Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Halaman ini menjelaskan cara memberikan akses akun pengguna atau akun layanan ke semua resource AlloyDB dalam project. Google Cloud
Bergantung pada cakupan kontrol yang Anda inginkan untuk akun tersebut, Anda memberinya salah satu peran IAM bawaan berikut:
roles/alloydb.admin (Cloud AlloyDB Admin) untuk memberikan kontrol penuh atas semua
resource AlloyDB
roles/alloydb.client (Klien Cloud AlloyDB) dan
roles/serviceusage.serviceUsageConsumer (Pengguna Penggunaan Layanan) untuk memberikan
akses konektivitas ke instance AlloyDB dari klien
yang terhubung dengan proxy Auth AlloyDB
roles/alloydb.databaseUser (Pengguna Database AlloyDB Cloud) untuk memberikan autentikasi pengguna database ke instance AlloyDB
roles/alloydb.viewer (Cloud AlloyDB Viewer) untuk memberikan akses hanya baca ke semua
resource AlloyDB
Untuk mengetahui informasi mendetail tentang izin IAM tertentu yang diberikan oleh peran ini, lihat Peran IAM AlloyDB bawaan.
Anda harus memiliki peran IAM dasar roles/owner (Pemilik) di
project Google Cloud yang Anda gunakan, atau peran yang memberikan izin ini:
resourcemanager.projects.get
resourcemanager.projects.getIamPolicy
resourcemanager.projects.setIamPolicy
Untuk mendapatkan izin ini sambil mengikuti prinsip hak istimewa paling rendah, minta administrator Anda untuk memberi Anda peran roles/resourcemanager.projectIamAdmin (Admin IAM Project).
Aktifkan Cloud Resource Manager API di project Google Cloud yang Anda gunakan.
Pilih project yang diaktifkan untuk mengakses AlloyDB.
Pilih akun utama (pengguna atau akun layanan) untuk memberikan akses ke:
Untuk memberikan peran kepada akun utama yang sudah memiliki peran lain di project,
temukan baris yang berisi alamat email akun utama, klik
editEdit akun utama di baris
tersebut, lalu klik addTambahkan peran lain.
Untuk memberikan peran kepada akun utama yang belum memiliki peran lain di
project, klik person_addTambahkan, lalu masukkan alamat email akun utama.
Dari menu drop-down, pilih salah satu peran berikut:
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-08-25 UTC."],[[["\u003cp\u003eThis guide details the process of granting Google Cloud user accounts or service accounts access to AlloyDB resources within a project.\u003c/p\u003e\n"],["\u003cp\u003eThere are four predefined IAM roles for AlloyDB: \u003ccode\u003eroles/alloydb.admin\u003c/code\u003e for full control, \u003ccode\u003eroles/alloydb.client\u003c/code\u003e and \u003ccode\u003eroles/serviceusage.serviceUsageConsumer\u003c/code\u003e for connectivity, \u003ccode\u003eroles/alloydb.databaseUser\u003c/code\u003e for database authentication, and \u003ccode\u003eroles/alloydb.viewer\u003c/code\u003e for read-only access.\u003c/p\u003e\n"],["\u003cp\u003eBefore granting access, the project must be enabled to access AlloyDB, and the user granting access needs the \u003ccode\u003eroles/owner\u003c/code\u003e role or equivalent permissions like \u003ccode\u003eresourcemanager.projects.get\u003c/code\u003e, \u003ccode\u003eresourcemanager.projects.getIamPolicy\u003c/code\u003e, and \u003ccode\u003eresourcemanager.projects.setIamPolicy\u003c/code\u003e.\u003c/p\u003e\n"],["\u003cp\u003eAccess can be granted via the Google Cloud console's IAM page or using the gcloud CLI with the \u003ccode\u003eadd-iam-policy-binding\u003c/code\u003e command, specifying the project ID, principal, and desired AlloyDB role.\u003c/p\u003e\n"],["\u003cp\u003ePolicy changes typically take effect within 60 seconds, but can take up to 7 minutes to fully propagate across the system.\u003c/p\u003e\n"]]],[],null,["# Grant access to other users\n\nThis page describes how to grant a Google Cloud user account or service\naccount access to all AlloyDB resources in a project.