[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-05。"],[[["\u003cp\u003eIAM roles are essential for managing access to Assured Workloads resources, ensuring that users only have the permissions needed to interact with Google Cloud services.\u003c/p\u003e\n"],["\u003cp\u003eCreating an Assured Workloads folder requires specific roles, such as the Assured Workloads Administrator (\u003ccode\u003eroles/assuredworkloads.admin\u003c/code\u003e), along with a Cloud Billing access control role and an active billing account.\u003c/p\u003e\n"],["\u003cp\u003eAssured Workloads provides predefined roles like \u003ccode\u003eroles/assuredworkloads.admin\u003c/code\u003e, \u003ccode\u003eroles/assuredworkloads.editor\u003c/code\u003e, and \u003ccode\u003eroles/assuredworkloads.reader\u003c/code\u003e, which offer varying levels of read and write access to Assured Workloads folders.\u003c/p\u003e\n"],["\u003cp\u003eCustom roles can be defined to bundle specific permissions, allowing for granular control over access within Assured Workloads, and adherence to the principle of least privilege.\u003c/p\u003e\n"],["\u003cp\u003eProperly securing IAM roles by following the principle of least privilege, limiting users to only in-scope products within the Assured Workloads folder, is a critical security best practice.\u003c/p\u003e\n"]]],[],null,["# IAM roles\n=========\n\nThis page describes the Identity and Access Management (IAM) roles you can use to\nconfigure Assured Workloads. Roles limit a principal's ability to\naccess resources. Only grant a principal the permissions it needs in order to\ninteract with applicable Google Cloud APIs, features, or resources.\n\nTo be able to create an Assured Workloads folder, you must be assigned\none of the roles listed below with that ability, as well as a Cloud Billing\naccess control role. You must also have an active, valid billing account. For\nmore information, see\n[Overview of Cloud Billing access control](/billing/docs/how-to/billing-access).\n\nRequired roles\n--------------\n\nFollowing are the minimum required Assured Workloads-related roles. To\nlearn how to grant, change, or revoke access to resources using\nIAM roles, see\n[Granting, changing, and revoking access to resources](/iam/docs/granting-changing-revoking-access).\n\n- **Assured Workloads Administrator (`roles/assuredworkloads.admin`):** For creating and deleting Assured Workloads folders.\n- **Resource Manager Organization Viewer (`roles/resourcemanager.organizationViewer`):** Access to view all resources belonging to an organization.\n\n| **Note:** To be able to assign roles, you must have the `resourcemanager.organizations.setIamPolicy` permission. This permission is included in the Organization Administrator role (`resourcemanager.organizationAdmin`). To learn more, see [Using predefined roles](/resource-manager/docs/access-control-org#using_predefined_roles).\n\nAssured Workloads roles\n-----------------------\n\nFollowing are the IAM roles that are associated with\nAssured Workloads, and how to grant these roles using the\nGoogle Cloud CLI. To learn how to grant these roles in the\nGoogle Cloud console or programmatically, see\n[Granting, changing, and revoking access to resources](/iam/docs/granting-changing-revoking-access)\nin the IAM documentation.\n\nReplace the \u003cvar translate=\"no\"\u003eORGANIZATION_ID\u003c/var\u003e placeholder with the actual organization\nidentifier and `example@customer.org` with the user email address. To retrieve\nyour organization ID, see\n[Retrieving your organization ID](/resource-manager/docs/creating-managing-organization#retrieving_your_organization_id).\n\n### `roles/assuredworkloads.admin`\n\nFor creating and deleting Assured Workloads folders. Allows read-write\naccess. \n\n```\ngcloud organizations add-iam-policy-binding ORGANIZATION_ID \\\n --member=\"user:example@customer.org\" \\\n --role=\"roles/assuredworkloads.admin\"\n```\n\n### `roles/assuredworkloads.editor`\n\nAllows read-write access. \n\n```\ngcloud organizations add-iam-policy-binding ORGANIZATION_ID \\\n --member=\"user:example@customer.org\" \\\n --role=\"roles/assuredworkloads.editor\"\n```\n\n### `roles/assuredworkloads.reader`\n\nFor getting and listing Assured Workloads folders. Allows read-only\naccess. \n\n```\ngcloud organizations add-iam-policy-binding ORGANIZATION_ID \\\n --member=\"user:example@customer.org\" \\\n --role=\"roles/assuredworkloads.reader\"\n```\n\nCustom roles\n------------\n\nIf you want to define your own roles to contain bundles of permissions that\nyou specify, use [custom roles](/iam/docs/creating-custom-roles).\n\nAssured Workloads IAM best practices\n------------------------------------\n\nProperly securing IAM roles to follow\n[least privilege](/iam/docs/using-iam-securely) is a Google Cloud security\nbest practice. This principle follows the rule that users should only have\naccess to the products, services, and applications required by their role. Users\nare not currently restricted from using out-of-scope services with\nAssured Workloads projects when deploying products and services outside\nof an Assured Workloads folder.\n\nThe\n[list of in-scope products by control package](/assured-workloads/docs/supported-products)\nhelps to guide security admins when creating\n[custom roles](/iam/docs/understanding-custom-roles) that limit user access to\nonly in-scope products within the Assured Workloads folder. Custom\nroles are able to help support obtaining and maintaining compliance within an\nAssured Workloads folder."]]
