Mantenha tudo organizado com as coleções
Salve e categorize o conteúdo com base nas suas preferências.
Nesta página, descrevemos como conceder a uma conta de usuário ou de serviço Google Cloud acesso a todos os recursos do AlloyDB em um projeto.
Dependendo do escopo de controle que você quer que a conta tenha, conceda a ela um destes papéis predefinidos do IAM:
roles/alloydb.admin (administrador do Cloud AlloyDB) para conceder controle total a todos os recursos do AlloyDB
roles/alloydb.client (cliente do Cloud AlloyDB) e
roles/serviceusage.serviceUsageConsumer (consumidor de uso do serviço) para conceder
acesso de conectividade a instâncias do AlloyDB de clientes
que se conectam com o proxy de autenticação do AlloyDB.
roles/alloydb.databaseUser (usuário do banco de dados do Cloud AlloyDB) para conceder autenticação de usuário do banco de dados a instâncias do AlloyDB
roles/alloydb.viewer (Leitor do Cloud AlloyDB) para conceder acesso somente leitura a todos os recursos do AlloyDB.
Você precisa ter o papel básico do IAM roles/owner (Proprietário) no projeto Google Cloud que está usando ou um papel que conceda estas permissões:
resourcemanager.projects.get
resourcemanager.projects.getIamPolicy
resourcemanager.projects.setIamPolicy
Para receber essas permissões seguindo o princípio de privilégio mínimo,
peça ao administrador para conceder a você o papel de
roles/resourcemanager.projectIamAdmin (administrador do IAM do projeto).
Ative a API Cloud Resource Manager no projeto do Google Cloud que você está usando.
Selecione o projeto ativado para acessar o AlloyDB.
Selecione um principal (usuário ou conta de serviço) para conceder acesso:
Para conceder um papel a um principal que já tem outros papéis no projeto,
encontre a linha que contém o endereço de e-mail dele, clique em
editEditar principal nessa
linha e clique em addAdicionar outro papel.
Para conceder um papel a um principal que ainda não tem outros papéis no
projeto, clique em person_addAdicionar e insira o endereço de e-mail do principal.
Na lista suspensa, selecione uma destas funções:
Administrador do Cloud AlloyDB
Leitor do Cloud AlloyDB
Cliente do Cloud AlloyDB e Consumidor de uso do serviço
[[["Fácil de entender","easyToUnderstand","thumb-up"],["Meu problema foi resolvido","solvedMyProblem","thumb-up"],["Outro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Informações incorretas ou exemplo de código","incorrectInformationOrSampleCode","thumb-down"],["Não contém as informações/amostras de que eu preciso","missingTheInformationSamplesINeed","thumb-down"],["Problema na tradução","translationIssue","thumb-down"],["Outro","otherDown","thumb-down"]],["Última atualização 2025-08-25 UTC."],[[["\u003cp\u003eThis guide details the process of granting Google Cloud user accounts or service accounts access to AlloyDB resources within a project.\u003c/p\u003e\n"],["\u003cp\u003eThere are four predefined IAM roles for AlloyDB: \u003ccode\u003eroles/alloydb.admin\u003c/code\u003e for full control, \u003ccode\u003eroles/alloydb.client\u003c/code\u003e and \u003ccode\u003eroles/serviceusage.serviceUsageConsumer\u003c/code\u003e for connectivity, \u003ccode\u003eroles/alloydb.databaseUser\u003c/code\u003e for database authentication, and \u003ccode\u003eroles/alloydb.viewer\u003c/code\u003e for read-only access.\u003c/p\u003e\n"],["\u003cp\u003eBefore granting access, the project must be enabled to access AlloyDB, and the user granting access needs the \u003ccode\u003eroles/owner\u003c/code\u003e role or equivalent permissions like \u003ccode\u003eresourcemanager.projects.get\u003c/code\u003e, \u003ccode\u003eresourcemanager.projects.getIamPolicy\u003c/code\u003e, and \u003ccode\u003eresourcemanager.projects.setIamPolicy\u003c/code\u003e.\u003c/p\u003e\n"],["\u003cp\u003eAccess can be granted via the Google Cloud console's IAM page or using the gcloud CLI with the \u003ccode\u003eadd-iam-policy-binding\u003c/code\u003e command, specifying the project ID, principal, and desired AlloyDB role.\u003c/p\u003e\n"],["\u003cp\u003ePolicy changes typically take effect within 60 seconds, but can take up to 7 minutes to fully propagate across the system.\u003c/p\u003e\n"]]],[],null,["# Grant access to other users\n\nThis page describes how to grant a Google Cloud user account or service\naccount access to all AlloyDB resources in a project.