Conceder papéis básicos do IAM do metastore do Dataproc aos usuários
Mantenha tudo organizado com as coleções
Salve e categorize o conteúdo com base nas suas preferências.
Nesta página, descrevemos como conceder a uma conta de usuário ou de serviço acesso aos recursos básicos do metastore do Dataproc em um projeto. Google Cloud As funções descritas nesta página fornecem acesso para criar um serviço do metastore do Dataproc.
Dependendo do escopo de controle que você quer que a conta tenha, conceda a ela um destes papéis predefinidos do IAM:
roles/metastore.editor para conceder controle total dos recursos do metastore do Dataproc
roles/metastore.admin para conceder controle total dos recursos do metastore do Dataproc, incluindo a atualização das permissões do IAM.
Sign in to your Google Cloud account. If you're new to
Google Cloud,
create an account to evaluate how our products perform in
real-world scenarios. New customers also get $300 in free credits to
run, test, and deploy workloads.
In the Google Cloud console, on the project selector page,
select or create a Google Cloud project.
Você precisa ter o papel básico do IAM roles/owner (Proprietário) no
projetoGoogle Cloud que está usando ou um papel que conceda estas permissões:
resourcemanager.projects.get
resourcemanager.projects.getIamPolicy
resourcemanager.projects.setIamPolicy
Para receber essas permissões seguindo o princípio de privilégio mínimo,
peça ao administrador para conceder a você o papel de roles/resourcemanager.projectIamAdmin (administrador do IAM do projeto).
Execute o seguinte comando add-iam-policy-binding para conceder um papel predefinido do metastore do Dataproc a um principal do IAM
(conta de usuário ou conta de serviço).
PROJECT_ID: o ID do projeto em que você quer ativar o acesso ao Metastore.
PRINCIPAL: o tipo e o ID de e-mail (endereço de e-mail) do principal.
Para contas de usuário: user:EMAIL_ID
Para contas de serviço: serviceAccount:EMAIL_ID
Para os Grupos do Google: group:EMAIL_ID
METASTORE_ROLE: um dos seguintes valores, dependendo do papel que você quer conceder ao principal: roles/metastore.editor ou roles/metastore.admin. Para detalhes sobre as permissões concedidas por esses papéis, consulte Papéis do IAM do Dataproc Metastore.
[[["Fácil de entender","easyToUnderstand","thumb-up"],["Meu problema foi resolvido","solvedMyProblem","thumb-up"],["Outro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Informações incorretas ou exemplo de código","incorrectInformationOrSampleCode","thumb-down"],["Não contém as informações/amostras de que eu preciso","missingTheInformationSamplesINeed","thumb-down"],["Problema na tradução","translationIssue","thumb-down"],["Outro","otherDown","thumb-down"]],["Última atualização 2025-09-02 UTC."],[[["\u003cp\u003eThis guide details how to grant Google Cloud user or service accounts access to Dataproc Metastore resources in a project.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003eroles/metastore.editor\u003c/code\u003e role grants full control over Dataproc Metastore resources, while \u003ccode\u003eroles/metastore.admin\u003c/code\u003e provides full control and the ability to update IAM permissions.\u003c/p\u003e\n"],["\u003cp\u003eYou must have the \u003ccode\u003eroles/owner\u003c/code\u003e IAM role or the required permissions (\u003ccode\u003eresourcemanager.projects.get\u003c/code\u003e, \u003ccode\u003eresourcemanager.projects.getIamPolicy\u003c/code\u003e, \u003ccode\u003eresourcemanager.projects.setIamPolicy\u003c/code\u003e) to grant access roles.\u003c/p\u003e\n"],["\u003cp\u003eThe gcloud CLI's \u003ccode\u003eadd-iam-policy-binding\u003c/code\u003e command is used to grant a predefined Dataproc Metastore role to an IAM principal by specifying the project ID, principal, and desired role.\u003c/p\u003e\n"],["\u003cp\u003eOther actions with the metastore may require additional roles not detailed here, and information on those can be found in the respective feature guides.\u003c/p\u003e\n"]]],[],null,["# Grant basic Dataproc Metastore IAM roles to users\n\nThis page describes how to grant a Google Cloud user account or service\naccount access to basic Dataproc Metastore resources in a project. These roles described on this page provide access to create a Dataproc Metastore service.