Cloud Workstations 角色和权限

本页面列出了 Cloud Workstations 的 IAM 角色和权限。如需搜索所有角色和权限，请参阅角色和权限索引。

Cloud Workstations 角色

Role Permissions

Role	Permissions
Cloud Workstations Admin (`roles/workstations.admin`) Grants CRUD access to all Workstation resources.	`compute.acceleratorTypes.` `compute.acceleratorTypes.get` `compute.acceleratorTypes.list` `compute.machineTypes.` `compute.machineTypes.get` `compute.machineTypes.list` `compute.networks.get` `compute.networks.list` `compute.subnetworks.get` `compute.subnetworks.list` `compute.zones.` `compute.zones.get` `compute.zones.list` `iam.serviceAccounts.get` `iam.serviceAccounts.list` `resourcemanager.projects.get` `resourcemanager.projects.list` `workstations.operations.get` `workstations.workstationClusters.` `workstations.workstationClusters.create` `workstations.workstationClusters.createTagBinding` `workstations.workstationClusters.delete` `workstations.workstationClusters.deleteTagBinding` `workstations.workstationClusters.get` `workstations.workstationClusters.list` `workstations.workstationClusters.listEffectiveTags` `workstations.workstationClusters.listTagBindings` `workstations.workstationClusters.update` `workstations.workstationConfigs.*` `workstations.workstationConfigs.create` `workstations.workstationConfigs.delete` `workstations.workstationConfigs.get` `workstations.workstationConfigs.getIamPolicy` `workstations.workstationConfigs.list` `workstations.workstationConfigs.setIamPolicy` `workstations.workstationConfigs.update` `workstations.workstations.create` `workstations.workstations.delete` `workstations.workstations.get` `workstations.workstations.getIamPolicy` `workstations.workstations.list` `workstations.workstations.setIamPolicy` `workstations.workstations.start` `workstations.workstations.stop` `workstations.workstations.update`
Cloud Workstations Network Admin (`roles/workstations.networkAdmin`) Grants ability to connect a Workstation Cluster to a shared VPC network.	`compute.addresses.create` `compute.addresses.createInternal` `compute.addresses.delete` `compute.addresses.deleteInternal` `compute.addresses.get` `compute.addresses.use` `compute.forwardingRules.create` `compute.forwardingRules.delete` `compute.forwardingRules.get` `compute.forwardingRules.pscCreate` `compute.forwardingRules.pscDelete` `compute.globalOperations.get` `compute.networks.get` `compute.networks.updatePolicy` `compute.networks.use` `compute.networks.useExternalIp` `compute.regionOperations.get` `compute.subnetworks.get` `compute.subnetworks.use` `compute.subnetworks.useExternalIp` `compute.zoneOperations.get` `servicedirectory.namespaces.create` `servicedirectory.namespaces.delete` `servicedirectory.services.create` `servicedirectory.services.delete`
Cloud Workstations Operation Viewer (`roles/workstations.operationViewer`) Grants ability to view Cloud Workstations API operations.	`workstations.operations.get`
Cloud Workstations Policy Admin (`roles/workstations.policyAdmin`) Grants permission to set IAM policy on workstation.	`workstations.workstations.getIamPolicy` `workstations.workstations.setIamPolicy`
