Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Halaman ini menjelaskan cara memecahkan masalah
kebijakan izin, penolakan, dan batas akses akun utama Identity and Access Management (IAM).
Menggunakan Pemecah Masalah Kebijakan
Jika Anda perlu memecahkan masalah akses untuk akun utama tertentu, gunakan
Pemecah Masalah Kebijakan untuk IAM.
Pemecah Masalah Kebijakan membantu Anda memahami apakah akun utama
dapat mengakses resource. Dengan mempertimbangkan akun utama, resource, dan izin,
Pemecah Masalah Kebijakan memeriksa kebijakan izinkan, kebijakan tolak,
dan kebijakan batas akses akun utama (PAB) yang memengaruhi akses akun utama.
Kemudian, class memberi tahu Anda apakah, berdasarkan kebijakan tersebut, akun utama dapat menggunakan izin yang ditentukan untuk mengakses resource. Bagian ini juga mencantumkan kebijakan
yang relevan dan menjelaskan pengaruhnya terhadap akses akun utama.
Untuk mempelajari cara menggunakan Pemecah Masalah Kebijakan guna memecahkan masalah kebijakan izin, kebijakan penolakan, dan kebijakan batas akses akun utama, lihat Memecahkan masalah izin IAM.
Melihat semua kebijakan izin dan tolak yang berlaku untuk resource
Di Google Cloud, kebijakan izin dan penolakan berikut memengaruhi akses
ke resource:
Kebijakan izinkan resource
Kebijakan penolakan resource, jika ada
Kebijakan izinkan project induk, folder, dan
organisasi resource, jika ada
Kebijakan penolakan project, folder, dan organisasi induk resource,
jika ada
Kebijakan izinkan dan tolak project induk, folder, dan organisasi
memengaruhi akses ke resource
karena adanya pewarisan kebijakan.
Jika Anda melampirkan kebijakan izinkan atau tolak ke project, folder, atau organisasi,
kebijakan tersebut juga berlaku untuk semua resource di dalam project, folder, atau
organisasi tersebut.
Misalnya, jika kebijakan penolakan untuk organisasi mengatakan bahwa akun utama tidak dapat
menggunakan izin tertentu, akun utama tidak dapat menggunakan izin tersebut untuk resource
apa pun dalam organisasi. Aturan ini berlaku meskipun folder dan
project di dalam organisasi tersebut memiliki kebijakan penolakan yang lebih permisif, atau mengizinkan
kebijakan yang memberikan izin kepada entity utama.
Demikian pula, jika kebijakan izinkan untuk suatu project memberikan izin
khusus kepada akun utama, maka akun utama memiliki izin tersebut untuk setiap resource dalam
project, asalkan tidak ditolak.
Gabungan dari semua kebijakan ini disebut kebijakan yang berlaku atau
kebijakan efektif untuk resource.
Di Google Cloud, Anda bisa mendapatkan daftar semua kebijakan izinkan dan tolak
yang memengaruhi akses ke project menggunakan perintah gcloud beta projects
get-ancestors-iam-policy dengan flag --include-deny. Bersama-sama,
kebijakan ini membentuk kebijakan yang berlaku untuk project. Anda dapat
menyelidiki setiap kebijakan untuk melihat pengaruhnya terhadap akses akun utama.
gcloud
Sebelum menggunakan salah satu data perintah di bawah, lakukan penggantian berikut:
PROJECT_ID: ID project Google Cloud Anda. Project ID adalah string alfanumerik, seperti my-project.
Respons berisi kebijakan izinkan dan tolak untuk proyek; folder apa pun yang merupakan ancestor
project; dan organisasi. Contoh berikut menunjukkan kebijakan izinkan untuk
organisasi 1234567890123 dan project my-project, serta kebijakan penolakan
project my-project:
Dalam contoh ini, Raha diberi peran Service Account
Admin (roles/iam.serviceAccountAdmin) di organisasi, tetapi
project memiliki kebijakan penolakan yang mencegah Raha menggunakan
izin iam.googleapis.com/serviceAccounts.create. Akibatnya, jika
Raha mencoba membuat akun layanan di project
my-project, permintaan akan ditolak.
Dalam beberapa kasus, Anda mungkin hanya perlu melihat kebijakan izinkan yang efektif untuk
resource—misalnya, jika organisasi Anda tidak menggunakan kebijakan tolak. Dalam
kasus ini, Anda dapat menggunakan metode berikut untuk melihat kebijakan
izin yang efektif:
Lihat kebijakan izin IAM resource di konsol
Google Cloud . Konsol Google Cloud otomatis menampilkan kebijakan efektif setiap resource.
