[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-19。"],[[["\u003cp\u003eDataplex uses IAM roles, which bundle permissions, to manage user access to specific actions on Dataplex services, resources, and operations, such as the \u003ccode\u003edataplex.datascans.create\u003c/code\u003e permission that allows creating data scans.\u003c/p\u003e\n"],["\u003cp\u003eManaging entry types, aspect types, and entry groups requires standard permissions like \u003ccode\u003ecreate\u003c/code\u003e, \u003ccode\u003eget\u003c/code\u003e, \u003ccode\u003elist\u003c/code\u003e, \u003ccode\u003eupdate\u003c/code\u003e, and \u003ccode\u003edelete\u003c/code\u003e, in addition to specific \u003ccode\u003euse\u003c/code\u003e permissions depending on whether they are custom or system resources.\u003c/p\u003e\n"],["\u003cp\u003eOperating on entries necessitates permissions like \u003ccode\u003edataplex.entries.create\u003c/code\u003e, \u003ccode\u003eupdate\u003c/code\u003e, \u003ccode\u003elist\u003c/code\u003e, and \u003ccode\u003eget\u003c/code\u003e, with the \u003ccode\u003euse\u003c/code\u003e permission also required for related entry and aspect types, as well as read permission of the original source system for lookup and search methods.\u003c/p\u003e\n"],["\u003cp\u003eWorking with system-defined aspects and entry types requires specific permissions formatted as \u003ccode\u003edataplex.entryGroups.use<ASPECT_TYPE>\u003c/code\u003e or \u003ccode\u003edataplex.entryGroups.use<ENTRY_TYPE>\u003c/code\u003e, where \u003ccode\u003e<ASPECT_TYPE>\u003c/code\u003e or \u003ccode\u003e<ENTRY_TYPE>\u003c/code\u003e is replaced by the specific system-defined type, such as \u003ccode\u003edataplex.entryGroups.useOverviewAspect\u003c/code\u003e.\u003c/p\u003e\n"],["\u003cp\u003eManaging resources like lakes, zones, assets, tasks, environments, metadata, and data scans, requires specific IAM permissions like \u003ccode\u003edataplex.lakes.create\u003c/code\u003e, \u003ccode\u003edataplex.zones.update\u003c/code\u003e, \u003ccode\u003edataplex.tasks.list\u003c/code\u003e, \u003ccode\u003edataplex.environments.delete\u003c/code\u003e, \u003ccode\u003edataplex.entities.get\u003c/code\u003e, or \u003ccode\u003edataplex.datascans.run\u003c/code\u003e, aligning with the corresponding API methods.\u003c/p\u003e\n"]]],[],null,["# Dataplex Universal Catalog IAM permissions\n\nDataplex Universal Catalog permissions allow users to perform specific actions on\nDataplex Universal Catalog services, resources, and operations. For example,\nthe `dataplex.datascans.create` permission allows a user to create\nDataplex Universal Catalog data scans in your project. You don't directly give users\npermissions; instead, you grant them roles, which have one or more permissions\nbundled within them.\n\nThis document focuses on the IAM permissions relevant to\nDataplex Universal Catalog. For more information about predefined\nDataplex Universal Catalog roles and the permissions that they contain, see\n[Dataplex Universal Catalog IAM roles](/dataplex/docs/iam-roles).\n\nFor a detailed description of IAM and its features, see the\n[IAM documentation](/iam/docs).\n\nIAM policy Set and Get permissions\n----------------------------------\n\nThe following table lists the permissions that are required to get and set\nIAM permissions:\n\nMetadata management permissions\n-------------------------------\n\nThe set of permissions that is required to perform operations on entry types,\naspect types, entry groups, and entries depends on whether the resources are\nsystem resources or custom resources. System resources are defined by\nDataplex Universal Catalog, and custom resources are defined by you or your\norganization.\n\nTo perform operations that are related to multiple resources (for example,\ncreating an entry of a particular entry type, or adding an aspect of a\nparticular aspect type to an entry), you might need multiple permissions\nassociated with the resources.\n\n### Entry types\n\nTo create and manage entry types, you must be granted at least the standard\n`create`, `get`, `list`, `update`, and `delete` permissions.\n\nWhen you create an entry type, you must be granted permissions to use each\naspect type that you want to mark as required for that entry type.\n\nTo use an entry type (for example, to create entries of an entry type), you must\nbe granted the `use` permission on the entry type.