Memberikan peran IAM Metastore Dataproc dasar kepada pengguna
Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Halaman ini menjelaskan cara memberikan akses akun pengguna atau akun layanan ke resource Dataproc Metastore dasar dalam project. Google Cloud Peran yang dijelaskan di halaman ini memberikan akses untuk membuat layanan Dataproc Metastore.
Bergantung pada cakupan kontrol yang Anda inginkan untuk akun tersebut, Anda memberinya salah satu peran IAM bawaan berikut:
roles/metastore.editor untuk memberikan kontrol penuh atas resource Dataproc Metastore
roles/metastore.admin untuk memberikan kontrol penuh atas resource Dataproc Metastore, termasuk memperbarui izin IAM.
Untuk mengetahui informasi mendetail tentang izin IAM tertentu yang diberikan oleh peran ini, lihat Peran IAM Dataproc Metastore.
Sebelum memulai
Sign in to your Google Cloud account. If you're new to
Google Cloud,
create an account to evaluate how our products perform in
real-world scenarios. New customers also get $300 in free credits to
run, test, and deploy workloads.
In the Google Cloud console, on the project selector page,
select or create a Google Cloud project.
Anda harus memiliki peran IAM dasar roles/owner (Pemilik) di
Google Cloud project yang Anda gunakan, atau peran yang memberikan izin ini:
resourcemanager.projects.get
resourcemanager.projects.getIamPolicy
resourcemanager.projects.setIamPolicy
Untuk mendapatkan izin ini sambil mengikuti prinsip hak istimewa paling rendah, minta administrator Anda untuk memberi Anda peran roles/resourcemanager.projectIamAdmin (Admin IAM Project).
Jalankan perintah add-iam-policy-binding berikut untuk memberikan peran standar Dataproc Metastore kepada akun utama IAM
(akun pengguna atau akun layanan).
PROJECT_ID: ID project yang akses Metastore-nya ingin Anda aktifkan.
PRINCIPAL: Jenis dan ID email (alamat email) prinsipal.
Untuk akun pengguna: user:EMAIL_ID
Untuk akun layanan: serviceAccount:EMAIL_ID
Untuk Google Grup: group:EMAIL_ID
METASTORE_ROLE: Salah satu nilai berikut, bergantung pada peran yang ingin Anda berikan kepada akun utama: roles/metastore.editor, atau roles/metastore.admin. Untuk mengetahui detail tentang izin yang diberikan oleh peran ini, lihat Peran IAM Dataproc Metastore.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-02 UTC."],[[["\u003cp\u003eThis guide details how to grant Google Cloud user or service accounts access to Dataproc Metastore resources in a project.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003eroles/metastore.editor\u003c/code\u003e role grants full control over Dataproc Metastore resources, while \u003ccode\u003eroles/metastore.admin\u003c/code\u003e provides full control and the ability to update IAM permissions.\u003c/p\u003e\n"],["\u003cp\u003eYou must have the \u003ccode\u003eroles/owner\u003c/code\u003e IAM role or the required permissions (\u003ccode\u003eresourcemanager.projects.get\u003c/code\u003e, \u003ccode\u003eresourcemanager.projects.getIamPolicy\u003c/code\u003e, \u003ccode\u003eresourcemanager.projects.setIamPolicy\u003c/code\u003e) to grant access roles.\u003c/p\u003e\n"],["\u003cp\u003eThe gcloud CLI's \u003ccode\u003eadd-iam-policy-binding\u003c/code\u003e command is used to grant a predefined Dataproc Metastore role to an IAM principal by specifying the project ID, principal, and desired role.\u003c/p\u003e\n"],["\u003cp\u003eOther actions with the metastore may require additional roles not detailed here, and information on those can be found in the respective feature guides.\u003c/p\u003e\n"]]],[],null,["# Grant basic Dataproc Metastore IAM roles to users\n\nThis page describes how to grant a Google Cloud user account or service\naccount access to basic Dataproc Metastore resources in a project. These roles described on this page provide access to create a Dataproc Metastore service.