\n\nDepending on the scope of control you want the account to have, you grant it one\nof these predefined IAM roles:\n\n- `roles/alloydb.admin` (Cloud AlloyDB Admin) to grant full control for all AlloyDB resources\n- `roles/alloydb.client` (Cloud AlloyDB Client) and `roles/serviceusage.serviceUsageConsumer` (Service Usage Consumer) to grant connectivity access to AlloyDB instances from clients connecting with the AlloyDB Auth proxy\n- `roles/alloydb.databaseUser` (Cloud AlloyDB Database User) to grant database-user authentication to AlloyDB instances\n- `roles/alloydb.viewer` (Cloud AlloyDB Viewer) to grant read-only access to all AlloyDB resources\n\nFor detailed information about the specific IAM permissions these\nroles provide, see\n[Predefined AlloyDB IAM roles](/alloydb/docs/reference/iam-roles-permissions#roles).\n\n\nBefore you begin\n----------------\n\n- The Google Cloud project you are using must have been [enabled to access AlloyDB](/alloydb/docs/project-enable-access).\n- You must have the `roles/owner` (Owner) basic IAM role in the Google Cloud project you are using, or a role that grants these permissions:\n - `resourcemanager.projects.get`\n - `resourcemanager.projects.getIamPolicy`\n - `resourcemanager.projects.setIamPolicy`\n\n To gain these permissions while following the principle of least privilege,\n ask your administrator to grant you the\n `roles/resourcemanager.projectIamAdmin` (Project IAM Admin)\n role.\n- Enable the Cloud Resource Manager API in the Google Cloud project you are using.\n\n [Enable\n the API](https://console.cloud.google.com/flows/enableapi?apiid=cloudresourcemanager.googleapis.com)\n- \n\n\u003cbr /\u003e\n\nProcedure\n---------\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n### Console\n\n1. In the Google Cloud console, go to the **IAM** page.\n\n [Go to IAM](https://console.cloud.google.com/iam-admin/iam?supportedpurview=project,folder,organizationId)\n2. Select the project enabled to access AlloyDB.\n3. Select a principal (user or service account) to grant access to:\n - To grant a role to a principal who already has other roles on the project, find the row containing the principal's email address, click edit **Edit principal** in that row, and click add **Add another role**.\n - To grant a role to a principal who does not already have other roles on the project, click person_add **Add**, then enter the principal's email address.\n4. From the drop-down list, select one of these roles:\n - **Cloud AlloyDB Admin**\n - **Cloud AlloyDB Viewer**\n - **Cloud AlloyDB Client** and **Service Usage Consumer**\n - **Cloud AlloyDB Database User**\n5. Click **Save**. The principal is granted the role.\n\n| **Note:** In general, the policy changes will take effect within 60 seconds. However, under certain circumstances, it can take up to 7 minutes for such changes to fully propagate across the system.\n\n### gcloud\n\nTo use the gcloud CLI, you can\n[install and initialize](/sdk/docs/install) the Google Cloud CLI, or you\ncan use [Cloud Shell](/shell/docs/using-cloud-shell).\n\nUse the `add-iam-policy-binding` command to grant\nan AlloyDB predefined role to an IAM principal\n(user account or service account). \n\n```\ngcloud projects add-iam-policy-binding PROJECT_ID \\\n --member=PRINCIPAL \\\n --role=ALLOYDB_ROLE\n```\n\n- \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: The ID of the project enabled to access AlloyDB.\n- \u003cvar translate=\"no\"\u003ePRINCIPAL\u003c/var\u003e: The type and email ID (email address) of the principal:\n - For user accounts: `user:`\u003cvar translate=\"no\"\u003eEMAIL_ID\u003c/var\u003e\n - For service accounts: `serviceAccount:`\u003cvar translate=\"no\"\u003eEMAIL_ID\u003c/var\u003e\n- \u003cvar translate=\"no\"\u003eALLOYDB_ROLE\u003c/var\u003e: The role you want to grant\n the principal. The value must be one of the following:\n\n - `roles/alloydb.admin`\n - `roles/alloydb.viewer`\n - `roles/alloydb.client` and `roles/serviceusage.serviceUsageConsumer`\n - `roles/alloydb.databaseUser`\n\n \u003cbr /\u003e\n\n For details about the permissions these roles grant, see\n [Predefined\n AlloyDB IAM roles](/alloydb/docs/reference/iam-roles-permissions#roles).\n\n| **Note:** In general, the policy changes will take effect within 60 seconds. However, under certain circumstances, it can take up to 7 minutes for such changes to fully propagate across the system."]]
