이 페이지에서는 Cloud Marketplace에서 상용 제품을 구입하고 관리하는 데 필요한 ID 및 액세스 관리(IAM) 역할 및 권한에 대해 설명합니다.
IAM을 사용하면 누구(ID)에게 무슨 리소스에 대한 어떤 액세스 권한(역할)이 있는지 정의하여 액세스 제어를 관리할 수 있습니다. Cloud Marketplace의 상용 앱의 경우 Google Cloud 조직의 사용자는 Cloud Marketplace 요금제에 가입하고 결제 요금제를 변경하기 위해 IAM 역할이 필요합니다.
사용자 권한을 더 세밀하게 제어해야 할 경우 부여하려는 권한이 포함된 커스텀 역할을 만들 수 있습니다.
제품별 요구사항
Google Cloud 프로젝트에서 다음 서비스를 사용하려면 프로젝트 편집자 역할이 있어야 합니다.
Google Cloud Dataprep by Trifacta
Neo4j Aura Professional
IAM 역할 및 권한 목록
다음 IAM 역할 중 하나 이상을 사용자에게 부여할 수 있습니다.
사용자에게 부여하는 역할에 따라 Google Cloud 결제 계정, 조직, 프로젝트에도 역할을 할당해야 합니다. 자세한 내용은 사용자에게 IAM 역할 부여 섹션을 참조하세요.
사용자에게 IAM 역할 부여
위 표의 역할에서 consumerprocurement.orderAdmin 및 consumerprocurement.orderViewer 역할은 결제 계정 또는 조직 수준에서 할당되어야 하고, consumerprocurement.entitlementManager 및 consumerprocurement.entitlementViewer 역할은 프로젝트 또는 조직 수준에서 할당되어야 합니다.
특정 Marketplace 제품은 파트너의 외부 웹사이트에 싱글 사인온(SSO)을 지원합니다. 조직 내 승인된 사용자는 제품 세부정보 페이지의 '제공업체에서 관리' 버튼에 액세스할 수 있습니다. 이 버튼은 사용자를 파트너의 웹사이트로 안내합니다. 경우에 따라 사용자에게 'Google 계정으로 로그인' 메시지가 표시됩니다. 다른 경우에는 사용자가 공유 계정 컨텍스트에 로그인됩니다.
SSO 기능에 액세스하는 경우 사용자는 제품 세부정보 페이지로 이동하여 적절한 프로젝트를 선택합니다. 프로젝트는 요금제를 구매한 결제 계정에 연결되어 있어야 합니다. Marketplace 요금제 관리에 대한 자세한 내용은 결제 요금제 관리를 참조하세요.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-04(UTC)"],[],[],null,["# Access control with IAM\n\nThis page describes the Identity and Access Management (IAM) roles and permissions\nthat you need to purchase and manage commercial products on Cloud Marketplace.\n\nWith IAM, you manage access control by defining *who* (identity)\nhas *what access* (role) for *which resource*. For commercial apps on\nCloud Marketplace, users in your Google Cloud organization require\nIAM roles to sign up for Cloud Marketplace plans, and to\nmake changes to billing plans.\n\n- [Learn about managing billing for Cloud Marketplace products](/marketplace/docs/manage-billing).\n- [Learn about factors that affect your bill](/marketplace/docs/understanding-billing).\n- [Learn about the basic concepts of IAM](/iam/docs/overview).\n- [Learn about the hierarchy of Google Cloud resources](/resource-manager/docs/cloud-platform-resource-hierarchy).\n\nBefore you begin\n----------------\n\n- To grant Cloud Marketplace roles and permissions using `gcloud`, install the [gcloud CLI](/sdk/docs/downloads-interactive). Otherwise, you can grant roles using the Google Cloud console.\n\nIAM roles for purchasing and managing products\n----------------------------------------------\n\nWe recommend that you assign the\n[Billing Account Administrator](/iam/docs/understanding-roles#billing-roles)\nIAM role to users who are purchasing services from\nCloud Marketplace.\n\nUsers who want to access the services must have the\n[Viewer](/iam/docs/understanding-roles#basic) role, at a minimum.\n\nFor more granular control over users' permissions, you can\n[create custom roles](#custom-roles) with the permissions that you want to\ngrant.\n\n### Product-specific requirements\n\nTo use the following services in a Google Cloud project, you must have the\n[Project Editor](/iam/docs/understanding-roles#basic) role:\n\n- Google Cloud Dataprep by Trifacta\n- Neo4j Aura Professional\n\n### List of IAM roles and permissions\n\nYou can grant users one or more of the following IAM roles.\nDepending on the role you are granting to users, you must also assign the role\nto a Google Cloud billing account, organization, or project. For details,\nsee the section on [Granting IAM roles to users](#grant-roles). \n\nGranting IAM roles to users\n---------------------------\n\nFrom the roles in the [table](#roles-permissions) above, the\n`consumerprocurement.orderAdmin` and `consumerprocurement.orderViewer` roles\nmust be assigned at the billing account or organization level, and the\n`consumerprocurement.entitlementManager` and `consumerprocurement.entitlementViewer`\nroles must be assigned at the project or organization level.\n\nTo grant roles to users using `gcloud`, run one of the following commands: \n\n### Organization\n\nYou must have the [`resourcemanager.organizationAdmin`](/iam/docs/understanding-roles#resource-manager-roles)\nrole to assign roles at the organization level. \n\n gcloud organizations add-iam-policy-binding \u003cvar translate=\"no\"\u003eorganization-id\u003c/var\u003e \\\n --member=\u003cvar translate=\"no\"\u003emember\u003c/var\u003e --role=\u003cvar translate=\"no\"\u003erole-id\u003c/var\u003e\n\nThe placeholder values are:\n\n- \u003cvar translate=\"no\"\u003eorganization-id\u003c/var\u003e: The numeric ID of the organization that you are granting the role for.\n- \u003cvar translate=\"no\"\u003emember\u003c/var\u003e: The user that you are granting access to.\n- \u003cvar translate=\"no\"\u003erole-id\u003c/var\u003e: The role ID, from the previous table.