Untuk mempelajari cara melihat kebijakan izin IAM resource di
konsolGoogle Cloud , lihat Melihat akses saat ini.
Gunakan Cloud Asset API untuk mendapatkan kebijakan izinkan resource yang efektif. Untuk mempelajari
lebih lanjut, baca Melihat kebijakan IAM yang efektif.
Telusuri kebijakan yang diizinkan
Jika perlu menemukan binding peran tertentu dalam kebijakan izinkan, Anda dapat
menelusuri kebijakan izinkan.
Inventaris Aset Cloud memungkinkan Anda menelusuri kebijakan izinkan untuk binding peran
yang cocok dengan parameter yang ditentukan. Anda dapat menggunakan berbagai parameter penelusuran,
termasuk parameter berikut:
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-08-21 UTC."],[[["\u003cp\u003ePolicy Troubleshooter for IAM helps determine if a principal can access a resource by examining allow policies, deny policies, and principal access boundary (PAB) policies, and it provides details on the relevant policies.\u003c/p\u003e\n"],["\u003cp\u003eAllow and deny policies at the resource, project, folder, and organization levels can affect access to a resource due to policy inheritance, where policies applied to parent entities are inherited by resources within them.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003egcloud beta projects get-ancestors-iam-policy\u003c/code\u003e command with the \u003ccode\u003e--include-deny\u003c/code\u003e flag can be used to list all allow and deny policies that affect access to a project, collectively forming the effective policy.\u003c/p\u003e\n"],["\u003cp\u003eEven if a principal is granted a permission via an allow policy, a deny policy can override it, preventing the principal from using that permission on specific resources, as illustrated with the example of Raha and service account creation.\u003c/p\u003e\n"],["\u003cp\u003eCloud asset inventory can be used to locate specific roles bindings through a search feature that uses parameters such as the resource type, principal type, role, project, folder, and organization.\u003c/p\u003e\n"]]],[],null,["# Troubleshoot policies\n\nThis page describes how to troubleshoot\nIdentity and Access Management (IAM) allow, deny, and principal access boundary policies.\n\nUse Policy Troubleshooter\n-------------------------\n\nIf you need to troubleshoot access for a specific principal, use\nPolicy Troubleshooter for IAM.\nPolicy Troubleshooter helps you understand whether a principal can access a resource. Given a principal, a resource, and a permission, Policy Troubleshooter examines the allow policies, deny policies, and principal access boundary (PAB) policies that impact the principal's access. Then, it tells you whether, based on those policies, the principal can use the specified permission to access the resource. It also lists the relevant policies and explains how they affect the principal's access.\n\nTo learn how to use Policy Troubleshooter to troubleshoot allow\npolicies, deny policies, and principal access boundary policies, see [Troubleshoot\nIAM permissions](/policy-intelligence/docs/troubleshoot-access).\n\nView all allow and deny policies that apply to a resource\n---------------------------------------------------------\n\n\nIn Google Cloud, the following allow and deny policies affect access\nto a resource:\n\n- The resource's allow policy\n- The resource's deny policies, if any\n- The allow policies of the resource's parent project, folder, and organization, if any\n- The deny policies of the resource's parent project, folder, and organization, if any\n\n\nThe allow and deny policies of parent projects, folders, and organizations\naffect access to a resource\nbecause of [policy inheritance](/iam/docs/policies#inheritance).\nWhen you attach an allow or deny policy to a project, folder, or organization,\nthat policy also applies for all resources inside that project, folder, or\norganization.\n\n\nFor example, if a deny policy for an organization says that a principal can't\nuse a specific permission, then the principal can't use that permission for any\nresource within the organization. This rule applies even if the folders and\nprojects within that organization have more permissive deny policies, or allow\npolicies that give the principal the permission.\n\n\nSimilarly, if an allow policy for a project gives a principal a specific\npermission, then the principal has that permission for any resource within the\nproject, provided that they aren't denied that permission.