Cloud Data Loss Prevention (Cloud DLP) 現已併入機密資料保護。API 名稱維持不變：Cloud Data Loss Prevention API (DLP API)。如要瞭解構成 Sensitive Data Protection 的服務，請參閱「Sensitive Data Protection 總覽」。
如要存取這兩項資源並執行對機密資料保護服務的呼叫，機密資料保護服務會使用 Cloud Data Loss Prevention 服務代理程式的憑證，向其他 API 進行驗證。 Google Cloud 服務代理程式是一種特殊的服務帳戶，可代表您執行內部 Google 程序。服務代理可以使用電子郵件識別：
系統會自動授予 Cloud Data Loss Prevention 服務代理人專案的常見權限，以便檢查資源，並列在 Google Cloud 控制台的 IAM 區段中。服務代理程式會與專案一起無限期存在，只有刪除專案時才會隨之刪除。Sensitive Data Protection 需要使用這個服務代理，因此請勿移除。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[],[],null,["# Sensitive Data Protection IAM permissions\n\nIAM permissions\n\n\u003cbr /\u003e\n\nCommon permissions\n------------------\n\nSome methods do not have Sensitive Data Protection-specific permissions. Instead,\nthey use common ones, as the methods can cause billable events, but do not\naccess any protected cloud resources.\n\nAll actions that trigger billable events such as the\n[`projects.content`](/sensitive-data-protection/docs/reference/rest/v2/projects.content)\nmethods require the `serviceusage.services.use` permission for the project\nthat's specified in `parent`. The `roles/editor`, `roles/owner`, and\n`roles/dlp.user` roles contain the required permission or you can define your\nown [custom roles](/iam/docs/creating-custom-roles) containing this permission.\n\nThis permission ensures you are authorized to bill the project you specify.\n\nService account\n---------------\n\nTo access both Google Cloud resources and execute calls to\nSensitive Data Protection,\nSensitive Data Protection uses the credentials of the\nCloud Data Loss Prevention Service Agent to authenticate to other APIs. A\nservice agent is a special type of service account that runs internal Google\nprocesses on your behalf. The service agent is identifiable using the email: \n\n```\nservice-PROJECT_NUMBER@dlp-api.iam.gserviceaccount.com\n```\n\nThe Cloud Data Loss Prevention Service Agent is created the first time it is\nneeded. You can create it in advance by making a call to\n[`InspectContent`](/sensitive-data-protection/docs/reference/rest/v2/projects.content/inspect): \n\n```bash\ncurl --request POST \\\n \"https://dlp.googleapis.com/v2/projects/\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e/locations/us-central1/content:inspect\" \\\n --header \"X-Goog-User-Project: \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e\" \\\n --header \"Authorization: Bearer $(gcloud auth print-access-token)\" \\\n --header 'Accept: application/json' \\\n --header 'Content-Type: application/json' \\\n --data '{\"item\":{\"value\":\"google@google.com\"}}' \\\n --compressed\n```\n\nReplace \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e with the [project ID](/resource-manager/docs/creating-managing-projects#before_you_begin).\n\nThe Cloud Data Loss Prevention Service Agent is automatically granted common\npermissions on the project that are needed for inspecting resources and is\nlisted in the IAM section of the Google Cloud console. The service agent exists\nindefinitely with the project and is only deleted when the project is deleted.\nSensitive Data Protection relies on this service agent, so you should not remove\nit.\n| **Note:** If you are using Sensitive Data Protection to scan critical resources, such as those protected by additional custom Identity and Access Management roles, you must assign those additional IAM roles to the Cloud Data Loss Prevention Service Agent. For example, if you want to use Sensitive Data Protection to inspect files in Google Cloud that are restricted to only a subset of individuals, you must grant the appropriate role to the Cloud Data Loss Prevention Service Agent.\n| **Warning:** If you remove the Cloud Data Loss Prevention Service Agent or revoke its roles, all [jobs](/sensitive-data-protection/docs/reference/rest/v2/projects.dlpJobs) and [job triggers](/sensitive-data-protection/docs/reference/rest/v2/projects.jobTriggers) will fail.\n\nFor more information on how service accounts are used in data profiling\noperations, see [Service agent container and service agent](/sensitive-data-protection/docs/data-profiles#service-agent-container).\n\nJob permissions\n---------------\n\nJob trigger permissions\n-----------------------\n\nInspection template permissions\n-------------------------------\n\nDe-identification template permissions\n--------------------------------------\n\nData profile permissions\n------------------------\n\nEstimate permissions\n--------------------\n\nStored infoType permissions\n---------------------------\n\nSubscription permissions\n------------------------\n\nChart permissions\n-----------------\n\nMiscellaneous permissions\n-------------------------"]]
