[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-18。"],[[["\u003cp\u003eCloud Build utilizes Identity and Access Management (IAM) to manage permissions for Google Cloud resources, allowing for granular control and adherence to the principle of least privilege.\u003c/p\u003e\n"],["\u003cp\u003eThere are several predefined Cloud Build IAM roles, including Viewer, Editor, Approver, and various roles for Integrations and WorkerPools, each with specific permissions to control different aspects of Cloud Build.\u003c/p\u003e\n"],["\u003cp\u003eBasic roles like Viewer, Editor, and Owner also include Cloud Build permissions, but using the specific Cloud Build predefined roles is recommended for enhanced security.\u003c/p\u003e\n"],["\u003cp\u003eCertain API methods within Cloud Build, such as \u003ccode\u003ebuilds.create\u003c/code\u003e and \u003ccode\u003ebuilds.get\u003c/code\u003e, require specific permissions, which are associated with particular Cloud Build roles like Editor or Viewer.\u003c/p\u003e\n"],["\u003cp\u003eThe Cloud Build legacy service account is automatically created when the API is enabled and is given permissions to run builds, and granting users roles with \u003ccode\u003ecloudbuild.builds.create\u003c/code\u003e permission will enable them to run builds as the service account.\u003c/p\u003e\n"]]],[],null,["# IAM roles and permissions\n\nAccess control in Cloud Build is controlled using\n[Identity and Access Management (IAM)](/iam).\nIAM enables you to create and manage\npermissions for Google Cloud resources. Cloud Build provides a specific\nset of [predefined IAM roles](/iam/docs/understanding-roles#role_types)\nwhere each role contains a set of permissions. You can use these roles to give\nmore granular access to specific Google Cloud resources and prevent unwanted\naccess to other resources. IAM lets you adopt the\n[security principle of least privilege](https://en.wikipedia.org/wiki/Principle_of_least_privilege),\nso you grant only the necessary access to your resources.\n\nThis page describes Cloud Build roles and permissions.\n\nPredefined Cloud Build roles\n----------------------------\n\nWith IAM, every API method in Cloud Build API requires\nthat the identity making the API request has the appropriate permissions to use\nthe resource. Permissions are granted by setting policies that grant roles to a\nprincipal (user, group, or service account). You can grant multiple roles to a\nprincipal on the same resource.\n\nThe table below lists the Cloud Build IAM roles and\nthe permissions that they include:\n\nIn addition to the above Cloud Build predefined roles, the\n[basic](/iam/docs/understanding-roles#basic) Viewer,\nEditor, and Owner roles also include permissions related to Cloud Build.\nHowever, we recommend that you grant predefined roles where possible to comply with the\n[security principle of least privilege](/iam/docs/using-iam-securely#least_privilege).\n\nThe table below lists the basic roles and the Cloud Build\nIAM roles\nthat they include.\n\n| **Note:** Owner, Editor, and Viewer include permissions for many other Google Cloud services. The Owner role is automatically granted to the original project creator.\n\nPermissions\n-----------\n\nThe following table lists the permissions that the caller must have to call each method:\n\n| **Caution:** `cloudbuild.builds.create` permission enables the user to run builds as the [Cloud Build legacy service account](/build/docs/cloud-build-service-account). This permission is included in Cloud Build Editor, Project Owner, and Project Editor roles. Granting a user any of these roles will enable them to run builds as the Cloud Build legacy service account. Depending on the IAM permissions granted to the user and the permissions of the Cloud Build legacy service account, this could enable the user escalated build-time privileges.\n\nPermissions to view build logs\n------------------------------\n\nTo view build logs, you require additional permissions depending on whether\nyou're storing your build logs in the default Cloud Storage bucket or in\na user-specified Cloud Storage bucket. For more information on permissions\nrequired to view build logs, see [Storing and viewing build logs](/build/docs/securing-builds/store-view-build-logs).\n\nWhat's next\n-----------\n\n- Learn about [the default Cloud Build service account](/build/docs/cloud-build-service-account).\n- Learn how to [configure access to Cloud Build resources](/build/docs/securing-builds/configure-access-to-resources).\n- Learn how to [configure access for Cloud Build service account](/build/docs/securing-builds/configure-access-for-cloud-build-service-account).\n- Learn about [IAM](/iam/docs)."]]
