범위가 지정된 액세스 정책을 위임받은 위임된 관리자에게 범위가 지정된 정책이 바인딩된 폴더나 프로젝트에 대한 cloudasset.assets.searchAllResources 권한이 있어야 합니다.
위임된 관리자가 모든 Google Cloud 리소스를 검색하려면 이 권한이 필요합니다.
VPC 서비스 제어 페이지에서 범위가 지정된 정책의 상위 요소인 액세스 정책을 선택합니다. 예를 들어 default policy 조직 정책을 선택할 수 있습니다.
정책 관리를 클릭합니다.
VPC 서비스 제어 관리 페이지에서 만들기를 클릭합니다.
액세스 정책 만들기 페이지의 액세스 정책 이름 상자에 범위가 지정된 액세스 정책의 이름을 입력합니다.
범위가 지정된 액세스 정책 이름의 최대 길이는 50자(영문 기준)이고 문자로 시작해야 하며 ASCII 라틴 문자(a~z, A~Z), 숫자(0~9) 또는 밑줄(_)만 이름에 사용할 수 있습니다. 범위가 지정된 액세스 정책 이름은 대소문자를 구분하며 조직의 액세스 정책 내에서 고유해야 합니다.
POLICY_TITLE은 인간이 읽을 수 있는 정책 제목입니다.
정책 제목의 최대 길이는 50자(영문 기준)이고 문자로 시작해야 하며 ASCII 라틴 문자(a~z, A~Z), 숫자(0~9), 밑줄(_)만 이름에 사용할 수 있습니다. 정책 제목은 대소문자를 구분하며 조직의 액세스 정책 내에서 고유해야 합니다.
SCOPE는 이 정책이 적용되는 폴더나 프로젝트입니다. 폴더 또는 프로젝트 하나만 범위로 지정할 수 있으며 범위는 지정된 조직 내에 있어야 합니다. 범위를 지정하지 않으면 정책이 전체 조직에 적용됩니다.
다음 출력이 표시됩니다. 여기서 POLICY_NAME은 Google Cloud에서 할당한 고유한 정책 숫자 식별자입니다.
Create request issued
Waiting for operation [accessPolicies/POLICY_NAME/create/1521580097614100] to complete...done.
Created.
PRINCIPAL은 binding이 추가되는 주 구성원입니다. user|group|serviceAccount:email 또는 domain:domain 형식으로 지정합니다.
ROLE은 주 구성원에 할당되는 역할 이름입니다. 역할 이름은 사전 정의된 역할(예: roles/accesscontextmanager.policyEditor) 또는 커스텀 역할의 역할 ID(예: organizations/{ORGANIZATION_ID}/roles/accesscontextmanager.policyEditor)의 전체 경로입니다.
POLICY_TITLE은 인간이 읽을 수 있는 정책 제목입니다.
정책 제목의 최대 길이는 50자(영문 기준)이고 문자로 시작해야 하며 ASCII 라틴 문자(a~z, A~Z), 숫자(0~9), 밑줄(_)만 이름에 사용할 수 있습니다. 정책 제목은 대소문자를 구분하며 조직의 액세스 정책 내에서 고유해야 합니다.
POST https://accesscontextmanager.googleapis.com/v1/accessPolicies
응답 본문
호출이 성공하면 호출의 응답 본문에 POST 작업에 대한 세부정보를 제공하는 Operation 리소스가 포함됩니다.
범위가 지정된 액세스 정책 관리를 위임하려면 다음을 수행합니다.
요청 본문을 만듭니다.
{"policy":"IAM_POLICY",}
각 항목의 의미는 다음과 같습니다.
