Dataplex 通用目录 IAM 角色

Dataplex Universal Catalog 定义了多个 Identity and Access Management (IAM) 角色。每个预定义角色都包含一组允许主账号执行特定操作的 IAM 权限。您可以使用 IAM 政策为主账号授予一个或多个 IAM 角色。

IAM 还提供创建自定义角色的功能。您可以创建自定义 IAM 角色，并为该角色分配一项或多项权限。然后，您可以将新创建的角色授予主账号。使用自定义角色可创建访问权限控制模型，该模型将直接映射到您的需求以及可用的预定义角色。

本文档介绍了与 Dataplex Universal Catalog 相关的 IAM 角色。

如需详细了解 IAM 及其功能，请参阅 IAM 文档。

Dataplex Universal Catalog 角色的相关信息

Dataplex Universal Catalog IAM 角色是一个或多个权限的集合。您为主账号授予角色，以允许他们对项目中的 Dataplex Universal Catalog 资源执行操作。例如，Dataplex Viewer 角色包含 dataplex.*.get 和 dataplex.*.list 权限，这些权限允许用户获取和列出项目中的 Dataplex Universal Catalog 资源。如需了解详情，请参阅 Dataplex Universal Catalog 权限。

您可以将 Dataplex Universal Catalog 角色应用于服务层次结构中的任何资源，包括项目、数据湖和数据区。

基本角色

您可以使用 IAM Project 角色在项目级分配基本角色。以下列出了与 IAM 项目角色关联的权限：

项目角色 权限
Project Owner 拥有所有“项目修改者”权限，外加为项目管理访问控制的权限（获取/设置 IamPolicy）和设置项目结算的权限
Project Editor 拥有所有 Project Viewer 权限，外加可修改状态的操作（创建、删除、更新、使用）的所有项目权限
项目查看者 拥有不会修改状态的只读操作（获取、列出）的所有项目权限

Dataplex Universal Catalog 的预定义角色

预定义角色包含执行任务或一组相关任务所需的权限。

请注意以下几点：

  • 如果您使用的是 Data Catalog，则 Data Catalog 条目访问权限不会自动转移到 Dataplex Universal Catalog 条目。您必须先明确授予对 Dataplex Universal Catalog 条目的访问权限，然后才能使用这些条目。
  • Dataplex 管理员、Dataplex 编辑者和 Dataplex 查看者角色不提供对元数据资源（例如条目组、条目类型、切面类型和条目）的访问权限。
  • 没有任何角色授予向系统定义的条目组（例如 @bigquery 和 @dataplex）添加或从中删除 Dataplex Universal Catalog 条目的权限。
  • Dataplex Entry Owner 角色包含以下权限：
    • 授予对条目相关操作的完全访问权限。
    • 授予添加某些系统方面类型（例如 Schema、Generic、Overview 和 Contacts）的方面的权限。
    • 授予创建 GenericEntry 类型条目的权限。
    • 借助此角色，您可以创建具有条目类型和方面类型的条目，其中条目类型和方面类型与条目定义在同一项目中。否则，必须在定义了条目类型和切面类型的项目上授予额外的 Dataplex Entry Type User 和 Dataplex Aspect Type User 角色。
    • 使用 LookupEntry 方法或 SearchEntries 方法时，此角色不会授予读取从 Dataplex Universal Catalog 之外的Google Cloud 资源（例如 BigQuery 条目）创建的条目的权限。如需读取这些条目，您必须获得源系统资源的权限。或者，您也可以使用 GetEntry 方法读取仅具有 Dataplex 条目所有者角色的条目。
  • 如需使用 SearchEntries 方法搜索条目，您必须在 API 请求中使用的项目上至少拥有以下一个 IAM 角色：Dataplex Catalog Admin、Dataplex Catalog Editor 或 Dataplex Catalog Viewer。搜索结果的权限检查与所选项目无关。

下表列出了 Dataplex Universal Catalog 预定义角色以及与每个角色关联的权限。

Role Permissions

(roles/dataplex.admin)

Full access to Dataplex resources, except Dataplex Catalog.

cloudasset.assets.analyzeIamPolicy

cloudasset.assets.searchAllIamPolicies

cloudasset.assets.searchAllResources

dataplex.assetActions.list

dataplex.assets.create

dataplex.assets.delete

dataplex.assets.get

dataplex.assets.getIamPolicy

dataplex.assets.list

dataplex.assets.setIamPolicy

dataplex.assets.update

dataplex.content.*

  • dataplex.content.create
  • dataplex.content.delete
  • dataplex.content.get
  • dataplex.content.getIamPolicy
  • dataplex.content.list
  • dataplex.content.setIamPolicy
  • dataplex.content.update

dataplex.dataAttributeBindings.*

  • dataplex.dataAttributeBindings.create
  • dataplex.dataAttributeBindings.delete
  • dataplex.dataAttributeBindings.get
  • dataplex.dataAttributeBindings.getIamPolicy
  • dataplex.dataAttributeBindings.list
  • dataplex.dataAttributeBindings.setIamPolicy
  • dataplex.dataAttributeBindings.update

dataplex.dataAttributes.*

  • dataplex.dataAttributes.bind
  • dataplex.dataAttributes.create
  • dataplex.dataAttributes.delete
  • dataplex.dataAttributes.get
  • dataplex.dataAttributes.getIamPolicy
  • dataplex.dataAttributes.list
  • dataplex.dataAttributes.setIamPolicy
  • dataplex.dataAttributes.update

dataplex.dataTaxonomies.*

  • dataplex.dataTaxonomies.configureDataAccess
  • dataplex.dataTaxonomies.configureResourceAccess
  • dataplex.dataTaxonomies.create
  • dataplex.dataTaxonomies.delete
  • dataplex.dataTaxonomies.get
  • dataplex.dataTaxonomies.getIamPolicy
  • dataplex.dataTaxonomies.list
  • dataplex.dataTaxonomies.setIamPolicy
  • dataplex.dataTaxonomies.update

dataplex.datascans.*

  • dataplex.datascans.create
  • dataplex.datascans.delete
  • dataplex.datascans.get
  • dataplex.datascans.getData
  • dataplex.datascans.getIamPolicy
  • dataplex.datascans.list
  • dataplex.datascans.run
  • dataplex.datascans.setIamPolicy
  • dataplex.datascans.update

dataplex.entities.*

  • dataplex.entities.create
  • dataplex.entities.delete
  • dataplex.entities.get
  • dataplex.entities.list
  • dataplex.entities.update