Workstations Service Agent (`roles/workstations.serviceAgent`) Grants the Workstations Service Account access to manage resources in consumer project. Warning: Do not grant service agent roles to any principals except service agents.	`compute.addresses.create` `compute.addresses.createInternal` `compute.addresses.delete` `compute.addresses.deleteInternal` `compute.addresses.get` `compute.addresses.use` `compute.disks.create` `compute.disks.createSnapshot` `compute.disks.createTagBinding` `compute.disks.delete` `compute.disks.deleteTagBinding` `compute.disks.get` `compute.disks.list` `compute.disks.setLabels` `compute.disks.use` `compute.disks.useReadOnly` `compute.firewalls.create` `compute.firewalls.delete` `compute.firewalls.get` `compute.firewalls.update` `compute.forwardingRules.create` `compute.forwardingRules.delete` `compute.forwardingRules.get` `compute.forwardingRules.pscCreate` `compute.forwardingRules.pscDelete` `compute.globalOperations.get` `compute.instances.attachDisk` `compute.instances.create` `compute.instances.createTagBinding` `compute.instances.delete` `compute.instances.deleteTagBinding` `compute.instances.detachDisk` `compute.instances.get` `compute.instances.getGuestAttributes` `compute.instances.getSerialPortOutput` `compute.instances.setLabels` `compute.instances.setMetadata` `compute.instances.setServiceAccount` `compute.instances.setTags` `compute.networks.addPeering` `compute.networks.get` `compute.networks.removePeering` `compute.networks.updatePolicy` `compute.networks.use` `compute.networks.useExternalIp` `compute.regionOperations.get` `compute.regions.get` `compute.snapshots.create` `compute.snapshots.createTagBinding` `compute.snapshots.delete` `compute.snapshots.deleteTagBinding` `compute.snapshots.get` `compute.snapshots.listTagBindings` `compute.snapshots.setLabels` `compute.snapshots.useReadOnly` `compute.subnetworks.get` `compute.subnetworks.use` `compute.subnetworks.useExternalIp` `compute.zoneOperations.get` `dns.networks.bindPrivateDNSZone` `dns.networks.targetWithPeeringZone` `iam.serviceAccounts.actAs` `iam.serviceAccounts.get` `iam.serviceAccounts.list` `resourcemanager.tagValueBindings.*` `resourcemanager.tagValueBindings.create` `resourcemanager.tagValueBindings.delete` `servicedirectory.namespaces.create` `servicedirectory.namespaces.delete` `servicedirectory.services.create` `servicedirectory.services.delete` `serviceusage.services.get`
Cloud Workstations User (`roles/workstations.user`) Grants runtime access to Workstation resources.	`workstations.operations.get` `workstations.workstations.delete` `workstations.workstations.get` `workstations.workstations.start` `workstations.workstations.stop` `workstations.workstations.update` `workstations.workstations.use`
Cloud Workstations Creator (`roles/workstations.workstationCreator`) Grants ability to create Workstation resources.	`resourcemanager.projects.get` `resourcemanager.projects.list` `workstations.operations.get` `workstations.workstationClusters.get` `workstations.workstationClusters.list` `workstations.workstationConfigs.get` `workstations.workstations.create`
Cloud Workstations Limit Exempted Creator (`roles/workstations.workstationLimitExemptedCreator`) Grants ability to create workstations with exemption from max_usable_workstations Limit.	`resourcemanager.projects.get` `resourcemanager.projects.list` `workstations.operations.get` `workstations.workstationConfigs.get` `workstations.workstations.create`

