[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-04。"],[[["\u003cp\u003eTo manage access to Bare Metal Solution resources, assign specific IAM roles and permissions to users or service accounts, following the principle of least privilege for security.\u003c/p\u003e\n"],["\u003cp\u003eSeveral predefined roles are available, such as Bare Metal Solution Admin, Editor, Instances Admin, and Viewer, each providing different levels of access to manage instances, networks, LUNs, and other resources.\u003c/p\u003e\n"],["\u003cp\u003eThe content recommends certain roles for various tasks, including using Bare Metal Solution Admin, Editor, or Instances Admin roles for intake forms, and Bare Metal Solution Viewer or Instances Viewer roles for listing and checking status.\u003c/p\u003e\n"],["\u003cp\u003eIAM roles can be granted through the Google Cloud console by navigating to the IAM permissions page and adding users with the desired roles, or by using the gcloud command-line tool with the \u003ccode\u003eadd-iam-policy-binding\u003c/code\u003e command.\u003c/p\u003e\n"],["\u003cp\u003eThere are additional resources available online to check the predefine roles, search for a specific permission and check the required permissions when granting, changing or revoking access to resources.\u003c/p\u003e\n"]]],[],null,["# Configure IAM for Bare Metal Solution\n=====================================\n\nWhen you want a [principal](/iam/docs/overview#concepts_related_identity),\nsuch as a Google Cloud project user or service account, to gain access to\nthe resources in your Bare Metal Solution environment, you need to grant them\nappropriate roles and permissions. To grant access, you can create an\nIdentity and Access Management (IAM) policy and grant predefined roles specific to\nBare Metal Solution.\n\nGrant roles with enough permissions for your principals to be\nable do their job but no more, so that you can follow the Google Cloud\nsecurity principle of least privilege.\n\nPredefined roles for Bare Metal Solution\n----------------------------------------\n\nEach IAM role for Bare Metal Solution contains permissions that\ngive the principal access to specific resources as shown in the following table. \n\nWe recommend applying the roles as follows:\n\n- **Filling out an intake form**\n\n - Bare Metal Solution roles: Admin, Editor, or Instances Admin AND Compute Network Viewer\n - Basic roles: Owner or Editor\n- **Restarting a Bare Metal Solution server**\n\n - Bare Metal Solution roles: Admin or Editor\n - Basic roles: Owner or Editor\n- **Listing servers or requesting status**\n\n - Bare Metal Solution roles: Viewer or Instances Viewer\n - Basic role: Viewer\n- **Managing storage components**\n\n - Bare Metal Solution roles: Admin, Editor, or Storage Admin\n - Basic roles: Owner or Editor\n- **Managing networking components**\n\n - Bare Metal Solution roles: Admin, Editor, or Networks Admin\n - Basic roles: Owner or Editor\n\nFor a full list of Bare Metal Solution roles, see [Predefined roles](https://cloud.google.com/iam/docs/understanding-roles#predefined) and enter\n`baremetalsolution.` in the search box.\n\nFor a full list of Bare Metal Solution permissions, see [Search for a permission](https://cloud.google.com/iam/docs/permissions-reference#search) and enter\n`baremetalsolution.` in the search box.\n\nGrant an IAM role\n-----------------\n\nAdd an IAM policy to grant a Bare Metal Solution role to\na principal. The role contains permissions which enable the principal to perform\ncertain actions. To grant a role: \n\n### Console\n\n1. Make sure that you have a role that contains the proper\n IAM permissions to grant roles to others, such as\n **Owner** , **Project IAM Admin** , or\n **Security Admin** . For more information about this requirement, see\n [Required Roles](https://cloud.google.com/iam/docs/granting-changing-revoking-access#required-permissions).\n\n2. In the Google Cloud console, go to the IAM\n permissions page.\n\n [Go to IAM](https://console.cloud.google.com/iam-admin/iam)\n3. Click **Grant access**.\n\n4. Enter the following information:\n\n - For **Add principals**, enter your users. You can add individual\n users, Google groups, service accounts, or Google Workspace\n domains.\n\n - For **Assign roles** , choose a role from the **Select a role** menu\n to grant this role to the principals.\n\n - Click **addAdd another role** if\n you need to assign multiple roles to your principals.\n\n - Click **Save**.\n\n Your principals and their assigned roles appear in the [IAM\n permissions](https://console.cloud.google.com/iam-admin/iam) status page.\n\n### gcloud\n\n1. Make sure that you have a role that contains the proper IAM permissions\n to grant roles to others, such as **Owner** , **Project IAM Admin** , or\n **Security Admin** . For more information about this requirement, see\n [Required Roles](https://cloud.google.com/iam/docs/granting-changing-revoking-access#required-permissions).\n\n2. Open a Cloud Shell window in your Google Cloud project.\n\n3. Add your Google Cloud project ID, email address for your\n principal's Google Cloud account, and the desired Bare Metal Solution\n role path into the following command:\n\n \u003cbr /\u003e\n\n ```\n gcloud projects add-iam-policy-binding PROJECT_ID \\\n --member=user:username@example.com \\\n --role=roles/baremetalsolution.admin\n \n ```\n\n \u003cbr /\u003e\n\n4. Copy the command and paste it into your Cloud Shell window.\n\n5. Press the **Enter** or **Return** key.\n\n6. In some cases, an **Authorize Cloud Shell** window opens, requesting\n you to allow an API call. If you see this, click **Authorize**.\n\n7. When you've entered the commands successfully, the output looks like\n this:\n\n \u003cbr /\u003e\n\n ```\n Updated IAM policy for project [PROJECT_ID].\n bindings:\n - members:\n - user:username@example.com\n role: roles/baremetalsolution.admin\n - members:\n - serviceAccount:service-PROJECT_NUMBER@compute-system.iam.gserviceaccount.com\n role: roles/compute.serviceAgent\n - members:\n - serviceAccount:PROJECT_NUMBER-compute@developer.gserviceaccount.com\n - serviceAccount:PROJECT_NUMBER@cloudservices.gserviceaccount.com\n role: roles/editor\n - members:\n - user:username@example.com\n role: roles/owner\n etag: ETAG_NUMBER\n version: 1\n \n ```\n\n \u003cbr /\u003e\n\nTo learn more about IAM, see [Identity and Access Management](/iam)."]]