dataplex.entries.link

dataplex.entryGroups.export

dataplex.entryGroups.import

dataplex.entryGroups.useDefinitionEntryLink

dataplex.entryGroups.useRelatedEntryLink

dataplex.entryGroups.useSynonymEntryLink

dataplex.entryLinks.*

  • dataplex.entryLinks.create
  • dataplex.entryLinks.delete
  • dataplex.entryLinks.get
  • dataplex.entryLinks.reference

dataplex.environments.*

  • dataplex.environments.create
  • dataplex.environments.delete
  • dataplex.environments.execute
  • dataplex.environments.get
  • dataplex.environments.getIamPolicy
  • dataplex.environments.list
  • dataplex.environments.setIamPolicy
  • dataplex.environments.update

dataplex.glossaries.*

  • dataplex.glossaries.create
  • dataplex.glossaries.delete
  • dataplex.glossaries.get
  • dataplex.glossaries.getIamPolicy
  • dataplex.glossaries.import
  • dataplex.glossaries.list
  • dataplex.glossaries.setIamPolicy
  • dataplex.glossaries.update

dataplex.glossaryCategories.*

  • dataplex.glossaryCategories.create
  • dataplex.glossaryCategories.delete
  • dataplex.glossaryCategories.get
  • dataplex.glossaryCategories.list
  • dataplex.glossaryCategories.update

dataplex.glossaryTerms.*

  • dataplex.glossaryTerms.create
  • dataplex.glossaryTerms.delete
  • dataplex.glossaryTerms.get
  • dataplex.glossaryTerms.list
  • dataplex.glossaryTerms.update
  • dataplex.glossaryTerms.use

dataplex.lakeActions.list

dataplex.lakes.*

  • dataplex.lakes.create
  • dataplex.lakes.delete
  • dataplex.lakes.get
  • dataplex.lakes.getIamPolicy
  • dataplex.lakes.list
  • dataplex.lakes.setIamPolicy
  • dataplex.lakes.update

dataplex.locations.*

  • dataplex.locations.get
  • dataplex.locations.list

dataplex.metadataJobs.*

  • dataplex.metadataJobs.cancel
  • dataplex.metadataJobs.create
  • dataplex.metadataJobs.get
  • dataplex.metadataJobs.list

dataplex.operations.*

  • dataplex.operations.cancel
  • dataplex.operations.delete
  • dataplex.operations.get
  • dataplex.operations.list

dataplex.partitions.*

  • dataplex.partitions.create
  • dataplex.partitions.delete
  • dataplex.partitions.get
  • dataplex.partitions.list
  • dataplex.partitions.update

dataplex.tasks.*

  • dataplex.tasks.cancel
  • dataplex.tasks.create
  • dataplex.tasks.delete
  • dataplex.tasks.get
  • dataplex.tasks.getIamPolicy
  • dataplex.tasks.list
  • dataplex.tasks.run
  • dataplex.tasks.setIamPolicy
  • dataplex.tasks.update

dataplex.zoneActions.list

dataplex.zones.*

  • dataplex.zones.create
  • dataplex.zones.delete
  • dataplex.zones.get
  • dataplex.zones.getIamPolicy
  • dataplex.zones.list
  • dataplex.zones.setIamPolicy
  • dataplex.zones.update

resourcemanager.projects.get

resourcemanager.projects.list

(roles/dataplex.aspectTypeOwner)

Grants access to creating and managing Aspect Types. Does not give the right to create/modify Entries.

datacatalog.migrationConfig.get

dataplex.aspectTypes.*

  • dataplex.aspectTypes.create
  • dataplex.aspectTypes.delete
  • dataplex.aspectTypes.get
  • dataplex.aspectTypes.getIamPolicy
  • dataplex.aspectTypes.list
  • dataplex.aspectTypes.setIamPolicy
  • dataplex.aspectTypes.update
  • dataplex.aspectTypes.use

dataplex.operations.get

dataplex.projects.search

resourcemanager.projects.get

resourcemanager.projects.list

(roles/dataplex.aspectTypeUser)

Grants access to use Aspect Types to create/modify Entries with the corresponding aspects.

datacatalog.migrationConfig.get

dataplex.aspectTypes.get

dataplex.aspectTypes.list

dataplex.aspectTypes.use

dataplex.projects.search

resourcemanager.projects.get

resourcemanager.projects.list

(roles/dataplex.bindingAdmin)

Full access on DataAttribute Bindig resources.

dataplex.dataAttributeBindings.*

  • dataplex.dataAttributeBindings.create
  • dataplex.dataAttributeBindings.delete
  • dataplex.dataAttributeBindings.get
  • dataplex.dataAttributeBindings.getIamPolicy
  • dataplex.dataAttributeBindings.list
  • dataplex.dataAttributeBindings.setIamPolicy
  • dataplex.dataAttributeBindings.update

(roles/dataplex.catalogAdmin)

Has full access to Catalog resources.

datacatalog.migrationConfig.get

dataplex.aspectTypes.*

  • dataplex.aspectTypes.create
  • dataplex.aspectTypes.delete
  • dataplex.aspectTypes.get
  • dataplex.aspectTypes.getIamPolicy
  • dataplex.aspectTypes.list
  • dataplex.aspectTypes.setIamPolicy
  • dataplex.aspectTypes.update
  • dataplex.aspectTypes.use

dataplex.entries.*

  • dataplex.entries.create
  • dataplex.entries.delete
  • dataplex.entries.get
  • dataplex.entries.link
  • dataplex.entries.list
  • dataplex.entries.update

dataplex.entryGroups.*

  • dataplex.entryGroups.create
  • dataplex.entryGroups.delete
  • dataplex.entryGroups.export
  • dataplex.entryGroups.get
  • dataplex.entryGroups.getIamPolicy
  • dataplex.entryGroups.import
  • dataplex.entryGroups.list
  • dataplex.entryGroups.setIamPolicy
  • dataplex.entryGroups.update
  • dataplex.entryGroups.useContactsAspect
  • dataplex.entryGroups.useDataQualityScorecardAspect
  • dataplex.entryGroups.useDefinitionEntryLink
  • dataplex.entryGroups.useGenericAspect
  • dataplex.entryGroups.useGenericEntry
  • dataplex.entryGroups.useOverviewAspect
  • dataplex.entryGroups.useRelatedEntryLink
  • dataplex.entryGroups.useSchemaAspect
  • dataplex.entryGroups.useSynonymEntryLink

