[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-04。"],[],[],null,["# Permissions control for a multi-zone universe\n\nThis document explains how you can manage permissions effectively across a\nmulti-zone Google Distributed Cloud (GDC) air-gapped universe. To maintain access to\nresources that can span multiple zones, you must implement global permissions\nthat consistently apply to them. GDC provides\nIdentity and Access Management (IAM) features to control your global permissions scheme\nwithout having to track and maintain zone-level access.\n\nThis document is for IT administrators within the platform administrator group\nwho are responsible for developing and maintaining access control for resources\nthat span across multiple zones in a GDC universe.\n\nFor more information, see\n[Audiences for GDC air-gapped documentation](/distributed-cloud/hosted/docs/latest/gdch/resources/audiences).\n\nAccess that spans a universe\n----------------------------\n\nGDC offers several key IAM capabilities\nto help control access to your zones and the resources within each zone.\n\n### Streamline role management\n\nGDC provides built-in global permissions control that\nlets you apply and manage IAM roles that span all zones\nautomatically. Global control over your permissions removes segmented use cases\nwhere you must manually apply roles in each zone. *Role-based access control\n(RBAC)* is global by default, but provides fine-tuned zonal permission\nallocation, when necessary.\n\nFor example, consider you have a new developer that needs to access your\nproject's resources. Since a project is global by default, it spans all zones in\nyour universe. Instead of manually applying and maintaining the roles necessary\nto access the project in each zone, you apply a global access role for the\nproject, which applies to all zones the project resides within automatically.\nThe new developer's project access now evolves with your universe, and is\npropagated to new zones automatically if your universe grows.\n\nFor more information about role bindings in GDC, see\n[Grant and revoke access](/distributed-cloud/hosted/docs/latest/gdch/platform/pa-user/iam/set-up-role-bindings).\n\n### Sign in once and propagate your existing credentials\n\nGDC offers *identity providers (IdP)* to streamline\nauthenticating users in your universe, without the hassle of signing in to each\nzone separately. An IdP is a system that centrally manages and secures user\nidentities, providing authentication services. Connecting to an existing IdP\nlets users access GDC using their organization's\ncredentials, without needing to create or manage separate accounts within\nGDC. Since an IdP is a global resource that is\nconfigured to span multiple zones by default, you can access\nGDC through the same IdP regardless of the zone you work\nin. For more information about IdPs in GDC, see\n[Connect to an identity provider](/distributed-cloud/hosted/docs/latest/gdch/platform/pa-user/iam/connect-identity).\n\n### Global workload and service permissions control\n\nJust as human users benefit from\n[IdPs to streamline authentication across zones](#idp),\nyour workloads and services can also benefit from global authentication in your\nuniverse with *service accounts*. Service accounts are the accounts that\nworkloads and services use to programmatically consume resources and access\nmicroservices securely. Since a service account is a global resource that is\nconfigured to span multiple zones by default, your workloads and services can\naccess resources that span a universe uniformly with a single set of global\npermissions.\n\nAs an example, consider you have a VM that has an attached storage volume.\nBecause a volume can span two zones, if you want to allow the VM to access the\nvolume, it must have access permissions in all zones where the volume resides.\nWith global service accounts, you can provide the VM access to the storage\nvolume once, which propagates to all zones where the volume resides. This\ncapability lets you configure access on a universal scale, without managing\nzone-specific access.\n\nFor more information about service accounts in GDC, see\n[Authenticate with service accounts](/distributed-cloud/hosted/docs/latest/gdch/platform/pa-user/service-identity).\n\nWhat's next\n-----------\n\n- [Zones in GDC air-gapped](/distributed-cloud/hosted/docs/latest/gdch/resources/multi-zone/mz-overview)\n- [Manage resources across zones](/distributed-cloud/hosted/docs/latest/gdch/resources/multi-zone/manage-mz-resources)\n- [Sign in](/distributed-cloud/hosted/docs/latest/gdch/platform/pa-user/iam/sign-in)"]]
