Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Kontrol akses dengan IAM
Halaman ini menjelaskan peran Identity and Access Management (IAM) yang diperlukan untuk menggunakan
Access Approval.
Peran yang diperlukan
Bagian berikut menyebutkan peran dan izin IAM
yang diperlukan untuk melakukan berbagai tindakan dengan Persetujuan Akses. Bagian ini juga memberikan petunjuk tentang cara memberikan peran yang diperlukan.
Melihat permintaan dan konfigurasi Persetujuan Akses
Tabel berikut mencantumkan izin IAM yang diperlukan untuk melihat
permintaan dan konfigurasi Persetujuan Akses:
Peran IAM bawaan
Izin dan peran yang diperlukan
roles/accessapproval.viewer
accessapproval.requests.get
accessapproval.requests.list
accessapproval.serviceAccounts.get
accessapproval.settings.get
resourcemanager.projects.get
resourcemanager.projects.list
Untuk memberikan peran Access Approval Viewer (roles/accessapproval.viewer), lakukan hal berikut:
Konsol
Untuk memberikan peran IAM ini kepada diri Anda sendiri, lakukan hal berikut:
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-01 UTC."],[[["\u003cp\u003eThis page outlines the required Identity and Access Management (IAM) roles for using Access Approval within Google Cloud.\u003c/p\u003e\n"],["\u003cp\u003eTo view Access Approval requests and configurations, you need the \u003ccode\u003eroles/accessapproval.viewer\u003c/code\u003e role, which includes specific permissions like \u003ccode\u003eaccessapproval.requests.get\u003c/code\u003e and \u003ccode\u003eaccessapproval.requests.list\u003c/code\u003e.\u003c/p\u003e\n"],["\u003cp\u003eApproving or viewing Access Approval requests requires the \u003ccode\u003eroles/accessapproval.approver\u003c/code\u003e role, with permissions such as \u003ccode\u003eaccessapproval.requests.approve\u003c/code\u003e and \u003ccode\u003eaccessapproval.requests.dismiss\u003c/code\u003e.\u003c/p\u003e\n"],["\u003cp\u003eManaging the Access Approval settings requires the \u003ccode\u003eroles/accessapproval.configEditor\u003c/code\u003e role, which enables actions like updating or deleting configurations.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003eroles/accessapproval.invalidator\u003c/code\u003e role is necessary to invalidate existing, approved Access Approval requests.\u003c/p\u003e\n"]]],[],null,["# Access control with IAM\n=======================\n\nThis page describes the Identity and Access Management (IAM) roles required to use\nAccess Approval.\n\nRequired roles\n--------------\n\nThe following sections mention the IAM roles and permissions\nrequired to perform various actions with Access Approval. The sections\nalso provide instructions about granting the required roles.\n\n### View Access Approval requests and configuration\n\nThe following table lists the IAM permissions required to view\nAccess Approval requests and configuration:\n\nTo grant the Access Approval Viewer (`roles/accessapproval.viewer`)\nrole, do the following: \n\n### Console\n\n\nTo grant this IAM role to yourself, do the following:\n\n1. Go to the **IAM** page in the Google Cloud console.\n\n\n [Go to IAM](https://console.cloud.google.com/iam-admin/iam?supportedpurview=project)\n2. In the **View by principals** tab, click person_add**Grant access**.\n3. In the **New principals** field in the right pane, enter your email address.\n4. Click the **Select a role** field, and select the **Access Approval Viewer** role from the menu.\n5. Click **Save**.\n\n### gcloud\n\nRun the following command: \n\n gcloud organizations add-iam-policy-binding \u003cvar translate=\"no\"\u003eORGANIZATION_ID\u003c/var\u003e \\\n --member='user:\u003cvar translate=\"no\"\u003eEMAIL_ID\u003c/var\u003e' \\\n --role='roles/accessapproval.viewer'\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003eORGANIZATION_ID\u003c/var\u003e: The organization ID.\n- \u003cvar translate=\"no\"\u003eEMAIL_ID\u003c/var\u003e: The email ID of the user.\n\nFor more information about the command, see [gcloud organizations\nadd-iam-policy-binding](/sdk/gcloud/reference/organizations/add-iam-policy-binding).