\n\nThe following table lists the permissions that are required for operating on\nentry types:\n\n### Aspect types\n\nTo create and manage aspect types, you must be granted the standard `create`,\n`get`, `list`, `update`, and `delete` permissions.\n\nTo use an aspect type (for example, to attach it as an optional aspect on an\nentry), you must be granted the `use` permission on the aspect type.\n\nAspect types are categorized into system aspect types and custom aspect types.\nSystem aspect types are created by Dataplex Universal Catalog and custom aspect\ntypes are created by you or your organization. System aspect types are further\ncategorized into usable and read-only. For more information, see\n[Categories of aspect types](/dataplex/docs/enrich-entries-metadata#categories-aspect-types).\n\nThe following table lists the permissions that are required for operating on\ncustom and system aspect types:\n\n### Entry groups\n\nTo create and manage entry groups, you must be granted the standard `create`,\n`get`, `list`, `update`, and `delete` permissions.\n| **Note:** You can't modify or delete the system entry groups whose names start with the `@` symbol, such as `@bigquery`. You can only add optional aspects to the entries in such entry groups.\n\nEntry groups are categorized into system entry groups, which are created by\nDataplex Universal Catalog, and custom entry groups, which are created by you or\nyour organization. For more information, see\n[Categories of entry groups](/dataplex/docs/ingest-custom-sources#categories-entry-groups).\n\nThe following table lists the permissions that are required for operating on\nentry groups:\n\n### Entries\n\nTo create and manage entries, you must be granted the standard `create`,\n`get`, `list`, `update`, and `delete` permissions.\n\nNote the following:\n\n- For lookup (`LookupEntry`) and search (`SearchEntries`) methods, the permission from the original source system is required on the entry. For example, if the source is a BigQuery table, you need `bigquery.tables.get` permission.\n- When you create an entry or update the top-level fields of an entry, you must be granted the `use` permission on the entry type.\n- When you create, update, or delete a required aspect, you must be granted the `use` permission on the entry type of an entry, as well as on the underlying aspect type. This is because the required aspects are enforced by the entry type.\n- When you create, update, or delete an optional aspect, you must be granted the `use` permission on the aspect type of an aspect.\n- When you upsert an entry (`UpdateEntry` with `allow_missing = True`), you must be granted the `create` permission.\n\nFor more information about the entry types that entries are based on, see\n[Categories of entry types](/dataplex/docs/ingest-custom-sources#categories-entry-types).\n\nThe following table lists the permissions that are required for operating on\nentries:\n\n### Metadata job permissions\n\nThe following table lists the permissions that are required for working with\n[metadata import jobs](/dataplex/docs/import-metadata) and\n[metadata export jobs](/dataplex/docs/export-metadata).\n\n### System aspect types and entry types\n\nEach system-defined aspect type and system-defined entry type has its own IAM\npermissions. These permissions use a format like\n`dataplex.entryGroups.use`\u003cvar translate=\"no\"\u003eASPECT_TYPE\u003c/var\u003e or\n`dataplex.entryGroups.use`\u003cvar translate=\"no\"\u003eENTRY_TYPE\u003c/var\u003e. For example, the\npermission for the `overview` system aspect type is\n`dataplex.entryGroups.useOverviewAspect`.\n\nThe following table lists the permissions that apply to system-defined aspect\ntypes and entry types.\n\nLake, zone, and asset permissions\n---------------------------------\n\nThe following table lists the permissions that are required for operating on\nlakes, zones, and assets:\n\nTask permissions\n----------------\n\nThe following table lists the permissions that are required for operating on\ntasks:\n\nEnvironment permissions\n-----------------------\n\nThe following table lists the permissions that are required for operating on\nenvironments:\n\nMetadata permissions\n--------------------\n\nThe following table lists the permissions that are required for operating on\nentities and partitions:\n\nData scan permissions\n---------------------\n\nThe following table lists the permissions that are required for operating on\ndata scans:"]]
