使用 IAM 进行访问权限控制
本页介绍了如何使用 Identity and Access Management (IAM) 管理对 Colab Enterprise 资源的访问。如需管理对其他 Vertex AI 资源的访问权限,请参阅使用 IAM 进行 Vertex AI 访问权限控制。
使用 IAM 控制对笔记本的访问权限
您可以在项目级层或按笔记本管理对 Colab Enterprise 笔记本 (IPYNB 文件) 的访问权限。
- 如需在项目级层授予对记事本的访问权限,请为主账号(用户、群组或服务账号)分配一个或多个角色。
- 如需授予对特定记事本的访问权限,请为记事本中的正文分配一个或多个角色。如需了解详情,请参阅管理对笔记本的访问权限。
运行与其他服务交互的代码 Google Cloud
授予对某个记事本的访问权限仅限于与与该记事本互动相关的特定权限。例如,您可以授予创建笔记本、在其中编写代码或删除笔记本的权限。
如需运行与其他服务交互的代码,您必须使用以下方法之一: Google Cloud
在启用了最终用户凭据的运行时中运行代码。这意味着,您的笔记本对服务的访问权限与笔记本用户相同。 Google Cloud
运行用于对您的笔记本进行身份验证并授权其与Google Cloud 服务交互的代码。
如需了解详情,请参阅运行与Google Cloud交互的代码。
IAM 角色的类型
您可以在 Colab Enterprise 中使用不同类型的 IAM 角色:
预定义角色允许您在项目级向 Colab Enterprise 资源授予一组相关权限。
基本角色(Owner、Editor 和 Viewer)提供项目级层的 Colab Enterprise 资源的访问权限控制,并且适用于所有 Google Cloud服务。
自定义角色让您可以基于一组特定权限创建具有这些权限的专属角色,然后将该角色授予组织中的用户。
如需在 Colab Enterprise 项目中添加、更新或移除这些角色,请参阅管理对项目、文件夹和组织的访问权限一文。
Colab Enterprise 的预定义角色
Colab Enterprise 是 Vertex AI 的一部分,Colab Enterprise 资源通过 Vertex AI API 进行管理。因此,您可以通过 Vertex AI 角色向主账号授予对 Colab Enterprise 资源的访问权限。
下表包含所有 Vertex AI 预定义角色。
如需针对常见的 Colab Enterprise 操作使用预定义角色,请参阅 Colab Enterprise Admin (
roles/aiplatform.colabEnterpriseAdmin
) 和 Colab Enterprise User (roles/aiplatform.colabEnterpriseUser
)。如需了解与运行时管理相关的角色,请参阅 Notebook Runtime Admin (
roles/aiplatform.notebookRuntimeAdmin
) 和 Notebook Runtime User (roles/aiplatform.notebookRuntimeUser
)。Vertex AI Administrator (
roles/aiplatform.admin
)、Vertex AI User (roles/aiplatform.user
) 和 Vertex AI Viewer (roles/aiplatform.viewer
) 还包含 Colab Enterprise 权限。
Role | Permissions |
---|---|
Vertex AI Administrator( Grants full access to all resources in Vertex AI |
|
Vertex AI Batch Prediction Service Agent( Vertex AI Batch Prediction Service Agent for serving batch prediction requests. |
|
Colab Enterprise Admin( Admin role of using colab enterprise. |
|
Colab Enterprise User( User role of using colab enterprise. |
|
Vertex AI Colab Service Agent( Gives Vertex AI Colab the proper permissions to function. |
|
Vertex AI Custom Code Service Agent( Gives Vertex AI Custom Code the proper permissions. |
|
Vertex AI Feature Store EntityType owner( Provides full access to all permissions for a particular entity type resource. Lowest-level resources where you can grant this role:
|
|
Vertex AI Platform Express Admin Beta( Grants admin access to Vertex AI Express |
|
Vertex AI Platform Express User Beta( Grants user access to Vertex AI Express |
|
Vertex AI Extension Custom Code Service Agent( Gives Vertex AI Extension that executes custom code the permissions it needs to function. |
|
Vertex AI Extension Service Agent( Gives Vertex AI Extension the permissions it needs to function. |
|
Vertex AI Feature Store Admin( Grants full access to all resources in Vertex AI Feature Store Lowest-level resources where you can grant this role:
|
|
Vertex AI Feature Store Data Viewer( This role provides permissions to read Feature data. Lowest-level resources where you can grant this role:
|
|
Vertex AI Feature Store Data Writer( This role provides permissions to read and write Feature data. Lowest-level resources where you can grant this role:
|
|
Vertex AI Feature Store Instance Creator( Administrator of Featurestore resources, but not the child resources under Featurestores. Lowest-level resources where you can grant this role:
|
|
