Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Halaman ini menjelaskan cara memberikan izin ke instance virtual machine Compute Engine untuk mengakses database Spanner.
Instance Anda dapat mengakses Cloud Spanner API dari Compute Engine dengan menggunakan akun layanan untuk bertindak atas nama Anda. Akun layanan menyediakan
kredensial default aplikasi
untuk aplikasi Anda sehingga Anda tidak perlu mengonfigurasi setiap
instance Compute Engine untuk menggunakan kredensial pengguna pribadi Anda.
Konfigurasikan akun layanan di instance Anda dengan salah satu opsi berikut:
Mengonfigurasi instance dengan akses ke semua Cloud API
Untuk mengizinkan instance Anda mengakses Cloud Spanner API dengan cepat, buat instance baru untuk menggunakan akun layanan default dan cakupan dengan akses penuh ke semua Cloud API.
Klik Create Instance untuk mulai membuat instance baru.
Di bagian Identity and API access, klik Allow full access to all Cloud APIs.
Konfigurasikan setelan instance lainnya sesuai kebutuhan, lalu klik Create.
Setelah akun layanan di instance Compute Engine Anda memiliki akses
ke Cloud Spanner API, gunakan library klien untuk membaca
dan menulis data di database Spanner. Instance menggunakan kredensial dari akun layanan default untuk melakukan autentikasi dengan Cloud Spanner API.
Mengonfigurasi instance dengan akun layanan
Untuk membatasi akses instance ke API dan peran tertentu, buat akun
layanan dengan izin hanya untuk mengakses database
Spanner Anda. Kemudian, terapkan akun layanan ke instance Anda.
Pilih akun layanan yang akan bertindak atas nama Anda untuk mengakses
Spanner. Gunakan salah satu opsi berikut:
Klik Create Instance untuk mulai membuat instance baru.
Di bagian Identity and API access, pilih akun layanan dari daftar di bagian Service account.
Konfigurasikan setelan instance lainnya sesuai kebutuhan, lalu klik Create.
Setelah akun layanan di instance Compute Engine Anda memiliki akses
ke Cloud Spanner API, gunakan library klien untuk membaca
dan menulis data di database Spanner. Instance menggunakan
kredensial akun layanan untuk melakukan autentikasi dengan Cloud Spanner API.
Pelajari akun layanan di Compute Engine lebih lanjut
dan cara menggunakannya untuk memberikan peran IAM dan cakupan akses API ke
aplikasi yang berjalan di instance Anda.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-05 UTC."],[],[],null,["# Using Spanner in a virtual machine instance\n\nThis page describes how to grant your Compute Engine\n[virtual machine instance](/compute/docs/instances) permission to access a\nSpanner database.\n\nYour instance can access the Cloud Spanner API from Compute Engine by\nusing a service account to act on your behalf. The service account provides\n[application default credentials](https://developers.google.com/identity/protocols/application-default-credentials)\nfor your applications so that you don't need to configure each\nCompute Engine instance to use your personal user credentials.\n\nConfigure the service account on your instance with one of the following\noptions:\n\n- For easy development and testing, configure your instance to [use the default service account with full access to all Cloud APIs](#default-full-access).\n- For production environments, [create a service account with read and write access to your Spanner databases](#service-account) and apply it to your instance.\n\nConfigure an instance with access to all Cloud APIs\n---------------------------------------------------\n\nTo quickly allow your instance to access the Cloud Spanner API, create a new instance\nto use the default service account and a scope with full access to all Cloud\nAPIs.\n\n1. Go to the Compute Engine VM instances page.\n\n [Go to the VM instances page](https://console.cloud.google.com/compute/instances)\n2. Select your project and click **Continue**.\n\n3. Click **Create Instance** to start creating a new instance.\n\n4. In the **Identity and API access** section, click **Allow full access to all Cloud APIs**.\n\n5. Configure other instance settings as needed, then click **Create**.\n\nNow that the service account on your Compute Engine instance has access\nto the Cloud Spanner API, [use a client library](/spanner/docs/tutorials) to read\nand write data in your Spanner database. The instance uses the\ncredentials from the default service account to authenticate with the\nCloud Spanner API.\n\nConfigure an instance with a service account\n--------------------------------------------\n\nTo restrict instance access to specific APIs and roles, create a service\naccount with permission only to access your Spanner\ndatabases. Then, apply the service account to your instance.\n\n1. Select a service account that will act on your behalf to access\n Spanner. Use one of the following options:\n\n - [Create a new service account](/iam/docs/service-accounts-create).\n - [Identify an existing service account](/iam/docs/service-accounts-list-edit#listing) that you can use for your instance.\n2. [Grant a role to the service account](/iam/docs/granting-roles-to-service-accounts#granting_access_to_a_service_account_for_a_resource)\n so that it has the necessary permissions to access Spanner. For a\n list of roles that apply to Spanner, see\n [Access Control for Spanner](/spanner/docs/iam#roles).\n\n3. Go to the Compute Engine VM instances page.\n\n [Go to the VM instances page](https://console.cloud.google.com/compute/instances)\n4. Select your project and click **Continue**.\n\n5. Click **Create Instance** to start creating a new instance.\n\n6. In the **Identity and API access** section, select the service account\n from the list under **Service account**.\n\n7. Configure other instance settings as needed, then click **Create**.\n\nNow that the service account on your Compute Engine instance has access\nto the Cloud Spanner API, [use a client library](/spanner/docs/tutorials) to read\nand write data in your Spanner database. The instance uses the\nservice account credentials to authenticate with the Cloud Spanner API.\n\nWhat's next\n-----------\n\n- [Connect to your instance](/compute/docs/instances/connecting-to-instance) and follow a [client library tutorial](/spanner/docs/tutorials) to learn how to read and write data to Spanner from your instance.\n- Learn more about [service accounts on Compute Engine](/compute/docs/access/service-accounts) and how you can use them to grant IAM roles and API access scopes to the applications that run on your instances.\n- Learn how to [change service accounts on existing instances](/compute/docs/access/create-enable-service-accounts-for-instances#changeserviceaccountandscopes).\n- Learn more about [creating and starting an Compute Engine instances](/compute/docs/instances/create-start-instance)."]]
