Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Kontrol akses di Cloud Build dikontrol menggunakan
Identity and Access Management (IAM).
IAM memungkinkan Anda membuat dan mengelola
izin untuk resource Google Cloud . Cloud Build menyediakan kumpulan
peran IAM standar
tertentu, dengan setiap peran berisi kumpulan izin. Anda dapat menggunakan peran ini untuk memberikan
akses yang lebih terperinci ke resource Google Cloud tertentu dan mencegah akses
yang tidak diinginkan ke resource lain. IAM memungkinkan Anda menerapkan
prinsip keamanan dengan hak istimewa terendah,
jadi Anda hanya memberikan akses yang diperlukan ke resource Anda.
Halaman ini menjelaskan peran dan izin Cloud Build.
Peran Cloud Build yang telah ditetapkan
Dengan IAM, setiap metode API di Cloud Build API mengharuskan
identitas yang membuat permintaan API memiliki izin yang sesuai untuk menggunakan
resource. Izin diberikan dengan menetapkan kebijakan yang memberikan peran kepada
akun utama (pengguna, grup, atau akun layanan). Anda dapat memberikan beberapa peran kepada akun utama di resource yang sama.
Tabel di bawah mencantumkan peran IAM Cloud Build dan izin yang disertakan:
Nama: roles/cloudbuild.builds.builder Judul: Akun Layanan Lama Cloud Build
Saat Anda mengaktifkan
Cloud Build API untuk project,
akun layanan lama Cloud Build
akan otomatis dibuat di project
dan diberi peran ini untuk resource
dalam project. Akun layanan lama Cloud Build hanya menggunakan peran ini karena diperlukan untuk melakukan tindakan saat menjalankan build Anda.
Nama: roles/cloudbuild.workerPoolUser Judul: Pengguna WorkerPool Cloud Build
Dapat menjalankan build di kumpulan pribadi
cloudbuild.workerpools.use
Selain peran bawaan Cloud Build di atas, peran Viewer, Editor, dan Pemilik dasar juga mencakup izin yang terkait dengan Cloud Build.
Namun, sebaiknya Anda memberikan peran bawaan jika memungkinkan untuk mematuhi
prinsip keamanan hak istimewa terendah.
Tabel di bawah mencantumkan peran dasar dan peran IAM Cloud Build yang disertakan.
Untuk melihat log build, Anda memerlukan izin tambahan, bergantung pada apakah Anda menyimpan log build di bucket Cloud Storage default atau di bucket Cloud Storage yang ditentukan pengguna. Untuk informasi selengkapnya tentang izin
yang diperlukan untuk melihat log build, lihat Menyimpan dan melihat log build.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-01 UTC."],[[["\u003cp\u003eCloud Build utilizes Identity and Access Management (IAM) to manage permissions for Google Cloud resources, allowing for granular control and adherence to the principle of least privilege.\u003c/p\u003e\n"],["\u003cp\u003eThere are several predefined Cloud Build IAM roles, including Viewer, Editor, Approver, and various roles for Integrations and WorkerPools, each with specific permissions to control different aspects of Cloud Build.\u003c/p\u003e\n"],["\u003cp\u003eBasic roles like Viewer, Editor, and Owner also include Cloud Build permissions, but using the specific Cloud Build predefined roles is recommended for enhanced security.\u003c/p\u003e\n"],["\u003cp\u003eCertain API methods within Cloud Build, such as \u003ccode\u003ebuilds.create\u003c/code\u003e and \u003ccode\u003ebuilds.get\u003c/code\u003e, require specific permissions, which are associated with particular Cloud Build roles like Editor or Viewer.\u003c/p\u003e\n"],["\u003cp\u003eThe Cloud Build legacy service account is automatically created when the API is enabled and is given permissions to run builds, and granting users roles with \u003ccode\u003ecloudbuild.builds.create\u003c/code\u003e permission will enable them to run builds as the service account.\u003c/p\u003e\n"]]],[],null,["# IAM roles and permissions\n\nAccess control in Cloud Build is controlled using\n[Identity and Access Management (IAM)](/iam).\nIAM enables you to create and manage\npermissions for Google Cloud resources. Cloud Build provides a specific\nset of [predefined IAM roles](/iam/docs/understanding-roles#role_types)\nwhere each role contains a set of permissions. You can use these roles to give\nmore granular access to specific Google Cloud resources and prevent unwanted\naccess to other resources. IAM lets you adopt the\n[security principle of least privilege](https://en.wikipedia.org/wiki/Principle_of_least_privilege),\nso you grant only the necessary access to your resources.\n\nThis page describes Cloud Build roles and permissions.\n\nPredefined Cloud Build roles\n----------------------------\n\nWith IAM, every API method in Cloud Build API requires\nthat the identity making the API request has the appropriate permissions to use\nthe resource. Permissions are granted by setting policies that grant roles to a\nprincipal (user, group, or service account). You can grant multiple roles to a\nprincipal on the same resource.\n\nThe table below lists the Cloud Build IAM roles and\nthe permissions that they include:\n\nIn addition to the above Cloud Build predefined roles, the\n[basic](/iam/docs/understanding-roles#basic) Viewer,\nEditor, and Owner roles also include permissions related to Cloud Build.\nHowever, we recommend that you grant predefined roles where possible to comply with the\n[security principle of least privilege](/iam/docs/using-iam-securely#least_privilege).\n\nThe table below lists the basic roles and the Cloud Build\nIAM roles\nthat they include.\n\n| **Note:** Owner, Editor, and Viewer include permissions for many other Google Cloud services. The Owner role is automatically granted to the original project creator.\n\nPermissions\n-----------\n\nThe following table lists the permissions that the caller must have to call each method:\n\n| **Caution:** `cloudbuild.builds.create` permission enables the user to run builds as the [Cloud Build legacy service account](/build/docs/cloud-build-service-account). This permission is included in Cloud Build Editor, Project Owner, and Project Editor roles. Granting a user any of these roles will enable them to run builds as the Cloud Build legacy service account. Depending on the IAM permissions granted to the user and the permissions of the Cloud Build legacy service account, this could enable the user escalated build-time privileges.\n\nPermissions to view build logs\n------------------------------\n\nTo view build logs, you require additional permissions depending on whether\nyou're storing your build logs in the default Cloud Storage bucket or in\na user-specified Cloud Storage bucket. For more information on permissions\nrequired to view build logs, see [Storing and viewing build logs](/build/docs/securing-builds/store-view-build-logs).\n\nWhat's next\n-----------\n\n- Learn about [the default Cloud Build service account](/build/docs/cloud-build-service-account).\n- Learn how to [configure access to Cloud Build resources](/build/docs/securing-builds/configure-access-to-resources).\n- Learn how to [configure access for Cloud Build service account](/build/docs/securing-builds/configure-access-for-cloud-build-service-account).\n- Learn about [IAM](/iam/docs)."]]