Cloud Workstations Admin

(roles/workstations.admin)

Grants CRUD access to all Workstation resources.

compute.acceleratorTypes.*

compute.acceleratorTypes.get
compute.acceleratorTypes.list

compute.machineTypes.*

compute.machineTypes.get
compute.machineTypes.list

compute.networks.get

compute.networks.list

compute.subnetworks.get

compute.subnetworks.list

compute.zones.*

compute.zones.get
compute.zones.list

iam.serviceAccounts.get

iam.serviceAccounts.list

resourcemanager.projects.get

resourcemanager.projects.list

workstations.operations.get

workstations.workstationClusters.*

workstations.workstationClusters.create
workstations.workstationClusters.createTagBinding
workstations.workstationClusters.delete
workstations.workstationClusters.deleteTagBinding
workstations.workstationClusters.get
workstations.workstationClusters.list
workstations.workstationClusters.listEffectiveTags
workstations.workstationClusters.listTagBindings
workstations.workstationClusters.update

workstations.workstationConfigs.*

workstations.workstationConfigs.create
workstations.workstationConfigs.delete
workstations.workstationConfigs.get
workstations.workstationConfigs.getIamPolicy
workstations.workstationConfigs.list
workstations.workstationConfigs.setIamPolicy
workstations.workstationConfigs.update

workstations.workstations.create

workstations.workstations.delete

workstations.workstations.get

workstations.workstations.getIamPolicy

workstations.workstations.list

workstations.workstations.setIamPolicy

workstations.workstations.start

workstations.workstations.stop

workstations.workstations.update

Cloud Workstations Network Admin

(roles/workstations.networkAdmin)

Grants ability to connect a Workstation Cluster to a shared VPC network.

compute.addresses.create

compute.addresses.createInternal

compute.addresses.delete

compute.addresses.deleteInternal

compute.addresses.get

compute.addresses.use

compute.forwardingRules.create

compute.forwardingRules.delete

compute.forwardingRules.get

compute.forwardingRules.pscCreate

compute.forwardingRules.pscDelete

compute.globalOperations.get

compute.networks.get

compute.networks.updatePolicy

compute.networks.use

compute.networks.useExternalIp

compute.regionOperations.get

compute.subnetworks.get

compute.subnetworks.use

compute.subnetworks.useExternalIp

compute.zoneOperations.get

servicedirectory.namespaces.create

servicedirectory.namespaces.delete

servicedirectory.services.create

servicedirectory.services.delete

Cloud Workstations Operation Viewer

(roles/workstations.operationViewer)

Grants ability to view Cloud Workstations API operations.

workstations.operations.get

Cloud Workstations Policy Admin

(roles/workstations.policyAdmin)

Grants permission to set IAM policy on workstation.

workstations.workstations.getIamPolicy

workstations.workstations.setIamPolicy

Workstations Service Agent

(roles/workstations.serviceAgent)

Grants the Workstations Service Account access to manage resources in consumer project.

compute.addresses.create

compute.addresses.createInternal

compute.addresses.delete

compute.addresses.deleteInternal

compute.addresses.get

compute.addresses.use

compute.disks.create

compute.disks.createSnapshot

compute.disks.createTagBinding

compute.disks.delete

compute.disks.deleteTagBinding

compute.disks.get

compute.disks.list

compute.disks.setLabels

compute.disks.use

compute.disks.useReadOnly

compute.firewalls.create

compute.firewalls.delete

compute.firewalls.get

compute.firewalls.update

compute.forwardingRules.create

compute.forwardingRules.delete

compute.forwardingRules.get

compute.forwardingRules.pscCreate

compute.forwardingRules.pscDelete

compute.globalOperations.get

compute.instances.attachDisk

compute.instances.create

compute.instances.createTagBinding

compute.instances.delete

compute.instances.deleteTagBinding

compute.instances.detachDisk

compute.instances.get

compute.instances.getGuestAttributes

compute.instances.getSerialPortOutput

compute.instances.setLabels

compute.instances.setMetadata

compute.instances.setServiceAccount

compute.instances.setTags

compute.networks.addPeering

compute.networks.get

compute.networks.removePeering

compute.networks.updatePolicy

compute.networks.use

compute.networks.useExternalIp

compute.regionOperations.get

compute.regions.get

compute.snapshots.create

compute.snapshots.createTagBinding

compute.snapshots.delete

compute.snapshots.deleteTagBinding

compute.snapshots.get

compute.snapshots.listTagBindings

compute.snapshots.setLabels

compute.snapshots.useReadOnly

compute.subnetworks.get

compute.subnetworks.use

compute.subnetworks.useExternalIp

compute.zoneOperations.get

dns.networks.bindPrivateDNSZone

dns.networks.targetWithPeeringZone

iam.serviceAccounts.actAs

iam.serviceAccounts.get

iam.serviceAccounts.list

resourcemanager.tagValueBindings.*

resourcemanager.tagValueBindings.create
resourcemanager.tagValueBindings.delete

servicedirectory.namespaces.create

servicedirectory.namespaces.delete

servicedirectory.services.create

servicedirectory.services.delete

serviceusage.services.get

Cloud Workstations User

(roles/workstations.user)

