Looker (Google Cloud Core) 使用 Identity and Access Management (IAM)，透過一組 IAM 角色佈建使用者和管理員存取權。如需 IAM 的詳細說明，請參閱 IAM 說明文件。 Google Cloud
什麼是身分與存取權管理 (IAM)
您可以透過 IAM 控管哪些人可存取 Google Cloud 專案中的資源。IAM 能讓您採用最低權限安全性原則，僅授予必要的資源存取權限給使用者。
主體是指 IAM 的「權限授予對象」。主體可以是個別使用者、群組或 Workspace 網域。主體會獲派角色，藉由角色授予的權限，在 Looker (Google Cloud Core) 及 Google Cloud 更廣的範圍中執行動作。每個角色具有一或多項權限。權限是 IAM 的基本單位：每種權限都能讓主體執行特定動作。
如要取得指派 Looker (Google Cloud Core) IAM 角色所需的權限，請要求管理員授予您執行個體所在專案的專案 IAM 管理員 (roles/resourcemanager.projectIamAdmin) IAM 角色。如要進一步瞭解如何授予角色，請參閱「管理專案、資料夾和機構的存取權」。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[],[],null,["# Looker (Google Cloud core) access control with IAM\n\nLooker (Google Cloud core) uses Identity and Access Management (IAM) to provision user and admin access through a set of [IAM roles](#iam-roles). For a detailed description of Google Cloud IAM, see the [IAM documentation](/iam/docs).\n\nWhat is Identity and Access Management (IAM)\n--------------------------------------------\n\nIAM lets you control who has access to the resources in your Google Cloud project. IAM lets you adopt the\n[security principle of least privilege](https://en.wikipedia.org/wiki/Principle_of_least_privilege),\nso you grant only the necessary access to your resources.\n\nPrincipals are the \"who\" of IAM. Principals can be individual users, groups, or Workspace domains. Principals are granted roles, which give them the ability to perform actions with Looker (Google Cloud core) as well as Google Cloud more generally. Each role is a collection of one or more permissions. Permissions are the basic units of IAM: each permission allows a principal to perform a certain action.\n\nFor example, the `looker.instances.login` permission lets a principal log in to Looker (Google Cloud core) instances. This permission is included in several [predefined](/iam/docs/roles-overview#role-types) roles, including the Looker Admin role (`roles/looker.admin`) and the Looker Instance User role (`roles/looker.instanceUser`).\n\nRequired role\n-------------\n\n\nTo get the permissions that\nyou need to assign Looker (Google Cloud core) IAM roles,\n\nask your administrator to grant you the\n\n\n[Project IAM Admin](/iam/docs/roles-permissions/resourcemanager#resourcemanager.projectIamAdmin) (`roles/resourcemanager.projectIamAdmin`)\nIAM role on the project in which the instance was created.\n\n\nFor more information about granting roles, see [Manage access to projects, folders, and organizations](/iam/docs/granting-changing-revoking-access).\n\n\nYou might also be able to get\nthe required permissions through [custom\nroles](/iam/docs/creating-custom-roles) or other [predefined\nroles](/iam/docs/roles-overview#predefined).\n| **Note:** [IAM basic\n| roles](/iam/docs/roles-overview#basic) might also contain permissions to assign Looker (Google Cloud core) IAM roles. You shouldn't grant basic roles in a production environment, but you can grant them in a development or test environment.\n\nIAM roles versus Looker roles\n-----------------------------\n\nTwo different kinds of roles grant permissions for Looker (Google Cloud core): IAM roles and Looker roles.\n\n- **Looker IAM roles:** These kinds of roles govern the following abilities:\n\n - Users' capabilities within the Google Cloud console with regard to Looker (Google Cloud core)\n\n When used together with [OAuth](/looker/docs/looker-core-oauth-authentication), they also govern the following abilities:\n - Users' abilities to sign in to a Looker (Google Cloud core) instance\n - Whether or not users are automatically assigned the **Admin via IAM** Looker role once they sign in to a Looker (Google Cloud core) instance. For more information, see the [Authentication and authorization with OAuth and IAM](/looker/docs/looker-core-oauth-authentication#auth) documentation.\n\n See the [IAM documentation](/iam/docs/manage-access-other-resources#grant-single-role) for information on how to grant IAM roles.\n- **Looker roles:** These kinds of roles govern what users can do once they sign in to a Looker (Google Cloud core) instance. See the [Roles](/looker/docs/admin-panel-users-roles) and [Groups](/looker/docs/admin-panel-users-groups) documentation pages for information on how to grant Looker roles.\n\nLooker roles are assigned or revoked within a Looker (Google Cloud core) instance, with the exception of the **Admin via IAM** Looker role, which can be assigned or revoked only through IAM. IAM roles can be assigned or revoked only in the Google Cloud console.\n\nLooker (Google Cloud core) IAM roles\n------------------------------------\n\n| **Note:** To learn more about roles, see the [Basic and predefined roles reference](/iam/docs/understanding-roles#looker-roles).\n\nThree predefined roles for Looker (Google Cloud core) users are available. These roles are granted at the Google Cloud project level and will control access uniformly for all Looker (Google Cloud core) instances within a Google Cloud project. If a user is authenticating with [OAuth](/looker/docs/looker-core-oauth-authentication), the IAM role assigned to each principal also affects which [Looker roles are assigned](/looker/docs/looker-core-oauth-authentication#auth) at sign into the instance.\n\nAt least one principal must have the Looker Admin (`roles/looker.admin`) IAM role.\n\nIf the predefined roles don't provide the set of permissions that you want, you can also create your own [custom roles](/iam/docs/creating-custom-roles).\n| **Warning:** The Looker Service Agent IAM role is intended only for the Looker [service account](/iam/docs/service-agents#looker-service-account) and is automatically assigned to the service account when the [Looker API is enabled](/looker/docs/looker-core-instance-create#before_you_begin). Don't grant [service agent](/iam/docs/service-agents) roles to any principals except service agents. Instead, choose a different [predefined role](/iam/docs/understanding-roles#predefined_roles), or create a [custom role](/iam/docs/understanding-custom-roles) with the permissions that you need.\n\nWhat's next\n-----------\n\n- [Use Google OAuth for Looker (Google Cloud core) user authentication](/looker/docs/looker-core-oauth-authentication)\n- [Manage users within Looker (Google Cloud core)](/looker/docs/looker-core-user-management)\n- [Configure a Looker (Google Cloud core) instance](/looker/docs/looker-core-instance-setup)\n- [Looker (Google Cloud core) admin settings](/looker/docs/looker-core-admin-looker)\n- [Administer a Looker (Google Cloud core) instance from the Google Cloud console](/looker/docs/looker-core-admin-console)"]]