\n\n### Billing account\n\nYou must have the [`billing.admin`](/iam/docs/understanding-roles#billing-roles)\nrole to assign roles at the billing account level. \n\n gcloud beta billing accounts set-iam-policy \u003cvar translate=\"no\"\u003eaccount-id\u003c/var\u003e \\\n \u003cvar translate=\"no\"\u003epolicy-file\u003c/var\u003e\n\nThe placeholder values are:\n\n- \u003cvar translate=\"no\"\u003eaccount-id\u003c/var\u003e: Your billing account ID, which you can get from the [Manage billing accounts page](https://console.cloud.google.com/billing).\n- \u003cvar translate=\"no\"\u003epolicy-file\u003c/var\u003e: [An IAM policy file](/iam/docs/reference/rest/v1/Policy), in JSON or YAML format. The policy file must contain the role IDs from the previous table, and the users that you are assigning the roles to.\n\n### Project\n\nYou must have the [`resourcemanager.folderAdmin`](/iam/docs/understanding-roles#resource-manager-roles)\nrole to assign roles at the project level. \n\n gcloud projects add-iam-policy-binding \u003cvar translate=\"no\"\u003eproject-id\u003c/var\u003e \\\n --member=\u003cvar translate=\"no\"\u003emember\u003c/var\u003e --role=\u003cvar translate=\"no\"\u003erole-id\u003c/var\u003e\n\nThe placeholder values are:\n\n- \u003cvar translate=\"no\"\u003eproject-id\u003c/var\u003e: The project that you are granting the role for.\n- \u003cvar translate=\"no\"\u003emember\u003c/var\u003e: The user that you are granting access to.\n- \u003cvar translate=\"no\"\u003erole-id\u003c/var\u003e: The role ID, from the previous table.\n\nTo grant roles to users using the Google Cloud console, see the IAM\ndocumentation on [Granting, changing, and revoking access for users](/iam/docs/granting-changing-revoking-access).\n\n### Using custom roles with Cloud Marketplace\n\nIf you want granular control over the permissions you grant users, you can\n[create custom roles](/iam/docs/creating-custom-roles) with the permissions\nthat you want to grant.\n\nIf you're creating a custom role for users who purchase services from\nCloud Marketplace, the role must include these permissions for the\nbilling account they use to purchase services:\n\n- `billing.accounts.get`, which is typically granted with the [`roles/consumerprocurement.orderAdmin`](/iam/docs/understanding-roles#billing-roles) role.\n- `consumerprocurement.orders.get`, which is typically granted with the [`roles/consumerprocurement.orderAdmin`](#roles-permissions) role.\n- `consumerprocurement.orders.list`, which is typically granted with the [`roles/consumerprocurement.orderAdmin`](#roles-permissions) role.\n- `consumerprocurement.orders.place`, which is typically granted with the [`roles/consumerprocurement.orderAdmin`](#roles-permissions) role.\n- `consumerprocurement.accounts.get`, which is typically granted with the [`roles/consumerprocurement.orderAdmin`](#roles-permissions) role.\n- `consumerprocurement.accounts.list`, which is typically granted with the [`roles/consumerprocurement.orderAdmin`](#roles-permissions) role.\n- `consumerprocurement.accounts.create`, which is typically granted with the [`roles/consumerprocurement.orderAdmin`](#roles-permissions) role.\n\nAccessing partner websites with Single Sign-on (SSO)\n----------------------------------------------------\n\nCertain Marketplace products support Single Sign-on (SSO) to a partner's\nexternal website. Authorized users within the organization have access to\na \"MANAGE ON PROVIDER\" button on the product details page. This\nbutton directs users to the partner's website. In some cases, users are\nprompted to \"Sign in with Google\". In other cases, users are signed in a\nshared account context.\n\nIn order to access the SSO capability, users navigate to the product\ndetails page, and select an appropriate project. The project must be linked to\na billing account where the plan has been purchased. For details about Marketplace\nplan management, see\n[Managing billing plans](/marketplace/docs/manage-billing#manage_billing_plan).\n\nAdditionally, the user must have sufficient IAM permissions within the selected\nproject. For most products, the [`roles/consumerprocurement.entitlementManager`](#roles-permissions) (or\n[`roles/editor`](#roles-permissions)\n[basic role](/iam/docs/understanding-roles#basic)) is currently required.\n\n### Minimal permissions for specific products\n\nThe following products can operate on a different set of permissions to access\nSSO capabilities:\n\n- Apache Kafka on Confluent Cloud\n- DataStax Astra for Apache Cassandra\n- Elastic Cloud\n- Neo4j Aura Professional\n- Redis Enterprise Cloud\n\nFor these products, you can use the following minimal permissions:\n\n- `consumerprocurement.entitlements.get`\n- `consumerprocurement.entitlements.list`\n- `serviceusage.services.get`\n- `serviceusage.services.list`\n- `resourcemanager.projects.get`\n\nThese permissions are typically granted with the\n[`roles/consumerprocurement.entitlementManager`](#roles-permissions) or\n[`roles/consumerprocurement.entitlementViewer`](#roles-permissions) roles."]]
