Workflows 역할 및 권한

이 페이지에서는 Workflows 리소스에 대한 액세스를 제어하는 데 사용할 수 있는 Identity and Access Management(IAM) 역할과 권한을 설명합니다.

개요

Workflows는 액세스 제어에 IAM을 사용합니다.

IAM을 사용한 액세스 제어에 대해 자세히 알아보려면 프로젝트, 폴더, 조직에 대한 액세스 관리를 참조하세요.

모든 Workflows 메서드는 호출자에게 필요 권한을 요구합니다. Workflows에서 지원하는 역할 및 해당 권한 목록은 이 문서의 Workflows 역할 섹션을 참고하세요.

Workflows 권한

이 표에서는 Workflows에서 사용할 수 있는 권한을 설명합니다.

권한	정의
workflows.callbacks.list	워크플로 실행의 콜백을 나열합니다.
workflows.callbacks.send	워크플로 실행 콜백을 트리거합니다.
workflows.executions.cancel	trace를 삭제하지 않고 워크플로 실행을 취소합니다.
workflows.executions.create	워크플로 실행을 트리거합니다.
workflows.executions.get	워크플로 실행 작업의 최신 상태를 가져옵니다.
workflows.executions.list	워크플로의 실행 작업을 나열합니다.
workflows.locations.get	워크플로의 위치를 가져옵니다.
workflows.locations.list	서비스를 사용할 수 있는 위치를 나열합니다.
workflows.operations.cancel	장기 실행 작업을 취소합니다.
workflows.operations.get	장기 실행 작업의 세부정보를 가져옵니다.
workflows.operations.list	장기 실행 작업 목록을 가져옵니다.
workflows.stepEntries.get	워크플로 실행의 단계 항목을 가져옵니다.
workflows.stepEntries.list	워크플로 실행의 단계 항목을 나열합니다.
workflows.workflows.create	새 워크플로를 만들고 배포합니다.
workflows.workflows.delete	기존 워크플로를 삭제합니다.
workflows.workflows.get	소스 코드, 라벨, 설명을 포함한 워크플로의 설정을 가져옵니다.
workflows.workflows.list	프로젝트의 워크플로를 나열합니다.
workflows.workflows.listRevision	워크플로의 버전을 나열합니다.
workflows.workflows.update	소스 코드, 라벨, 설명을 포함한 워크플로의 설정을 업데이트합니다.

Workflows 역할

다음 표에서는 Workflows 사전 정의 IAM 역할과 각 역할에 포함된 모든 권한 목록을 보여줍니다.

사용 가능한 역할은 대부분의 일반적인 사용 사례를 지원합니다. 사용 사례가 사용 가능한 역할로 처리되지 않는 경우, IAM 커스텀 역할을 만들 수 있습니다.

Role	Permissions
Workflows Admin (roles/workflows.admin) Full access to workflows and related resources. Lowest-level resources where you can grant this role: Project	resourcemanager.projects.get resourcemanager.projects.list workflows.* workflows.callbacks.list workflows.callbacks.send workflows.executions.cancel workflows.executions.create workflows.executions.get workflows.executions.list workflows.locations.get workflows.locations.list workflows.operations.cancel workflows.operations.get workflows.operations.list workflows.stepEntries.get workflows.stepEntries.list workflows.workflows.create workflows.workflows.createTagBinding workflows.workflows.delete workflows.workflows.deleteTagBinding workflows.workflows.get workflows.workflows.list workflows.workflows.listEffectiveTags workflows.workflows.listRevision workflows.workflows.listTagBindings workflows.workflows.update
Workflows Editor (roles/workflows.editor) Read and write access to workflows and related resources, including development and debugging of workflows. Lowest-level resources where you can grant this role: Project	resourcemanager.projects.get resourcemanager.projects.list workflows.* workflows.callbacks.list workflows.callbacks.send workflows.executions.cancel workflows.executions.create workflows.executions.get workflows.executions.list workflows.locations.get workflows.locations.list workflows.operations.cancel workflows.operations.get workflows.operations.list workflows.stepEntries.get workflows.stepEntries.list workflows.workflows.create workflows.workflows.createTagBinding workflows.workflows.delete workflows.workflows.deleteTagBinding workflows.workflows.get workflows.workflows.list workflows.workflows.listEffectiveTags workflows.workflows.listRevision workflows.workflows.listTagBindings workflows.workflows.update
Workflows Invoker (roles/workflows.invoker) Access to execute workflows and manage the executions using the API. Does not provide access to develop and debug workflows. Lowest-level resources where you can grant this role: Project	resourcemanager.projects.get resourcemanager.projects.list workflows.callbacks.* workflows.callbacks.list workflows.callbacks.send workflows.executions.* workflows.executions.cancel workflows.executions.create workflows.executions.get workflows.executions.list workflows.stepEntries.* workflows.stepEntries.get workflows.stepEntries.list
Cloud Workflows Service Agent (roles/workflows.serviceAgent) Gives Cloud Workflows service account access to managed resources. Warning: Do not grant service agent roles to any principals except service agents.	container.clusters.connect iam.serviceAccounts.get iam.serviceAccounts.getAccessToken iam.serviceAccounts.getOpenIdToken serviceusage.services.use
Workflows Viewer (roles/workflows.viewer) Read-only access to workflows and related resources. Lowest-level resources where you can grant this role: Project	resourcemanager.projects.get resourcemanager.projects.list workflows.callbacks.list workflows.executions.get workflows.executions.list workflows.locations.* workflows.locations.get workflows.locations.list workflows.operations.get workflows.operations.list workflows.stepEntries.* workflows.stepEntries.get workflows.stepEntries.list workflows.workflows.get workflows.workflows.list workflows.workflows.listEffectiveTags workflows.workflows.listRevision workflows.workflows.listTagBindings

다음 단계

커스텀 역할 생성 및 관리