[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[],[],null,["# Access control for projects with IAM\n\nGoogle Cloud offers [Identity and Access Management (IAM)](/iam/docs/overview), which lets\nyou give more granular access to specific Google Cloud resources and\nprevents unwanted access to other resources. IAM lets you adopt\nthe\n[security principle of least privilege](https://wikipedia.org/wiki/Principle_of_least_privilege),\nso you grant only the necessary access to your resources.\n\nIAM lets you control **who (users)** has **what access (roles)**\nto **which resources** by setting allow policies. Allow policies grant specific\nroles to a user giving the user certain permissions.\n\nThis page explains the IAM permissions and roles you can use to\nmanage access to projects. For more information, see\n[Manage access to projects, folders, and organizations](/iam/docs/granting-changing-revoking-access).\n\n\n| **Note:** You can also use deny policies to prevent principals from using specific IAM permissions. For more information, see [Deny\n| policies](/iam/docs/deny-overview).\n\n\u003cbr /\u003e\n\n| **Note:** If you're getting started with Google Cloud, you can set up your resource hierarchy and grant initial access as part of the [Google Cloud setup process](/docs/enterprise/setup-checklist).\n\nPermissions and roles\n---------------------\n\nTo control access to resources, Google Cloud requires that accounts making API\nrequests have appropriate IAM roles. IAM roles\ninclude permissions that allow users to perform specific actions on\nGoogle Cloud resources. For example, the `resourcemanager.projects.delete`\npermission allows a user to delete a project.\n\nYou don't directly give users permissions; instead, you grant them *roles* ,\nwhich have one or more permissions bundled within them. You grant these roles on\na particular resource, but they also apply to all of that resource's descendants\nin the\n[resource hierarchy](/resource-manager/docs/cloud-platform-resource-hierarchy).\n\n### Permissions\n\nTo manage projects, the caller must have a role that includes the following\npermissions. The role is granted on the organization resource or folder that contains the\nprojects:\n\n### Using predefined roles\n\nIAM predefined roles allow you to carefully manage the set of\npermissions that your users have access to. For a full list of the roles that\ncan be granted at the project level, see\n[Understanding Roles](/iam/docs/understanding-roles).\n\nThe following table lists the predefined roles that you can use to grant access\nto a project. Each role includes a description of what the role does, and the\npermissions included in that role.\n\n### Basic roles\n\nAvoid using basic roles except when absolutely necessary. These roles are very\npowerful, and include a large number of permissions across all\nGoogle Cloud services. For more details on when you should use basic\nroles, see [Basic roles](/iam/docs/roles-overview#basic).\n\n### Creating custom roles\n\nIn addition to the predefined roles described in this topic, you can also create [custom roles](/iam/docs/understanding-custom-roles) that are collections of permissions that you tailor to your needs. When creating a custom role for use with Resource Manager, be aware of the following points:\n\n- List and get permissions, such as `resourcemanager.projects.get/list`, should always be granted as a pair.\n- When your custom role includes the `folders.list` and `folders.get` permissions, it should also include `projects.list` and `projects.get`.\n- Be aware that the `setIamPolicy` permission for organization, folder, and project resources allows the user to grant all other permissions, and so should be assigned with care.\n\nAccess control at the project level\n-----------------------------------\n\nYou can grant roles to users at the project level using the [Google Cloud console](https://console.cloud.google.com/),\nthe Cloud Resource Manager API, and the Google Cloud CLI. For instructions, see\n[Granting, Changing, and Revoking Access](/iam/docs/granting-changing-revoking-access).\n\n### Default roles\n\nWhen you create a project, you are granted the **roles/owner** role for the\nproject to provide you full control as the creator. This default role can be\nchanged as normal in an allow policy.\n\nVPC Service Controls\n--------------------\n\n**VPC Service Controls** can provide additional security when using the\nCloud Resource Manager API. To learn more\nabout VPC Service Controls, see the\n[VPC Service Controls overview](/vpc-service-controls/docs/overview).\n\nTo learn about the current limitations in using Resource Manager with\nVPC Service Controls, see the\n[supported products and limitations](/vpc-service-controls/docs/supported-products)\npage."]]
