如要限制專案或機構中使用者的存取權,可以使用 Dataflow 的身分與存取權管理 (IAM) 角色。您可以控管 Dataflow 相關資源的存取權,而不將整個 Google Cloud 專案的檢視者、編輯者或擁有者角色授予使用者。
本頁主要說明如何使用 Dataflow 的身分與存取權管理角色。如需 IAM 和其功能的詳細說明,請參閱 IAM 說明文件。
每個 Dataflow 方法都要求呼叫者具備必要的權限。如需 Dataflow 支援的權限與角色清單,請參閱下節的說明。
權限與角色
本節概述 Dataflow IAM 支援的權限與角色。
所需權限
下表列出呼叫者呼叫每個方法所需的權限:
方法 | 所需權限 |
---|---|
dataflow.jobs.create |
dataflow.jobs.create |
dataflow.jobs.cancel |
dataflow.jobs.cancel |
dataflow.jobs.updateContents |
dataflow.jobs.updateContents |
dataflow.jobs.list |
dataflow.jobs.list |
dataflow.jobs.get |
dataflow.jobs.get |
dataflow.messages.list |
dataflow.messages.list |
dataflow.metrics.get |
dataflow.metrics.get |
dataflow.jobs.snapshot |
dataflow.jobs.snapshot |
角色
下表列出 Dataflow IAM 角色,以及各角色具備的所有 Dataflow 相關權限對應清單。每個權限只適用於特定資源類型。如需權限清單,請參閱 Google Cloud 控制台的「角色」頁面。
(
Minimal role for creating and managing dataflow jobs.
(
Provides the permissions necessary to execute and manipulate
Dataflow jobs.
Lowest-level resources where you can grant this role:
(
Gives Cloud Dataflow service account access to managed resources. Includes access to service accounts.
(
Provides read-only access to all Dataflow-related
resources.
Lowest-level resources where you can grant this role: (
Provides the permissions necessary for a Compute Engine service
account to execute work units for a Dataflow pipeline.
Lowest-level resources where you can grant this role:
Role
Permissions
Dataflow Admin
roles/
)
cloudbuild.builds.create
cloudbuild.builds.get
cloudbuild.builds.list
cloudbuild.builds.update
cloudbuild.locations.*
cloudbuild.locations.get
cloudbuild.locations.list
cloudbuild.operations.*
cloudbuild.operations.get
cloudbuild.operations.list
cloudkms.keyHandles.*
cloudkms.keyHandles.create
cloudkms.keyHandles.get
cloudkms.keyHandles.list
cloudkms.operations.get
cloudkms.
compute.machineTypes.get
compute.projects.get
compute.regions.list
compute.zones.list
dataflow.jobs.*
dataflow.jobs.cancel
dataflow.jobs.create
dataflow.jobs.get
dataflow.jobs.list
dataflow.jobs.snapshot
dataflow.jobs.updateContents
dataflow.messages.list
dataflow.metrics.get
dataflow.snapshots.*
dataflow.snapshots.delete
dataflow.snapshots.get
dataflow.snapshots.list
recommender.
recommender.
recommender.
recommender.
remotebuildexecution.blobs.get
resourcemanager.projects.get
resourcemanager.projects.list
storage.buckets.get
storage.objects.create
storage.objects.get
storage.objects.list
Dataflow Developer
roles/
)
cloudbuild.builds.create
cloudbuild.builds.get
cloudbuild.builds.list
cloudbuild.builds.update
cloudbuild.locations.*
cloudbuild.locations.get
cloudbuild.locations.list
cloudbuild.operations.*
cloudbuild.operations.get
cloudbuild.operations.list
cloudkms.keyHandles.*
cloudkms.keyHandles.create
cloudkms.keyHandles.get
cloudkms.keyHandles.list
cloudkms.operations.get
cloudkms.
compute.projects.get
compute.regions.list
compute.zones.list
dataflow.jobs.*
dataflow.jobs.cancel
dataflow.jobs.create
dataflow.jobs.get
dataflow.jobs.list
dataflow.jobs.snapshot
dataflow.jobs.updateContents
dataflow.messages.list
dataflow.metrics.get
dataflow.snapshots.*
dataflow.snapshots.delete
dataflow.snapshots.get
dataflow.snapshots.list
recommender.
recommender.
recommender.
recommender.
remotebuildexecution.blobs.get
resourcemanager.projects.get
resourcemanager.projects.list
Cloud Dataflow Service Agent
roles/
)
backupdr.
backupdr.
backupdr.
backupdr.
backupdr.
backupdr.
backupdr.
backupdr.
backupdr.
backupdr.
backupdr.backupPlans.get
backupdr.backupPlans.list
backupdr.
backupdr.
