设置完整访问权限

本页描述了通过使用 curl 命令的 Timeseries Insights API 设置本地环境以进行试验所必需的基本步骤。

本指南介绍了如何设置具有 Timeseries Insights DataSet Owner 角色 (roles/timeseriesinsights.datasetsOwner) 的项目，该角色允许您创建和删除数据集。

准备工作

Sign in to your Google Cloud account. If you're new to Google Cloud, create an account to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.
Install the Google Cloud CLI.
如果您使用的是外部身份提供方 (IdP)，则必须先 使用联合身份登录 gcloud CLI。
如需初始化 gcloud CLI，请运行以下命令：
gcloud init
Create or select a Google Cloud project.
Note: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.
• Create a Google Cloud project:

  gcloud projects create PROJECT_ID

  Replace PROJECT_ID with a name for the Google Cloud project you are creating.

• Select the Google Cloud project that you created:

  gcloud config set project PROJECT_ID

  Replace PROJECT_ID with your Google Cloud project name.
Enable the Timeseries Insights API:
gcloud services enable timeseriesinsights.googleapis.com
Set up authentication:
1. Create the service account:

   gcloud iam service-accounts create SERVICE_ACCOUNT_NAME

   Replace SERVICE_ACCOUNT_NAME with a name for the service account.

2. Grant the roles/timeseriesinsights.datasetsOwner IAM role to the service account:

   gcloud projects add-iam-policy-binding PROJECT_ID --member="serviceAccount:SERVICE_ACCOUNT_NAME@PROJECT_ID.iam.gserviceaccount.com" --role=roles/timeseriesinsights.datasetsOwner

   Replace the following:

   • SERVICE_ACCOUNT_NAME: the name of the service account
   • PROJECT_ID: the project ID where you created the service account
   Note: The --role flag affects which resources the service account can access in your project. You can revoke these roles or grant additional roles later.

3. Grant the required role to the principal that will create the access tokens for the service account.

   gcloud iam service-accounts add-iam-policy-binding SERVICE_ACCOUNT_NAME@PROJECT_ID.iam.gserviceaccount.com --member="user:USER_EMAIL" --role=roles/iam.serviceAccountTokenCreator

   Replace the following:

   • SERVICE_ACCOUNT_NAME: the name of the service account
   • PROJECT_ID: the project ID where you created the service account
   • USER_EMAIL: the email address for a Google Account

Install the Google Cloud CLI.

如果您使用的是外部身份提供方 (IdP)，则必须先 使用联合身份登录 gcloud CLI。

如需初始化 gcloud CLI，请运行以下命令：

gcloud init

Create or select a Google Cloud project.

Note: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.

• Create a Google Cloud project:

  gcloud projects create PROJECT_ID

  Replace PROJECT_ID with a name for the Google Cloud project you are creating.

• Select the Google Cloud project that you created:

  gcloud config set project PROJECT_ID

  Replace PROJECT_ID with your Google Cloud project name.

Enable the Timeseries Insights API:

gcloud services enable timeseriesinsights.googleapis.com

Set up authentication:

1. Create the service account:

   gcloud iam service-accounts create SERVICE_ACCOUNT_NAME

   Replace SERVICE_ACCOUNT_NAME with a name for the service account.

2. Grant the roles/timeseriesinsights.datasetsOwner IAM role to the service account:

   gcloud projects add-iam-policy-binding PROJECT_ID --member="serviceAccount:SERVICE_ACCOUNT_NAME@PROJECT_ID.iam.gserviceaccount.com" --role=roles/timeseriesinsights.datasetsOwner

   Replace the following:

   • SERVICE_ACCOUNT_NAME: the name of the service account
   • PROJECT_ID: the project ID where you created the service account
   Note: The --role flag affects which resources the service account can access in your project. You can revoke these roles or grant additional roles later.

3. Grant the required role to the principal that will create the access tokens for the service account.

   gcloud iam service-accounts add-iam-policy-binding SERVICE_ACCOUNT_NAME@PROJECT_ID.iam.gserviceaccount.com --member="user:USER_EMAIL" --role=roles/iam.serviceAccountTokenCreator

   Replace the following:

   • SERVICE_ACCOUNT_NAME: the name of the service account
   • PROJECT_ID: the project ID where you created the service account
   • USER_EMAIL: the email address for a Google Account

用 curl 进行测试

1. 为调用 Google REST API 定义一个方便的 shell 别名：

   alias gcurl='curl -H "Authorization: Bearer $(gcloud auth print-access-token --impersonate-service-account=SERVICE_ACCOUNT_EMAIL)" -H "Content-Type: application/json"'

2. 使用项目的标识符设置环境变量 PROJECT_ID：

   PROJECT_ID="my-project-id"
   

3. 列出此项目中已启用的 API 和服务：

   gcurl "https://timeseriesinsights.googleapis.com/v1/projects/${PROJECT_ID}/datasets"
   

   如果您没有看到任何错误，则表示设置成功。

后续步骤

按照教程了解该 API。