Vertex AI Feature Store Resource Viewer( Viewer of all resources in Vertex AI Feature Store but cannot make changes. Lowest-level resources where you can grant this role:
|
|
Vertex AI Feature Store User Beta( Deprecated. Use featurestoreAdmin instead. |
|
Vertex AI Migration Service User( Grants access to use migration service in Vertex AI |
|
Vertex AI Model Monitoring Service Agent( Gives Vertex AI Model Monitoring the permissions it needs to function. |
|
Notebook Executor User Beta( Grants users full access to schedules and notebook execution jobs. |
|
Notebook Runtime Admin( Grants full access to all runtime templates and runtimes in Notebook Service. |
|
Notebook Runtime User( Grants users permissions to create runtime resources using a runtime template and manage the runtime resources they created. |
|
Vertex AI Notebook Service Agent( Vertex AI Service Agent used to run Notebook managed resources in user project with restricted permissions. |
|
Vertex AI Online Prediction Service Agent( Gives Vertex AI Online Prediction the permissions it needs to function. |
|
Vertex AI Platform Provisioned Throughput Admin Beta( Grants access to use all resources related to Vertex AI Provisioned Throughput |
|
Vertex AI RAG Data Service Agent( Vertex AI Service Agent used by Vertex RAG to access user imported data, Vertex AI, Document AI processors in the project |
|
Vertex AI Rapid Eval Service Agent( Vertex AI Service Agent used by GenAI Rapid Evaluation Service to access publisher model endpoints in the user project |
|
Vertex AI Reasoning Engine Service Agent( Gives Vertex AI Reasoning Engine the proper permissions to function. The aiplatform.reasoningEngines.create IAM permission implies read access to the GCS objects of the consumer project through this service agent. |
|
Vertex AI Service Agent( Gives Vertex AI the permissions it needs to function. |
|
Vertex AI Telemetry Service Agent( Allows Vertex AI Telemetry Service Agent to access telemetry data. |
|
Vertex AI Tensorboard Web App User Beta( Grants access to the Vertex AI TensorBoard web app. |
|
Vertex AI Tuning Service Agent( Vertex AI Service Agent used for tuning in user project. |
|
Vertex AI User( Grants access to use all resource in Vertex AI |
|
Vertex AI Viewer( Grants access to view all resource in Vertex AI |
|
基本角色
旧版 Google Cloud 基本角色适用于所有 Google Cloud 服务。这些角色包括 Owner、Editor 和 Viewer。
这些基本角色可在整个 Google Cloud中提供权限,而不仅仅是针对 Colab Enterprise。因此,您应尽可能使用 Colab Enterprise 角色。
自定义角色
如果 Colab Enterprise 的预定义 IAM 角色不符合您的需求,您可以定义自定义角色。自定义角色让您可以基于一组特定权限创建具有这些权限的专属角色,然后将该角色授予组织中的用户。如需了解详情,请参阅了解 IAM 自定义角色。
Colab Enterprise 的服务人员
Colab Enterprise 会自动创建和使用服务代理来代表您访问资源。创建服务代理后,系统会为服务代理授予项目的预定义角色。
下表列出了 Colab Enterprise 服务人员、他们的电子邮件地址以及各自的角色:
名称 | 用于: | 电子邮件地址 | 角色 |
---|---|---|---|
Vertex AI Service Agent | Vertex AI 功能 | service-PROJECT_NUMBER@gcp-sa-aiplatform.iam.gserviceaccount.com |
roles/aiplatform.serviceAgent |
Vertex AI Colab Service Agent | 授予 Colab Enterprise 正常运行所需的适当权限 | service-PROJECT_NUMBER@gcp-sa-vertex-nb.iam.gserviceaccount.com |
roles/aiplatform.colabServiceAgent |
Vertex AI Notebook Service Agent | 在权限受限的用户项目中运行笔记本管理的资源 | service-PROJECT_NUMBER@gcp-sa-aiplatform-vm.iam.gserviceaccount.com |
roles/aiplatform.notebookServiceAgent |
如果您移除 Colab Enterprise 服务代理的默认角色,Colab Enterprise 可以自动重新分配这些角色,以确保服务功能不中断。如需停用 Colab Enterprise 服务,您必须停用相关 API,而不是移除角色。