\n\nThe union of all of these policies is called the *applicable policy* or\n*effective policy* for the resource.\n\nIn Google Cloud, you can get a list of all of the allow and deny policies\nthat affect access to a project by using the `gcloud beta projects\nget-ancestors-iam-policy` command with the `--include-deny` flag. Together,\nthese policies make up the applicable policy for the project. You can\ninvestigate each policy to see how it affects the principal's access. \n\n### gcloud\n\n\nBefore using any of the command data below,\nmake the following replacements:\n\n- \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: Your Google Cloud project ID. Project IDs are alphanumeric strings, like `my-project`.\n\n\nExecute the\n\n[`gcloud beta projects get-ancestors-iam-policy`](/sdk/gcloud/reference/beta/projects/get-ancestors-iam-policy)\n\ncommand:\n\n#### Linux, macOS, or Cloud Shell\n\n```bash\ngcloud beta projects get-ancestors-iam-policy PROJECT_ID --include-deny --format=json\n```\n\n#### Windows (PowerShell)\n\n```bash\ngcloud beta projects get-ancestors-iam-policy PROJECT_ID --include-deny --format=json\n```\n\n#### Windows (cmd.exe)\n\n```bash\ngcloud beta projects get-ancestors-iam-policy PROJECT_ID --include-deny --format=json\n```\n\n\nThe response contains the allow and deny policies for the project; any folders that are ancestors\nof the project; and the organization. The following example shows allow policies for the\norganization `1234567890123` and the project `my-project`, as well as a deny\npolicy for the project `my-project`:\n\n```\n[\n {\n \"id\": \"1234567890123\",\n \"policy\": {\n \"bindings\": [\n {\n \"members\": [\n \"group:cloud-admins@example.com\"\n ],\n \"role\": \"roles/iam.denyAdmin\"\n },\n {\n \"members\": [\n \"user:raha@example.com\"\n ],\n \"role\": \"roles/iam.serviceAccountAdmin\"\n }\n ],\n \"etag\": \"BwXW6Eab7TI=\",\n \"version\": 1\n },\n \"type\": \"organization\"\n },\n {\n \"id\": \"my-project\",\n \"policy\": {\n \"bindings\": [\n {\n \"members\": [\n \"group:cloud-admins@example.com\"\n ],\n \"role\": \"roles/owner\"\n }\n ],\n \"etag\": \"BwXXjOM7L6M=\",\n \"type\": \"project\"\n }\n },\n {\n \"id\": \"my-project\",\n \"policy\": {\n \"createTime\": \"2022-02-14T21:46:35.865279Z\",\n \"displayName\": \"My deny policy\",\n \"etag\": \"MTgyMzg2ODcwNTEyMjMxMTM3Mjg=\",\n \"kind\": \"DenyPolicy\",\n \"name\": \"policies/cloudresourcemanager.googleapis.com%2Fprojects%2F123456789012/denypolicies/my-deny-policy\",\n \"rules\": [\n {\n \"denyRule\": {\n \"deniedPermissions\": [\n \"iam.googleapis.com/serviceAccounts.create\"\n ],\n \"deniedPrincipals\": [\n \"user:raha@example.com\"\n ]\n },\n \"description\": \"Prevent service account creation\"\n }\n ],\n \"uid\": \"c83e3dc3-d8a6-6f51-4018-814e9f200b05\",\n \"updateTime\": \"2022-02-14T21:46:35.865279Z\"\n },\n \"type\": \"project\"\n }\n]\n```\n\nIn this example, Raha is granted the Service Account\nAdmin role (`roles/iam.serviceAccountAdmin`) on the organization, but the\nproject has a deny policy that prevents Raha from using the\npermission `iam.googleapis.com/serviceAccounts.create`. As a result, if\nRaha tries to create a service account in the project\n`my-project`, the request will be denied.\n\nIn some cases, you might only need to view the effective allow policy for a\nresource---for example, if your organization doesn't use deny policies. In\nthese cases, you can use the following methods to view the effective allow\npolicy:\n\n- View the resource's IAM allow policy in the\n Google Cloud console. The Google Cloud console automatically shows each\n resource's effective policy.\n\n To learn how to view a resource's IAM allow policy in the\n Google Cloud console, see [View current access](/iam/docs/granting-changing-revoking-access#view-access).\n- Use the Cloud Asset API to get the resource's effective allow policy. To learn\n more, see [Viewing effective IAM policies](/asset-inventory/docs/view-effective-iam-policies).\n\nSearch allow policies\n---------------------\n\nIf you need to locate a specific role binding in an allow policy, you can\nsearch the allow policy.\n\nCloud Asset Inventory lets you search allow policies for role bindings\nthat match the specified parameters. You can use a variety of search parameters,\nincluding the following:\n\n- