[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[],[],null,["# Prerequisites for using the Guided Deployment Automation tool\n\nThis document describes the prerequisites for using the Guided Deployment Automation\ntool in Workload Manager.\n\nIn addition, you must meet the following prerequisites that are specific to the\napplication you're deploying:\n\n- [Prerequisites for deploying an SAP S/4HANA application](/workload-manager/docs/deploy/sap/prerequisites-sap)\n- [Prerequisites for deploying a SQL Server workload](/workload-manager/docs/deploy/sql-server/prerequisites-sql)\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n### Workload Manager service account\n\nThe Guided Deployment Automation tool uses a\n[service agent](/iam/docs/service-account-types#service-agents)\nfor deploying applications.\n\nWhen you create a deployment, Workload Manager prompts you to grant\nthe required roles to this service account if they're not already granted.\nIf you don't have the permission to grant these roles, ask an administrator to\ngrant the following roles to the Workload Manager service account before\ncreating a deployment.\n\n### User-managed service account\n\nWorkload Manager uses the service account attached to your deployment\nto call other APIs and services for creating resources required for the deployment.\n\nYou can either attach an existing service account or create a service account\nwhen you configure the deployment. Depending on your application and configuration,\nWorkload Manager prompts you to grant any of the missing roles to your\nservice account.\n\nFor more information about granting roles to service accounts,\nsee [Manage access to service accounts](/iam/docs/manage-access-service-accounts).\n\n### IAM roles and permissions\n\nAccess control in Workload Manager is controlled using\n[Identity and Access Management (IAM)](/iam). Workload Manager provides a specific set of [predefined IAM roles](/iam/docs/understanding-roles#role_types)\nwhere each role contains a set of permissions. IAM lets you adopt the\n[security principle of least privilege](https://en.wikipedia.org/wiki/Principle_of_least_privilege),\nso you grant only the necessary access to your resources. \n\nThe following permission is required to enable the Workload Manager API\nin the selected project. This task only needs to be performed once in each project.\nAn administrator or another user with the permission can enable the API and after that\nother users can access Workload Manager.\n\nWorkload Manager also has roles to control who can access the deployment\nfeatures and determine who can deploy, manage, and view deployments.\nEach role has the necessary permissions to perform the stated tasks.\n\nFor more information, see\n[Access control with IAM](/workload-manager/docs/access-control).\nWhen granting IAM roles to principals, Google recommends that you\napply the principle of [least privilege](/iam/docs/using-iam-securely#least_privilege).\n\n### Use a Cloud Build private worker pool\n\nIf your organization enforces VPC Service Controls compliance, then you must\nuse a private worker pool for your deployment.\n\nPrivate pools are hosted in a Google-owned Virtual Private Cloud network called the *service\nproducer network* . Before creating a private pool, [set up a private connection\nbetween the service producer network and the\nVPC network that contains your resources](/build/docs/private-pools/set-up-private-pool-to-use-in-vpc-network#setup-private-connection).\n\nTo create and use a Cloud Build private pool, follow the instructions in\n[Create and manage private pools](/build/docs/private-pools/create-manage-private-pools).\n\nConsider the following requirements when you set up a private worker pool to use\nwith Workload Manager:\n\n- You must use a Cloud Build private worker pool for the deployment. You cannot use the default Cloud Build worker pool. For more information, see [Limitations](/build/docs/private-pools/using-vpc-service-controls#limitations) in the Cloud Build documentation.\n- To download the Terraform configuration, the Cloud Build private pool must have [public internet calls enabled](/build/docs/private-pools/using-vpc-service-controls#enable-public-internet).\n\nYou must also ensure that the following resources are in the same [VPC Service Controls\nservice perimeter](/vpc-service-controls/docs/service-perimeters):\n\n- Cloud Build private worker pool.\n- [Workload Manager service account](/workload-manager/docs/deploy/prerequisites#wlm-service-account).\n- The [Cloud Storage bucket](/workload-manager/docs/deploy/sap/sap-install-files#upload-install-files) that Workload Manager uses for deployment.\n\n### Quotas\n\nGoogle Cloud uses quotas to protect and control the number of resources that a\nparticular account or organization can use. The supported applications often consume a\nlarge portion of resources. Given the size of the databases and applications,\nyou might experience quota issues during the deployment process.\n\nTo avoid quota issues, do the following:\n\n1. [View available resource quota for your project](/docs/quota#viewing_your_quota_console).\n2. If needed, [request a higher quota value](/docs/quotas/help/request_increase) or contact your project administrator.\n\nWhat's next\n-----------\n\n- Learn how to [prepare SAP installation files for deployment](/workload-manager/docs/deploy/sap-install-files).\n- Learn how to [deploy a SAP S/4HANA workload](/workload-manager/docs/deploy/deploy-sap)."]]