Grants runtime access to Workstation resources.

workstations.operations.get

workstations.workstations.delete

workstations.workstations.get

workstations.workstations.start

workstations.workstations.stop

workstations.workstations.update

workstations.workstations.use

Cloud Workstations Creator

(roles/workstations.workstationCreator)

Grants ability to create Workstation resources.

resourcemanager.projects.get

resourcemanager.projects.list

workstations.operations.get

workstations.workstationClusters.get

workstations.workstationClusters.list

workstations.workstationConfigs.get

workstations.workstations.create

Cloud Workstations Limit Exempted Creator

(roles/workstations.workstationLimitExemptedCreator)

Grants ability to create workstations with exemption from max_usable_workstations Limit.

resourcemanager.projects.get

resourcemanager.projects.list

workstations.operations.get

workstations.workstationConfigs.get

workstations.workstations.create

Cloud Workstations 权限

权限	以下角色拥有此权限
`workstations.operations.get`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Cloud Workstations Admin (`roles/workstations.admin`) Cloud Workstations Operation Viewer (`roles/workstations.operationViewer`) Cloud Workstations User (`roles/workstations.user`) Cloud Workstations Creator (`roles/workstations.workstationCreator`) Cloud Workstations Limit Exempted Creator (`roles/workstations.workstationLimitExemptedCreator`)
`workstations.workstationClusters.create`	Owner (`roles/owner`) Editor (`roles/editor`) Cloud Workstations Admin (`roles/workstations.admin`)
`workstations.workstationClusters.createTagBinding`	Owner (`roles/owner`) DLP Organization Data Profiles Driver (`roles/dlp.orgdriver`) DLP Project Data Profiles Driver (`roles/dlp.projectdriver`) Tag User (`roles/resourcemanager.tagUser`) Cloud Workstations Admin (`roles/workstations.admin`)
`workstations.workstationClusters.delete`	Owner (`roles/owner`) Editor (`roles/editor`) Cloud Workstations Admin (`roles/workstations.admin`)
`workstations.workstationClusters.deleteTagBinding`	Owner (`roles/owner`) DLP Organization Data Profiles Driver (`roles/dlp.orgdriver`) DLP Project Data Profiles Driver (`roles/dlp.projectdriver`) Tag User (`roles/resourcemanager.tagUser`) Cloud Workstations Admin (`roles/workstations.admin`)
`workstations.workstationClusters.get`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Cloud Workstations Admin (`roles/workstations.admin`) Cloud Workstations Creator (`roles/workstations.workstationCreator`)
`workstations.workstationClusters.list`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Security Admin (`roles/iam.securityAdmin`) Security Reviewer (`roles/iam.securityReviewer`) Cloud Workstations Admin (`roles/workstations.admin`) Cloud Workstations Creator (`roles/workstations.workstationCreator`)
`workstations.workstationClusters.listEffectiveTags`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) DLP Organization Data Profiles Driver (`roles/dlp.orgdriver`) DLP Project Data Profiles Driver (`roles/dlp.projectdriver`) Tag User (`roles/resourcemanager.tagUser`) Tag Viewer (`roles/resourcemanager.tagViewer`) Cloud Workstations Admin (`roles/workstations.admin`)
`workstations.workstationClusters.listTagBindings`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) DLP Organization Data Profiles Driver (`roles/dlp.orgdriver`) DLP Project Data Profiles Driver (`roles/dlp.projectdriver`) Tag User (`roles/resourcemanager.tagUser`) Tag Viewer (`roles/resourcemanager.tagViewer`) Cloud Workstations Admin (`roles/workstations.admin`)
