IAM 还允许您通过设置 IAM 政策来控制谁（身份）对哪些资源具有何种权限（角色）。IAM 政策可为项目成员授予特定角色，进而授予相应身份特定权限。例如，您可以为 Google 账号分配给定资源（如项目）的 roles/metastore.admin 角色，此后该账号便可控制项目中的 Dataproc Metastore 资源，但无法管理其他资源。您还可以使用 IAM 来管理向项目团队成员授予的基本角色。
针对用户的访问权限控制选项
为了让用户能够创建和管理您的 Dataproc Metastore 资源，您可以将用户作为团队成员添加到项目或特定资源，然后使用 IAM 角色向这些用户授予权限。
团队成员可以是具有有效 Google 账号的个人用户、Google 群组、服务账号或 Google Workspace 网域。当您将团队成员添加到项目或资源中时，请指定要向其授予的角色。IAM 提供三种类型的角色：预定义角色、基本角色和自定义角色。
通过将 IAM 政策直接附加到 Dataproc Metastore 资源（例如 Dataproc Metastore 服务），您可以授予对这些资源的访问权限。通过 IAM 政策，您可以管理这些资源的 IAM 角色，甚至在项目级管理角色。这可让您灵活应用最低权限原则，例如，仅授予协作者完成其工作所需的特定资源的权限。
资源会沿用其父级资源的政策。如果在项目级层设置政策，则项目的所有子资源都会沿用该政策。资源的有效政策是为该资源设置的政策及其从层次结构中更高层级沿用而来的政策的集合。如需了解详情，请参阅 IAM 政策层次结构。
您可以使用 Google Cloud 控制台、IAM API 或 Google Cloud CLI 来获取和设置 IAM 政策。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-27。"],[[["\u003cp\u003eBy default, only the original project creator has access to a new Google Cloud project and its Dataproc Metastore resources.\u003c/p\u003e\n"],["\u003cp\u003eIdentity and Access Management (IAM) allows for granular control over who can access Google Cloud resources, adhering to the principle of least privilege.\u003c/p\u003e\n"],["\u003cp\u003eUsers can be added as team members to a project or specific resources, and they can be granted permissions via predefined, basic, or custom IAM roles.\u003c/p\u003e\n"],["\u003cp\u003eIAM policies can be applied at the project level or directly to individual Dataproc Metastore resources, with resources inheriting policies from their parent resources.\u003c/p\u003e\n"],["\u003cp\u003eDataproc Metastore utilizes a service agent service account to perform actions on behalf of the user, requiring appropriate permissions, like the \u003ccode\u003estorage.objectAdmin\u003c/code\u003e role for Hive metastore warehouse directories.\u003c/p\u003e\n"]]],[],null,["# Dataproc Metastore: Access control with IAM\n\nBy default, all Google Cloud projects come with a single user, the\noriginal project creator. No other users have access to the project, and\ntherefore, access to Dataproc Metastore resources, until a user\nis added as a project member or is bound to a specific resource.\n\nThis page explains the ways you can add new users to your project and how to\nset access control for your Dataproc Metastore resources.\n\nWhat is IAM?\n------------\n\nGoogle Cloud offers [Identity and Access Management (IAM)](/iam), which lets you\ngive more granular access to specific Google Cloud resources and prevents\nunwanted access to other resources. IAM lets you adopt the\n[security principle of least privilege](https://en.wikipedia.org/wiki/Principle_of_least_privilege),\nso you grant only the necessary access to your resources.\n\nIAM also lets you control who (identity) has what (roles)\npermission to which resources by setting IAM policies. IAM\npolicies grant specific roles to a project member, giving the identity certain\npermissions. For example, for a given resource, such as a project, you can\nassign the `roles/metastore.admin` role to a Google Account and that account can\ncontrol Dataproc Metastore resources in the project, but cannot\nmanage other resources. You can also use IAM to manage the basic\nroles granted to project team members.\n\nAccess control options for users\n--------------------------------\n\nTo give users the ability to create and manage your Dataproc Metastore\nresources, you can add users as *team members* to your project or to specific\nresources and grant them permissions using IAM *roles*.\n\nA team member can be an individual user with a valid Google Account, a Google\nGroup, a service account, or a Google Workspace domain. When you add a team\nmember to a project or to a resource, you specify which roles to grant them.\nIAM provides three types of roles: [predefined roles](/iam/docs/overview#roles),\n[basic roles](/iam/docs/overview#roles), and [custom roles](/iam/docs/understanding-custom-roles).\n\nTo see a list of capabilities of each Dataproc Metastore role\nand API methods that a specific role grants permission to, review\n[Dataproc Metastore IAM roles](/dataproc-metastore/docs/iam-roles).\n\nFor other member types, such as service accounts and groups, refer to the [Policy\nbinding reference](/iam/docs/reference/rest/v1/Policy#binding).\n\nService accounts\n----------------\n\nWhen you call Dataproc Metastore APIs to perform actions in a project\nwhere your service is located, Dataproc Metastore performs these\nactions on your behalf by using a Service Agent service account that has the permissions required\nto perform the actions.\n\nThe following service accounts have the permissions\nrequired to perform Dataproc Metastore actions in the project where\nyour service is located:\n\n- `service-`\u003cvar translate=\"no\"\u003eCUSTOMER_PROJECT_NUMBER\u003c/var\u003e`@gcp-sa-metastore.iam.gserviceaccount.com`.\n\n | **Note:** You may need to grant [`storage.objectAdmin`](/storage/docs/access-control/iam-roles) role to this service account for your Dataproc Metastore service to have access to its Hive metastore warehouse directory, if a non-default warehouse directory is provided. For more information, see [Hive Metastore](/dataproc-metastore/docs/hive-metastore).\n\nIAM policies for resources\n--------------------------\n\nYou can grant access to Dataproc Metastore resources by\nattaching IAM policies directly to those resources, such as a\nDataproc Metastore service. An IAM\npolicy lets you manage IAM roles on those resources\ninstead of, or in addition to, managing roles at the project level. This gives\nyou flexibility to apply the principle of least privilege, which is to grant\naccess only to the specific resources that collaborators need to do their work.\n\nResources also inherit the policies of their parent resources. If you set a\npolicy at the project level, it's inherited by all its child resources. The\neffective policy for a resource is the union of the policy set at that resource\nand the policy inherited from higher up in the hierarchy. For more information,\nread about the [IAM policy hierarchy](/iam/docs/overview#policy_hierarchy).\n\nYou can get and set IAM policies using the Google Cloud console, the\nIAM API, or the Google Cloud CLI.\n\n- For the Google Cloud console, see [Access control via the Google Cloud console](/iam/docs/grant-role-console).\n- For the API, see [Access control via the API](/iam/docs/reference/rest).\n- For the Google Cloud CLI, see [Access control via the Google Cloud CLI](/sdk/gcloud/reference/iam).\n\nWhat's next\n-----------\n\n- Learn how to grant [fine-grained access to metadata when using gRPC](/dataproc-metastore/docs/grpc-endpoints)\n- Learn more about [IAM roles](/dataproc-metastore/docs/iam-roles).\n- Learn more about [IAM permissions](/dataproc-metastore/docs/iam-permissions).\n- Learn how to set [policies at a project level](/iam/docs/managing-policies)."]]
