角色：如要使用 Memorystore IAM 驗證，使用者必須具備 redis.clusters.connect 權限，才能向叢集進行驗證。如要取得這項權限，您可以將使用者或服務帳戶繫結至預先定義的 Redis Cluster DB Connection User (roles/redis.dbConnectionUser) 角色。如要進一步瞭解 IAM 角色，請參閱「角色」一文。
資源。主體存取的資源是 Memorystore 叢集。根據預設，IAM 政策繫結是在專案層級套用，因此主體會取得專案中所有 Memorystore 執行個體的角色權限。不過，IAM 政策繫結可以限制為特定叢集。如需操作說明，請參閱管理 IAM 驗證的權限。
Redis AUTH 指令
IAM 驗證功能會使用 Redis AUTH 指令與 IAM 整合，讓用戶端提供 IAM 存取權杖，並在允許存取資料前，由 Memorystore 叢集驗證權杖。
啟用 IAM 驗證功能後，每秒建立的用戶端連線速率會受到節流。這是因為 Google Cloud 的 IAM 驗證必須驗證每個新連線。在穩定狀態下，應用程式會啟用連線集區，因此影響微乎其微。不過，當用戶端應用程式透過部署或彈跳處理程序重新整理時，可能會再次建立大量連線。如果您逐步更新用戶端並實作指數輪詢間隔，就能吸收這項降幅。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[],[],null,["# About IAM authentication\n\nMemorystore provides the Identity and Access Management (IAM) authentication\nfeature that leverages IAM to help you better manage\nlogin access for users and service accounts. IAM-based\nauthentication integrates with Redis AUTH, letting you seamlessly rotate\ncredentials (IAM tokens) without relying on static passwords.\n\nFor instructions on setting up IAM authentication for your\nMemorystore cluster, see [Manage IAM authentication](/memorystore/docs/cluster/manage-iam-auth).\n\nIAM authentication for Redis\n----------------------------\n\nWhen using IAM authentication, permission to access a Memorystore cluster\nisn't granted directly to the end user. Instead, permissions are grouped into\nroles, and roles are granted to principals. For more information, see the\n[IAM overview](/iam/docs/overview).\n| **Note:** Memorystore lets you restrict access to a cluster by granting the **roles/redis.dbConnectionUser** role the users you choose. For information about limiting user access on a per-cluster basis, see [Grant access to a group of resources based on resource name prefixes](/iam/docs/configuring-resource-based-access#resource-name-instance). For more information about granting permissions for IAM authentication, see [Grant permissions for IAM authentication](/memorystore/docs/cluster/manage-iam-auth#grant_permissions_for_iam_authentication).\n\nAdministrators who authenticate with IAM can use\nMemorystore IAM authentication to centrally manage\naccess control to their instances using IAM policies.\nIAM policies involve the following entities:\n\n- *Principals* . In Memorystore, you can use two types of principals:\n A user account, and a service account (for applications). Other principal types,\n such as Google groups, Google Workspace domains, or Cloud Identity domains are\n not yet supported for IAM authentication. For more information,\n see [Concepts related to identity](/iam/docs/overview#concepts_related_identity).\n\n- *Roles* . For Memorystore IAM authentication, a\n user requires the **redis.clusters.connect** permission to authenticate with a\n cluster. To get this permission, you can bind the user or service account to the\n predefined Redis Cluster DB Connection User\n (**roles/redis.dbConnectionUser** ) role. For more information about\n IAM roles, see [Roles](/iam/docs/overview#roles).\n\n- *Resources* . The resources that principals access are Memorystore\n clusters. By default, IAM policy bindings are applied at the\n project-level, such that principals receive role permissions for all\n Memorystore instances in the project. However, IAM\n policy bindings can be restricted to a particular cluster. For instructions, see\n [Manage permissions for IAM authentication](/memorystore/docs/cluster/manage-iam-auth#manage_permissions_for_iam_authentication).\n\nRedis AUTH command\n------------------\n\nThe IAM authentication feature uses the Redis AUTH command to\nintegrate with IAM, allowing clients to provide an\nIAM access token that will be verified by the\nMemorystore cluster before allowing access to data.\n\nLike every command, the AUTH command is sent unencrypted unless [In Transit Encryption](/memorystore/docs/cluster/about-in-transit-encryption) is enabled.\n\nFor an example of what the AUTH command can look like, see [Connecting to a Redis cluster that uses IAM authentication](/memorystore/docs/cluster/manage-iam-auth#connect_to_a_cluster_that_uses_iam_authentication).\n\n### IAM access token time frame\n\nBy default, the IAM access token that you retrieve as a part of\nauthentication expires one hour after it's retrieved. Alternatively, when you [generate the access token](/iam/docs/create-short-lived-credentials-direct#create-access),\nyou can define the access token expiration time.\n\nWhen you establish a new Redis connection, you must present a valid access token by\nusing the `AUTH` command. If the token expires, then you must get a new\ntoken to establish new connections. However, if you already authenticated an existing connection, then it continues to work, even if the token expires.\n| **Note:** We strongly recommend that you [automate access token retrieval](/memorystore/docs/cluster/manage-iam-auth#automate_access_token_retrieval) in your application. You can't hardcode an access token because of its short lifetime.\n\n### End an authenticated connection\n\nIf you want to end the connection, then use the Redis `CLIENT KILL`\ncommand. To find the connection that you want to end, first run `CLIENT LIST`,\nwhich returns client connections in order of age. You can then run `CLIENT KILL`\nto end the connection.\n\n### Enable IAM authentication\n\nEnabling IAM authentication doesn't degrade steady state\nperformance. However, it does affect the rate that you can establish a\nconnection.\n\nEnabling IAM authentication throttles the rate of client\nconnections that are established every second. This is because Google Cloud's\nIAM authentication must authenticate each new connection. In\nsteady state, an application enables connection pools so this impact is\nnegligible. However, when client applications are refreshed through deployments\nor bounce processing, there might be an influx of connections established again.\nIf you update your clients gradually and you implement exponential backoffs,\nthen you can absorb this reduced rate.\n\nTo view a code sample of how to use IAM authentication, see\n[IAM authentication and in-transit encryption code sample](/memorystore/docs/cluster/client-library-connection#iam-auth-in-transit-encryption).\n\nSecurity and privacy\n--------------------\n\nIAM authentication helps you ensure that your Redis cluster is\nonly accessible by authorized IAM principals. TLS encryption is\nnot provided unless [In Transit Encryption](/memorystore/docs/cluster/about-in-transit-encryption)\nenabled. For this reason, it is recommended that In Transit Encryption\nbe turned on when using IAM authentication.\n\nConnect with a Compute Engine VM\n--------------------------------\n\nIf you are using a Compute Engine VM to [Connect to an instance that uses IAM authentication](/memorystore/docs/cluster/manage-iam-auth#connect_to_an_instance_that_uses_iam_authentication) you must enable the following access scopes and APIs for your project:\n\n- **Cloud Platform API scope** . For instructions on enabling this scope, see [Attach the service account and update the access scope](/compute/docs/instances/change-service-account#changeserviceaccountandscopes). For a description of best practices for this access scope, see [Scopes best practice](/compute/docs/access/service-accounts#scopes_best_practice).\n\n- **Memorystore for Redis Cluster API** . For a link to enable the API, click the following button:\n\n [Memorystore for Redis Cluster](https://console.cloud.google.com/apis/library/redis.googleapis.com)"]]
