이 페이지에서는 Spanner 데이터베이스에 액세스할 수 있는 Compute Engine 가상 머신 인스턴스 권한을 부여하는 방법을 설명합니다.
인스턴스는 사용자를 대신하여 서비스 계정으로 Compute Engine에서 Cloud Spanner API에 액세스할 수 있습니다. 서비스 계정은 애플리케이션에 애플리케이션 기본 사용자 인증 정보를 제공하므로 개인 사용자 인증 정보를 사용하기 위해 각 Compute Engine 인스턴스를 구성할 필요가 없습니다.
ID 및 API 액세스 섹션에서 모든 Cloud API에 대한 전체 액세스 허용을 클릭합니다.
필요에 따라 다른 인스턴스 설정을 구성한 후 만들기를 클릭합니다.
이제 Compute Engine 인스턴스의 서비스 계정이 Cloud Spanner API에 액세스할 수 있으므로, 클라이언트 라이브러리를 사용하여 Spanner 데이터베이스에서 데이터를 읽고 쓸 수 있습니다. 인스턴스가 기본 서비스 계정의 사용자 인증 정보를 사용하여 Cloud Spanner API를 인증합니다.
서비스 계정을 사용하여 인스턴스 구성
특정 API와 역할에 대한 인스턴스 액세스를 제한하려면 Spanner 데이터베이스 액세스 권한만 가진 서비스 계정을 만듭니다. 그런 다음 이 서비스 계정을 인스턴스에 적용합니다.
사용자를 대신해 Spanner에 액세스하는 서비스 계정을 선택합니다. 다음 옵션 중 하나를 사용합니다.
이제 Compute Engine 인스턴스의 서비스 계정이 Cloud Spanner API에 액세스할 수 있으므로, 클라이언트 라이브러리를 사용하여 Spanner 데이터베이스에서 데이터를 읽고 쓸 수 있습니다. 인스턴스가 서비스 계정의 사용자 인증 정보를 사용하여 Cloud Spanner API를 인증합니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-05(UTC)"],[],[],null,["# Using Spanner in a virtual machine instance\n\nThis page describes how to grant your Compute Engine\n[virtual machine instance](/compute/docs/instances) permission to access a\nSpanner database.\n\nYour instance can access the Cloud Spanner API from Compute Engine by\nusing a service account to act on your behalf. The service account provides\n[application default credentials](https://developers.google.com/identity/protocols/application-default-credentials)\nfor your applications so that you don't need to configure each\nCompute Engine instance to use your personal user credentials.\n\nConfigure the service account on your instance with one of the following\noptions:\n\n- For easy development and testing, configure your instance to [use the default service account with full access to all Cloud APIs](#default-full-access).\n- For production environments, [create a service account with read and write access to your Spanner databases](#service-account) and apply it to your instance.\n\nConfigure an instance with access to all Cloud APIs\n---------------------------------------------------\n\nTo quickly allow your instance to access the Cloud Spanner API, create a new instance\nto use the default service account and a scope with full access to all Cloud\nAPIs.\n\n1. Go to the Compute Engine VM instances page.\n\n [Go to the VM instances page](https://console.cloud.google.com/compute/instances)\n2. Select your project and click **Continue**.\n\n3. Click **Create Instance** to start creating a new instance.\n\n4. In the **Identity and API access** section, click **Allow full access to all Cloud APIs**.\n\n5. Configure other instance settings as needed, then click **Create**.\n\nNow that the service account on your Compute Engine instance has access\nto the Cloud Spanner API, [use a client library](/spanner/docs/tutorials) to read\nand write data in your Spanner database. The instance uses the\ncredentials from the default service account to authenticate with the\nCloud Spanner API.\n\nConfigure an instance with a service account\n--------------------------------------------\n\nTo restrict instance access to specific APIs and roles, create a service\naccount with permission only to access your Spanner\ndatabases. Then, apply the service account to your instance.\n\n1. Select a service account that will act on your behalf to access\n Spanner. Use one of the following options:\n\n - [Create a new service account](/iam/docs/service-accounts-create).\n - [Identify an existing service account](/iam/docs/service-accounts-list-edit#listing) that you can use for your instance.\n2. [Grant a role to the service account](/iam/docs/granting-roles-to-service-accounts#granting_access_to_a_service_account_for_a_resource)\n so that it has the necessary permissions to access Spanner. For a\n list of roles that apply to Spanner, see\n [Access Control for Spanner](/spanner/docs/iam#roles).\n\n3. Go to the Compute Engine VM instances page.\n\n [Go to the VM instances page](https://console.cloud.google.com/compute/instances)\n4. Select your project and click **Continue**.\n\n5. Click **Create Instance** to start creating a new instance.\n\n6. In the **Identity and API access** section, select the service account\n from the list under **Service account**.\n\n7. Configure other instance settings as needed, then click **Create**.\n\nNow that the service account on your Compute Engine instance has access\nto the Cloud Spanner API, [use a client library](/spanner/docs/tutorials) to read\nand write data in your Spanner database. The instance uses the\nservice account credentials to authenticate with the Cloud Spanner API.\n\nWhat's next\n-----------\n\n- [Connect to your instance](/compute/docs/instances/connecting-to-instance) and follow a [client library tutorial](/spanner/docs/tutorials) to learn how to read and write data to Spanner from your instance.\n- Learn more about [service accounts on Compute Engine](/compute/docs/access/service-accounts) and how you can use them to grant IAM roles and API access scopes to the applications that run on your instances.\n- Learn how to [change service accounts on existing instances](/compute/docs/access/create-enable-service-accounts-for-instances#changeserviceaccountandscopes).\n- Learn more about [creating and starting an Compute Engine instances](/compute/docs/instances/create-start-instance)."]]
