[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-02 (世界標準時間)。"],[],[],null,["# Access control with IAM\n\nThis page describes the Identity and Access Management (IAM) roles you can use to\nconfigure Secret Manager. Roles limit a principal's ability to\naccess resources. Always grant the minimum set of permissions required to\nperform a given task.\n\nSecret Manager roles\n--------------------\n\nFollowing are the IAM roles that are associated with\nSecret Manager. To learn how to grant, change, or revoke access to resources using\nIAM roles, see\n[Granting, changing, and revoking access to resources](/iam/docs/granting-changing-revoking-access).\n**Important:** To use Secret Manager with workloads running on Compute Engine or Google Kubernetes Engine, the underlying instance or node must have the `cloud-platform` OAuth scope. See [accessing the Secret Manager API](/secret-manager/docs/accessing-the-api#oauth-scopes) for more information. \n\nPrinciple of least privilege\n----------------------------\n\nWhen you follow the principle of least privilege, you grant the minimum level of\naccess to resources required to perform a given task. For example, if a\nprincipal needs access to a single secret, don't give that principal access to\nother secrets or all secrets in the project or organization. If a principal only\nneeds to read a secret, don't grant that principal the ability to modify the\nsecret.\n\nYou can use [IAM](/iam/docs/overview) to grant IAM\nroles and permissions at the level of the Google Cloud secret, project,\nfolder, or organization. Always apply permissions at the lowest level in the\n[resource hierarchy](/resource-manager/docs/cloud-platform-resource-hierarchy).\n\nThe following table shows the effective capabilities of a service account, based on the\nlevel of the resource hierarchy where the Secret Manager Secret Accessor role\n(`roles/secretmanager.secretAccessor`) is granted.\n\nThe role `roles/owner` includes the\n\\`secretmanager.versions.access\\` permission, but the `roles/editor`\nand `roles/viewer` do not.\n\nIf a principal only needs to access a single secret's value, don't grant that\nprincipal the ability to access **all** secrets. For example, you can grant a\nservice account the Secret Manager Secret Accessor role\n(`roles/secretmanager.secretAccessor`) on a single secret.\n\nIf a principal only needs to manage a single secret, don't grant that principal\nthe ability to manage all secrets. For example, you can grant a service\naccount the Secret Manager Admin role (`roles/secretmanager.admin`) on a single secret.\n\nIAM conditions\n--------------\n\n[IAM Conditions](/iam/docs/conditions-overview)\nallow you to define and enforce conditional, attribute-based access control for\nsome Google Cloud resources, including Secret Manager\nresources.\n\nIn Secret Manager, you can enforce conditional access\nbased on the following attributes:\n\n- **[Date/time attributes](/iam/docs/conditions-attribute-reference#date-time)**: Use to set expirable, scheduled, or limited-duration access to Secret Manager resources. For example, you could allow a user to access a secret until a specified date.\n- **[Resource attributes](/iam/docs/conditions-attribute-reference#resource)**: Use to configure conditional access based on a resource name, resource type, or resource service attributes. In Secret Manager, you can use attributes of secrets and secret versions to configure conditional access. For example, you can allow a user to manage secret versions only on secrets that begin with a specific prefix, or allow a user to access only a specific secret version.\n\nFor more information about IAM Conditions, see the\n[Conditions overview](/iam/docs/conditions-overview).\n\nWhat's next\n-----------\n\n- Learn how to [manage access to secrets](/secret-manager/docs/manage-access-to-secrets).\n- Learn how to apply the [principle of least privilege](/iam/docs/using-iam-securely#least_privilege) when managing Secret Manager resources by [creating and managing custom roles](/iam/docs/creating-custom-roles).\n- Learn about [IAM Conditions](/iam/docs/conditions-overview)."]]