dataplex.entryLinks.*

  • dataplex.entryLinks.create
  • dataplex.entryLinks.delete
  • dataplex.entryLinks.get
  • dataplex.entryLinks.reference

dataplex.entryTypes.*

  • dataplex.entryTypes.create
  • dataplex.entryTypes.delete
  • dataplex.entryTypes.get
  • dataplex.entryTypes.getIamPolicy
  • dataplex.entryTypes.list
  • dataplex.entryTypes.setIamPolicy
  • dataplex.entryTypes.update
  • dataplex.entryTypes.use

dataplex.glossaries.*

  • dataplex.glossaries.create
  • dataplex.glossaries.delete
  • dataplex.glossaries.get
  • dataplex.glossaries.getIamPolicy
  • dataplex.glossaries.import
  • dataplex.glossaries.list
  • dataplex.glossaries.setIamPolicy
  • dataplex.glossaries.update

dataplex.glossaryCategories.*

  • dataplex.glossaryCategories.create
  • dataplex.glossaryCategories.delete
  • dataplex.glossaryCategories.get
  • dataplex.glossaryCategories.list
  • dataplex.glossaryCategories.update

dataplex.glossaryTerms.*

  • dataplex.glossaryTerms.create
  • dataplex.glossaryTerms.delete
  • dataplex.glossaryTerms.get
  • dataplex.glossaryTerms.list
  • dataplex.glossaryTerms.update
  • dataplex.glossaryTerms.use

dataplex.operations.get

dataplex.projects.search

resourcemanager.projects.get

resourcemanager.projects.list

(roles/dataplex.catalogEditor)

Has write access to Catalog resources. Cannot set IAM policies on resources

datacatalog.migrationConfig.get

dataplex.aspectTypes.create

dataplex.aspectTypes.delete

dataplex.aspectTypes.get

dataplex.aspectTypes.getIamPolicy

dataplex.aspectTypes.list

dataplex.aspectTypes.update

dataplex.aspectTypes.use

dataplex.entries.*

  • dataplex.entries.create
  • dataplex.entries.delete
  • dataplex.entries.get
  • dataplex.entries.link
  • dataplex.entries.list
  • dataplex.entries.update

dataplex.entryGroups.create

dataplex.entryGroups.delete

dataplex.entryGroups.get

dataplex.entryGroups.getIamPolicy

dataplex.entryGroups.list

dataplex.entryGroups.update

dataplex.entryGroups.useContactsAspect

dataplex.entryGroups.useDataQualityScorecardAspect

dataplex.entryGroups.useDefinitionEntryLink

dataplex.entryGroups.useGenericAspect

dataplex.entryGroups.useGenericEntry

dataplex.entryGroups.useOverviewAspect

dataplex.entryGroups.useRelatedEntryLink

dataplex.entryGroups.useSchemaAspect

dataplex.entryGroups.useSynonymEntryLink

dataplex.entryLinks.create

dataplex.entryLinks.delete

dataplex.entryLinks.get

dataplex.entryTypes.create

dataplex.entryTypes.delete

dataplex.entryTypes.get

dataplex.entryTypes.getIamPolicy

dataplex.entryTypes.list

dataplex.entryTypes.update

dataplex.entryTypes.use

dataplex.glossaries.create

dataplex.glossaries.delete

dataplex.glossaries.get

dataplex.glossaries.getIamPolicy

dataplex.glossaries.list

dataplex.glossaries.update

dataplex.glossaryCategories.*

  • dataplex.glossaryCategories.create
  • dataplex.glossaryCategories.delete
  • dataplex.glossaryCategories.get
  • dataplex.glossaryCategories.list
  • dataplex.glossaryCategories.update

dataplex.glossaryTerms.*

  • dataplex.glossaryTerms.create
  • dataplex.glossaryTerms.delete
  • dataplex.glossaryTerms.get
  • dataplex.glossaryTerms.list
  • dataplex.glossaryTerms.update
  • dataplex.glossaryTerms.use

dataplex.operations.get

dataplex.projects.search

resourcemanager.projects.get

resourcemanager.projects.list

(roles/dataplex.catalogViewer)

Has read access to Catalog resources: Entry Groups, Entry Types, Aspect Types, Entry Link Types, Entries and Entry Links. Can view IAM policies on Catalog resources.

datacatalog.migrationConfig.get

dataplex.aspectTypes.get

dataplex.aspectTypes.getIamPolicy

dataplex.aspectTypes.list

dataplex.entries.get

dataplex.entries.list

dataplex.entryGroups.get

dataplex.entryGroups.getIamPolicy

dataplex.entryGroups.list

dataplex.entryLinks.get

dataplex.entryTypes.get

dataplex.entryTypes.getIamPolicy

dataplex.entryTypes.list

dataplex.glossaries.get

dataplex.glossaries.getIamPolicy

dataplex.glossaries.list

dataplex.glossaryCategories.get

dataplex.glossaryCategories.list

dataplex.glossaryTerms.get

dataplex.glossaryTerms.list

dataplex.projects.search

resourcemanager.projects.get

resourcemanager.projects.list

(roles/dataplex.dataOwner)

Owner access to data. To be granted to Dataplex resources Lake, Zone or Asset only.

dataplex.assets.ownData

dataplex.assets.readData

dataplex.assets.writeData

(roles/dataplex.dataReader)

Read only access to data. To be granted to Dataplex resources Lake, Zone or Asset only.

dataplex.assets.readData

(roles/dataplex.dataScanAdmin)

Full access to DataScan resources.

dataplex.datascans.*

  • dataplex.datascans.create
  • dataplex.datascans.delete
  • dataplex.datascans.get
  • dataplex.datascans.getData
  • dataplex.datascans.getIamPolicy
  • dataplex.datascans.list
  • dataplex.datascans.run
  • dataplex.datascans.setIamPolicy
  • dataplex.datascans.update

dataplex.operations.get

dataplex.operations.list

(roles/dataplex.dataScanCreator)

Access to create new DataScan resources.

dataplex.datascans.create

dataplex.datascans.get

dataplex.datascans.list

dataplex.operations.get

(roles/dataplex.dataScanDataViewer)

Read access to DataScan resources and additional contents.

dataplex.datascans.get

dataplex.datascans.getData

dataplex.datascans.getIamPolicy

dataplex.datascans.list

(roles/dataplex.dataScanEditor)

Write access to DataScan resources.