`workstations.workstationClusters.update`	Owner (`roles/owner`) Editor (`roles/editor`) Cloud Workstations Admin (`roles/workstations.admin`)
`workstations.workstationConfigs.create`	Owner (`roles/owner`) Editor (`roles/editor`) Cloud Workstations Admin (`roles/workstations.admin`)
`workstations.workstationConfigs.delete`	Owner (`roles/owner`) Editor (`roles/editor`) Cloud Workstations Admin (`roles/workstations.admin`)
`workstations.workstationConfigs.get`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Cloud Workstations Admin (`roles/workstations.admin`) Cloud Workstations Creator (`roles/workstations.workstationCreator`) Cloud Workstations Limit Exempted Creator (`roles/workstations.workstationLimitExemptedCreator`)
`workstations.workstationConfigs.getIamPolicy`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Security Admin (`roles/iam.securityAdmin`) Security Reviewer (`roles/iam.securityReviewer`) Cloud Workstations Admin (`roles/workstations.admin`)
`workstations.workstationConfigs.list`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Security Admin (`roles/iam.securityAdmin`) Security Reviewer (`roles/iam.securityReviewer`) Cloud Workstations Admin (`roles/workstations.admin`)
`workstations.workstationConfigs.setIamPolicy`	Owner (`roles/owner`) Security Admin (`roles/iam.securityAdmin`) Cloud Workstations Admin (`roles/workstations.admin`)
`workstations.workstationConfigs.update`	Owner (`roles/owner`) Editor (`roles/editor`) Cloud Workstations Admin (`roles/workstations.admin`)
`workstations.workstations.create`	Owner (`roles/owner`) Editor (`roles/editor`) Cloud Workstations Admin (`roles/workstations.admin`) Cloud Workstations Creator (`roles/workstations.workstationCreator`) Cloud Workstations Limit Exempted Creator (`roles/workstations.workstationLimitExemptedCreator`)
`workstations.workstations.delete`	Owner (`roles/owner`) Editor (`roles/editor`) Cloud Workstations Admin (`roles/workstations.admin`) Cloud Workstations User (`roles/workstations.user`)
`workstations.workstations.get`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Cloud Workstations Admin (`roles/workstations.admin`) Cloud Workstations User (`roles/workstations.user`)
`workstations.workstations.getIamPolicy`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Security Admin (`roles/iam.securityAdmin`) Security Reviewer (`roles/iam.securityReviewer`) Cloud Workstations Admin (`roles/workstations.admin`) Cloud Workstations Policy Admin (`roles/workstations.policyAdmin`)
`workstations.workstations.list`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Security Admin (`roles/iam.securityAdmin`) Security Reviewer (`roles/iam.securityReviewer`) Cloud Workstations Admin (`roles/workstations.admin`)
`workstations.workstations.setIamPolicy`	Owner (`roles/owner`) Security Admin (`roles/iam.securityAdmin`) Cloud Workstations Admin (`roles/workstations.admin`) Cloud Workstations Policy Admin (`roles/workstations.policyAdmin`)
`workstations.workstations.start`	Owner (`roles/owner`) Editor (`roles/editor`) Cloud Workstations Admin (`roles/workstations.admin`) Cloud Workstations User (`roles/workstations.user`)
`workstations.workstations.stop`	Owner (`roles/owner`) Editor (`roles/editor`) Cloud Workstations Admin (`roles/workstations.admin`) Cloud Workstations User (`roles/workstations.user`)
`workstations.workstations.update`	Owner (`roles/owner`) Editor (`roles/editor`) Cloud Workstations Admin (`roles/workstations.admin`) Cloud Workstations User (`roles/workstations.user`)
`workstations.workstations.use`	Cloud Workstations User (`roles/workstations.user`)

Cloud Workstations 角色和权限