[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-05 (世界標準時間)。"],[],[],null,["# Using Spanner in a virtual machine instance\n\nThis page describes how to grant your Compute Engine\n[virtual machine instance](/compute/docs/instances) permission to access a\nSpanner database.\n\nYour instance can access the Cloud Spanner API from Compute Engine by\nusing a service account to act on your behalf. The service account provides\n[application default credentials](https://developers.google.com/identity/protocols/application-default-credentials)\nfor your applications so that you don't need to configure each\nCompute Engine instance to use your personal user credentials.\n\nConfigure the service account on your instance with one of the following\noptions:\n\n- For easy development and testing, configure your instance to [use the default service account with full access to all Cloud APIs](#default-full-access).\n- For production environments, [create a service account with read and write access to your Spanner databases](#service-account) and apply it to your instance.\n\nConfigure an instance with access to all Cloud APIs\n---------------------------------------------------\n\nTo quickly allow your instance to access the Cloud Spanner API, create a new instance\nto use the default service account and a scope with full access to all Cloud\nAPIs.\n\n1. Go to the Compute Engine VM instances page.\n\n [Go to the VM instances page](https://console.cloud.google.com/compute/instances)\n2. Select your project and click **Continue**.\n\n3. Click **Create Instance** to start creating a new instance.\n\n4. In the **Identity and API access** section, click **Allow full access to all Cloud APIs**.\n\n5. Configure other instance settings as needed, then click **Create**.\n\nNow that the service account on your Compute Engine instance has access\nto the Cloud Spanner API, [use a client library](/spanner/docs/tutorials) to read\nand write data in your Spanner database. The instance uses the\ncredentials from the default service account to authenticate with the\nCloud Spanner API.\n\nConfigure an instance with a service account\n--------------------------------------------\n\nTo restrict instance access to specific APIs and roles, create a service\naccount with permission only to access your Spanner\ndatabases. Then, apply the service account to your instance.\n\n1. Select a service account that will act on your behalf to access\n Spanner. Use one of the following options:\n\n - [Create a new service account](/iam/docs/service-accounts-create).\n - [Identify an existing service account](/iam/docs/service-accounts-list-edit#listing) that you can use for your instance.\n2. [Grant a role to the service account](/iam/docs/granting-roles-to-service-accounts#granting_access_to_a_service_account_for_a_resource)\n so that it has the necessary permissions to access Spanner. For a\n list of roles that apply to Spanner, see\n [Access Control for Spanner](/spanner/docs/iam#roles).\n\n3. Go to the Compute Engine VM instances page.\n\n [Go to the VM instances page](https://console.cloud.google.com/compute/instances)\n4. Select your project and click **Continue**.\n\n5. Click **Create Instance** to start creating a new instance.\n\n6. In the **Identity and API access** section, select the service account\n from the list under **Service account**.\n\n7. Configure other instance settings as needed, then click **Create**.\n\nNow that the service account on your Compute Engine instance has access\nto the Cloud Spanner API, [use a client library](/spanner/docs/tutorials) to read\nand write data in your Spanner database. The instance uses the\nservice account credentials to authenticate with the Cloud Spanner API.\n\nWhat's next\n-----------\n\n- [Connect to your instance](/compute/docs/instances/connecting-to-instance) and follow a [client library tutorial](/spanner/docs/tutorials) to learn how to read and write data to Spanner from your instance.\n- Learn more about [service accounts on Compute Engine](/compute/docs/access/service-accounts) and how you can use them to grant IAM roles and API access scopes to the applications that run on your instances.\n- Learn how to [change service accounts on existing instances](/compute/docs/access/create-enable-service-accounts-for-instances#changeserviceaccountandscopes).\n- Learn more about [creating and starting an Compute Engine instances](/compute/docs/instances/create-start-instance)."]]
