[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-25。"],[[["\u003cp\u003eThis guide details the process of granting Google Cloud user accounts or service accounts access to AlloyDB resources within a project.\u003c/p\u003e\n"],["\u003cp\u003eThere are four predefined IAM roles for AlloyDB: \u003ccode\u003eroles/alloydb.admin\u003c/code\u003e for full control, \u003ccode\u003eroles/alloydb.client\u003c/code\u003e and \u003ccode\u003eroles/serviceusage.serviceUsageConsumer\u003c/code\u003e for connectivity, \u003ccode\u003eroles/alloydb.databaseUser\u003c/code\u003e for database authentication, and \u003ccode\u003eroles/alloydb.viewer\u003c/code\u003e for read-only access.\u003c/p\u003e\n"],["\u003cp\u003eBefore granting access, the project must be enabled to access AlloyDB, and the user granting access needs the \u003ccode\u003eroles/owner\u003c/code\u003e role or equivalent permissions like \u003ccode\u003eresourcemanager.projects.get\u003c/code\u003e, \u003ccode\u003eresourcemanager.projects.getIamPolicy\u003c/code\u003e, and \u003ccode\u003eresourcemanager.projects.setIamPolicy\u003c/code\u003e.\u003c/p\u003e\n"],["\u003cp\u003eAccess can be granted via the Google Cloud console's IAM page or using the gcloud CLI with the \u003ccode\u003eadd-iam-policy-binding\u003c/code\u003e command, specifying the project ID, principal, and desired AlloyDB role.\u003c/p\u003e\n"],["\u003cp\u003ePolicy changes typically take effect within 60 seconds, but can take up to 7 minutes to fully propagate across the system.\u003c/p\u003e\n"]]],[],null,["# Grant access to other users\n\nThis page describes how to grant a Google Cloud user account or service\naccount access to all AlloyDB resources in a project.\n\nDepending on the scope of control you want the account to have, you grant it one\nof these predefined IAM roles:\n\n- `roles/alloydb.admin` (Cloud AlloyDB Admin) to grant full control for all AlloyDB resources\n- `roles/alloydb.client` (Cloud AlloyDB Client) and `roles/serviceusage.serviceUsageConsumer` (Service Usage Consumer) to grant connectivity access to AlloyDB instances from clients connecting with the AlloyDB Auth proxy\n- `roles/alloydb.databaseUser` (Cloud AlloyDB Database User) to grant database-user authentication to AlloyDB instances\n- `roles/alloydb.viewer` (Cloud AlloyDB Viewer) to grant read-only access to all AlloyDB resources\n\nFor detailed information about the specific IAM permissions these\nroles provide, see\n[Predefined AlloyDB IAM roles](/alloydb/docs/reference/iam-roles-permissions#roles).\n\n\nBefore you begin\n----------------\n\n- The Google Cloud project you are using must have been [enabled to access AlloyDB](/alloydb/docs/project-enable-access).\n- You must have the `roles/owner` (Owner) basic IAM role in the Google Cloud project you are using, or a role that grants these permissions:\n - `resourcemanager.projects.get`\n - `resourcemanager.projects.getIamPolicy`\n - `resourcemanager.projects.setIamPolicy`\n\n To gain these permissions while following the principle of least privilege,\n ask your administrator to grant you the\n `roles/resourcemanager.projectIamAdmin` (Project IAM Admin)\n role.\n- Enable the Cloud Resource Manager API in the Google Cloud project you are using.\n\n [Enable\n the API](https://console.cloud.google.com/flows/enableapi?apiid=cloudresourcemanager.googleapis.com)\n- \n\n\u003cbr /\u003e\n\nProcedure\n---------\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n### Console\n\n1. In the Google Cloud console, go to the **IAM** page.\n\n [Go to IAM](https://console.cloud.google.com/iam-admin/iam?supportedpurview=project,folder,organizationId)\n2. Select the project enabled to access AlloyDB.\n3. Select a principal (user or service account) to grant access to:\n - To grant a role to a principal who already has other roles on the project, find the row containing the principal's email address, click edit **Edit principal** in that row, and click add **Add another role**.\n - To grant a role to a principal who does not already have other roles on the project, click person_add **Add**, then enter the principal's email address.\n4. From the drop-down list, select one of these roles:\n - **Cloud AlloyDB Admin**\n - **Cloud AlloyDB Viewer**\n - **Cloud AlloyDB Client** and **Service Usage Consumer**\n - **Cloud AlloyDB Database User**\n5. Click **Save**. The principal is granted the role.\n\n| **Note:** In general, the policy changes will take effect within 60 seconds. However, under certain circumstances, it can take up to 7 minutes for such changes to fully propagate across the system.\n\n### gcloud\n\nTo use the gcloud CLI, you can\n[install and initialize](/sdk/docs/install) the Google Cloud CLI, or you\ncan use [Cloud Shell](/shell/docs/using-cloud-shell).\n\nUse the `add-iam-policy-binding` command to grant\nan AlloyDB predefined role to an IAM principal\n(user account or service account). \n\n```\ngcloud projects add-iam-policy-binding PROJECT_ID \\\n --member=PRINCIPAL \\\n --role=ALLOYDB_ROLE\n```\n\n- \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: The ID of the project enabled to access AlloyDB.\n- \u003cvar translate=\"no\"\u003ePRINCIPAL\u003c/var\u003e: The type and email ID (email address) of the principal:\n - For user accounts: `user:`\u003cvar translate=\"no\"\u003eEMAIL_ID\u003c/var\u003e\n - For service accounts: `serviceAccount:`\u003cvar translate=\"no\"\u003eEMAIL_ID\u003c/var\u003e\n- \u003cvar translate=\"no\"\u003eALLOYDB_ROLE\u003c/var\u003e: The role you want to grant\n the principal. The value must be one of the following:\n\n - `roles/alloydb.admin`\n - `roles/alloydb.viewer`\n - `roles/alloydb.client` and `roles/serviceusage.serviceUsageConsumer`\n - `roles/alloydb.databaseUser`\n\n \u003cbr /\u003e\n\n For details about the permissions these roles grant, see\n [Predefined\n AlloyDB IAM roles](/alloydb/docs/reference/iam-roles-permissions#roles).\n\n| **Note:** In general, the policy changes will take effect within 60 seconds. However, under certain circumstances, it can take up to 7 minutes for such changes to fully propagate across the system."]]
