請注意，上述範例會取代所有現有的服務層級 IAM 政策。如要逐步授予新角色，您必須在要求主體中納入所有 IAM 政策。
在服務用戶層級授予角色
您可以在服務消費者層級授予 roles/servicemanagement.serviceController 角色。服務消費者層級權限規定，對 Service Control API 的要求必須包含至少一個有效的服務消費者專案 ID。以下範例使用「開始使用」指南「使用 curl 進行測試」一節中定義的 gcurl 別名：
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[],[],null,["# Service Control API Access Control\n\nTo invoke the Service Control API for a\n[managed service](/service-infrastructure/docs/glossary#managed), the caller must have the following\n[Identity and Access Management (IAM)](/iam) permissions on the service:\n\n- [`services.check`](/service-infrastructure/docs/service-control/reference/rest/v1/services/check) requires permission `servicemanagement.services.check`.\n- [`services.report`](/service-infrastructure/docs/service-control/reference/rest/v1/services/report) requires permission `servicemanagement.services.report`.\n- [`services.allocateQuota`](/service-infrastructure/docs/service-control/reference/rest/v1/services/allocateQuota) requires permission `servicemanagement.services.quota`.\n\nThe IAM roles `roles/servicemanagement.serviceController`,\n`roles/owner` and `roles/editor` include these permissions and can each be used\nto grant them. We recommend using the IAM role\n`roles/servicemanagement.serviceController` to run your managed services. While\n`roles/owner` and `roles/editor` also grant these permissions, the narrower role\nis better for security reasons.\n\nResource model\n--------------\n\nIAM applies IAM policies on resources to control\nwho can perform what actions on the resources. The Service Control API\nuses the following resources to provide its functionality:\n\n- **Service producer project** : A [service producer](/service-infrastructure/docs/glossary#producer) project may own zero or more managed services. The service producer project is the parent of services in this hierarchy.\n- **Managed service** : A managed service may have zero or more [service consumers](/service-infrastructure/docs/glossary#consumer).\n- **Service consumer** : A [service consumer](/service-infrastructure/docs/glossary#consumer) refers to a Google Cloud project that has enabled the service.\n\nThe IAM access control is applied to the resource model. If a\nrole is granted at the service producer project level, it affects all managed\nservices owned by the producer project. If a role is granted at the managed\nservice level, it affects all service consumers of the managed service.\n\nIt is highly recommended that you only create one managed service per service\nproducer project for security and isolation reasons. Otherwise, for example, if\nthe service producer project runs out of quota for sending requests to the\nService Control API, multiple managed services will be impacted.\n\nIf you have a multi-tenant service, you should grant the role\n`roles/servicemanagement.serviceController` at the managed service\nlevel. If you have a single-tenant service, in other words, a service where\neach service consumer gets its own instance of your managed service, you should\ngrant the role at the service consumer level. For background data processing\nthat affects all service consumers, you should grant the role at the managed\nservice level.\n\nGrant roles\n-----------\n\nTo call the Service Control API, you must grant the necessary roles to\nthe callers. You can grant the roles via one of the following three approaches.\nYou need to be an owner of the service producer project so that you can grant\nthe necessary roles.\n\n### Grant a role at the service producer project level\n\nYou can grant the necessary roles on the project that a managed service belongs\nto, following the instructions in\n[Granting, changing, and revoking access to resources](/iam/docs/granting-changing-revoking-access), or use the\nGoogle Cloud CLI\n[add-iam-policy-binding](/sdk/gcloud/reference/projects/add-iam-policy-binding)\ncommand to grant the roles.\n\nFor example, you can grant the roles to a service account, such as\n`foo@developer.gserviceaccount.com`: \n\n```\ngcloud projects add-iam-policy-binding PRODUCER_PROJECT_ID --member serviceAccount:SERVICE_ACCOUNT --role roles/servicemanagement.serviceController\n```\n\nSimilarly, you can grant the roles to a user account, such as `bar@gmail.com`: \n\n```\ngcloud projects add-iam-policy-binding PRODUCER_PROJECT_ID --member user:USER_ACCOUNT --role roles/servicemanagement.serviceController\n```\n\n### Grant a role at the service level\n\nYou can grant the role `roles/servicemanagement.serviceController` at the\nservice level using `curl`. The following example uses the `gcurl` alias\ndefined in the\n[Test with curl](/service-usage/docs/set-up-development-environment#test)\nsection of the **Getting started** guide: \n\n```\ngcurl -d \"{\n 'policy': {\n 'bindings': [ {\n role: 'roles/servicemanagement.serviceController',\n members: 'serviceAccount:SERVICE_ACCOUNT'\n } ]\n }\n}\" https://servicemanagement.googleapis.com/v1/services/YOUR_SERVICE_NAME:setIamPolicy\n```\n\nPlease note the above example will replace all existing service level IAM policies. To grant the new role incrementally, you need to include all IAM policies in the request body.\n\n### Grant a role at the service consumer level\n\nYou can grant the role `roles/servicemanagement.serviceController` at the\nservice consumer level. Service consumer level permissions require that the\nrequest to the Service Control API must contain at least one valid\nservice consumer project ID. The following example uses the `gcurl` alias\ndefined in the\n[Test with curl](/service-usage/docs/set-up-development-environment#test)\nsection of the **Getting started** guide: \n\n```\ngcurl -d \"{\n 'policy': {\n 'bindings': [ {\n role: 'roles/servicemanagement.serviceController',\n members: 'serviceAccount:SERVICE_ACCOUNT'\n } ]\n }\n}\" https://servicemanagement.googleapis.com/v1/services/YOUR_SERVICE_NAME/consumers/CONSUMER_PROJECT_NUMBER:setIamPolicy\n```\n\nPlease note the above example will replace all existing consumer project level IAM policies. To grant the new role incrementally, you need to include all IAM policies in the request body.\n\nFor more information, see [Cloud Auth Guide](/docs/authentication)."]]