\n\nDepending on the scope of control you want the account to have, you grant it one of these predefined IAM roles:\n\n- `roles/metastore.editor` to grant full control of Dataproc Metastore resources\n- `roles/metastore.admin` to grant full control of Dataproc Metastore resources, including updating IAM permissions.\n\nFor detailed information about the specific IAM permissions these roles provide, see [Dataproc Metastore IAM roles](/dataproc-metastore/docs/iam-roles).\n| **Note:** Completing other actions with your metastore---such as importing MYSQL files---require you to add extra roles that are not detailed on this page. You can find more information about these roles in the respective feature guides.\n\nBefore you begin\n----------------\n\n- Sign in to your Google Cloud account. If you're new to Google Cloud, [create an account](https://console.cloud.google.com/freetrial) to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.\n- In the Google Cloud console, on the project selector page,\n select or create a Google Cloud project.\n\n | **Note**: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.\n\n [Go to project selector](https://console.cloud.google.com/projectselector2/home/dashboard)\n-\n [Verify that billing is enabled for your Google Cloud project](/billing/docs/how-to/verify-billing-enabled#confirm_billing_is_enabled_on_a_project).\n\n-\n\n\n Enable the Dataproc Metastore API.\n\n\n [Enable the API](https://console.cloud.google.com/flows/enableapi?apiid=metastore.googleapis.com)\n\n- In the Google Cloud console, on the project selector page,\n select or create a Google Cloud project.\n\n | **Note**: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.\n\n [Go to project selector](https://console.cloud.google.com/projectselector2/home/dashboard)\n-\n [Verify that billing is enabled for your Google Cloud project](/billing/docs/how-to/verify-billing-enabled#confirm_billing_is_enabled_on_a_project).\n\n-\n\n\n Enable the Dataproc Metastore API.\n\n\n [Enable the API](https://console.cloud.google.com/flows/enableapi?apiid=metastore.googleapis.com)\n\n\u003cbr /\u003e\n\n### Required Roles\n\nYou must have the `roles/owner` (Owner) basic IAM role in the\nGoogle Cloud project you are using, or a role that grants these permissions:\n\n- `resourcemanager.projects.get`\n- `resourcemanager.projects.getIamPolicy`\n- `resourcemanager.projects.setIamPolicy`\n\nTo gain these permissions while following the principle of least privilege,\nask your administrator to grant you the `roles/resourcemanager.projectIamAdmin` (Project IAM Admin)\nrole.\n\nHow to grant access roles\n-------------------------\n\n### gcloud\n\nTo use the gcloud CLI, you can [install and initialize](https://cloud.google.com/sdk/docs/install) the Google Cloud CLI, or you can use [Cloud Shell](https://cloud.google.com/shell/docs/using-cloud-shell).\n\nRun the following `add-iam-policy-binding` command to grant a Dataproc Metastore predefined role to an IAM principal\n(user account or service account).\n\n\u003cbr /\u003e\n\n```\n gcloud projects add-iam-policy-binding PROJECT_ID \\\n --member=PRINCIPAL \\\n --role=METASTORE_ROLE\n```\n\n\u003cbr /\u003e\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: The ID of the project you want to enable Metastore access to.\n- \u003cvar translate=\"no\"\u003ePRINCIPAL\u003c/var\u003e: The type and email ID (email address) of the principal.\n - For user accounts: user:\u003cvar translate=\"no\"\u003eEMAIL_ID\u003c/var\u003e\n - For service accounts: serviceAccount:\u003cvar translate=\"no\"\u003eEMAIL_ID\u003c/var\u003e\n - For Google Groups: group:\u003cvar translate=\"no\"\u003eEMAIL_ID\u003c/var\u003e\n- \u003cvar translate=\"no\"\u003eMETASTORE_ROLE\u003c/var\u003e: One of the following values, depending on the role you want to grant the principal: `roles/metastore.editor`, or `roles/metastore.admin`. For details about the permissions these roles grant, see [Dataproc Metastore IAM roles](/dataproc-metastore/docs/iam-roles)."]]
