Serverless for Apache Spark 权限允许用户（包括服务账号）对 Serverless for Apache Spark 资源执行操作。例如，dataproc.batches.create 权限可让您在项目中创建 Serverless for Apache Spark 批处理。您不直接授予用户权限，而是向其授予角色（角色自带一个或多个权限）。
下表列出了调用 Serverless for Apache Spark API（方法）所需的权限。这些表格根据与每个 Serverless for Apache Spark 资源（批处理、会话、sessionTemplates 和操作）关联的 API 进行整理。如需查看每个角色中包含的 Google Cloud 权限的列表，请参阅 Dataproc 角色。
权限范围：下表列出的 Serverless for Apache Spark 权限范围为其所属的 Google Cloud项目（cloud-platform 范围）。请参阅服务账号权限。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-25。"],[[["\u003cp\u003eIdentity and Access Management (IAM) controls user and group access to project resources, including Dataproc Serverless.\u003c/p\u003e\n"],["\u003cp\u003eDataproc Serverless permissions allow users, including service accounts, to perform specific actions, such as creating batches or sessions, on Dataproc Serverless resources.\u003c/p\u003e\n"],["\u003cp\u003eUsers are granted roles, not individual permissions, and these roles bundle one or more permissions necessary for specific actions on Dataproc Serverless.\u003c/p\u003e\n"],["\u003cp\u003eTo perform certain operations, like creating batches or sessions, additional permissions, such as getting status updates, are often required.\u003c/p\u003e\n"],["\u003cp\u003eIAM policies can be managed through the Google Cloud console, the IAM API, or the \u003ccode\u003egcloud\u003c/code\u003e command-line tool to define access to Dataproc Serverless resources.\u003c/p\u003e\n"]]],[],null,["# Serverless for Apache Spark permissions and IAM roles\n\n[Identity and Access Management (IAM)](/iam) lets you control\nuser and group access to your project's resources. This document focuses on\nthe IAM permissions relevant to Serverless for Apache Spark and the IAM roles\nthat grant those permissions.\n\nServerless for Apache Spark permissions\n---------------------------------------\n\n| **Note:** Security requirement: You are required to have [service account `ActAs` permission](/iam/docs/service-accounts-actas) to deploy Serverless for Apache Spark resources, for example, to create clusters, submit jobs, and instantiate workflows. See [Roles for service account\n| authentication](/iam/docs/service-account-permissions) for detailed information.\n\nServerless for Apache Spark permissions allow users, including\n[service accounts](/compute/docs/access/service-accounts),\nto perform actions on Serverless for Apache Spark\nresources. For example, the `dataproc.batches.create`\npermission lets you create Serverless for Apache Spark batches in your project.\nYou don't directly give users permissions; instead, you grant them\n[roles](#roles), which have one or more permissions bundled within\nthem.\n\nThe following tables list the permissions necessary to call Serverless for Apache Spark\nAPIs (methods). The tables are organized according to the APIs associated with\neach Serverless for Apache Spark resource (batches, sessions, sessionTemplates, and\noperations). For a listing of the Google Cloud permissions included in each role, see\n[Dataproc roles](/iam/docs/understanding-roles#dataproc-roles).\n\n\n**Permission Scope:** The scope of Serverless for Apache Spark\npermissions listed in the following tables is the containing Google Cloud\nproject (`cloud-platform` scope). See\n[Service account permissions](/compute/docs/access/service-accounts#service_account_permissions).\n\nExamples:\n\n- `dataproc.batches.create` permits the creation of batches in the containing project.\n- `dataproc.sessions.create` permits the creation of an interactive session in the containing project.\n- `dataproc.operations.list` permits the listing of details of Dataproc operations in the containing project.\n\n### Batch permissions\n\n^1^ `dataproc.batches.create` also requires `dataproc.batches.get` and\n`dataproc.operations.get` permissions to allow it to get status updates\nfrom the `gcloud` command-line tool.\n\n### Session permissions\n\n^1^ `dataproc.sessions.create` also requires `dataproc.sessions.get` and\n`dataproc.operations.get` permissions to allow it to get status updates\nfrom the `gcloud` command-line tool.\n\n### Session runtime template permissions\n\n^1^ `dataproc.sessionTemplates.create` also requires `dataproc.sessionTemplates.get` and\n`dataproc.operations.get` permissions to allow it to get status updates\nfrom the `gcloud` command-line tool.\n\n### Operations permissions\n\n^1^ To cancel batch operations, `dataproc.operations.cancel` also requires\n`dataproc.batches.cancel` permission.\n\nServerless for Apache Spark roles\n---------------------------------\n\n[Serverless for Apache Spark IAM roles](/iam/docs/understanding-roles#dataproc-roles)\nare a bundle of one or more [permissions](#permissions).\nYou grant roles to users or groups to allow them to perform actions on the\nServerless for Apache Spark resources in your\nproject. For example, the **Dataproc Viewer** role contains the\n`dataproc.batches` and `dataproc.sessions` get and list permissions, which\nallow you to get and list Serverless for Apache Spark batches and sessions in a project.\n\nThe following table lists the Serverless for Apache Spark IAM roles and\nthe permissions associated with each role:\n\nProject roles\n-------------\n\nYou can also set permissions at the project level by using the IAM\n**Project** roles. Here is a summary of the permissions associated with\nIAM Project roles:\n\nCustom Roles\n------------\n\nDataproc batch permissions can be added to custom roles through\nthe Google Cloud console or the `gcloud` command-line tool.\n\nManaging IAM policies\n---------------------\n\nYou can get and set IAM policies using the Google Cloud console, the IAM API, or the\n`gcloud` command-line tool.\n\n- For the Google Cloud console, see [Access control using the Google Cloud console](/iam/docs/managing-policies#access_control_via_console).\n- For the API, see [Access control using the API](/iam/docs/managing-policies#access_control_via_api).\n- For the `gcloud` command-line tool, see [Access control using the Google Cloud CLI command-line tool](/iam/docs/managing-policies#access_control_via_the_gcloud_tool).\n\nWhat's next\n-----------\n\n- [Learn more about IAM](/iam)."]]