backupdr.backupVaults.get
backupdr.backupVaults.list
backupdr.locations.list
backupdr.operations.get
backupdr.operations.list
backupdr.
bigquery.bireservations.*
bigquery.bireservations.get
bigquery.bireservations.update
bigquery.capacityCommitments.*
bigquery.
bigquery.
bigquery.
bigquery.
bigquery.
bigquery.config.*
bigquery.config.get
bigquery.config.update
bigquery.connections.*
bigquery.connections.create
bigquery.connections.delegate
bigquery.connections.delete
bigquery.connections.get
bigquery.
bigquery.connections.list
bigquery.
bigquery.connections.update
bigquery.connections.updateTag
bigquery.connections.use
bigquery.dataPolicies.create
bigquery.dataPolicies.delete
bigquery.dataPolicies.get
bigquery.
bigquery.dataPolicies.list
bigquery.
bigquery.dataPolicies.update
bigquery.datasets.*
bigquery.datasets.create
bigquery.
bigquery.datasets.delete
bigquery.
bigquery.datasets.get
bigquery.datasets.getIamPolicy
bigquery.datasets.link
bigquery.
bigquery.
bigquery.
bigquery.datasets.setIamPolicy
bigquery.datasets.update
bigquery.datasets.updateTag
bigquery.jobs.*
bigquery.jobs.create
bigquery.jobs.delete
bigquery.jobs.get
bigquery.jobs.list
bigquery.jobs.listAll
bigquery.
bigquery.jobs.update
bigquery.models.*
bigquery.models.create
bigquery.models.delete
bigquery.models.export
bigquery.models.getData
bigquery.models.getMetadata
bigquery.models.list
bigquery.models.updateData
bigquery.models.updateMetadata
bigquery.models.updateTag
bigquery.objectRefs.*
bigquery.objectRefs.read
bigquery.objectRefs.write
bigquery.readsessions.*
bigquery.readsessions.create
bigquery.readsessions.getData
bigquery.readsessions.update
bigquery.
bigquery.
bigquery.
bigquery.
bigquery.
bigquery.reservations.*
bigquery.reservations.create
bigquery.reservations.delete
bigquery.reservations.get
bigquery.reservations.list
bigquery.
bigquery.reservations.update
bigquery.reservations.use
bigquery.routines.*
bigquery.routines.create
bigquery.routines.delete
bigquery.routines.get
bigquery.routines.list
bigquery.routines.update
bigquery.routines.updateTag
bigquery.
bigquery.
bigquery.rowAccessPolicies.get
bigquery.
bigquery.
bigquery.
bigquery.
bigquery.
bigquery.savedqueries.*
bigquery.savedqueries.create
bigquery.savedqueries.delete
bigquery.savedqueries.get
bigquery.savedqueries.list
bigquery.savedqueries.update
bigquery.tables.*
bigquery.tables.create
bigquery.tables.createIndex
bigquery.tables.createSnapshot
bigquery.
bigquery.tables.delete
bigquery.tables.deleteIndex
bigquery.tables.deleteSnapshot
bigquery.
bigquery.tables.export
bigquery.tables.get
bigquery.tables.getData
bigquery.tables.getIamPolicy
bigquery.tables.list
bigquery.
bigquery.
bigquery.tables.replicateData
bigquery.
bigquery.tables.setCategory
bigquery.
bigquery.tables.setIamPolicy
bigquery.tables.update
bigquery.tables.updateData
bigquery.tables.updateIndex
bigquery.tables.updateTag
bigquery.transfers.*
bigquery.transfers.get
bigquery.transfers.update
bigquerymigration.
clouddebugger.breakpoints.list
clouddebugger.
clouddebugger.
clouddebugger.debuggees.create
cloudnotifications.
compute.acceleratorTypes.*
compute.acceleratorTypes.get
compute.acceleratorTypes.list
compute.addresses.*
compute.addresses.create
compute.
compute.
compute.addresses.delete
compute.
compute.
compute.addresses.get
compute.addresses.list
compute.
compute.
compute.addresses.setLabels
compute.addresses.use
compute.addresses.useInternal
compute.autoscalers.*
compute.autoscalers.create
compute.autoscalers.delete
compute.autoscalers.get
compute.autoscalers.list
compute.autoscalers.update
compute.backendBuckets.*
compute.
compute.backendBuckets.create
compute.
compute.backendBuckets.delete
compute.
compute.
compute.backendBuckets.get
compute.
compute.backendBuckets.list
compute.
compute.
compute.
compute.
compute.backendBuckets.update
compute.backendBuckets.use
compute.backendServices.*
compute.
compute.backendServices.create
compute.
compute.backendServices.delete
compute.
compute.
compute.backendServices.get
compute.
