舉例來說，您可以將某個特定資源 (例如專案) 的 roles/compute.networkAdmin 角色指派給一個 Google 帳戶，該帳戶即可控管專案中的網路相關資源，但無法管理執行個體和磁碟這類其他的資源。
Service Catalog IAM 角色
透過身分與存取權管理功能，Service Catalog API 和 Service Catalog Producer API 中的每個 API 方法都要求提出 API 要求的身分具備使用該資源的適當權限。只要設定政策將角色授予使用者、群組或服務帳戶等實體，即可授予權限。除了基本角色「擁有者」、「編輯者」和「檢視者」外，您還可以將本頁所述的服務目錄和服務目錄製作者角色指派給主體。
下表列出 Service Catalog 使用者可用的 IAM 角色。資料表會分成不同角色。
目錄機構管理員
角色名稱
說明
具備的權限
roles/cloudprivatecatalogproducer.orgAdmin
管理 Google Cloud機構層級的服務目錄設定。建立及管理 Service Catalog 資源，例如解決方案和目錄。
cloudprivatecatalogproducer.settings.*
cloudprivatecatalogproducer.catalogs.*
cloudprivatecatalogproducer.associations.*
cloudprivatecatalogproducer.targets.*
cloudprivatecatalogproducer.producerCatalogs.*
cloudprivatecatalogproducer.catalogAssociations.*
cloudprivatecatalogproducer.products.*
cloudprivatecatalog.targets.*
resourcemanager.projects.get
resourcemanager.projects.list
resourcemanager.folders.get
resourcemanager.folders.list
resourcemanager.organizations.get
目錄管理員
角色名稱
說明
具備的權限
roles/cloudprivatecatalogproducer.admin
建立及管理 Service Catalog 資源，例如解決方案和目錄。
cloudprivatecatalogproducer.catalogs.*
cloudprivatecatalogproducer.associations.*
cloudprivatecatalogproducer.targets.*
cloudprivatecatalogproducer.producerCatalogs.*
cloudprivatecatalogproducer.catalogAssociations.*
cloudprivatecatalogproducer.products.*
cloudprivatecatalog.targets.*
resourcemanager.projects.get
resourcemanager.projects.list
resourcemanager.folders.get
resourcemanager.folders.list
resourcemanager.organizations.get
目錄管理員
角色名稱
說明
具備的權限
roles/cloudprivatecatalogproducer.manager
查看解決方案和目錄，並與 Service Catalog 使用者分享目錄。
cloudprivatecatalog.targets.get
cloudprivatecatalogproducer.catalogs.get
cloudprivatecatalogproducer.catalogs.list
cloudprivatecatalogproducer.targets.*
cloudprivatecatalogproducer.associations.*
cloudprivatecatalogproducer.producerCatalogs.get
cloudprivatecatalogproducer.producerCatalogs.list
cloudprivatecatalogproducer.catalogAssociations.*
resourcemanager.projects.get
resourcemanager.projects.list
resourcemanager.folders.get
resourcemanager.folders.list
resourcemanager.organizations.get
目錄消費者
角色名稱
說明
具備的權限
roles/cloudprivatecatalog.consumer
瀏覽目錄。觀看次數和啟動解決方案。在目標 Google Cloud 資源 (例如組織、專案或資料夾) 下運作。
cloudprivatecatalog.targets.get
resourcemanager.projects.get
resourcemanager.projects.list
將使用者新增至 Service Catalog IAM 角色
使用者、Google 網路論壇或網域必須具備機構的 resourcemanager.organizations.setIamPolicy 權限，才能將使用者新增至 Service Catalog IAM 角色。您可以授予使用者或群組「機構管理員」角色 (roles/resourcemanager.organizationAdmin)，將該權限授予使用者或群組。
舉例來說，如果貴機構希望已獲授 Catalog 管理員角色的使用者也能從其他 Service Catalog IAM 角色新增及移除使用者和群組，機構管理員可以執行下列操作：
為使用者建立 Google 網路論壇群組 (MyCompanyCatalogAdmins)。
指派 Google 群組 (MyCompanyCatalogAdmins) 為「機構管理員」角色。
指派 Google 群組 (MyCompanyCatalogAdmins) 為目錄管理員角色。
在這個範例中，Google 群組 (MyCompanyCatalogAdmins) 的成員可以將使用者和群組指派給機構中的 IAM 角色，因為群組在獲得機構管理員角色時已獲得 setIamPolicy 權限。當新的目錄管理員加入機構時，請將他們加入 Google 群組 (MyCompanyCatalogAdmins)，授予所需角色。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[],[],null,["# Access control with IAM\n=======================\n\nThis page explains how you grant and manage access to Service Catalog\nusing Identity and Access Management (IAM).\n\n### Before you begin\n\n- You must have Service Catalog [enabled for your Google Cloud organization](/service-catalog/docs/quickstart#before_you_begin).\n- To grant Service Catalog IAM roles, you must have the [Organization Administrator](/resource-manager/docs/access-control-org#using_predefined_roles) (`roles/resourcemanager.organizationAdmin`) role for your Google Cloud organization.\n\nWhat is Identity and Access Management (IAM)?