下表列出 Memorystore for Valkey 支援的各項權限，以及包含這些權限的 Memorystore for Valkey 角色：
權限
Memorystore 角色
基本角色
memorystore.instances.list
Memorystore 管理員
Memorystore 編輯者
Memorystore 檢視者
檢視者
memorystore.instances.get
Memorystore 管理員
Memorystore 編輯者
Memorystore 檢視者
檢視者
memorystore.instances.create
Memorystore 管理員
擁有者
memorystore.instances.update
Memorystore 管理員
Memorystore 編輯者
編輯者
memorystore.instances.connect
Memorystore 管理員
Memorystore 資料庫連線使用者
擁有者
memorystore.instances.rescheduleMaintenance
Memorystore 管理員
擁有者
自訂角色
如果預先定義的角色無法滿足您的獨特業務需求，您可以指定權限來定義自己的自訂角色。為了支援這方面的需求，身分與存取權管理提供自訂角色的功能。為 Memorystore for Valkey 建立自訂角色時，請務必同時加入 resourcemanager.projects.get 和 resourcemanager.projects.list。否則， Google Cloud 主控台將無法針對 Memorystore for Valkey 正常運作。詳情請參閱「權限依附元件」。如要瞭解如何建立自訂角色，請參閱「建立自訂角色」。
傳輸中資料加密權限
下表列出為 Memorystore for Valkey 啟用及管理「傳輸中加密」所需的權限。
必須授予權限
建立啟用傳輸加密的 Memorystore 執行個體
下載憑證授權單位
memorystore.instances.create
✓
X
memorystore.instances.get
X
✓
網路連線政策建立角色
如網路頁面所述，網路管理員需要本節所述的權限，才能為 Memorystore for Valkey 建立服務連線政策。
如要建立 Memorystore for Valkey 執行個體所需的政策，網路管理員必須具備 networkconnectivity.consumerNetworkAdmin 角色，該角色會授予下列權限：
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-05 (世界標準時間)。"],[],[],null,["# Access control\n\nThis page explains the Identity and Access Management roles available for Memorystore for Valkey,\nand the associated permissions for those roles.\n\nTo learn how to grant the role to a user in your project, see [Grant or revoke a single role](/iam/docs/granting-changing-revoking-access#single-role).\n| **Note:** Modifications to IAM settings for Memorystore for Valkey take on the order of minutes to take effect.\n\nPredefined roles\n----------------\n\nThe following predefined roles are available for Memorystore for Valkey. If you update a role for an [Identity and Access Management principal](/iam/docs/overview#concepts_related_identity), the change takes several minutes to [take effect](/iam/docs/access-change-propagation).\n\n### Permissions and their roles\n\nThe following table lists each permission that Memorystore for Valkey supports\nand the Memorystore for Valkey roles that include it:\n\n### Custom roles\n\nIf the predefined roles do not address your unique business requirements, you\ncan define your own custom roles with permissions that you specify. To support\nthis, IAM offers [custom roles](/iam/docs/understanding-custom-roles). When you create custom roles\nfor Memorystore for Valkey, make sure that you include\nboth `resourcemanager.projects.get` and `resourcemanager.projects.list`.\nOtherwise, the Google Cloud console will not function correctly\nfor Memorystore for Valkey. For more information, see\n[Permission dependencies](/iam/docs/understanding-custom-roles#permission_dependencies).\nTo learn how to create a custom role, see [Creating a custom role](/iam/docs/creating-custom-roles#creating_a_custom_role).\n\nIn-transit encryption permissions\n---------------------------------\n\nThe table below shows permissions required for enabling and managing [In-transit encryption](/memorystore/docs/valkey/about-in-transit-encryption)\nfor Memorystore for Valkey.\n\nNetwork connectivity policy creation role\n-----------------------------------------\n\nThe permissions described in this section are needed for the Network Admin who\nis establishing a service connection policy for Memorystore for Valkey, as\ndescribed in the [Networking](/memorystore/docs/valkey/networking) page.\n\nTo establish the policy required for Memorystore for Valkey instance creation,\nthe Network Admin must have the `networkconnectivity.consumerNetworkAdmin`\nrole, which grants the following permissions:\n\n- networkconnectivity.serviceconnectionpolicies.create\n- networkconnectivity.serviceconnectionpolicies.list\n- networkconnectivity.serviceconnectionpolicies.get\n- networkconnectivity.serviceconnectionpolicies.delete\n- networkconnectivity.serviceconnectionpolicies.update"]]