IAM_POLICY는 binding 컬렉션입니다. binding은 구성원 또는 주 구성원 하나 이상을 단일 역할에 바인딩합니다. 주 구성원은 사용자 계정, 서비스 계정, Google 그룹, 도메인일 수 있습니다. 역할이란 이름이 지정된 권한 목록입니다. 각 역할은 IAM 사전 정의된 역할이나 사용자가 만든 커스텀 역할일 수 있습니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-04(UTC)"],[],[],null,["# Create a scoped access policy\n\nThis page describes how to create and delegate scoped access policies.\n\nBefore you begin\n----------------\n\n- Read about [scoped policies](/access-context-manager/docs/scoped-policies).\n\n- Read about [granting access to VPC Service Controls](/vpc-service-controls/docs/access-control).\n\n | **Note:** The access control for scoped policies is independent of the projects or folders in their scopes. Any Access Context Manager permissions granted on folders or projects have no effect on scoped policies as permissions can only be granted at the organization-level or on individual policies.\n- Make sure that the delegated administrator to whom the scoped access policy\n is delegated has the [`cloudasset.assets.searchAllResources`](/sdk/gcloud/reference/asset/search-all-resources)\n permission on the folder or the project to which the scoped policy is bound.\n This permission is required by the delegated administrator to search all Google Cloud resources.\n\n- Read about [configuring service perimeters](/vpc-service-controls/docs/service-perimeters).\n\nCreating a scoped access policy\n-------------------------------\n\nCreate a scoped access policy and delegate administration to folders and projects in the organization.\nAfter you create a scoped access policy, you cannot change the scope of the policy.\nTo change the scope of an existing policy, delete the policy, and recreate the policy with the new scope.\n**Warning:** If an organization-level access policy doesn't exist for your organization, scoped policies that you create at the folder or project-level don't work. \n\n### Console\n\n1. In the Google Cloud console navigation menu, click **Security** , and then\n click **VPC Service Controls**.\n\n [Go to VPC Service Controls](https://console.cloud.google.com/security/service-perimeter)\n2. If you are prompted, select your organization, folder, or project.\n\n3. On the **VPC Service Controls** page, select the access policy that is the\n parent of the scoped policy. For example, you can select the `default policy`\n organization policy.\n\n4. Click **Manage policies**.\n\n5. On the **Manage VPC Service Controls** page, click **Create**.\n\n6. On the **Create access policy** page, in the **Access policy name** box,\n type a name for the scoped access policy.\n\n The scoped access policy name can have a maximum length of 50 characters, must start\n with a letter, and can contain only ASCII Latin letters (a-z, A-Z),\n numbers (0-9), or underscores (`_`). The scoped access policy name is case sensitive\n and must be unique within an organization's access policy.\n7. To specify a scope for the access policy, click **Scopes**.\n\n8. Specify either a project or a folder as the scope of the access policy.\n\n - To select a project that you want to add to the scope of the access\n policy, do the following:\n\n 1. In the **Scopes** pane, click **Add project**.\n\n 2. In the **Add project** dialog, select that project's checkbox.\n\n 3. Click **Done** . The added project appears in the **Scopes** section.\n\n - To select a folder that you want to add to the scope of the access policy,\n do the following:\n\n 1. In the **Scopes** pane, click **Add folder**.\n\n 2. In the **Add folders** dialog, select that folder's checkbox.\n\n 3. Click **Done** . The added folder appears in the **Scopes** section.\n\n9. To delegate administration of the scoped access policy, click **Principals**.\n\n10. To specify the [principal](/iam/docs/overview#concepts_related_identity)\n and the role that you want to bind to the access policy, do the following:\n\n 1. In the **Principals** pane, click **Add principals**.\n\n 2. In the **Add principals** dialog, select a principal, such as a user\n name or service account.\n\n 3. Select the role that you want to associate with the principal, such\n as editor and read roles.\n\n 4. Click **Save** . The added principal and role appear in the **Principals** section.\n\n11. On the **Create access policy** page, click **Create access policy**.\n\n### gcloud\n\nTo create a scoped access policy, use the [`gcloud access-context-manager policies create`](/sdk/gcloud/reference/access-context-manager/policies/create)\ncommand. \n\n```bash\ngcloud access-context-manager policies create \\\n--organization ORGANIZATION_ID [--scopes=SCOPE] --title POLICY_TITLE\n```\n\nWhere:\n\n- \u003cvar translate=\"no\"\u003eORGANIZATION_ID\u003c/var\u003e is the numeric ID of your organization.