Menetapkan dan mengelola kebijakan IAM untuk zona terkelola
Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Halaman ini memberikan petunjuk tentang cara menyiapkan izin Identity and Access Management (IAM) baca, tulis, atau
administrator tertentu untuk zona terkelola
yang berbeda dalam project yang sama.
Untuk informasi mendetail tentang kebijakan IAM, lihat Memahami
kebijakan izin. Untuk informasi tentang API kebijakan IAM, lihat Policy. Untuk mempelajari cara membuat peran khusus IAM yang dapat Anda gunakan di zona terkelola, lihat Memahami peran khusus IAM.
Izin yang diperlukan untuk langkah ini
Untuk menjalankan tugas ini, Anda harus diberi izin berikut
atau peran IAM berikut.
Izin
dns.managedZones.setIamPolicy untuk metode setIamPolicy
dns.managedZones.getIamPolicy untuk metode getIamPolicy
dns.managedZones.list untuk metode testIamPermission
Peran
roles/iam.securityAdmin
roles/dns.admin
Prosedur ini mengasumsikan bahwa Anda telah membuat zona terkelola dalam project. Untuk
mengetahui petunjuk tentang cara membuat zona terkelola, lihat Membuat, mengubah, dan menghapus zona.
Menetapkan kebijakan IAM untuk zona terkelola
Untuk menetapkan kebijakan IAM di zona terkelola tertentu, ikuti langkah-langkah berikut.
Konsol
Di Google Cloud konsol, buka halaman Cloud DNS zones.
Pilih satu atau beberapa zona yang ingin Anda tambahkan izin kontrol akses.
Di halaman Permissions to resources, klik Add principal.
Di halaman Grant access to resource, pada bagian New principals, tambahkan alamat email pengguna, grup, domain, atau akun layanan yang ingin Anda tambahkan sebagai akun utama baru.
Dari daftar Tetapkan peran, pilih peran yang ingin Anda
tetapkan ke akun utama.
Untuk menetapkan peran tambahan, klik Tambahkan peran lain.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-08-11 UTC."],[[["\u003cp\u003eThis guide outlines the process for configuring Identity and Access Management (IAM) permissions for read, write, or administrator access across different managed zones within a single project.\u003c/p\u003e\n"],["\u003cp\u003eSetting IAM policies for a managed zone can be achieved using the Google Cloud console, the \u003ccode\u003egcloud\u003c/code\u003e command-line tool, or the API, each with its specific steps and required parameters.\u003c/p\u003e\n"],["\u003cp\u003eRetrieving the current IAM policy for a managed zone is possible through the \u003ccode\u003egcloud\u003c/code\u003e command or the API, allowing users to view the existing permissions.\u003c/p\u003e\n"],["\u003cp\u003eTo check a managed zones IAM permissions you can use the API and by sending a \u003ccode\u003ePOST\u003c/code\u003e request.\u003c/p\u003e\n"],["\u003cp\u003eSpecific permissions, such as \u003ccode\u003edns.managedZones.setIamPolicy\u003c/code\u003e, \u003ccode\u003edns.managedZones.getIamPolicy\u003c/code\u003e, and \u003ccode\u003edns.managedZones.list\u003c/code\u003e, or roles like \u003ccode\u003eroles/iam.securityAdmin\u003c/code\u003e and \u003ccode\u003eroles/dns.admin\u003c/code\u003e, are necessary to perform IAM policy actions on managed zones.\u003c/p\u003e\n"]]],[],null,["# Set and manage IAM policies for managed zones\n\nThis page provides instructions about how to set up specific read, write, or\nadministrator Identity and Access Management (IAM) permissions for different managed\nzones under the same project.\n\nFor detailed information about IAM policies, see [Understanding\nallow policies](/iam/docs/policies). For information about the IAM\npolicy API, see [`Policy`](/iam/docs/reference/rest/v1/Policy). To learn how to\ncreate IAM custom roles that you can use on your managed zones,\nsee [Understanding IAM custom\nroles](/iam/docs/understanding-custom-roles).\n\n#### Permissions required for this task\n\nTo perform this task, you must have been granted the following permissions\n*or* the following IAM roles.\n\n**Permissions**\n\n- `dns.managedZones.setIamPolicy` for the `setIamPolicy` method\n- `dns.managedZones.getIamPolicy` for the `getIamPolicy` method\n- `dns.managedZones.list` for the `testIamPermission` method\n\n**Roles**\n\n- `roles/iam.securityAdmin`\n- `roles/dns.admin`\n\nThis procedure assumes that you have created a managed zone in a project. For\ninstructions about how to create a managed zone, see [Create, modify, and delete\nzones](/dns/docs/zones).