compute.backendServices.list
compute.
compute.
compute.
compute.
compute.backendServices.update
compute.backendServices.use
compute.crossSiteNetworks.*
compute.
compute.
compute.crossSiteNetworks.get
compute.crossSiteNetworks.list
compute.
compute.diskSettings.*
compute.diskSettings.get
compute.diskSettings.update
compute.diskTypes.*
compute.diskTypes.get
compute.diskTypes.list
compute.disks.*
compute.
compute.disks.create
compute.disks.createSnapshot
compute.disks.createTagBinding
compute.disks.delete
compute.disks.deleteTagBinding
compute.disks.get
compute.disks.getIamPolicy
compute.disks.list
compute.
compute.disks.listTagBindings
compute.
compute.disks.resize
compute.disks.setIamPolicy
compute.disks.setLabels
compute.
compute.
compute.
compute.disks.update
compute.disks.use
compute.disks.useReadOnly
compute.externalVpnGateways.*
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.firewallPolicies.get
compute.firewallPolicies.list
compute.
compute.
compute.firewallPolicies.use
compute.firewalls.get
compute.firewalls.list
compute.
compute.
compute.forwardingRules.*
compute.forwardingRules.create
compute.
compute.forwardingRules.delete
compute.
compute.forwardingRules.get
compute.forwardingRules.list
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.forwardingRules.update
compute.forwardingRules.use
compute.globalAddresses.*
compute.globalAddresses.create
compute.
compute.
compute.globalAddresses.delete
compute.
compute.
compute.globalAddresses.get
compute.globalAddresses.list
compute.
compute.
compute.
compute.globalAddresses.use
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.globalOperations.get
compute.globalOperations.list
compute.
compute.
compute.
compute.
compute.healthChecks.*
compute.healthChecks.create
compute.
compute.healthChecks.delete
compute.
compute.healthChecks.get
compute.healthChecks.list
compute.
compute.
compute.healthChecks.update
compute.healthChecks.use
compute.
compute.httpHealthChecks.*
compute.
compute.
compute.
compute.
compute.httpHealthChecks.get
compute.httpHealthChecks.list
compute.
compute.
compute.
compute.httpHealthChecks.use
compute.
compute.httpsHealthChecks.*
compute.
compute.
compute.
compute.
compute.httpsHealthChecks.get
compute.httpsHealthChecks.list
compute.
compute.
compute.
compute.httpsHealthChecks.use
compute.
compute.images.*
compute.images.create
compute.
compute.images.delete
compute.
compute.images.deprecate
compute.images.get
compute.images.getFromFamily
compute.images.getIamPolicy
compute.images.list
compute.
compute.images.listTagBindings
compute.images.setIamPolicy
compute.images.setLabels
compute.images.update
compute.images.useReadOnly
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.instanceGroups.*
compute.instanceGroups.create
compute.
compute.instanceGroups.delete
compute.
compute.instanceGroups.get
compute.instanceGroups.list
compute.
compute.
compute.instanceGroups.update
compute.instanceGroups.use
compute.instanceSettings.get
compute.instanceTemplates.*
compute.
compute.
compute.instanceTemplates.get
compute.
compute.instanceTemplates.list
compute.
compute.
compute.instances.*
compute.
compute.
compute.
compute.instances.attachDisk
compute.instances.create
compute.
compute.instances.delete
compute.
compute.
compute.
compute.instances.detachDisk
compute.instances.get
compute.
compute.
compute.instances.getIamPolicy
compute.
compute.
compute.
compute.
compute.instances.list
compute.
compute.
compute.
compute.instances.osAdminLogin
compute.instances.osLogin
compute.
compute.
compute.instances.reset
compute.instances.resume
compute.
compute.
compute.
compute.instances.setIamPolicy
compute.instances.setLabels
compute.
compute.
compute.instances.setMetadata
compute.
compute.instances.setName
compute.
compute.
compute.
compute.
compute.
compute.instances.setTags
compute.
compute.instances.start
compute.
compute.instances.stop
compute.instances.suspend
compute.instances.update
compute.
compute.
compute.
compute.
compute.
compute.
compute.instances.use
compute.instances.useReadOnly
compute.instantSnapshots.*
compute.
compute.
compute.
compute.instantSnapshots.get
compute.
compute.instantSnapshots.list
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.interconnectGroups.*
compute.
compute.
compute.interconnectGroups.get
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.interconnects.*
compute.interconnects.create
compute.
compute.interconnects.delete
compute.
compute.interconnects.get
compute.
compute.interconnects.list
compute.
compute.
compute.
compute.interconnects.update
compute.interconnects.use
compute.licenseCodes.*
compute.licenseCodes.get
compute.
compute.licenseCodes.list
compute.
