Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Halaman ini menjelaskan cara menyiapkan instance AlloyDB untuk PostgreSQL agar mengizinkan autentikasi database melalui Identity and Access Management (IAM).
Autentikasi IAM melengkapi autentikasi database melalui
pengguna PostgreSQL standar, yang
didukung oleh setiap cluster AlloyDB. Jika mengaktifkan
autentikasi IAM di cluster, Anda dapat menggunakan peran pengguna IAM atau PostgreSQL untuk melakukan autentikasi dengan cluster tersebut.
Secara default, instance AlloyDB tidak mengaktifkan autentikasi
IAM. Untuk mengaktifkan autentikasi IAM, selesaikan
langkah-langkah berikut:
Untuk setiap akun pengguna atau akun layanan IAM yang perlu login
sebagai pengguna database, selesaikan langkah-langkah berikut:
Dengan menggunakan alat administrator IAM, berikan peranalloydb.databaseUser
dan serviceusage.serviceUsageConsumer kepada pengguna atau akun layanan tersebut.
Dengan menggunakan Google Cloud CLI, buat pengguna database
yang sesuai dengan pengguna atau akun layanan tersebut di cluster
AlloyDB Anda.
Anda dapat mengulangi langkah kedua untuk memberikan akses akun IAM ke cluster lain dalam project Anda.
Memperbarui akun IAM dengan peran yang sesuai
Anda dapat memberikan kemampuan kepada pengguna IAM atau akun layanan untuk
mengautentikasi dengan instance AlloyDB dengan memberikan
peran IAM berikut kepada mereka:
alloydb.databaseUser: Mengizinkan pengguna terhubung ke instance AlloyDB Anda.
serviceusage.serviceUsageConsumer: Memberikan akses pengguna ke API yang memeriksa izin.
Untuk melakukannya, ikuti petunjuk di bagian
Memberikan akses kepada pengguna lain. Pada langkah saat Anda memilih peran untuk diberikan ke akun utama IAM, pilih alloydb.databaseUser.
Menambahkan akun pengguna atau akun layanan IAM ke cluster
Klik nama cluster tempat Anda ingin menambahkan pengguna.
Klik Pengguna.
Klik Tambahkan akun pengguna.
Pilih Cloud IAM.
Di kolom Principal, masukkan akun utama IAM.
Untuk akun pengguna IAM, berikan alamat email lengkap akun pengguna. Misalnya, kai@altostrat.com.
Untuk akun layanan IAM, berikan alamat akun layanan
tanpa akhiran .gserviceaccount.com. Misalnya, untuk menentukan akun layanan
my-service@my-project.iam.gserviceaccount.com, Anda
akan menggunakan nilai my-service@my-project.iam di sini.
Untuk menetapkan peran selain alloydbsuperuser default kepada pengguna, ikuti langkah-langkah berikut:
Masukkan nama peran di Peran.
Untuk menambahkan peran, tekan Enter atau Tab.
Pilih x untuk peran yang ingin Anda hapus bagi pengguna tersebut.
USERNAME: ID untuk pengguna IAM yang ingin Anda tambahkan sebagai pengguna database baru.
Untuk akun pengguna IAM, berikan alamat email lengkap akun pengguna. Misalnya, kai@altostrat.com.
Untuk akun layanan IAM, berikan alamat akun layanan
tanpa akhiran .gserviceaccount.com. Misalnya, untuk menentukan akun layanan
my-service@my-project.iam.gserviceaccount.com, Anda
akan menggunakan nilai my-service@my-project.iam di sini.
CLUSTER: ID cluster tempat akun pengguna
database ini akan dibuat.
REGION: ID region tempat cluster berada.
Contoh, us-central1.
Memberikan izin database yang sesuai kepada pengguna IAM
Saat pengguna IAM ditambahkan ke instance database, pengguna baru tersebut
tidak diberi hak istimewa di database mana pun secara default.
