本页介绍了 Cloud Domains API 角色以及 Cloud Domains 中提供的访问权限控制选项。
Google Cloud 提供 Identity and Access Management (IAM)，可让您授予对特定 Google Cloud 资源的更细化访问权限，并防止对其他资源进行不必要的访问。IAM 允许您采用最低权限安全原则，您只需授予对您资源的必要访问权限。IAM 允许您通过设置 IAM 政策来控制谁对哪些资源具有什么访问权限。您可以使用 IAM 政策向用户授予特定角色，从而给予用户特定权限。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-25。"],[[["\u003cp\u003eCloud Domains uses Identity and Access Management (IAM) to control who has what permissions to which resources, ensuring the security principle of least privilege is enforced.\u003c/p\u003e\n"],["\u003cp\u003eThere are two primary roles within Cloud Domains: Admin, which provides full access to domain registrations and related resources, and Viewer, which allows read-only access.\u003c/p\u003e\n"],["\u003cp\u003eTo manage Cloud Domains IAM roles, you must enable the Cloud Domains API for your project, after which you will be able to see these roles within the Google Cloud console.\u003c/p\u003e\n"],["\u003cp\u003eThe Admin role can register new domains, update domain registration settings, while the Viewer role can view existing domains and their registration details, including DNS and expiry information.\u003c/p\u003e\n"],["\u003cp\u003eThe page provides detailed tables listing the permissions included with each role and the specific permissions required to perform different methods related to domain registrations.\u003c/p\u003e\n"]]],[],null,["# Roles and permissions\n\n| **Note:** On September 7, 2023 Squarespace acquired all domain registrations and related customer accounts from Google Domains. For more information about how this change affects Cloud Domains, see [Cloud Domains feature deprecations](/domains/docs/deprecations/feature-deprecations), [Renew an expired domain registration](https://support.google.com/a/answer/6152355), and [Squarespace purchase of Google Domains FAQ](/domains/docs/faq).\n\n\u003cbr /\u003e\n\nThis page describes the Cloud Domains API roles and the access control options that\nare available to you in Cloud Domains.\n\nGoogle Cloud offers Identity and Access Management (IAM), which lets you give\nmore granular access to specific Google Cloud resources and prevents\nunwanted access to other resources. IAM lets you adopt the\n[security principle of least privilege](https://wikipedia.org/wiki/Principle_of_least_privilege)\nso that you grant only the necessary access to your resources.\nIAM lets you control *who* has *what* permissions to\n*which* resources by setting IAM policies.\nIAM policies grant specific roles to a user, which gives the user\ncertain permissions.\n\nFor example, a particular user might need to create and modify the contact\nsettings for a domain, so you would give that user the\nCloud Domains Admin role (`roles/domains.admin`). On the other hand,\na user might need to only view existing resource domains, so they would get a\nCloud Domains Viewer role (`roles/domains.viewer`). For\nCloud Domains, you can configure both project-level and\nresource-level access.\n\nFollowing are some examples of permissions for the Viewer role:\n\n- View all domains registered in a project.\n- View registration details such as DNS or expiry time.\n- Search domain availability and get registration parameters.\n\nFollowing are some examples of permissions for the Admin role:\n\n- Register a new domain.\n- Update registration settings, including DNS settings and contact settings.\n\nTo understand role types, see the\n[IAM basic and predefined roles reference](/iam/docs/understanding-roles).\n\nEnable the Cloud Domains API\n----------------------------\n\nTo view and assign Cloud Domains IAM roles,\nyou must enable the Cloud Domains API for your project. You cannot see the\nCloud Domains roles in the Google Cloud console until you\nenable the API.\n\n[Enable the API](https://console.cloud.google.com/apis/library/domains.googleapis.com)\n\nFor lists of the roles and permissions that Cloud Domains\nsupports, see the following sections.\n\nRoles\n-----\n\nThe following table lists the Cloud Domains API\nIAM roles with a corresponding list of all the permissions that\neach role includes. Each permission is applicable to a particular resource\ntype. For more details about each permission, see the\n[Permissions](#permissions) section.\n\nPermissions\n-----------\n\nThe following table lists the permissions that the caller must have to call\neach method.\n\nAccess control using the Google Cloud console\n---------------------------------------------\n\nYou can use the Google Cloud console to manage access control for your\nprojects.\n\nFor detailed instructions, see\n[Manage access to projects, folders, and organizations](/iam/docs/granting-changing-revoking-access).\n\nWhat's next\n-----------\n\n- To get started using Cloud Domains, see the [Quickstart](/domains/docs/buy-register-domain).\n- To improve the security of your Cloud Domains configuration, see [VPC Service Controls support](/domains/docs/vpc-sc-support).\n- To find solutions for common issues that you might encounter when using Cloud Domains, see [Troubleshooting](/domains/docs/troubleshooting)."]]