compute.licenseCodes.update
compute.licenses.*
compute.licenses.create
compute.licenses.delete
compute.licenses.get
compute.licenses.getIamPolicy
compute.licenses.list
compute.licenses.setIamPolicy
compute.licenses.update
compute.machineImages.*
compute.machineImages.create
compute.machineImages.delete
compute.machineImages.get
compute.
compute.machineImages.list
compute.
compute.
compute.
compute.machineTypes.*
compute.machineTypes.get
compute.machineTypes.list
compute.multiMig.*
compute.multiMig.create
compute.multiMig.delete
compute.multiMig.get
compute.multiMig.list
compute.networkAttachments.*
compute.
compute.
compute.
compute.
compute.networkAttachments.get
compute.
compute.
compute.
compute.
compute.
compute.
compute.networkAttachments.use
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.networkProfiles.*
compute.networkProfiles.get
compute.networkProfiles.list
compute.networks.*
compute.networks.access
compute.networks.addPeering
compute.networks.create
compute.
compute.networks.delete
compute.
compute.networks.get
compute.
compute.
compute.networks.list
compute.
compute.
compute.
compute.networks.mirror
compute.networks.removePeering
compute.
compute.
compute.networks.update
compute.networks.updatePeering
compute.networks.updatePolicy
compute.networks.use
compute.networks.useExternalIp
compute.packetMirrorings.get
compute.packetMirrorings.list
compute.
compute.
compute.projects.get
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.regionHealthChecks.*
compute.
compute.
compute.
compute.
compute.regionHealthChecks.get
compute.
compute.
compute.
compute.
compute.regionHealthChecks.use
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.regionOperations.get
compute.regionOperations.list
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.regionSslPolicies.*
compute.
compute.
compute.
compute.
compute.regionSslPolicies.get
compute.regionSslPolicies.list
compute.
compute.
compute.
compute.
compute.regionSslPolicies.use
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.regionUrlMaps.*
compute.regionUrlMaps.create
compute.
compute.regionUrlMaps.delete
compute.
compute.regionUrlMaps.get
compute.
compute.regionUrlMaps.list
compute.
compute.
compute.regionUrlMaps.update
compute.regionUrlMaps.use
compute.regionUrlMaps.validate
compute.regions.*
compute.regions.get
compute.regions.list
compute.reservationBlocks.get
compute.reservationBlocks.list
compute.reservationSubBlocks.*
compute.
compute.
compute.
compute.reservations.get
compute.reservations.list
compute.resourcePolicies.*
compute.
compute.
compute.resourcePolicies.get
compute.
compute.resourcePolicies.list
compute.
compute.
compute.resourcePolicies.use
compute.
compute.routers.*
compute.routers.create
compute.
compute.routers.delete
compute.
compute.
compute.routers.get
compute.routers.getRoutePolicy
compute.routers.list
compute.routers.listBgpRoutes
compute.
compute.
compute.
compute.routers.update
compute.
compute.routers.use
compute.routes.*
compute.routes.create
compute.
compute.routes.delete
compute.
compute.routes.get
compute.routes.list
compute.
compute.routes.listTagBindings
compute.securityPolicies.get
compute.securityPolicies.list
compute.
compute.
compute.securityPolicies.use
compute.serviceAttachments.*
compute.
compute.
compute.
compute.
compute.serviceAttachments.get
compute.
compute.
compute.
compute.
compute.
compute.
compute.serviceAttachments.use
compute.snapshots.*
compute.snapshots.create
compute.
compute.snapshots.delete
compute.
compute.snapshots.get
compute.snapshots.getIamPolicy
compute.snapshots.list
compute.
compute.
compute.snapshots.setIamPolicy
compute.snapshots.setLabels
compute.snapshots.useReadOnly
compute.sslCertificates.get
compute.sslCertificates.list
compute.
compute.
compute.sslPolicies.*
compute.sslPolicies.create
compute.
compute.sslPolicies.delete
compute.
compute.sslPolicies.get
compute.sslPolicies.list
compute.
compute.
compute.
compute.sslPolicies.update
compute.sslPolicies.use
compute.storagePools.*
compute.storagePools.create
compute.storagePools.delete
compute.storagePools.get
compute.
compute.storagePools.list
compute.
compute.storagePools.update
compute.storagePools.use
compute.subnetworks.*
compute.subnetworks.create
compute.
compute.subnetworks.delete
compute.
compute.
compute.subnetworks.get
compute.
compute.subnetworks.list
compute.
compute.
compute.subnetworks.mirror
compute.
compute.
compute.subnetworks.update
compute.subnetworks.use
compute.
compute.
compute.targetGrpcProxies.*
compute.
compute.
compute.
compute.