\n\nDepending on the scope of control you want the account to have, you grant it one\nof these predefined IAM roles:\n\n- `roles/alloydb.admin` (Cloud AlloyDB Admin) to grant full control for all AlloyDB resources\n- `roles/alloydb.client` (Cloud AlloyDB Client) and `roles/serviceusage.serviceUsageConsumer` (Service Usage Consumer) to grant connectivity access to AlloyDB instances from clients connecting with the AlloyDB Auth proxy\n- `roles/alloydb.databaseUser` (Cloud AlloyDB Database User) to grant database-user authentication to AlloyDB instances\n- `roles/alloydb.viewer` (Cloud AlloyDB Viewer) to grant read-only access to all AlloyDB resources\n\nFor detailed information about the specific IAM permissions these\nroles provide, see\n[Predefined AlloyDB IAM roles](/alloydb/docs/reference/iam-roles-permissions#roles).\n\n\nBefore you begin\n----------------\n\n- The Google Cloud project you are using must have been [enabled to access AlloyDB](/alloydb/docs/project-enable-access).\n- You must have the `roles/owner` (Owner) basic IAM role in the Google Cloud project you are using, or a role that grants these permissions:\n - `resourcemanager.projects.get`\n - `resourcemanager.projects.getIamPolicy`\n - `resourcemanager.projects.setIamPolicy`\n\n To gain these permissions while following the principle of least privilege,\n ask your administrator to grant you the\n `roles/resourcemanager.projectIamAdmin` (Project IAM Admin)\n role.\n- Enable the Cloud Resource Manager API in the Google Cloud project you are using.\n\n [Enable\n the API](https://console.cloud.google.com/flows/enableapi?apiid=cloudresourcemanager.googleapis.com)\n- \n\n\u003cbr /\u003e\n\nProcedure\n---------\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n### Console\n\n1. In the Google Cloud console, go to the **IAM** page.\n\n [Go to IAM](https://console.cloud.google.com/iam-admin/iam?supportedpurview=project,folder,organizationId)\n2. Select the project enabled to access AlloyDB.\n3. Select a principal (user or service account) to grant access to:\n - To grant a role to a principal who already has other roles on the project, find the row containing the principal's email address, click edit **Edit principal** in that row, and click add **Add another role**.\n - To grant a role to a principal who does not already have other roles on the project, click person_add **Add**, then enter the principal's email address.\n4. From the drop-down list, select one of these roles:\n - **Cloud AlloyDB Admin**\n - **Cloud AlloyDB Viewer**\n - **Cloud AlloyDB Client** and **Service Usage Consumer**\n - **Cloud AlloyDB Database User**\n5. Click **Save**. The principal is granted the role.\n\n| **Note:** In general, the policy changes will take effect within 60 seconds. However, under certain circumstances, it can take up to 7 minutes for such changes to fully propagate across the system.\n\n### gcloud\n\nTo use the gcloud CLI, you can\n[install and initialize](/sdk/docs/install) the Google Cloud CLI, or you\ncan use [Cloud Shell](/shell/docs/using-cloud-shell).\n\nUse the `add-iam-policy-binding` command to grant\nan AlloyDB predefined role to an IAM principal\n(user account or service account). \n\n```\ngcloud projects add-iam-policy-binding PROJECT_ID \\\n --member=PRINCIPAL \\\n --role=ALLOYDB_ROLE\n```\n\n- \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: The ID of the project enabled to access AlloyDB.\n- \u003cvar translate=\"no\"\u003ePRINCIPAL\u003c/var\u003e: The type and email ID (email address) of the principal:\n - For user accounts: `user:`\u003cvar translate=\"no\"\u003eEMAIL_ID\u003c/var\u003e\n - For service accounts: `serviceAccount:`\u003cvar translate=\"no\"\u003eEMAIL_ID\u003c/var\u003e\n- \u003cvar translate=\"no\"\u003eALLOYDB_ROLE\u003c/var\u003e: The role you want to grant\n the principal. The value must be one of the following:\n\n - `roles/alloydb.admin`\n - `roles/alloydb.viewer`\n - `roles/alloydb.client` and `roles/serviceusage.serviceUsageConsumer`\n - `roles/alloydb.databaseUser`\n\n \u003cbr /\u003e\n\n For details about the permissions these roles grant, see\n [Predefined\n AlloyDB IAM roles](/alloydb/docs/reference/iam-roles-permissions#roles).\n\n| **Note:** In general, the policy changes will take effect within 60 seconds. However, under certain circumstances, it can take up to 7 minutes for such changes to fully propagate across the system."]]
