Definir e gerenciar políticas de IAM para zonas gerenciadas
Mantenha tudo organizado com as coleções
Salve e categorize o conteúdo com base nas suas preferências.
Nesta página, você encontra instruções sobre como configurar permissões específicas de leitura, gravação ou gerenciamento de identidade e acesso (IAM, na sigla em inglês) para diferentes zonas gerenciadas no mesmo projeto.
Para executar esta tarefa, são necessárias as seguintes permissões
ou papéis do IAM.
Permissões
dns.managedZones.setIamPolicy para o método setIamPolicy
dns.managedZones.getIamPolicy para o método getIamPolicy
dns.managedZones.list para o método testIamPermission
Papéis
roles/iam.securityAdmin
roles/dns.admin
Para este procedimento, presumimos que você tenha criado uma zona gerenciada em um projeto. Para
instruções sobre como criar uma zona gerenciada, consulte Criar, modificar e excluir
zonas.
Definir a política do IAM para uma zona gerenciada
Para definir a política do IAM em uma zona gerenciada específica,
siga estas etapas.
Console
No Google Cloud console, acesse a página Zonas do Cloud DNS.
Selecione uma ou mais zonas para as quais você quer adicionar permissões de controle de
acesso.
Na página Permissões para recursos, clique em Adicionar principal.
Na página Conceder acesso ao recurso, em Novos principais, adicione
o endereço de e-mail do usuário, grupo, domínio ou conta de serviço que você
quer adicionar como o novo principal.
Na lista Atribuir papéis, selecione o papel que você quer
atribuir ao principal.
Para atribuir mais papéis, clique em Adicionar outro papel.
gcloud dns managed-zones set-iam-policy NAME \
--policy-file=POLICY-FILE
Substitua:
NAME: o nome da zona gerenciada em que
você quer definir a permissão do IAM.
POLICY-FILE: o arquivo que contém a política
do IAM que você quer especificar para a zona gerenciada. Para ver um exemplo de arquivo de política, consulte Política.
Se esse comando for executado corretamente, ele retorna a política IAM.
Caso contrário, uma mensagem de erro retorna especificando o erro.
[[["Fácil de entender","easyToUnderstand","thumb-up"],["Meu problema foi resolvido","solvedMyProblem","thumb-up"],["Outro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Informações incorretas ou exemplo de código","incorrectInformationOrSampleCode","thumb-down"],["Não contém as informações/amostras de que eu preciso","missingTheInformationSamplesINeed","thumb-down"],["Problema na tradução","translationIssue","thumb-down"],["Outro","otherDown","thumb-down"]],["Última atualização 2025-08-11 UTC."],[[["\u003cp\u003eThis guide outlines the process for configuring Identity and Access Management (IAM) permissions for read, write, or administrator access across different managed zones within a single project.\u003c/p\u003e\n"],["\u003cp\u003eSetting IAM policies for a managed zone can be achieved using the Google Cloud console, the \u003ccode\u003egcloud\u003c/code\u003e command-line tool, or the API, each with its specific steps and required parameters.\u003c/p\u003e\n"],["\u003cp\u003eRetrieving the current IAM policy for a managed zone is possible through the \u003ccode\u003egcloud\u003c/code\u003e command or the API, allowing users to view the existing permissions.\u003c/p\u003e\n"],["\u003cp\u003eTo check a managed zones IAM permissions you can use the API and by sending a \u003ccode\u003ePOST\u003c/code\u003e request.\u003c/p\u003e\n"],["\u003cp\u003eSpecific permissions, such as \u003ccode\u003edns.managedZones.setIamPolicy\u003c/code\u003e, \u003ccode\u003edns.managedZones.getIamPolicy\u003c/code\u003e, and \u003ccode\u003edns.managedZones.list\u003c/code\u003e, or roles like \u003ccode\u003eroles/iam.securityAdmin\u003c/code\u003e and \u003ccode\u003eroles/dns.admin\u003c/code\u003e, are necessary to perform IAM policy actions on managed zones.\u003c/p\u003e\n"]]],[],null,["# Set and manage IAM policies for managed zones\n\nThis page provides instructions about how to set up specific read, write, or\nadministrator Identity and Access Management (IAM) permissions for different managed\nzones under the same project.\n\nFor detailed information about IAM policies, see [Understanding\nallow policies](/iam/docs/policies). For information about the IAM\npolicy API, see [`Policy`](/iam/docs/reference/rest/v1/Policy). To learn how to\ncreate IAM custom roles that you can use on your managed zones,\nsee [Understanding IAM custom\nroles](/iam/docs/understanding-custom-roles).\n\n#### Permissions required for this task\n\nTo perform this task, you must have been granted the following permissions\n*or* the following IAM roles.