dataplex.datascans.create

dataplex.datascans.delete

dataplex.datascans.get

dataplex.datascans.getData

dataplex.datascans.getIamPolicy

dataplex.datascans.list

dataplex.datascans.run

dataplex.datascans.update

dataplex.operations.get

dataplex.operations.list

(roles/dataplex.dataScanViewer)

Read access to DataScan resources.

dataplex.datascans.get

dataplex.datascans.getIamPolicy

dataplex.datascans.list

(roles/dataplex.dataWriter)

Write access to data. To be granted to Dataplex resources Lake, Zone or Asset only.

dataplex.assets.writeData

(roles/dataplex.developer)

Allows running data analytics workloads in a lake.

dataplex.content.*

  • dataplex.content.create
  • dataplex.content.delete
  • dataplex.content.get
  • dataplex.content.getIamPolicy
  • dataplex.content.list
  • dataplex.content.setIamPolicy
  • dataplex.content.update

dataplex.environments.execute

dataplex.environments.get

dataplex.environments.list

dataplex.tasks.cancel

dataplex.tasks.create

dataplex.tasks.delete

dataplex.tasks.get

dataplex.tasks.list

dataplex.tasks.run

dataplex.tasks.update

(roles/dataplex.discoveryBigLakePublishingServiceAgent)

Gives the Dataplex Discovery Service Agent permissions to use bigquery connection.

bigquery.connections.delegate

bigquery.connections.use

(roles/dataplex.discoveryPublishingServiceAgent)

Gives the Dataplex Discovery Service Agent dataset create and get permissions.

bigquery.datasets.create

bigquery.datasets.get

(roles/dataplex.discoveryServiceAgent)

Gives the Dataplex Discovery Service Agent bucket read permissions.

storage.buckets.get

storage.objects.get

storage.objects.list

(roles/dataplex.editor)

Write access to Dataplex resources.

cloudasset.assets.analyzeIamPolicy

dataplex.assetActions.list

dataplex.assets.create

dataplex.assets.delete

dataplex.assets.get

dataplex.assets.getIamPolicy

dataplex.assets.list

dataplex.assets.update

dataplex.content.delete

dataplex.content.get

dataplex.content.getIamPolicy

dataplex.content.list

dataplex.dataAttributeBindings.create

dataplex.dataAttributeBindings.delete

dataplex.dataAttributeBindings.get

dataplex.dataAttributeBindings.getIamPolicy

dataplex.dataAttributeBindings.list

dataplex.dataAttributeBindings.update

dataplex.dataAttributes.bind

dataplex.dataAttributes.create

dataplex.dataAttributes.delete

dataplex.dataAttributes.get

dataplex.dataAttributes.getIamPolicy

dataplex.dataAttributes.list

dataplex.dataAttributes.update

dataplex.dataTaxonomies.configureDataAccess

dataplex.dataTaxonomies.configureResourceAccess

dataplex.dataTaxonomies.create

dataplex.dataTaxonomies.delete

dataplex.dataTaxonomies.get

dataplex.dataTaxonomies.getIamPolicy

dataplex.dataTaxonomies.list

dataplex.dataTaxonomies.update

dataplex.datascans.create

dataplex.datascans.delete

dataplex.datascans.get

dataplex.datascans.getIamPolicy

dataplex.datascans.list

dataplex.datascans.run

dataplex.datascans.update

dataplex.environments.create

dataplex.environments.delete

dataplex.environments.get

dataplex.environments.getIamPolicy

dataplex.environments.list

dataplex.environments.update

dataplex.lakeActions.list

dataplex.lakes.create

dataplex.lakes.delete

dataplex.lakes.get

dataplex.lakes.getIamPolicy

dataplex.lakes.list

dataplex.lakes.update

dataplex.operations.*

  • dataplex.operations.cancel
  • dataplex.operations.delete
  • dataplex.operations.get
  • dataplex.operations.list

dataplex.tasks.cancel

dataplex.tasks.create

dataplex.tasks.delete

dataplex.tasks.get

dataplex.tasks.getIamPolicy

dataplex.tasks.list

dataplex.tasks.run

dataplex.tasks.update

dataplex.zoneActions.list

dataplex.zones.create

dataplex.zones.delete

dataplex.zones.get

dataplex.zones.getIamPolicy

dataplex.zones.list

dataplex.zones.update

(roles/dataplex.encryptionAdmin)

Gives user permissions to manage encryption config.

dataplex.encryptionConfig.*

  • dataplex.encryptionConfig.create
  • dataplex.encryptionConfig.delete
  • dataplex.encryptionConfig.get
  • dataplex.encryptionConfig.list
  • dataplex.encryptionConfig.update

dataplex.operations.get

dataplex.operations.list

(roles/dataplex.entryGroupExporter)

Grants access to export this entry group for Metadata Job processing.

dataplex.entryGroups.export

dataplex.entryGroups.get

resourcemanager.projects.get

resourcemanager.projects.list

(roles/dataplex.entryGroupImporter)

Grants access to import this entry group for Metadata Job processing.

dataplex.entryGroups.get

dataplex.entryGroups.import

resourcemanager.projects.get

resourcemanager.projects.list

(roles/dataplex.entryGroupOwner)

Owns Entry Groups and Entries inside of them.

datacatalog.migrationConfig.get

dataplex.aspectTypes.get

dataplex.aspectTypes.list

dataplex.aspectTypes.use

dataplex.entries.*

  • dataplex.entries.create
  • dataplex.entries.delete
  • dataplex.entries.get
  • dataplex.entries.link
  • dataplex.entries.list
  • dataplex.entries.update

dataplex.entryGroups.*

  • dataplex.entryGroups.create
  • dataplex.entryGroups.delete
  • dataplex.entryGroups.export
  • dataplex.entryGroups.get
  • dataplex.entryGroups.getIamPolicy
  • dataplex.entryGroups.import
  • dataplex.entryGroups.list
  • dataplex.entryGroups.setIamPolicy
  • dataplex.entryGroups.update
  • dataplex.entryGroups.useContactsAspect
  • dataplex.entryGroups.useDataQualityScorecardAspect
  • dataplex.entryGroups.useDefinitionEntryLink
  • dataplex.entryGroups.useGenericAspect
  • dataplex.entryGroups.useGenericEntry
  • dataplex.entryGroups.useOverviewAspect
  • dataplex.entryGroups.useRelatedEntryLink
  • dataplex.entryGroups.useSchemaAspect
  • dataplex.entryGroups.useSynonymEntryLink

dataplex.entryLinks.*

  • dataplex.entryLinks.create
  • dataplex.entryLinks.delete
  • dataplex.entryLinks.get
  • dataplex.entryLinks.reference

dataplex.entryTypes.get

dataplex.entryTypes.list

dataplex.entryTypes.use

dataplex.operations.get

dataplex.projects.search

resourcemanager.projects.get

resourcemanager.projects.list

(roles/dataplex.entryOwner)