\n\n- \u003cvar translate=\"no\"\u003ePOLICY_TITLE\u003c/var\u003e is a human-readable title for your policy.\n The policy title can have a maximum length of 50 characters, must start\n with a letter, and can contain only ASCII Latin letters (a-z, A-Z),\n numbers (0-9), or underscores (`_`). The policy title is case sensitive\n and must be unique within an organization's access policy.\n\n- \u003cvar translate=\"no\"\u003eSCOPE\u003c/var\u003e is the folder or project on which this policy is applicable. You\n can specify only one folder or project as the scope, and the scope must exist\n within the specified organization. If you don't specify a scope, the policy\n applies to the entire organization.\n\nThe following output appears (where \u003cvar translate=\"no\"\u003ePOLICY_NAME\u003c/var\u003e\nis a unique [numeric identifier for the policy](https://cloud.google.com/access-context-manager/docs/manage-access-policy#get_the_name_of_an_access_policy)\nassigned by Google Cloud): \n\n```\nCreate request issued\nWaiting for operation [accessPolicies/POLICY_NAME/create/1521580097614100] to complete...done.\nCreated.\n```\n\nTo delegate administration by binding a principal and role with a scoped access policy, use the [`add-iam-policy-binding`](/sdk/gcloud/reference/access-context-manager/policies/add-iam-policy-binding)\ncommand. \n\n```bash\ngcloud access-context-manager policies add-iam-policy-binding \\\n[POLICY] --member=PRINCIPAL --role=ROLE\n```\n\nWhere:\n\n- \u003cvar translate=\"no\"\u003ePOLICY\u003c/var\u003e is ID of the policy or fully qualified identifier for the policy.\n\n- \u003cvar translate=\"no\"\u003ePRINCIPAL\u003c/var\u003e is the principal to add the binding for. Specify in the\n following format: `user|group|serviceAccount:email` or `domain:domain`.\n\n- \u003cvar translate=\"no\"\u003eROLE\u003c/var\u003e is the role name to assign to the principal. The role name\n is the complete path of a predefined role, such as `roles/accesscontextmanager.policyEditor`,\n or the role ID for a custom role, such as\n `organizations/{ORGANIZATION_ID}/roles/accesscontextmanager.policyEditor`.\n\n### API\n\nTo create a scoped access policy, do the following:\n\n1. Create a request body.\n\n ```json\n {\n \"parent\": \"\u003cvar translate=\"no\"\u003eORGANIZATION_ID\u003c/var\u003e\",\n \"scope\": \"\u003cvar translate=\"no\"\u003eSCOPE\u003c/var\u003e\"\n \"title\": \"\u003cvar translate=\"no\"\u003ePOLICY_TITLE\u003c/var\u003e\"\n }\n ```\n\n Where:\n - \u003cvar translate=\"no\"\u003eORGANIZATION_ID\u003c/var\u003e is the numeric ID of your organization.\n\n - \u003cvar translate=\"no\"\u003eSCOPE\u003c/var\u003e is the folder or project on which this policy is applicable.\n\n - \u003cvar translate=\"no\"\u003ePOLICY_TITLE\u003c/var\u003e is a human-readable title for your policy.\n The policy title can have a maximum length of 50 characters, must start\n with a letter, and can contain only ASCII Latin letters (a-z, A-Z),\n numbers (0-9), or underscores (`_`). The policy title is case sensitive\n and must be unique within an organization's access policy.\n\n2. Create the access policy by\n calling [`accessPolicies.create`](/access-context-manager/docs/reference/rest/v1/accessPolicies/create).\n\n ```\n POST https://accesscontextmanager.googleapis.com/v1/accessPolicies\n ```\n\n#### Response body\n\nIf successful, the response body for the call contains an\n[`Operation`](/access-context-manager/docs/reference/rest/Shared.Types/Operation) resource that provides details about the\n`POST` operation.\n\nTo delegate administration of the scoped access policy, do the following:\n\n1. Create a request body.\n\n ```json\n {\n \"policy\": \"\u003cvar translate=\"no\"\u003eIAM_POLICY\u003c/var\u003e\",\n }\n ```\n\n Where:\n - \u003cvar translate=\"no\"\u003eIAM_POLICY\u003c/var\u003e is a collection of bindings. A binding binds one or more members, or principals, to a single role. Principals can be user accounts, service accounts, Google groups, and domains. A role is a named list of permissions; each role can be an IAM predefined role or a user-created custom role.\n2. Delegate the access policy by\n calling [`accessPolicies.setIamPolicy`](/access-context-manager/docs/reference/rest/v1/accessPolicies/setIamPolicy).\n\n ```\n POST https://accesscontextmanager.googleapis.com/v1/accessPolicies\n ```\n\n#### Response body\n\nIf successful, the response body contains an instance of [`policy`](/access-context-manager/docs/reference/rest/Shared.Types/Policy).\n\nWhat's next\n-----------\n\n- Learn how to [manage existing](/vpc-service-controls/docs/manage-service-perimeters) service perimeters."]]