\n\n**Permissions**\n\n- `dns.managedZones.setIamPolicy` for the `setIamPolicy` method\n- `dns.managedZones.getIamPolicy` for the `getIamPolicy` method\n- `dns.managedZones.list` for the `testIamPermission` method\n\n**Roles**\n\n- `roles/iam.securityAdmin`\n- `roles/dns.admin`\n\nThis procedure assumes that you have created a managed zone in a project. For\ninstructions about how to create a managed zone, see [Create, modify, and delete\nzones](/dns/docs/zones).\n\nSet IAM policy for a managed zone\n---------------------------------\n\nTo set the IAM policy on a specific managed zone,\nfollow these steps. \n\n### Console\n\n1. In the Google Cloud console, go to the **Cloud DNS zones** page.\n\n [Go to Cloud DNS zones](https://console.cloud.google.com/net-services/dns/zones)\n2. Select one or more zones for which you want to add access control\n permissions.\n\n3. On the **Permissions to resources** page, click **Add principal**.\n\n4. On the **Grant access to resource** page, under **New principals**, add\n the email address of the user, group, domain, or service account that you\n want to add as the new principal.\n\n5. From the **Assign roles** list, select the role that you want to\n assign to the principal.\n\n6. To assign additional roles, click **Add another role**.\n\n7. Click **Save**.\n\n### gcloud\n\nRun the\n[`gcloud dns managed-zones set-iam-policy`\ncommand](/sdk/gcloud/reference/dns/managed-zones/set-iam-policy): \n\n```\ngcloud dns managed-zones set-iam-policy NAME \\\n --policy-file=POLICY-FILE\n```\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003eNAME\u003c/var\u003e: the name of the managed zone for which you want to set the IAM permission\n- \u003cvar translate=\"no\"\u003ePOLICY-FILE\u003c/var\u003e: the file that contains the IAM policy that you want to specify for the managed zone. For an example policy file, see [Policy](/iam/docs/reference/rest/v1/Policy)\n\nIf this command runs successfully, it returns the IAM policy.\nOtherwise it returns an error message specifying the error.\n\n### API\n\nSend a `POST` request by using the\n[`managedZone.setIamPolicy`](/dns/docs/reference/v1/managedZones/setiampolicy)\nmethod: \n\n```\nPOST https://dns.googleapis.com/dns/v1/projects/PROJECT_ID/managedZones/MANAGED_ZONE:setIamPolicy\n```\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: the name or ID of the project\n- \u003cvar translate=\"no\"\u003eMANAGED_ZONE\u003c/var\u003e: the name of the managed zone for which you want to set the IAM permission\n\nFor detailed information on this API call, see\n[Binding](/iam/docs/reference/rest/v1/Policy#binding) on the\nIAM `Policy` API page.\n\nGet IAM policy for a managed zone\n---------------------------------\n\nTo get the IAM policy for a specific managed zone,\nfollow these steps. \n\n### gcloud\n\nRun the\n[`gcloud dns managed-zones get-iam-policy`\ncommand](/sdk/gcloud/reference/dns/managed-zones/get-iam-policy): \n\n```\ngcloud dns managed-zones get-iam-policy NAME\n```\n\nReplace \u003cvar translate=\"no\"\u003eNAME\u003c/var\u003e with the name of the managed zone for which\nyou want to get the IAM policy.\n\nIf this command runs successfully, it returns the IAM policy.\nOtherwise it returns an error message specifying the error.\n\n### API\n\nSend a `POST` request by using the\n[`managedZone.getIamPolicy`](/dns/docs/reference/v1/managedZones/getiampolicy)\nmethod: \n\n```\nPOST https://dns.googleapis.com/dns/v1/projects/PROJECT_ID/managedZones/ManagedZone:getIamPolicy\n```\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: the name or ID of the project\n- \u003cvar translate=\"no\"\u003eMANAGED_ZONE\u003c/var\u003e: the name of the managed zone for which you want to set the IAM permission\n\nCheck IAM permissions for a managed zone\n----------------------------------------\n\nSend a `POST` request by using the\n[`managedZone.testIamPermissions`](/dns/docs/reference/v1/managedZones/testiampermissions)\nmethod: \n\n```\nPOST https://dns.googleapis.com/dns/v1/projects/PROJECT_ID/managedZones/ManagedZone:testIamPermissions\n```\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: the name or ID of the project\n- \u003cvar translate=\"no\"\u003eMANAGED_ZONE\u003c/var\u003e: the name of the managed zone for which you want to check the IAM permission\n\nWhat's next\n-----------\n\n- To work with managed zones, see [Create, modify, and delete zones](/dns/docs/zones).\n- To find solutions for common issues that you might encounter when using Cloud DNS, see [Troubleshooting](/dns/docs/troubleshooting).\n- To get an overview of Cloud DNS, see [Cloud DNS overview](/dns/docs/overview)."]]