[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-04。"],[[["\u003cp\u003eCloud Deploy utilizes Identity and Access Management (IAM) to manage permissions and control access to Google Cloud resources, offering predefined roles for granular control.\u003c/p\u003e\n"],["\u003cp\u003eBy default, Cloud Deploy operates using the Compute Engine service account, but you can configure a different account for specific needs, according to the linked documentation.\u003c/p\u003e\n"],["\u003cp\u003eCloud Deploy's predefined IAM roles, such as Admin, Approver, Developer, and Viewer, come with specific permissions that dictate what actions each role can perform on Cloud Deploy resources.\u003c/p\u003e\n"],["\u003cp\u003eIAM allows the implementation of the principle of least privilege, granting only necessary permissions to users, groups, or service accounts, enhancing security and preventing unwanted access.\u003c/p\u003e\n"],["\u003cp\u003eIAM meta APIs and Conditional IAM can be utilized for advanced control over Cloud Deploy resources, restricting actions like creating, updating, or deleting delivery pipelines, targets, or releases to specific users or groups.\u003c/p\u003e\n"]]],[],null,["# IAM roles and permissions\n\nThis page describes Cloud Deploy service accounts, roles, and\npermissions.\n\nAccess in Cloud Deploy is controlled using [Identity and Access Management (IAM)](/iam).\nIAM lets you create and manage\npermissions for Google Cloud resources. Cloud Deploy provides a specific\nset of [predefined IAM roles](/iam/docs/understanding-roles#role_types)\nwhere each role contains a set of permissions. You can use these roles to give\nmore fine-grained access to specific Google Cloud resources and prevent unwanted\naccess to other resources. IAM lets you adopt the\n[security principle of least privilege](https://en.wikipedia.org/wiki/Principle_of_least_privilege),\nso you grant only the necessary access to your resources.\n\nSee [Using IAM to restrict Cloud Deploy access](/deploy/docs/securing/iam)\nto learn about advanced access-control security features.\n\nService accounts in Cloud Deploy\n--------------------------------\n\nBy default, Cloud Deploy runs using the default Compute Engine\nservice account. For more information on configuring this service account for\nuse with Cloud Deploy, or choosing a different account, see the [Cloud Deploy\nexecution service account](/deploy/docs/iam-roles-permissions#execution-service-account)\ndocumentation.\n\n[Find out more](/deploy/docs/cloud-deploy-service-account) about how\nCloud Deploy uses service accounts.\n\nPredefined Cloud Deploy roles\n-----------------------------\n\nWith IAM, every API method in Cloud Deploy API requires\nthat the identity making the API request has the appropriate permissions to use\nthe resource. Permissions are granted by setting policies that grant roles to a\nprincipal (user, group, or service account) of your project. You can grant\nmultiple roles to a principal on the same resource.\n\nThe IAM documentation includes a\n[searchable reference](/iam/docs/understanding-roles#predefined)\nof all predefined roles.\n\nThe following table lists the Cloud Deploy IAM roles and\nthe permissions that they include: \n\n| **Note:** If an [alternate service account](/deploy/docs/execution-environment#changing_from_the_default_to_custom_execution_service_account) is specified on the target, users with the `roles/clouddeploy.admin`, `.developer`, and `.operator` roles must also have the `iam.serviceAccounts.actAs` permission for the service accounts specified in a rollout target.\n\nIn addition to the Cloud Deploy predefined roles, the\n[basic](/iam/docs/understanding-roles#basic) Viewer,\nEditor, and Owner roles also include permissions related to Cloud Deploy.\nHowever, we recommend that you grant predefined roles where possible to comply with the\n[security principle of least privilege](/iam/docs/using-iam-securely#least_privilege).\n\nPermissions\n-----------\n\nThe following table lists the permissions that the caller must have to call each method:\n\nUsing IAM to restrict actions on Cloud Deploy resources\n-------------------------------------------------------\n\nYou can secure your Cloud Deploy resources using IAM\nin the following ways:\n\n- IAM meta APIs\n\n Use [`setIamPolicy`](/sdk/gcloud/reference/projects/set-iam-policy) on\n Cloud Deploy resources to restrict actions on those resources.\n- Conditional IAM\n\n Programmatically apply [access policies](/iam/docs/granting-changing-revoking-access#policy-overview),\n including the [conditions](/iam/docs/conditions-overview) under which to grant\n or deny access.\n\nYou can use these policies and conditions to restrict the following actions on\nyour Cloud Deploy resources:\n\n- Create a delivery pipeline or target\n\n You can grant this access to specific users or groups.\n- Update or delete a specific delivery pipeline\n\n You can grant this access to specific users or groups.\n- Create a release for a specific delivery pipeline\n\n You can grant this access to specific users or groups.\n- Update or delete a specific target\n\n You can grant this access to specific users or groups.\n- Create or approve a rollout or promote a release\n\n You can grant this access to specific users or groups for a specific target or\n delivery pipeline.\n\n You can also set a condition that limits this access to within a specified\n time window.\n\nWhat's next\n-----------\n\n- Learn about [IAM](/iam/docs).\n- Learn more about [using conditions in IAM](/deploy/docs/securing/iam#about_iam_conditions)\n- Find out more about [Cloud Deploy service accounts](/deploy/docs/cloud-deploy-service-account)."]]