Owns Metadata Entries and EntryLinks.

datacatalog.migrationConfig.get

dataplex.aspectTypes.get

dataplex.aspectTypes.list

dataplex.aspectTypes.use

dataplex.entries.*

  • dataplex.entries.create
  • dataplex.entries.delete
  • dataplex.entries.get
  • dataplex.entries.link
  • dataplex.entries.list
  • dataplex.entries.update

dataplex.entryGroups.get

dataplex.entryGroups.useContactsAspect

dataplex.entryGroups.useDataQualityScorecardAspect

dataplex.entryGroups.useDefinitionEntryLink

dataplex.entryGroups.useGenericAspect

dataplex.entryGroups.useGenericEntry

dataplex.entryGroups.useOverviewAspect

dataplex.entryGroups.useRelatedEntryLink

dataplex.entryGroups.useSchemaAspect

dataplex.entryGroups.useSynonymEntryLink

dataplex.entryLinks.*

  • dataplex.entryLinks.create
  • dataplex.entryLinks.delete
  • dataplex.entryLinks.get
  • dataplex.entryLinks.reference

dataplex.entryTypes.get

dataplex.entryTypes.list

dataplex.entryTypes.use

dataplex.projects.search

resourcemanager.projects.get

resourcemanager.projects.list

(roles/dataplex.entryTypeOwner)

Grants access to creating and managing Entry Types. Does not give the right to create/modify Entries.

datacatalog.migrationConfig.get

dataplex.entryTypes.*

  • dataplex.entryTypes.create
  • dataplex.entryTypes.delete
  • dataplex.entryTypes.get
  • dataplex.entryTypes.getIamPolicy
  • dataplex.entryTypes.list
  • dataplex.entryTypes.setIamPolicy
  • dataplex.entryTypes.update
  • dataplex.entryTypes.use

dataplex.operations.get

dataplex.projects.search

resourcemanager.projects.get

resourcemanager.projects.list

(roles/dataplex.entryTypeUser)

Grants access to use Entry Types to create/modify Entries of those types.

datacatalog.migrationConfig.get

dataplex.entryTypes.get

dataplex.entryTypes.list

dataplex.entryTypes.use

dataplex.projects.search

resourcemanager.projects.get

resourcemanager.projects.list

(roles/dataplex.metadataJobOwner)

Grants access to creating and managing Metadata Jobs. Does not give the right to create/modify Entry Groups.

dataplex.metadataJobs.*

  • dataplex.metadataJobs.cancel
  • dataplex.metadataJobs.create
  • dataplex.metadataJobs.get
  • dataplex.metadataJobs.list

dataplex.operations.get

resourcemanager.projects.get

resourcemanager.projects.list

(roles/dataplex.metadataJobViewer)

Read access to Metadata Job resources.

dataplex.metadataJobs.get

dataplex.metadataJobs.list

dataplex.operations.get

resourcemanager.projects.get

resourcemanager.projects.list

(roles/dataplex.metadataReader)

Read only access to metadata.

dataplex.assets.get

dataplex.assets.list

dataplex.entities.get

dataplex.entities.list

dataplex.partitions.get

dataplex.partitions.list

dataplex.zones.get

dataplex.zones.list

resourcemanager.projects.get

resourcemanager.projects.list

(roles/dataplex.metadataWriter)

Write and Read access to metadata.

dataplex.assets.get

dataplex.assets.list

dataplex.entities.*

  • dataplex.entities.create
  • dataplex.entities.delete
  • dataplex.entities.get
  • dataplex.entities.list
  • dataplex.entities.update

dataplex.partitions.*

  • dataplex.partitions.create
  • dataplex.partitions.delete
  • dataplex.partitions.get
  • dataplex.partitions.list
  • dataplex.partitions.update

dataplex.zones.get

dataplex.zones.list

resourcemanager.projects.get

resourcemanager.projects.list

(roles/dataplex.securityAdmin)

Permissions configure ResourceAccess and DataAccess Specs on Data Attributes.

dataplex.dataTaxonomies.configureDataAccess

dataplex.dataTaxonomies.configureResourceAccess

(roles/dataplex.serviceAgent)

Gives the Dataplex service account access to project resources. This access will be used in data discovery, data management and data workload management.

bigquery.bireservations.*

  • bigquery.bireservations.get
  • bigquery.bireservations.update

bigquery.capacityCommitments.*

  • bigquery.capacityCommitments.create
  • bigquery.capacityCommitments.delete
  • bigquery.capacityCommitments.get
  • bigquery.capacityCommitments.list
  • bigquery.capacityCommitments.update

bigquery.config.*

  • bigquery.config.get
  • bigquery.config.update

bigquery.connections.*

  • bigquery.connections.create
  • bigquery.connections.delegate
  • bigquery.connections.delete
  • bigquery.connections.get
  • bigquery.connections.getIamPolicy
  • bigquery.connections.list
  • bigquery.connections.setIamPolicy
  • bigquery.connections.update
  • bigquery.connections.updateTag
  • bigquery.connections.use

bigquery.dataPolicies.create

bigquery.dataPolicies.delete

bigquery.dataPolicies.get

bigquery.dataPolicies.getIamPolicy

bigquery.dataPolicies.list

bigquery.dataPolicies.setIamPolicy

bigquery.dataPolicies.update

bigquery.datasets.*

  • bigquery.datasets.create
  • bigquery.datasets.createTagBinding
  • bigquery.datasets.delete
  • bigquery.datasets.deleteTagBinding
  • bigquery.datasets.get
  • bigquery.datasets.getIamPolicy
  • bigquery.datasets.link
  • bigquery.datasets.listEffectiveTags
  • bigquery.datasets.listSharedDatasetUsage
  • bigquery.datasets.listTagBindings
  • bigquery.datasets.setIamPolicy
  • bigquery.datasets.update
  • bigquery.datasets.updateTag

bigquery.jobs.*

  • bigquery.jobs.create
  • bigquery.jobs.delete
  • bigquery.jobs.get
  • bigquery.jobs.list
  • bigquery.jobs.listAll
  • bigquery.jobs.listExecutionMetadata
  • bigquery.jobs.update

