Google Cloud 提供 Identity and Access Management (IAM)，可让您授予对特定 Google Cloud 资源的访问权限，并防止对其他资源进行未经授权的访问。本页面介绍了 Cloud SQL 如何与 IAM 集成。
如需详细了解 Google Cloud IAM，请参阅 IAM 文档。
Cloud SQL 提供了一组预定义角色，旨在帮助您控制对 Cloud SQL 资源的访问权限。如果预定义角色无法提供您所需的权限集，您还可以创建自己的自定义角色。此外，旧版基本角色（Editor、Viewer、Owner）仍可供您使用，但这些角色提供的控制不如 Cloud SQL 角色那样精细。具体而言，基本角色提供的是对整个 Google Cloud资源的访问权限，而不仅仅是对 Cloud SQL 的访问权限。如需详细了解 Google Cloud 基本角色，请参阅基本角色。
您可以在资源层次结构中的任一层级设置 IAM 政策：组织级、文件夹级或项目级。资源会继承其所有父级资源的政策。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-04。"],[],[],null,["# IAM authentication\n\n\u003cbr /\u003e\n\n[MySQL](/sql/docs/mysql/iam-authentication \"View this page for the MySQL database engine\") \\| [PostgreSQL](/sql/docs/postgres/iam-authentication \"View this page for the PostgreSQL database engine\") \\| SQL Server\n\n\u003cbr /\u003e\n\nGoogle Cloud offers Identity and Access Management (IAM), which lets you give\naccess to specific Google Cloud resources and prevent unwanted\naccess to other resources. This page describes how Cloud SQL is integrated with\nIAM .\nFor a detailed description of Google Cloud IAM, see\n[IAM documentation](/iam/docs).\n\nCloud SQL provides a set of [predefined roles](/sql/docs/sqlserver/iam-roles)\ndesigned to help you control access to your Cloud SQL resources. You can\nalso create your own [custom roles](/sql/docs/sqlserver/iam-roles#custom-roles),\nif the predefined roles don't provide the sets of permissions you need.\nIn addition, the legacy basic roles (Editor, Viewer, and Owner) are also still\navailable to you, although they don't provide\nthe same fine-grained control as the Cloud SQL roles. In particular, the\nbasic roles provide access to resources across Google Cloud, rather than just\nfor Cloud SQL. For more information about basic Google Cloud roles, see\n[Basic roles](/iam/docs/understanding-roles#basic).\n\nYou can set an IAM policy at any level in the\n[resource hierarchy](/iam/docs/overview#resource-hierarchy): the\norganization level, the folder level, or the project level.\nResources inherit the policies of all of their parent resources.\n\nIAM references for Cloud SQL\n----------------------------\n\n- [Required permissions for common tasks in the Google Cloud console](/sql/docs/sqlserver/iam-permissions#permissions-console)\n- [Required permissions for `gcloud sql` commands](/sql/docs/sqlserver/iam-permissions#permissions-gcloud)\n- [Required permissions for Cloud SQL Admin API methods](/sql/docs/sqlserver/iam-permissions#api-methods)\n- [Predefined Cloud SQL IAM roles](/sql/docs/sqlserver/iam-roles#roles)\n- [Permissions and their roles](/sql/docs/sqlserver/iam-roles#permissions-roles)\n- [Custom roles](/sql/docs/sqlserver/iam-roles#custom-roles)\n\nIAM authentication concepts\n---------------------------\n\nWhen using IAM authentication, permission to access a resource\n(a Cloud SQL instance) isn't granted *directly* to the end user. Instead,\npermissions are grouped into *roles* , and roles are granted to *principals* . For\nmore information, see the\n[IAM overview](/iam/docs/overview).\n\n\u003cbr /\u003e\n\nIAM policies involve the following entities:\n\n- **Principals** . In Cloud SQL, you can use two types of principals: a *user account* , and a *service account* (for applications). For more information, see [Concepts related to identity](/iam/docs/overview#concepts_related_identity).\n- **Roles** . A role is a collection of permissions. You can grant roles to principals to provide them with the privileges required to accomplish specific tasks. For more information about IAM roles, see [Roles](/iam/docs/overview#roles).\n- **Resource**. The resources that principals access are Cloud SQL instances. By default, IAM policy bindings are applied at the project-level, such that principals receive role permissions for all Cloud SQL instances in the project."]]