\n\n### View and approve an Access Approval request\n\nThe following table lists the IAM permissions required to view\nand approve an Access Approval request:\n\nTo grant the Access Approval Approver\n(`roles/accessapproval.approver`) role, do the following: \n\n### Console\n\n\nTo grant this IAM role to yourself, do the following:\n\n1. Go to the **IAM** page in the Google Cloud console.\n\n\n [Go to IAM](https://console.cloud.google.com/iam-admin/iam?supportedpurview=project)\n2. In the **View by principals** tab, click person_add**Grant access**.\n3. In the **New principals** field in the right pane, enter your email address.\n4. Click the **Select a role** field, and select the **Access Approval Approver** role from the menu.\n5. Click **Save**.\n\n### gcloud\n\nRun the following command: \n\n gcloud organizations add-iam-policy-binding \u003cvar translate=\"no\"\u003eORGANIZATION_ID\u003c/var\u003e \\\n --member='user:\u003cvar translate=\"no\"\u003eEMAIL_ID\u003c/var\u003e' \\\n --role='roles/accessapproval.approver'\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003eORGANIZATION_ID\u003c/var\u003e: The organization ID.\n- \u003cvar translate=\"no\"\u003eEMAIL_ID\u003c/var\u003e: The email ID of the user.\n\n### Update the Access Approval configuration\n\nThe following table lists the IAM permissions required to\nupdate Access Approval configuration:\n\nTo grant the Access Approval Config Editor\n(`roles/accessapproval.configEditor`) role, do the following: \n\n### Console\n\n\nTo grant this IAM role to yourself, do the following:\n\n1. Go to the **IAM** page in the Google Cloud console.\n\n\n [Go to IAM](https://console.cloud.google.com/iam-admin/iam?supportedpurview=project)\n2. In the **View by principals** tab, click person_add**Grant access**.\n3. In the **New principals** field in the right pane, enter your email address.\n4. Click the **Select a role** field, and select the **Access Approval Config Editor** role from the menu.\n5. Click **Save**.\n\n### gcloud\n\nRun the following command: \n\n gcloud organizations add-iam-policy-binding \u003cvar translate=\"no\"\u003eORGANIZATION_ID\u003c/var\u003e \\\n --member='user:\u003cvar translate=\"no\"\u003eEMAIL_ID\u003c/var\u003e' \\\n --role='roles/accessapproval.approver'\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003eORGANIZATION_ID\u003c/var\u003e: The organization ID.\n- \u003cvar translate=\"no\"\u003eEMAIL_ID\u003c/var\u003e: The email ID of the user.\n\n### Invalidate existing Access Approval requests\n\nThe following table lists the IAM permissions required to\ninvalidate existing Access Approval requests that have been approved:\n\nTo grant the Access Approval Invalidator\n(`roles/accessapproval.invalidator`) role, do the following: \n\n### Console\n\n\nTo grant this IAM role to yourself, do the following:\n\n1. Go to the **IAM** page in the Google Cloud console.\n\n\n [Go to IAM](https://console.cloud.google.com/iam-admin/iam?supportedpurview=project)\n2. In the **View by principals** tab, click person_add**Grant access**.\n3. In the **New principals** field in the right pane, enter your email address.\n4. Click the **Select a role** field, and select the **Access Approval Invalidator** role from the menu.\n5. Click **Save**.\n\n### gcloud\n\nRun the following command: \n\n gcloud organizations add-iam-policy-binding \u003cvar translate=\"no\"\u003eORGANIZATION_ID\u003c/var\u003e \\\n --member='user:\u003cvar translate=\"no\"\u003eEMAIL_ID\u003c/var\u003e' \\\n --role='roles/accessapproval.invalidator'\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003eORGANIZATION_ID\u003c/var\u003e: The organization ID.\n- \u003cvar translate=\"no\"\u003eEMAIL_ID\u003c/var\u003e: The email ID of the user.\n\nWhat's next\n-----------\n\n- [Grant or revoke a single IAM role](/iam/docs/granting-changing-revoking-access#single-role)\n- [Manage access to service accounts](/iam/docs/manage-access-service-accounts)"]]