bigquery.models.*

  • bigquery.models.create
  • bigquery.models.delete
  • bigquery.models.export
  • bigquery.models.getData
  • bigquery.models.getMetadata
  • bigquery.models.list
  • bigquery.models.updateData
  • bigquery.models.updateMetadata
  • bigquery.models.updateTag

bigquery.objectRefs.*

  • bigquery.objectRefs.read
  • bigquery.objectRefs.write

bigquery.readsessions.*

  • bigquery.readsessions.create
  • bigquery.readsessions.getData
  • bigquery.readsessions.update

bigquery.reservationAssignments.*

  • bigquery.reservationAssignments.create
  • bigquery.reservationAssignments.delete
  • bigquery.reservationAssignments.list
  • bigquery.reservationAssignments.search

bigquery.reservations.*

  • bigquery.reservations.create
  • bigquery.reservations.delete
  • bigquery.reservations.get
  • bigquery.reservations.list
  • bigquery.reservations.listFailoverDatasets
  • bigquery.reservations.update
  • bigquery.reservations.use

bigquery.routines.*

  • bigquery.routines.create
  • bigquery.routines.delete
  • bigquery.routines.get
  • bigquery.routines.list
  • bigquery.routines.update
  • bigquery.routines.updateTag

bigquery.rowAccessPolicies.create

bigquery.rowAccessPolicies.delete

bigquery.rowAccessPolicies.get

bigquery.rowAccessPolicies.getIamPolicy

bigquery.rowAccessPolicies.list

bigquery.rowAccessPolicies.overrideTimeTravelRestrictions

bigquery.rowAccessPolicies.setIamPolicy

bigquery.rowAccessPolicies.update

bigquery.savedqueries.*

  • bigquery.savedqueries.create
  • bigquery.savedqueries.delete
  • bigquery.savedqueries.get
  • bigquery.savedqueries.list
  • bigquery.savedqueries.update

bigquery.tables.*

  • bigquery.tables.create
  • bigquery.tables.createIndex
  • bigquery.tables.createSnapshot
  • bigquery.tables.createTagBinding
  • bigquery.tables.delete
  • bigquery.tables.deleteIndex
  • bigquery.tables.deleteSnapshot
  • bigquery.tables.deleteTagBinding
  • bigquery.tables.export
  • bigquery.tables.get
  • bigquery.tables.getData
  • bigquery.tables.getIamPolicy
  • bigquery.tables.list
  • bigquery.tables.listEffectiveTags
  • bigquery.tables.listTagBindings
  • bigquery.tables.replicateData
  • bigquery.tables.restoreSnapshot
  • bigquery.tables.setCategory
  • bigquery.tables.setColumnDataPolicy
  • bigquery.tables.setIamPolicy
  • bigquery.tables.update
  • bigquery.tables.updateData
  • bigquery.tables.updateIndex
  • bigquery.tables.updateTag

bigquery.transfers.*

  • bigquery.transfers.get
  • bigquery.transfers.update

bigquerymigration.translation.translate

datacatalog.catalogs.searchAll

datacatalog.categories.getIamPolicy

datacatalog.categories.setIamPolicy

datacatalog.entries.get

datacatalog.taxonomies.create

datacatalog.taxonomies.delete

datacatalog.taxonomies.get

datacatalog.taxonomies.list

datacatalog.taxonomies.update

dataform.*

  • dataform.commentThreads.create
  • dataform.commentThreads.delete
  • dataform.commentThreads.get
  • dataform.commentThreads.list
  • dataform.commentThreads.update
  • dataform.comments.create
  • dataform.comments.delete
  • dataform.comments.get
  • dataform.comments.list
  • dataform.comments.update
  • dataform.compilationResults.create
  • dataform.compilationResults.get
  • dataform.compilationResults.list
  • dataform.compilationResults.query
  • dataform.config.get
  • dataform.config.update
  • dataform.locations.get
  • dataform.locations.list
  • dataform.releaseConfigs.create
  • dataform.releaseConfigs.delete
  • dataform.releaseConfigs.get
  • dataform.releaseConfigs.list
  • dataform.releaseConfigs.update
  • dataform.repositories.commit
  • dataform.repositories.computeAccessTokenStatus
  • dataform.repositories.create
  • dataform.repositories.delete
  • dataform.repositories.fetchHistory
  • dataform.repositories.fetchRemoteBranches
  • dataform.repositories.get
  • dataform.repositories.getIamPolicy
  • dataform.repositories.list
  • dataform.repositories.queryDirectoryContents
  • dataform.repositories.readFile
  • dataform.repositories.setIamPolicy
  • dataform.repositories.update
  • dataform.workflowConfigs.create
  • dataform.workflowConfigs.delete
  • dataform.workflowConfigs.get
  • dataform.workflowConfigs.list
  • dataform.workflowConfigs.update
  • dataform.workflowInvocations.cancel
  • dataform.workflowInvocations.create
  • dataform.workflowInvocations.delete
  • dataform.workflowInvocations.get
  • dataform.workflowInvocations.list
  • dataform.workflowInvocations.query
  • dataform.workspaces.commit
  • dataform.workspaces.create
  • dataform.workspaces.delete
  • dataform.workspaces.fetchFileDiff
  • dataform.workspaces.fetchFileGitStatuses
  • dataform.workspaces.fetchGitAheadBehind
  • dataform.workspaces.get
  • dataform.workspaces.getIamPolicy
  • dataform.workspaces.installNpmPackages
  • dataform.workspaces.list
  • dataform.workspaces.makeDirectory
  • dataform.workspaces.moveDirectory
  • dataform.workspaces.moveFile
  • dataform.workspaces.pull
  • dataform.workspaces.push
  • dataform.workspaces.queryDirectoryContents
  • dataform.workspaces.readFile
  • dataform.workspaces.removeDirectory
  • dataform.workspaces.removeFile
  • dataform.workspaces.reset
  • dataform.workspaces.searchFiles
  • dataform.workspaces.setIamPolicy
  • dataform.workspaces.writeFile

dataplex.assets.getIamPolicy

dataplex.datascans.*

  • dataplex.datascans.create
  • dataplex.datascans.delete
  • dataplex.datascans.get
  • dataplex.datascans.getData
  • dataplex.datascans.getIamPolicy
  • dataplex.datascans.list
  • dataplex.datascans.run
  • dataplex.datascans.setIamPolicy
  • dataplex.datascans.update