compute.targetGrpcProxies.get
compute.targetGrpcProxies.list
compute.
compute.
compute.
compute.targetGrpcProxies.use
compute.targetHttpProxies.*
compute.
compute.
compute.
compute.
compute.targetHttpProxies.get
compute.targetHttpProxies.list
compute.
compute.
compute.
compute.
compute.targetHttpProxies.use
compute.targetHttpsProxies.*
compute.
compute.
compute.
compute.
compute.targetHttpsProxies.get
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.targetHttpsProxies.use
compute.targetInstances.*
compute.targetInstances.create
compute.
compute.targetInstances.delete
compute.
compute.targetInstances.get
compute.targetInstances.list
compute.
compute.
compute.
compute.targetInstances.use
compute.targetPools.*
compute.
compute.
compute.targetPools.create
compute.
compute.targetPools.delete
compute.
compute.targetPools.get
compute.targetPools.list
compute.
compute.
compute.
compute.
compute.
compute.targetPools.update
compute.targetPools.use
compute.targetSslProxies.*
compute.
compute.
compute.
compute.
compute.targetSslProxies.get
compute.targetSslProxies.list
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.
compute.targetSslProxies.use
compute.targetTcpProxies.*
compute.
compute.
compute.
compute.
compute.targetTcpProxies.get
compute.targetTcpProxies.list
compute.
compute.
compute.
compute.targetTcpProxies.use
compute.targetVpnGateways.*
compute.
compute.
compute.
compute.
compute.targetVpnGateways.get
compute.targetVpnGateways.list
compute.
compute.
compute.
compute.targetVpnGateways.use
compute.urlMaps.*
compute.urlMaps.create
compute.
compute.urlMaps.delete
compute.
compute.urlMaps.get
compute.
compute.urlMaps.list
compute.
compute.
compute.urlMaps.update
compute.urlMaps.use
compute.urlMaps.validate
compute.vpnGateways.*
compute.vpnGateways.create
compute.
compute.vpnGateways.delete
compute.
compute.vpnGateways.get
compute.vpnGateways.list
compute.
compute.
compute.vpnGateways.setLabels
compute.vpnGateways.use
compute.vpnTunnels.*
compute.vpnTunnels.create
compute.
compute.vpnTunnels.delete
compute.
compute.vpnTunnels.get
compute.vpnTunnels.list
compute.
compute.
compute.vpnTunnels.setLabels
compute.wireGroups.*
compute.wireGroups.create
compute.wireGroups.delete
compute.wireGroups.get
compute.wireGroups.list
compute.wireGroups.update
compute.zoneOperations.get
compute.zoneOperations.list
compute.zones.*
compute.zones.get
compute.zones.list
dataflow.jobs.*
dataflow.jobs.cancel
dataflow.jobs.create
dataflow.jobs.get
dataflow.jobs.list
dataflow.jobs.snapshot
dataflow.jobs.updateContents
dataflow.messages.list
dataflow.metrics.get
dataflow.snapshots.*
dataflow.snapshots.delete
dataflow.snapshots.get
dataflow.snapshots.list
dataform.*
dataform.commentThreads.create
dataform.commentThreads.delete
dataform.commentThreads.get
dataform.commentThreads.list
dataform.commentThreads.update
dataform.comments.create
dataform.comments.delete
dataform.comments.get
dataform.comments.list
dataform.comments.update
dataform.
dataform.
dataform.
dataform.
dataform.config.get
dataform.config.update
dataform.locations.get
dataform.locations.list
dataform.releaseConfigs.create
dataform.releaseConfigs.delete
dataform.releaseConfigs.get
dataform.releaseConfigs.list
dataform.releaseConfigs.update
dataform.repositories.commit
dataform.
dataform.repositories.create
dataform.repositories.delete
dataform.
dataform.
dataform.repositories.get
dataform.
dataform.repositories.list
dataform.
dataform.repositories.readFile
dataform.
dataform.repositories.update
dataform.
dataform.
dataform.workflowConfigs.get
dataform.workflowConfigs.list
dataform.
dataform.
dataform.
dataform.
dataform.
dataform.
dataform.
dataform.workspaces.commit
dataform.workspaces.create
dataform.workspaces.delete
dataform.
dataform.
dataform.
dataform.workspaces.get
dataform.
dataform.
dataform.workspaces.list
dataform.
dataform.
dataform.workspaces.moveFile
dataform.workspaces.pull
dataform.workspaces.push
dataform.
dataform.workspaces.readFile
dataform.
dataform.workspaces.removeFile
dataform.workspaces.reset
dataform.
dataform.
dataform.workspaces.writeFile
dataplex.datascans.*
dataplex.datascans.create
dataplex.datascans.delete
dataplex.datascans.get
dataplex.datascans.getData
dataplex.