Saat akun pengguna atau akun layanan terhubung ke database, mereka dapat
menjalankan kueri terhadap objek database yang aksesnya telah diberikan ke
Publik.
Jika membutuhkan akses tambahan, lebih banyak hak istimewa dapat diberikan menggunakan
pernyataan PostgreSQL GRANT.
GRANTSELECTONTABLE_NAMETO"USERNAME";
Ganti variabel berikut:
USERNAME: Alamat email untuk pengguna. Anda harus menyertakan
tanda kutip ganda di sekitar alamat.
TABLE_NAME: Nama tabel yang ingin Anda berikan akses
kepada pengguna.
Menghapus akun pengguna atau akun layanan IAM dari cluster
USERNAME: ID pengguna IAM yang ingin Anda hapus dari cluster.
Untuk akun pengguna IAM, berikan alamat email lengkap akun pengguna. Misalnya, kai@altostrat.com.
Untuk akun layanan IAM, berikan alamat akun layanan
tanpa akhiran .gserviceaccount.com. Misalnya, untuk menentukan akun layanan
my-service@my-project.iam.gserviceaccount.com, Anda
akan menggunakan nilai my-service@my-project.iam di sini.
CLUSTER: ID cluster tempat pengguna ini akan dihapus.
REGION: ID region tempat cluster berada.
Contoh, us-central1.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-08-25 UTC."],[[["\u003cp\u003eThis guide outlines how to enable and manage Identity and Access Management (IAM) authentication for AlloyDB for PostgreSQL instances, which can be used in addition to standard PostgreSQL user authentication.\u003c/p\u003e\n"],["\u003cp\u003eEnabling IAM authentication requires manually setting the \u003ccode\u003ealloydb.iam_authentication\u003c/code\u003e flag to \u003ccode\u003eon\u003c/code\u003e for each instance that needs it, with \u003ccode\u003eoff\u003c/code\u003e being the default setting.\u003c/p\u003e\n"],["\u003cp\u003eGranting IAM users or service accounts access involves assigning them the \u003ccode\u003ealloydb.databaseUser\u003c/code\u003e and \u003ccode\u003eserviceusage.serviceUsageConsumer\u003c/code\u003e roles, and creating a corresponding database user within the AlloyDB cluster.\u003c/p\u003e\n"],["\u003cp\u003eYou can add IAM users or service accounts to a cluster by using the Google Cloud Console or the gcloud command-line interface, supplying either the full email address or the service account name without the \u003ccode\u003e.gserviceaccount.com\u003c/code\u003e suffix.\u003c/p\u003e\n"],["\u003cp\u003eAfter adding IAM users, administrators must use PostgreSQL's \u003ccode\u003eGRANT\u003c/code\u003e command to give users any necessary database privileges beyond the default public access, and use the console or the gcloud to remove them.\u003c/p\u003e\n"]]],[],null,["# Manage IAM authentication\n\nThis page explains how to prepare your AlloyDB for PostgreSQL instance to let database\nauthentication through Identity and Access Management (IAM).\n\nIAM authentication complements database authentication through\n[standard PostgreSQL users](/alloydb/docs/database-users/manage-roles), which\nevery AlloyDB cluster supports. If you enable\nIAM authentication on your cluster, then you can use either\nIAM or PostgreSQL user roles to authenticate with that cluster.\n\nBy default, an AlloyDB instance does not have IAM\nauthentication enabled. To enable IAM authentication, complete\nthe following steps:\n\n- [Manually enable IAM authentication](#enable) on every\n instance that IAM user or service accounts need to connect\n to.\n\n- For every IAM user or service account that needs to sign in\n as a database user, complete the following steps:\n\n 1. Using IAM administrator tools,\n [grant that user or service account](#role) the `alloydb.databaseUser`\n and `serviceusage.serviceUsageConsumer` roles.\n\n 2. Using the Google Cloud CLI, [create a database user](#create-user)\n corresponding to that user or service account on your\n AlloyDB cluster.