dataplex.environments.execute

dataplex.environments.get

dataplex.environments.list

dataplex.lakes.get

dataplex.lakes.getIamPolicy

dataplex.operations.get

dataplex.operations.list

dataplex.projects.search

dataplex.zones.getIamPolicy

dataproc.batches.cancel

dataproc.batches.create

dataproc.batches.get

dataproc.operations.cancel

dataproc.operations.get

dataproc.operations.list

firebase.projects.get

iam.serviceAccounts.actAs

logging.logEntries.create

logging.logEntries.route

metastore.services.get

monitoring.metricDescriptors.create

monitoring.metricDescriptors.get

monitoring.metricDescriptors.list

monitoring.monitoredResourceDescriptors.*

  • monitoring.monitoredResourceDescriptors.get
  • monitoring.monitoredResourceDescriptors.list

monitoring.timeSeries.create

orgpolicy.policy.get

recommender.iamPolicyInsights.*

  • recommender.iamPolicyInsights.get
  • recommender.iamPolicyInsights.list
  • recommender.iamPolicyInsights.update

recommender.iamPolicyRecommendations.*

  • recommender.iamPolicyRecommendations.get
  • recommender.iamPolicyRecommendations.list
  • recommender.iamPolicyRecommendations.update

recommender.storageBucketSoftDeleteInsights.*

  • recommender.storageBucketSoftDeleteInsights.get
  • recommender.storageBucketSoftDeleteInsights.list
  • recommender.storageBucketSoftDeleteInsights.update

recommender.storageBucketSoftDeleteRecommendations.*

  • recommender.storageBucketSoftDeleteRecommendations.get
  • recommender.storageBucketSoftDeleteRecommendations.list
  • recommender.storageBucketSoftDeleteRecommendations.update

resourcemanager.hierarchyNodes.listEffectiveTags

resourcemanager.projects.get

resourcemanager.projects.list

servicemanagement.services.report

serviceusage.services.use

storage.anywhereCaches.*

  • storage.anywhereCaches.create
  • storage.anywhereCaches.disable
  • storage.anywhereCaches.get
  • storage.anywhereCaches.list
  • storage.anywhereCaches.pause
  • storage.anywhereCaches.resume
  • storage.anywhereCaches.update

storage.bucketOperations.*

  • storage.bucketOperations.cancel
  • storage.bucketOperations.get
  • storage.bucketOperations.list

storage.buckets.*

  • storage.buckets.create
  • storage.buckets.createTagBinding
  • storage.buckets.delete
  • storage.buckets.deleteTagBinding
  • storage.buckets.enableObjectRetention
  • storage.buckets.get
  • storage.buckets.getIamPolicy
  • storage.buckets.getIpFilter
  • storage.buckets.getObjectInsights
  • storage.buckets.list
  • storage.buckets.listEffectiveTags
  • storage.buckets.listTagBindings
  • storage.buckets.relocate
  • storage.buckets.restore
  • storage.buckets.setIamPolicy
  • storage.buckets.setIpFilter
  • storage.buckets.update

storage.folders.*

  • storage.folders.create
  • storage.folders.delete
  • storage.folders.get
  • storage.folders.list
  • storage.folders.rename

storage.intelligenceConfigs.*

  • storage.intelligenceConfigs.get
  • storage.intelligenceConfigs.update

storage.managedFolders.*

  • storage.managedFolders.create
  • storage.managedFolders.delete
  • storage.managedFolders.get
  • storage.managedFolders.getIamPolicy
  • storage.managedFolders.list
  • storage.managedFolders.setIamPolicy

storage.multipartUploads.*

  • storage.multipartUploads.abort
  • storage.multipartUploads.create
  • storage.multipartUploads.list
  • storage.multipartUploads.listParts

storage.objects.*

  • storage.objects.create
  • storage.objects.delete
  • storage.objects.get
  • storage.objects.getIamPolicy
  • storage.objects.list
  • storage.objects.move
  • storage.objects.overrideUnlockedRetention
  • storage.objects.restore
  • storage.objects.setIamPolicy
  • storage.objects.setRetention
  • storage.objects.update

(roles/dataplex.storageDataOwner)

Owner access to data. Should not be used directly. This role is granted by Dataplex to managed resources like Cloud Storage buckets, BigQuery datasets etc.

bigquery.datasets.get

bigquery.models.create

bigquery.models.delete

bigquery.models.export

bigquery.models.getData

bigquery.models.getMetadata

bigquery.models.list

bigquery.models.updateData

bigquery.models.updateMetadata

bigquery.routines.create

bigquery.routines.delete

bigquery.routines.get

bigquery.routines.list

bigquery.routines.update

bigquery.tables.create

bigquery.tables.createSnapshot

bigquery.tables.delete

bigquery.tables.deleteSnapshot

bigquery.tables.export

bigquery.tables.get

bigquery.tables.getData

bigquery.tables.list

bigquery.tables.restoreSnapshot

bigquery.tables.update

bigquery.tables.updateData

storage.buckets.get

storage.objects.create

storage.objects.delete

storage.objects.get

storage.objects.list

storage.objects.update

(roles/dataplex.storageDataReader)

Read only access to data. Should not be used directly. This role is granted by Dataplex to managed resources like Cloud Storage buckets, BigQuery datasets etc.

bigquery.datasets.get

bigquery.models.export

bigquery.models.getData

bigquery.models.getMetadata

bigquery.models.list

bigquery.routines.get

bigquery.routines.list

bigquery.tables.export

bigquery.tables.get

bigquery.tables.getData

bigquery.tables.list

storage.buckets.get

storage.objects.get

storage.objects.list

(roles/dataplex.storageDataWriter)

Write access to data. Should not be used directly. This role is granted by Dataplex to managed resources like Cloud Storage buckets, BigQuery datasets etc.

bigquery.tables.updateData

storage.objects.create

storage.objects.delete

storage.objects.update

(roles/dataplex.taxonomyAdmin)

Full access to DataTaxonomy, DataAttribute resources.

dataplex.dataAttributes.*

  • dataplex.dataAttributes.bind
  • dataplex.dataAttributes.create
  • dataplex.dataAttributes.delete
  • dataplex.dataAttributes.get
  • dataplex.dataAttributes.getIamPolicy
  • dataplex.dataAttributes.list
  • dataplex.dataAttributes.setIamPolicy
  • dataplex.dataAttributes.update

dataplex.dataTaxonomies.create

dataplex.dataTaxonomies.delete

dataplex.dataTaxonomies.get

dataplex.dataTaxonomies.getIamPolicy

dataplex.dataTaxonomies.list

dataplex.dataTaxonomies.setIamPolicy

dataplex.dataTaxonomies.update

(roles/dataplex.taxonomyViewer)