dataplex.datascans.list
dataplex.datascans.run
dataplex.
dataplex.datascans.update
dataplex.operations.get
dataplex.operations.list
dataplex.projects.search
dns.
firebase.projects.get
iam.serviceAccounts.actAs
iam.serviceAccounts.get
iam.
iam.
iam.serviceAccounts.list
iam.serviceAccounts.signBlob
iam.serviceAccounts.signJwt
logging.buckets.create
logging.
logging.buckets.delete
logging.
logging.buckets.get
logging.buckets.list
logging.
logging.
logging.buckets.undelete
logging.buckets.update
logging.exclusions.*
logging.exclusions.create
logging.exclusions.delete
logging.exclusions.get
logging.exclusions.list
logging.exclusions.update
logging.links.*
logging.links.create
logging.links.delete
logging.links.get
logging.links.list
logging.locations.*
logging.locations.get
logging.locations.list
logging.logEntries.create
logging.logEntries.route
logging.logMetrics.*
logging.logMetrics.create
logging.logMetrics.delete
logging.logMetrics.get
logging.logMetrics.list
logging.logMetrics.update
logging.logScopes.*
logging.logScopes.create
logging.logScopes.delete
logging.logScopes.get
logging.logScopes.list
logging.logScopes.update
logging.logServiceIndexes.list
logging.logServices.list
logging.logs.list
logging.notificationRules.*
logging.
logging.
logging.notificationRules.get
logging.notificationRules.list
logging.
logging.operations.*
logging.operations.cancel
logging.operations.get
logging.operations.list
logging.settings.*
logging.settings.get
logging.settings.update
logging.sinks.*
logging.sinks.create
logging.sinks.delete
logging.sinks.get
logging.sinks.list
logging.sinks.update
logging.sqlAlerts.*
logging.sqlAlerts.create
logging.sqlAlerts.update
logging.views.create
logging.views.delete
logging.views.get
logging.views.getIamPolicy
logging.views.list
logging.views.update
monitoring.alertPolicies.get
monitoring.alertPolicies.list
monitoring.
monitoring.
monitoring.dashboards.get
monitoring.dashboards.list
monitoring.
monitoring.
monitoring.groups.get
monitoring.groups.list
monitoring.
monitoring.
monitoring.
monitoring.
monitoring.
monitoring.
monitoring.
monitoring.
monitoring.
monitoring.
monitoring.
monitoring.services.get
monitoring.services.list
monitoring.slos.get
monitoring.slos.list
monitoring.snoozes.get
monitoring.snoozes.list
monitoring.timeSeries.*
monitoring.timeSeries.create
monitoring.timeSeries.list
monitoring.
monitoring.
networkconnectivity.
networkconnectivity.
networkconnectivity.
networkconnectivity.
networkconnectivity.
networkconnectivity.
networkconnectivity.
networkconnectivity.
networkconnectivity.
networkconnectivity.
networkconnectivity.
networkconnectivity.
networkconnectivity.
networkconnectivity.
networkconnectivity.
networkconnectivity.
networkconnectivity.
networkconnectivity.
networkconnectivity.
networkconnectivity.
networkconnectivity.
networkconnectivity.
networkconnectivity.
networkconnectivity.
networkconnectivity.
networkconnectivity.
networkconnectivity.
networkconnectivity.
networkconnectivity.
networkconnectivity.
networkconnectivity.
networkconnectivity.
networkconnectivity.
networkconnectivity.
networkconnectivity.
networkconnectivity.
networkconnectivity.
networkconnectivity.
networkconnectivity.
networkconnectivity.
networkconnectivity.
networkconnectivity.
networkconnectivity.
networkconnectivity.
networkconnectivity.
networkconnectivity.
networkconnectivity.
networkmanagement.
networkmanagement.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.locations.*
networksecurity.locations.get
networksecurity.locations.list
networksecurity.operations.*
networksecurity.
networksecurity.
networksecurity.operations.get
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.sacRealms.*
networksecurity.
networksecurity.
networksecurity.sacRealms.get
networksecurity.sacRealms.list
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.
networksecurity.urlLists.*
networksecurity.
networksecurity.
networksecurity.urlLists.get
networksecurity.urlLists.list
networksecurity.
networksecurity.urlLists.use
networkservices.*
networkservices.
networkservices.
networkservices.
networkservices.
networkservices.
networkservices.
networkservices.
networkservices.
networkservices.
networkservices.
networkservices.
networkservices.
networkservices.
networkservices.gateways.get
networkservices.gateways.list
networkservices.
networkservices.gateways.use
networkservices.
networkservices.
networkservices.grpcRoutes.get
networkservices.