\n\nSet IAM policy for a managed zone\n---------------------------------\n\nTo set the IAM policy on a specific managed zone,\nfollow these steps. \n\n### Console\n\n1. In the Google Cloud console, go to the **Cloud DNS zones** page.\n\n [Go to Cloud DNS zones](https://console.cloud.google.com/net-services/dns/zones)\n2. Select one or more zones for which you want to add access control\n permissions.\n\n3. On the **Permissions to resources** page, click **Add principal**.\n\n4. On the **Grant access to resource** page, under **New principals**, add\n the email address of the user, group, domain, or service account that you\n want to add as the new principal.\n\n5. From the **Assign roles** list, select the role that you want to\n assign to the principal.\n\n6. To assign additional roles, click **Add another role**.\n\n7. Click **Save**.\n\n### gcloud\n\nRun the\n[`gcloud dns managed-zones set-iam-policy`\ncommand](/sdk/gcloud/reference/dns/managed-zones/set-iam-policy): \n\n```\ngcloud dns managed-zones set-iam-policy NAME \\\n --policy-file=POLICY-FILE\n```\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003eNAME\u003c/var\u003e: the name of the managed zone for which you want to set the IAM permission\n- \u003cvar translate=\"no\"\u003ePOLICY-FILE\u003c/var\u003e: the file that contains the IAM policy that you want to specify for the managed zone. For an example policy file, see [Policy](/iam/docs/reference/rest/v1/Policy)\n\nIf this command runs successfully, it returns the IAM policy.\nOtherwise it returns an error message specifying the error.\n\n### API\n\nSend a `POST` request by using the\n[`managedZone.setIamPolicy`](/dns/docs/reference/v1/managedZones/setiampolicy)\nmethod: \n\n```\nPOST https://dns.googleapis.com/dns/v1/projects/PROJECT_ID/managedZones/MANAGED_ZONE:setIamPolicy\n```\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: the name or ID of the project\n- \u003cvar translate=\"no\"\u003eMANAGED_ZONE\u003c/var\u003e: the name of the managed zone for which you want to set the IAM permission\n\nFor detailed information on this API call, see\n[Binding](/iam/docs/reference/rest/v1/Policy#binding) on the\nIAM `Policy` API page.\n\nGet IAM policy for a managed zone\n---------------------------------\n\nTo get the IAM policy for a specific managed zone,\nfollow these steps. \n\n### gcloud\n\nRun the\n[`gcloud dns managed-zones get-iam-policy`\ncommand](/sdk/gcloud/reference/dns/managed-zones/get-iam-policy): \n\n```\ngcloud dns managed-zones get-iam-policy NAME\n```\n\nReplace \u003cvar translate=\"no\"\u003eNAME\u003c/var\u003e with the name of the managed zone for which\nyou want to get the IAM policy.\n\nIf this command runs successfully, it returns the IAM policy.\nOtherwise it returns an error message specifying the error.\n\n### API\n\nSend a `POST` request by using the\n[`managedZone.getIamPolicy`](/dns/docs/reference/v1/managedZones/getiampolicy)\nmethod: \n\n```\nPOST https://dns.googleapis.com/dns/v1/projects/PROJECT_ID/managedZones/ManagedZone:getIamPolicy\n```\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: the name or ID of the project\n- \u003cvar translate=\"no\"\u003eMANAGED_ZONE\u003c/var\u003e: the name of the managed zone for which you want to set the IAM permission\n\nCheck IAM permissions for a managed zone\n----------------------------------------\n\nSend a `POST` request by using the\n[`managedZone.testIamPermissions`](/dns/docs/reference/v1/managedZones/testiampermissions)\nmethod: \n\n```\nPOST https://dns.googleapis.com/dns/v1/projects/PROJECT_ID/managedZones/ManagedZone:testIamPermissions\n```\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: the name or ID of the project\n- \u003cvar translate=\"no\"\u003eMANAGED_ZONE\u003c/var\u003e: the name of the managed zone for which you want to check the IAM permission\n\nWhat's next\n-----------\n\n- To work with managed zones, see [Create, modify, and delete zones](/dns/docs/zones).\n- To find solutions for common issues that you might encounter when using Cloud DNS, see [Troubleshooting](/dns/docs/troubleshooting).\n- To get an overview of Cloud DNS, see [Cloud DNS overview](/dns/docs/overview)."]]