Read access on DataTaxonomy, DataAttribute resources.

dataplex.dataAttributes.get

dataplex.dataAttributes.getIamPolicy

dataplex.dataAttributes.list

dataplex.dataTaxonomies.get

dataplex.dataTaxonomies.getIamPolicy

dataplex.dataTaxonomies.list

(roles/dataplex.viewer)

Read access to Dataplex resources.

cloudasset.assets.analyzeIamPolicy

dataplex.assetActions.list

dataplex.assets.get

dataplex.assets.getIamPolicy

dataplex.assets.list

dataplex.content.get

dataplex.content.getIamPolicy

dataplex.content.list

dataplex.dataAttributeBindings.get

dataplex.dataAttributeBindings.getIamPolicy

dataplex.dataAttributeBindings.list

dataplex.dataAttributes.get

dataplex.dataAttributes.getIamPolicy

dataplex.dataAttributes.list

dataplex.dataTaxonomies.get

dataplex.dataTaxonomies.getIamPolicy

dataplex.dataTaxonomies.list

dataplex.datascans.get

dataplex.datascans.getIamPolicy

dataplex.datascans.list

dataplex.environments.get

dataplex.environments.getIamPolicy

dataplex.environments.list

dataplex.lakeActions.list

dataplex.lakes.get

dataplex.lakes.getIamPolicy

dataplex.lakes.list

dataplex.operations.get

dataplex.operations.list

dataplex.tasks.get

dataplex.tasks.getIamPolicy

dataplex.tasks.list

dataplex.zoneActions.list

dataplex.zones.get

dataplex.zones.getIamPolicy

dataplex.zones.list

数据沿袭的预定义角色

如需访问任何 Dataplex Universal Catalog 条目的沿袭，您需要有权访问 Dataplex Universal Catalog 中的相应条目。如需访问 Dataplex Universal Catalog 条目，您需要对相应的系统资源拥有查看者角色，或者对存储 Dataplex Universal Catalog 条目的项目拥有 Dataplex Catalog Viewer 角色 (roles/dataplex.catalogViewer)。本部分介绍查看谱系所需的角色。

沿袭查看者角色

借助 Data Lineage Viewer 角色 (roles/datalineage.viewer)，您可以在 Google Cloud 控制台中查看 Dataplex Universal Catalog 沿袭，并使用 Data Lineage API 读取沿袭信息。指定进程的运行和事件都存储在与该进程相同的项目中。对于自动沿袭，流程、运行和事件会存储在生成沿袭的作业所运行的项目中。例如，这可能是运行 BigQuery 作业的项目。

您需要拥有不同的角色才能查看资源之间的谱系以及资源的元数据。对于前者，您需要 Data Lineage Viewer 角色 (roles/datalineage.viewer)。对于后者，您需要拥有与访问 Dataplex Universal Catalog 中的元数据条目相同的角色。

查看两个资源之间沿袭所需的角色

如需查看资产之间的沿袭，您需要拥有以下项目的数据沿袭查看者角色 (roles/datalineage.viewer)：

  • 您正在查看沿袭信息的项目（称为活动项目），即 Google Cloud 控制台顶部下拉菜单中的项目或发出 API 调用的项目。这通常是包含您将在 Dataplex Universal Catalog 中创建或使用 API 在其他 Google Cloud 系统中访问的资源的项目。
  • 记录谱系的项目（称为计算项目）。如前所述，谱系存储在执行相应流程的项目中。此项目可以不同于存储您要查看沿袭的资产的项目。

如需详细了解如何授予角色，请参阅管理访问权限。 您也可以通过自定义角色或其他预定义角色来获取所需的权限。

根据使用情形，在文件夹或组织级别授予数据沿袭查看者角色 (roles/datalineage.viewer)，以确保能够访问沿袭（请参阅授予或撤消单个角色）。只能通过 Google Cloud CLI 授予数据沿袭所需的角色。

查看沿袭时查看资产元数据的角色

当有关资产的元数据存储在 Dataplex Universal Catalog 中时，您只有在拥有相应系统资源的查看者角色或存储 Dataplex Universal Catalog 条目的项目中的 Dataplex Catalog Viewer 角色 (roles/dataplex.catalogViewer) 时，才能查看该元数据。您可能通过适当的查看者角色有权访问谱系图或列表中的资产，但无权访问它们之间的谱系。如果您在记录沿袭的项目中没有 Data Lineage Viewer 角色 (roles/datalineage.viewer)，则会出现这种情况。在这种情况下，为了防止泄露有关谱系存在的信息，Data Lineage API 和 Google Cloud 控制台不会显示谱系，也不会返回错误。因此，如果某个资产没有沿袭，并不意味着该资产没有沿袭，而是您可能无权访问该沿袭。

Data Lineage Events Producer 角色

借助 Data Lineage Events Producer 角色 (roles/datalineage.producer)，用户可以使用 Data Lineage API 手动记录沿袭信息。

Data Lineage Editor 角色

借助数据沿袭编辑器角色 (roles/datalineage.editor)，用户可以使用 Data Lineage API 手动修改沿袭信息。

Data Lineage Administrator 角色

借助 Data Lineage Administrator 角色 (roles/datalineage.admin)，用户可以执行本部分中列出的所有沿袭操作。

数据角色

Dataplex Universal Catalog 定义了以下 IAM 角色，这些角色旨在应用于由 Dataplex Universal Catalog 管理的任何资源。如需详细了解与每个角色关联的权限，请参阅本文档的预定义角色部分。

数据角色 功能 理由
Dataplex Data Owner (roles/dataplex.dataOwner) 对受管理资源的所有权限。以及所有子资源（无论资源类型）的所有权限。 数据所有者可以更新资源元数据、授予更精细的权限（例如，针对 BigQuery 数据集的子表）以及创建子资源，此外还拥有各种其他权限。他们对资源拥有完全的所有权。
Dataplex Data Reader (roles/dataplex.dataReader) 能够读取受管资源及其子资源中的数据。并且能够读取受管理资源及其子资源的元数据。 允许读取数据和元数据。
Dataplex Data Writer (roles/dataplex.dataWriter) 能够创建/更新/删除数据（而非元数据）。 启用核心 Dataplex Universal Catalog 用户历程。

后续步骤