networkservices.
networkservices.
networkservices.
networkservices.
networkservices.
networkservices.
networkservices.
networkservices.
networkservices.httpRoutes.get
networkservices.
networkservices.
networkservices.
networkservices.
networkservices.
networkservices.
networkservices.
networkservices.
networkservices.
networkservices.
networkservices.
networkservices.
networkservices.
networkservices.
networkservices.
networkservices.
networkservices.
networkservices.
networkservices.
networkservices.
networkservices.
networkservices.
networkservices.
networkservices.
networkservices.
networkservices.locations.get
networkservices.locations.list
networkservices.meshes.create
networkservices.meshes.delete
networkservices.meshes.get
networkservices.meshes.list
networkservices.meshes.update
networkservices.meshes.use
networkservices.
networkservices.
networkservices.operations.get
networkservices.
networkservices.
networkservices.
networkservices.
networkservices.
networkservices.
networkservices.
networkservices.
networkservices.
networkservices.
networkservices.
networkservices.
networkservices.
networkservices.
networkservices.
networkservices.tcpRoutes.get
networkservices.tcpRoutes.list
networkservices.
networkservices.
networkservices.
networkservices.tlsRoutes.get
networkservices.tlsRoutes.list
networkservices.
networkservices.
networkservices.
networkservices.
networkservices.
networkservices.
networkservices.
observability.scopes.get
opsconfigmonitoring.
orgpolicy.policy.get
pubsub.*
pubsub.
pubsub.schemas.attach
pubsub.schemas.commit
pubsub.schemas.create
pubsub.schemas.delete
pubsub.schemas.get
pubsub.schemas.getIamPolicy
pubsub.schemas.list
pubsub.schemas.listRevisions
pubsub.schemas.rollback
pubsub.schemas.setIamPolicy
pubsub.schemas.validate
pubsub.snapshots.create
pubsub.snapshots.delete
pubsub.snapshots.get
pubsub.snapshots.getIamPolicy
pubsub.snapshots.list
pubsub.snapshots.seek
pubsub.snapshots.setIamPolicy
pubsub.snapshots.update
pubsub.subscriptions.consume
pubsub.subscriptions.create
pubsub.subscriptions.delete
pubsub.subscriptions.get
pubsub.
pubsub.subscriptions.list
pubsub.
pubsub.subscriptions.update
pubsub.
pubsub.topics.create
pubsub.topics.delete
pubsub.
pubsub.topics.get
pubsub.topics.getIamPolicy
pubsub.topics.list
pubsub.topics.publish
pubsub.topics.setIamPolicy
pubsub.topics.update
pubsub.topics.updateTag
recommender.
recommender.
recommender.
recommender.
recommender.
recommender.
recommender.
recommender.
recommender.
recommender.
recommender.
recommender.
recommender.
recommender.
recommender.
recommender.
recommender.
recommender.
recommender.
recommender.
resourcemanager.
resourcemanager.projects.get
resourcemanager.projects.list
servicedirectory.
servicedirectory.
servicedirectory.
servicedirectory.
servicenetworking.
servicenetworking.
servicenetworking.
servicenetworking.
servicenetworking.
servicenetworking.
servicenetworking.
servicenetworking.services.get
servicenetworking.
serviceusage.quotas.get
serviceusage.services.get
serviceusage.services.list
serviceusage.services.use
stackdriver.projects.get
stackdriver.
storage.anywhereCaches.*
storage.anywhereCaches.create
storage.anywhereCaches.disable
storage.anywhereCaches.get
storage.anywhereCaches.list
storage.anywhereCaches.pause
storage.anywhereCaches.resume
storage.anywhereCaches.update
storage.bucketOperations.*
storage.
storage.bucketOperations.get
storage.bucketOperations.list
storage.buckets.*
storage.buckets.create
storage.
storage.buckets.delete
storage.
storage.
storage.buckets.get
storage.buckets.getIamPolicy
storage.buckets.getIpFilter
storage.
storage.buckets.list
storage.
storage.
storage.buckets.relocate
storage.buckets.restore
storage.buckets.setIamPolicy
storage.buckets.setIpFilter
storage.buckets.update
storage.folders.*
storage.folders.create
storage.folders.delete
storage.folders.get
storage.folders.list
storage.folders.rename
storage.intelligenceConfigs.*
storage.
storage.
storage.managedFolders.*
storage.managedFolders.create
storage.managedFolders.delete
storage.managedFolders.get
storage.
storage.managedFolders.list
storage.
storage.multipartUploads.*
storage.multipartUploads.abort
storage.
storage.multipartUploads.list
storage.
storage.objects.*
storage.objects.create
storage.objects.delete
storage.objects.get
storage.objects.getIamPolicy
storage.objects.list
storage.objects.move
storage.
storage.objects.restore
storage.objects.setIamPolicy
storage.objects.setRetention
storage.objects.update
trafficdirector.*
trafficdirector.
trafficdirector.