\n\nDepending on the scope of control you want the account to have, you grant it one of these predefined IAM roles:\n\n- `roles/metastore.editor` to grant full control of Dataproc Metastore resources\n- `roles/metastore.admin` to grant full control of Dataproc Metastore resources, including updating IAM permissions.\n\nFor detailed information about the specific IAM permissions these roles provide, see [Dataproc Metastore IAM roles](/dataproc-metastore/docs/iam-roles).\n| **Note:** Completing other actions with your metastore---such as importing MYSQL files---require you to add extra roles that are not detailed on this page. You can find more information about these roles in the respective feature guides.\n\nBefore you begin\n----------------\n\n- Sign in to your Google Cloud account. If you're new to Google Cloud, [create an account](https://console.cloud.google.com/freetrial) to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.\n- In the Google Cloud console, on the project selector page,\n select or create a Google Cloud project.\n\n | **Note**: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.\n\n [Go to project selector](https://console.cloud.google.com/projectselector2/home/dashboard)\n-\n [Verify that billing is enabled for your Google Cloud project](/billing/docs/how-to/verify-billing-enabled#confirm_billing_is_enabled_on_a_project).\n\n-\n\n\n Enable the Dataproc Metastore API.\n\n\n [Enable the API](https://console.cloud.google.com/flows/enableapi?apiid=metastore.googleapis.com)\n\n- In the Google Cloud console, on the project selector page,\n select or create a Google Cloud project.\n\n | **Note**: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.\n\n [Go to project selector](https://console.cloud.google.com/projectselector2/home/dashboard)\n-\n [Verify that billing is enabled for your Google Cloud project](/billing/docs/how-to/verify-billing-enabled#confirm_billing_is_enabled_on_a_project).\n\n-\n\n\n Enable the Dataproc Metastore API.\n\n\n [Enable the API](https://console.cloud.google.com/flows/enableapi?apiid=metastore.googleapis.com)\n\n\u003cbr /\u003e\n\n### Required Roles\n\nYou must have the `roles/owner` (Owner) basic IAM role in the\nGoogle Cloud project you are using, or a role that grants these permissions:\n\n- `resourcemanager.projects.get`\n- `resourcemanager.projects.getIamPolicy`\n- `resourcemanager.projects.setIamPolicy`\n\nTo gain these permissions while following the principle of least privilege,\nask your administrator to grant you the `roles/resourcemanager.projectIamAdmin` (Project IAM Admin)\nrole.\n\nHow to grant access roles\n-------------------------\n\n### gcloud\n\nTo use the gcloud CLI, you can [install and initialize](https://cloud.google.com/sdk/docs/install) the Google Cloud CLI, or you can use [Cloud Shell](https://cloud.google.com/shell/docs/using-cloud-shell).\n\nRun the following `add-iam-policy-binding` command to grant a Dataproc Metastore predefined role to an IAM principal\n(user account or service account).\n\n\u003cbr /\u003e\n\n```\n gcloud projects add-iam-policy-binding PROJECT_ID \\\n --member=PRINCIPAL \\\n --role=METASTORE_ROLE\n```\n\n\u003cbr /\u003e\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: The ID of the project you want to enable Metastore access to.\n- \u003cvar translate=\"no\"\u003ePRINCIPAL\u003c/var\u003e: The type and email ID (email address) of the principal.\n - For user accounts: user:\u003cvar translate=\"no\"\u003eEMAIL_ID\u003c/var\u003e\n - For service accounts: serviceAccount:\u003cvar translate=\"no\"\u003eEMAIL_ID\u003c/var\u003e\n - For Google Groups: group:\u003cvar translate=\"no\"\u003eEMAIL_ID\u003c/var\u003e\n- \u003cvar translate=\"no\"\u003eMETASTORE_ROLE\u003c/var\u003e: One of the following values, depending on the role you want to grant the principal: `roles/metastore.editor`, or `roles/metastore.admin`. For details about the permissions these roles grant, see [Dataproc Metastore IAM roles](/dataproc-metastore/docs/iam-roles)."]]
