[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-04。"],[],[],null,["# IAM roles and permissions\n\nThis document lists the roles and permissions you need on different projects to\nuse Workload Manager evaluation and to automatically create\nWorkload Manager service accounts for running the evaluation.\n\nWorkload Manager projects\n-------------------------\n\nWorkload Manager evaluations scan resources across multiple projects\nwhich are called *target projects* , but the evaluation is stored in only one\nproject called a *consumer project*.\n\nYou use the consumer project to access Workload Manager in the\nGoogle Cloud console, and to create and run evaluations. When you create an evaluation\nusing the Google Cloud console, in the **Evaluation scope** section of the workflow,\nyou specify the target projects that hold the resources you want to evaluate.\n\nIf the resources to evaluate are present in the same project where you create a\nWorkload Manager evaluation, then the consumer project is also\nconsidered as one of your target projects.\n\nSummary of required permissions to create and run an evaluation\n---------------------------------------------------------------\n\nThe following table summarizes the permissions required for users\nin the consumer and target projects to create and run evaluations using\nWorkload Manager.\nTo get the permission that you need, ask your administrator to grant you a role\nthat includes the required permission or create a custom role.\n\nWorkload Manager service agents\n-------------------------------\n\nWorkload Manager uses\n[service agents](/iam/docs/service-account-types#service-agents)\nto control access and communication between resources and the associated\nprojects.\n\nYou can use the [Google Cloud console](https://console.cloud.google.com/) or the Workload Manager API\nto evaluate workloads. If you use the [Google Cloud console](https://console.cloud.google.com/), Workload Manager\ncreates all required service agents automatically. If you use the\nWorkload Manager API, you must manually create the service agents.\n\n### Required roles\n\n\nTo get the permission that\nyou need to create a service agent,\n\nask your administrator to grant you the\n\n\n[Project IAM Admin](/iam/docs/roles-permissions/resourcemanager#resourcemanager.projectIamAdmin) (`roles/resourcemanager.projectIamAdmin`)\nIAM role on each target project in scope.\n\n\nFor more information about granting roles, see [Manage access to projects, folders, and organizations](/iam/docs/granting-changing-revoking-access).\n\n\nThis predefined role contains the\n` resourcemanager.projects.setIamPolicy`\npermission,\nwhich is required to\ncreate a service agent.\n\n\nYou might also be able to get\nthis permission\nwith [custom roles](/iam/docs/creating-custom-roles) or\nother [predefined roles](/iam/docs/roles-overview#predefined).\n\n### Create and grant roles to service agents\n\n### Google Cloud console\n\nIf you use the [Google Cloud console](https://console.cloud.google.com/) to evaluate workloads, then Workload Manager\ncreates service agents in the consumer projects automatically.\n\nThe email address for this service agent is\n`service-`\u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e`@gcp-sa-workloadmanager.iam.gserviceaccount.com`,\nand it is called Workload Manager Service Account.\n\nWorkload Manager service agents require the following roles to run\nevaluations. If prompted, grant these roles to the service agents.\n\n- Workload Manager Service Agent (`roles/workloadmanager.serviceAgent`): required in the target projects.\n- Workload Manager Worker (`roles/workloadmanager.worker`): required in the consumer project only if you set a frequency for the evaluation.\n\n### Workload Manager API\n\nIf you use the Workload Manager API to evaluate workloads, then you must\nmanually create the Workload Manager service agent in the consumer\nprojects before you create an evaluation.\nTo create a service agent, use the [`gcloud beta services identity create`command](/sdk/gcloud/reference/beta/services/identity/create): \n\n```\n gcloud beta services identity create --service=workloadmanager.googleapis.com \\\n --project=PROJECT_NUMBER\n```\n\nReplace \u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e with the numeric ID of the consumer project\nin which you want to create the service agent.\n\nAfter creating the service agent, you must grant the following roles to the service agent:\n\n- Workload Manager Service Agent (`roles/workloadmanager.serviceAgent`): required in the target projects.\n- Workload Manager Worker (`roles/workloadmanager.worker`): required in the consumer project only if you set a frequency for the evaluation.\n\nFor more information, see [Grant a role to the service agent](/iam/docs/create-service-agents#grant-role).\n| **Tip:** A user who has the required permission to create service accounts on the target projects can create the first evaluation and create the service agents. For subsequent evaluations, Workload Manager uses the existing service agent. Other users don't require the permission to create service accounts.\n\nAdditional Workload Manager roles\n---------------------------------\n\nUsers require additional Workload Manager roles to control further\naccess to Workload Manager evaluations and resources.\n\nFor more information, see\n[Workload Manager: Access control with IAM](/workload-manager/docs/access-control).\n\nWhat's next\n-----------\n\n- [Create and run an evaluation](/workload-manager/docs/create-evaluation)"]]