Dataflow Viewer
roles/
)
dataflow.jobs.get
dataflow.jobs.list
dataflow.messages.list
dataflow.metrics.get
dataflow.snapshots.get
dataflow.snapshots.list
recommender.
recommender.
resourcemanager.projects.get
resourcemanager.projects.list
Dataflow Worker
roles/
)
autoscaling.
autoscaling.sites.writeMetrics
autoscaling.sites.writeState
compute.
compute.instances.delete
compute.
dataflow.jobs.get
dataflow.shuffle.*
dataflow.shuffle.read
dataflow.shuffle.write
dataflow.streamingWorkItems.*
dataflow.
dataflow.
dataflow.
dataflow.
dataflow.
dataflow.workItems.*
dataflow.workItems.lease
dataflow.workItems.sendMessage
dataflow.workItems.update
logging.logEntries.create
logging.logEntries.route
monitoring.timeSeries.create
storage.buckets.get
storage.objects.create
storage.objects.get
Dataflow 工作站角色 (roles/dataflow.worker
) 提供 Compute Engine 服務帳戶執行 Apache Beam 管道工作單元所需的權限。Dataflow 工作者角色必須指派給可從 Dataflow 服務要求及更新工作的服務帳戶。
Dataflow 服務代理程式角色 (roles/dataflow.serviceAgent
) 僅供 Dataflow 服務帳戶使用。這項角色可授予服務帳戶存取專案中受管理資源的權限,以便執行 Dataflow 工作。 Google Cloud 當您透過 Google Cloud 控制台的「APIs」(API) 頁面,為專案啟用 Dataflow API 時,系統會自動將這個角色指派給服務帳戶。
建立工作
如要建立工作,roles/dataflow.admin
角色包含執行及檢查工作所需的最低權限。
或者需要以下權限:
roles/dataflow.developer
角色:可對工作本身進行執行個體化。roles/compute.viewer
角色:可存取機器類型資訊及查看其他設定。roles/storage.objectAdmin
角色:可提供在 Cloud Storage 上暫存檔案的權限。
角色指派範例
為說明不同 Dataflow 角色的功用,請參考以下細分資訊:
- 建立及檢查工作的開發人員需要
roles/iam.serviceAccountUser
角色。 - 如要進行更精細的權限管理,與 Dataflow 工作互動的開發人員需要
roles/dataflow.developer
角色。- 如要暫存必要檔案,則需要
roles/storage.objectAdmin
或相關角色。 - 如要偵錯和檢查配額,則需要專案
roles/compute.viewer
角色。 - 如未指派其他角色,這個角色可讓開發人員建立及取消 Dataflow 工作,但無法與個別 VM 互動,也無法存取其他 Cloud 服務。
- 如要暫存必要檔案,則需要
- 工作站服務帳戶需要
roles/dataflow.worker
和roles/dataflow.admin
角色,才能處理 Dataflow 服務的資料。- 如要存取工作資料,工作者服務帳戶需要其他角色,例如
roles/storage.objectAdmin
。 - 如要寫入 BigQuery 資料表,工作人員服務帳戶必須具備
roles/bigquery.dataEditor
角色。 - 如要從 Pub/Sub 主題或訂閱項目讀取資料,工作人員服務帳戶需要
roles/pubsub.editor
角色。
- 如要存取工作資料,工作者服務帳戶需要其他角色,例如
- 如果您使用共用虛擬私有雲,則需要與 Dataflow 服務帳戶共用共用虛擬私有雲子網路,並在指定子網路上指派Compute 網路使用者角色。
- 如要查看共用虛擬私有雲子網路是否已與 Dataflow 服務帳戶共用,請前往 Google Cloud 控制台的「Shared VPC」(共用虛擬私有雲) 頁面,然後搜尋子網路。在「與誰共用」欄中,您可以查看虛擬私有雲子網路是否與 Dataflow 服務帳戶共用。詳情請參閱「共用虛擬私有雲的子網路參數指定指南」。
- 主專案的 Compute Engine 服務帳戶、服務專案的 Dataflow 工作者服務帳戶,以及用於提交工作的服務帳戶,都必須具備下列角色:
roles/dataflow.admin
roles/compute.networkUser
roles/storage.objectViewer
指派 Dataflow 角色
目前只能針對機構和專案設定 Dataflow 角色。
如要管理機構層級的角色,請參閱使用 IAM 對機構進行存取權控管一文。
如要設定專案層級的角色,請參閱「授予、變更及撤銷資源存取權」一文。