\n\n 3. Using a database administrator account such as `postgres`,\n [grant the new database user access privileges](#grant-privileges) to\n the appropriate database tables.\n\nYou can repeat these steps whenever you need to add further IAM\nusers to your AlloyDB cluster.\n\nEnable or disable IAM authentication\n------------------------------------\n\nTo enable IAM authentication on an instance, set\n[the `alloydb.iam_authentication` flag](/alloydb/docs/reference/alloydb-flags#alloydb.iam_authentication)\non that instance to `on`.\n\nTo disable IAM authentication on an instance, set\n`alloydb.iam_authentication` back to its default value, `off`.\n\nFor more information about setting flags on AlloyDB instances,\nsee\n[Configure an instance's database flags](/alloydb/docs/instance-configure-database-flags).\n\nGrant an IAM user or service account access to an instance\n----------------------------------------------------------\n\nEnabling IAM access to a new database user is a two-step process:\n\n1. [Update your project's IAM settings](#enable) to grant\n AlloyDB database access to the appropriate IAM\n user or service account.\n\n2. [Create a new database user on your cluster](#create-user), setting the\n username as the email address of the IAM user or service\n account.\n\nYou can repeat step two to give an IAM account access to other\nclusters inside your project.\n\n### Update an IAM account with the appropriate role\n\nYou can give IAM users or service accounts the ability to\nauthenticate with AlloyDB instances by granting them the\nfollowing IAM roles:\n\n- `alloydb.databaseUser`: Lets the user connect to your AlloyDB instance.\n- `serviceusage.serviceUsageConsumer`: Provides the user access to an API that checks permissions.\n\nTo do this, follow the instructions on\n[Grant access to other users](/alloydb/docs/user-grant-access#procedure). In the\nstep where you select a role to grant to the IAM principal,\nchoose `alloydb.databaseUser`.\n\n### Add an IAM user or service account to a cluster\n\n### Console\n\n1. Go to the **Clusters** page.\n\n [Go to Clusters](https://console.cloud.google.com/alloydb/clusters)\n2. Click the name of the cluster that you want to add a user to.\n\n3. Click **Users**.\n\n4. Click **Add user account**.\n\n5. Select **Cloud IAM**.\n\n6. In the **Principal** field, enter the IAM principal.\n\n\n For an IAM user account, supply the user account's full email\n address. For example, `kai@altostrat.com`.\n\n For an IAM service account, supply the service account's address\n *without* the `.gserviceaccount.com` suffix. For\n example, to specify the service account\n `my-service@my-project.iam.gserviceaccount.com`, you\n would use the value `my-service@my-project.iam` here.\n7. To assign roles other than the default `alloydbsuperuser` to the user, follow these steps:\n\n 1. Enter the name of the role in **Roles**.\n 2. To add the role, press \u003ckbd\u003eEnter\u003c/kbd\u003e or \u003ckbd\u003eTab\u003c/kbd\u003e.\n 3. Select **x** for any role that you want to remove for that user.\n\n For more information, see [Predefined roles](/alloydb/docs/database-users/overview#predefined-roles)\n8. Click **Add**.\n\n### gcloud\n\nTo create a PostgreSQL database user based on an IAM user or\nservice account, use\n[the `gcloud alloydb users create` command](/sdk/gcloud/reference/alloydb/users/create). \n\n gcloud alloydb users create \u003cvar translate=\"no\"\u003eUSERNAME\u003c/var\u003e \\\n --cluster=\u003cvar translate=\"no\"\u003eCLUSTER\u003c/var\u003e \\\n --region=\u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e \\\n --type=IAM_BASED\n\nReplace the following variables:\n\n- \u003cvar translate=\"no\"\u003eUSERNAME\u003cvar translate=\"no\"\u003e\u003c/var\u003e\u003c/var\u003e: Identifier for the IAM user\n that you want to add as a new database user.