IAM 还允许您通过设置 IAM 政策来控制谁（身份）对哪些资源具有何种权限（角色）。
IAM 政策可为项目成员授予一个或多个特定角色，进而授予相应身份特定权限。例如，您可以为 Google 账号分配给定资源（如项目）的 roles/dataplex.admin 角色，此后该账号便可控制项目中的 Dataplex Universal Catalog 资源，但无法管理其他资源。您还可以使用 IAM 来管理向项目团队成员授予的基本角色。
针对用户的访问权限控制选项
为了让用户能够创建和管理您的 Dataplex Universal Catalog 资源，您可以将用户作为团队成员添加到项目或特定资源，然后使用 IAM 角色向这些用户授予权限。
团队成员可以是具有有效 Google 账号的个人用户、Google 群组、服务账号或 Google Workspace 网域。当您将团队成员添加到项目或资源中时，请指定要向其授予的角色。IAM 提供三种类型的角色：预定义角色、基本角色和自定义角色。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-19。"],[[["\u003cp\u003eBy default, only the project creator has access to a new Google Cloud project and its Dataplex resources until other users are explicitly added as project members or granted access to specific resources.\u003c/p\u003e\n"],["\u003cp\u003eGoogle Cloud's Identity and Access Management (IAM) allows for granular access control to resources, enforcing the principle of least privilege by enabling administrators to grant only necessary permissions.\u003c/p\u003e\n"],["\u003cp\u003eUsers can be granted access to Dataplex resources by adding them as team members to a project or specific resources, assigning them IAM roles, which can be predefined, basic, or custom.\u003c/p\u003e\n"],["\u003cp\u003eDataplex uses a service account with necessary permissions to access managed resources, and this service account requires explicit permissions to access other projects and resources.\u003c/p\u003e\n"],["\u003cp\u003eDataplex propagates IAM policies from the lake level down to data zones and their underlying storage resources, allowing for management of roles at the resource level in addition to or instead of the project level, while resources inherit policies from parent resources.\u003c/p\u003e\n"]]],[],null,["# Access control with IAM\n\nBy default, all Google Cloud projects come with a single user, the\noriginal project creator. No other users have access to the project, and\ntherefore, access to Dataplex Universal Catalog resources, until a user\nis added as a project member or is bound to a specific resource. This page\ndescribes the ways you can add new users to your project and how to set access\ncontrol for your Dataplex Universal Catalog resources.\n\nIAM overview\n------------\n\nGoogle Cloud offers [Identity and Access Management (IAM)](/iam),\nwhich lets you give more granular access to specific\nGoogle Cloud resources and prevents unwanted access to other resources.\nIAM lets you adopt the\n[security principle of least privilege](https://en.wikipedia.org/wiki/Principle_of_least_privilege),\nso you grant only the necessary access to your resources.\n\nIAM also lets you control who (identity) has what (roles)\npermission to which resources by setting IAM policies.\nIAM policies grant\nspecific role(s) to a project member, giving the identity certain permissions.\nFor example, for a given resource, such as a project, you can assign the\n`roles/dataplex.admin` role to a Google Account and that account can\ncontrol Dataplex Universal Catalog resources in the project, but cannot\nmanage other resources. You can also use IAM to\nmanage the basic roles granted to project team members.\n\nAccess control options for users\n--------------------------------\n\nTo give users the ability to create and manage your Dataplex Universal Catalog\nresources, you can add users as *team members* to your project or to\nspecific resources and grant them permissions using IAM *roles*.\n\nA team member can be an individual user with a valid Google Account, a Google\nGroup, a service account, or a Google Workspace domain. When you add a team\nmember to a project or to a resource, you specify which roles to grant them.\nIAM provides three types of roles: [predefined roles](/iam/docs/overview#roles),\n[basic roles](/iam/docs/overview#roles), and [custom roles](/iam/docs/understanding-custom-roles).\n\nFor more information about the capabilities of each Dataplex Universal Catalog role,\nand API methods that a specific role grants permission to, see\n[Dataplex Universal Catalog IAM roles](/dataplex/docs/iam-roles).\n\nFor other member types, such as service accounts and groups, refer to the [Policy\nbinding reference](/iam/docs/reference/rest/v1/Policy#binding).\n\nService accounts\n----------------\n\nDataplex Universal Catalog uses a service account that has been granted the\nnecessary permissions to access resources managed within a lake. This service\naccount is automatically granted permissions in the project containing a lake\ninstance. You must explicitly grant it permissions to other projects and\nresources that you want to add to and manage within a lake.\n\nThe service account in Dataplex Universal Catalog is of the following format:\n\n`service-`\u003cvar translate=\"no\"\u003eCUSTOMER_PROJECT_NUMBER\u003c/var\u003e`@gcp-sa-dataplex.iam.gserviceaccount.com`\n\n\u003cvar translate=\"no\"\u003eCUSTOMER_PROJECT_NUMBER\u003c/var\u003e is the project where you have\nenabled the Dataplex API.\n\nYou must grant the Dataplex Universal Catalog Service Agent\n(`roles/dataplex.serviceAgent`) access to the underlying assets that you add to\na lake or data zone.\n\nIAM policies for resources\n--------------------------\n\nDataplex Universal Catalog adds a virtual hierarchy on top of base storage\nresources such as Cloud Storage buckets and BigQuery\ndatasets. Dataplex Universal Catalog propagates IAM policies\nassigned to the lake down to data zone assets and finally to the resources pointed\nto by these assets. Policies are added to those already in existence on the\nbase storage resource (Cloud Storage bucket and BigQuery\ndataset).\n\nAn IAM policy lets you manage IAM roles on those\nresources instead of, or in addition to, managing roles at the project level.\nThis gives you flexibility to apply the principle of least privilege, which is\nto grant access only to the specific resources that collaborators need to do\ntheir work.\n\nResources also inherit the policies of their parent resources. If you set a\npolicy at the project level, it's inherited by all its child resources. The\neffective policy for a resource is the union of the policy set at that resource\nand the policy inherited from higher up in the hierarchy. For more information,\nread about the [IAM policy hierarchy](/iam/docs/overview#policy_hierarchy).\n\nYou can get and set IAM policies using the Google Cloud console, the\nIAM API, or the Google Cloud CLI.\n\n- For the Google Cloud console, see [Access control using the Google Cloud console](/iam/docs/grant-role-console).\n- For the API, see [Access control using the API](/iam/docs/reference/rest).\n- For the Google Cloud CLI, see [Access control using the Google Cloud CLI](/sdk/gcloud/reference/iam).\n\nWhat's next?\n------------\n\n- Learn more about [IAM roles](/dataplex/docs/iam-roles).\n- Learn more about [IAM permissions](/dataplex/docs/iam-permissions).\n- Learn more about [Dataplex Universal Catalog lake security](/dataplex/docs/lake-security)."]]