\n---------------------------------------------\n\nGoogle Cloud offers [Identity and Access Management (IAM)](https://cloud.google.com/iam/),\nwhich lets you give more granular access to specific Google Cloud resources\nand prevents unwanted access to other resources. IAM lets you\nadopt the [security principle of least privilege](https://en.wikipedia.org/wiki/Principle_of_least_privilege)\n,\nso you grant only the necessary access to your resources.\n\nIAM lets you control **who (identity)** has **what (roles)**\npermissions to **which** resources by setting IAM policies.\nIAM policies grant specific role(s) to a principal, giving the\nidentity certain permissions.\n\nFor example, for a given resource, such as a project, you can assign the\n`roles/compute.networkAdmin` role to a Google account and that account can\ncontrol network-related resources in the project, but cannot manage other\nresources, like instances and disks.\n\nService Catalog IAM roles\n-------------------------\n\nWith IAM, every API method in both the Service Catalog API\nand Service Catalog Producer API require that the identity making the API\nrequest has the appropriate permissions to use the resource. Permissions are\ngranted by setting policies that grant roles to a principal, such as a user,\ngroup, or service account. In addition to the basic roles,\n[Owner, Editor, and Viewer](/iam/docs/understanding-roles#basic),\nyou can assign the Service Catalog and Service Catalog\nProducer roles described in this page to principals.\n| **Note:** You can grant multiple roles to a principal on the same resource. For example, you can grant both `roles/cloudprivatecatalogproducer.admin` and `roles/cloudprivatecatalogproducer.manager` to your cloud admin team's [Google group](https://cloud.google.com/iam/docs/overview#google_group).\n\nThe following tables list the IAM roles available to\nService Catalog users. The tables are organized into different roles.\n\n### Catalog Org Admin\n\n### Catalog Admin\n\n### Catalog Manager\n\n### Catalog Consumer\n\nAdding users to Service Catalog IAM roles\n-----------------------------------------\n\nUsers, Google Groups, or domains must have the `resourcemanager.organizations.setIamPolicy`\npermission on the organization to add users to the Service Catalog\nIAM roles. You can give a user or group that permission by\ngranting them the Organization Administrator role\n(`roles/resourcemanager.organizationAdmin`).\n\nFor example, if your organization would like users granted the Catalog\nAdmin role to *also* be able to add and remove users and groups from\nthe other Service Catalog IAM roles, then an Organization\nAdministrator can do the following:\n\n- Create a Google Group for the users (`MyCompanyCatalogAdmins`).\n- Assign the Google Group (`MyCompanyCatalogAdmins`) the Organization Administrator role.\n- Assign the Google Group (`MyCompanyCatalogAdmins`) the Catalog Admin role.\n\nIn the example, members of the Google Group (`MyCompanyCatalogAdmins`)\ncan assign users and groups to IAM roles in the organization\nbecause the group has been granted the `setIamPolicy` permission when\ngranted the Organization Administrator role. As new Catalog Administrators join\nthe organization, add them to the Google Group (`MyCompanyCatalogAdmins`) to grant\nthem the desired roles.\n\nTo add a user, group, or domain to a Service Catalog IAM\nrole, follow these steps.\n\n1. Sign in to the Google Cloud console [IAM \\& admin page](https://console.cloud.google.com/iam-admin) as an Organization Administrator. \n [Go to the Google Cloud console IAM \\& admin page](https://console.cloud.google.com/iam-admin)\n2. Select **Cloud Private Catalog** from the side menu.\n3. Select the role to assign:\n - **Catalog Admin**\n - **Catalog Manager**\n - **Catalog Consumer**\n4. Specify the users, groups, or domains to add.\n\nWhat's next\n-----------\n\n- [Create a catalog](/service-catalog/docs/create-catalog)."]]