\n\n\n For an IAM user account, supply the user account's full email\n address. For example, `kai@altostrat.com`.\n\n For an IAM service account, supply the service account's address\n *without* the `.gserviceaccount.com` suffix. For\n example, to specify the service account\n `my-service@my-project.iam.gserviceaccount.com`, you\n would use the value `my-service@my-project.iam` here.\n- \u003cvar translate=\"no\"\u003eCLUSTER\u003cvar translate=\"no\"\u003e\u003c/var\u003e\u003c/var\u003e: ID of the cluster to create this database\n user account within.\n\n- \u003cvar translate=\"no\"\u003eREGION\u003cvar translate=\"no\"\u003e\u003c/var\u003e\u003c/var\u003e: ID of the region where the cluster resides.\n For example, `us-central1`.\n\n### Grant appropriate database permissions to IAM users\n\nWhen an IAM user is added to a database instance, that new user\nis granted no privileges on any databases by default.\n\nWhen a user or service account connects to a database, they can run queries\nagainst any database objects whose access has been granted to\n[PUBLIC](https://www.postgresql.org/docs/16/ddl-priv.html).\n\nIf they need additional access, more privileges can be granted using the\n[`GRANT` PostgreSQL statement](https://www.postgresql.org/docs/16/sql-grant.html). \n\n GRANT SELECT ON \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-k\"\u003eTABLE_NAME\u003c/span\u003e\u003c/var\u003e TO \"\u003cvar translate=\"no\"\u003eUSERNAME\u003c/var\u003e\";\n\nReplace the following variables:\n\n- \u003cvar translate=\"no\"\u003eUSERNAME\u003cvar translate=\"no\"\u003e\u003c/var\u003e\u003c/var\u003e: Email address for the user. You must include\n double quotes around the address.\n\n- \u003cvar translate=\"no\"\u003eTABLE_NAME\u003cvar translate=\"no\"\u003e\u003c/var\u003e\u003c/var\u003e: Name of the table you want to give the user\n access to.\n\nRemove an IAM user or service account from a cluster\n----------------------------------------------------\n\n### Console\n\n1. Go to the **Clusters** page.\n\n [Go to Clusters](https://console.cloud.google.com/alloydb/clusters)\n2. Click the name of the cluster you want to remove the user from.\n\n3. Click **Users**.\n\n4. On the row representing the user you want to remove, click\n more_vert **Open actions for this\n user**.\n\n5. Select **Remove**.\n\n6. In the **Remove user account?** dialog, click **Remove**.\n\n### gcloud\n\nUse\n[the `gcloud alloydb users delete` command](/sdk/gcloud/reference/alloydb/users/delete). \n\n gcloud alloydb users delete \u003cvar translate=\"no\"\u003eUSERNAME\u003c/var\u003e \\\n --cluster=\u003cvar translate=\"no\"\u003eCLUSTER\u003c/var\u003e \\\n --region=\u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003eUSERNAME\u003cvar translate=\"no\"\u003e\u003c/var\u003e\u003c/var\u003e: Identifier of the IAM user\n that you want to remove from the cluster.\n\n\n For an IAM user account, supply the user account's full email\n address. For example, `kai@altostrat.com`.\n\n For an IAM service account, supply the service account's address\n *without* the `.gserviceaccount.com` suffix. For\n example, to specify the service account\n `my-service@my-project.iam.gserviceaccount.com`, you\n would use the value `my-service@my-project.iam` here.\n- \u003cvar translate=\"no\"\u003eCLUSTER\u003cvar translate=\"no\"\u003e\u003c/var\u003e\u003c/var\u003e: ID of the cluster to remove this user from.\n\n- \u003cvar translate=\"no\"\u003eREGION\u003cvar translate=\"no\"\u003e\u003c/var\u003e\u003c/var\u003e: ID of the region where the cluster resides.\n For example, `us-central1`.\n\nWhat's next\n-----------\n\n- [Connect using an IAM account](/alloydb/docs/connect-iam)"]]
