one or more permissions. Permissions are the basic units of IAM: each permission allows a principal to perform a certain action.\n\nFor example, the `looker.instances.login` permission lets a principal log in to Looker (Google Cloud core) instances. This permission is included in several [predefined](/iam/docs/roles-overview#role-types) roles, including the Looker Admin role (`roles/looker.admin`) and the Looker Instance User role (`roles/looker.instanceUser`).\n\nRequired role\n-------------\n\n\nTo get the permissions that\nyou need to assign Looker (Google Cloud core) IAM roles,\n\nask your administrator to grant you the\n\n\n[Project IAM Admin](/iam/docs/roles-permissions/resourcemanager#resourcemanager.projectIamAdmin) (`roles/resourcemanager.projectIamAdmin`)\nIAM role on the project in which the instance was created.\n\n\nFor more information about granting roles, see [Manage access to projects, folders, and organizations](/iam/docs/granting-changing-revoking-access).\n\n\nYou might also be able to get\nthe required permissions through [custom\nroles](/iam/docs/creating-custom-roles) or other [predefined\nroles](/iam/docs/roles-overview#predefined).\n| **Note:** [IAM basic\n| roles](/iam/docs/roles-overview#basic) might also contain permissions to assign Looker (Google Cloud core) IAM roles. You shouldn't grant basic roles in a production environment, but you can grant them in a development or test environment.\n\nIAM roles versus Looker roles\n-----------------------------\n\nTwo different kinds of roles grant permissions for Looker (Google Cloud core): IAM roles and Looker roles.\n\n- **Looker IAM roles:** These kinds of roles govern the following abilities:\n\n - Users' capabilities within the Google Cloud console with regard to Looker (Google Cloud core)\n\n When used together with [OAuth](/looker/docs/looker-core-oauth-authentication), they also govern the following abilities:\n - Users' abilities to sign in to a Looker (Google Cloud core) instance\n - Whether or not users are automatically assigned the **Admin via IAM** Looker role once they sign in to a Looker (Google Cloud core) instance. For more information, see the [Authentication and authorization with OAuth and IAM](/looker/docs/looker-core-oauth-authentication#auth) documentation.\n\n See the [IAM documentation](/iam/docs/manage-access-other-resources#grant-single-role) for information on how to grant IAM roles.\n- **Looker roles:** These kinds of roles govern what users can do once they sign in to a Looker (Google Cloud core) instance. See the [Roles](/looker/docs/admin-panel-users-roles) and [Groups](/looker/docs/admin-panel-users-groups) documentation pages for information on how to grant Looker roles.\n\nLooker roles are assigned or revoked within a Looker (Google Cloud core) instance, with the exception of the **Admin via IAM** Looker role, which can be assigned or revoked only through IAM. IAM roles can be assigned or revoked only in the Google Cloud console.\n\nLooker (Google Cloud core) IAM roles\n------------------------------------\n\n| **Note:** To learn more about roles, see the [Basic and predefined roles reference](/iam/docs/understanding-roles#looker-roles).\n\nThree predefined roles for Looker (Google Cloud core) users are available. These roles are granted at the Google Cloud project level and will control access uniformly for all Looker (Google Cloud core) instances within a Google Cloud project. If a user is authenticating with [OAuth](/looker/docs/looker-core-oauth-authentication), the IAM role assigned to each principal also affects which [Looker roles are assigned](/looker/docs/looker-core-oauth-authentication#auth) at sign into the instance.\n\nAt least one principal must have the Looker Admin (`roles/looker.admin`) IAM role.\n\nIf the predefined roles don't provide the set of permissions that you want, you can also create your own [custom roles](/iam/docs/creating-custom-roles).\n| **Warning:** The Looker Service Agent IAM role is intended only for the Looker [service account](/iam/docs/service-agents#looker-service-account) and is automatically assigned to the service account when the [Looker API is enabled](/looker/docs/looker-core-instance-create#before_you_begin). Don't grant [service agent](/iam/docs/service-agents) roles to any principals except service agents. Instead, choose a different [predefined role](/iam/docs/understanding-roles#predefined_roles), or create a [custom role](/iam/docs/understanding-custom-roles) with the permissions that you need.\n\nWhat's next\n-----------\n\n- [Use Google OAuth for Looker (Google Cloud core) user authentication](/looker/docs/looker-core-oauth-authentication)\n- [Manage users within Looker (Google Cloud core)](/looker/docs/looker-core-user-management)\n- [Configure a Looker (Google Cloud core) instance](/looker/docs/looker-core-instance-setup)\n- [Looker (Google Cloud core) admin settings](/looker/docs/looker-core-admin-looker)\n- [Administer a Looker (Google Cloud core) instance from the Google Cloud console](/looker/docs/looker-core-admin-console)"]]
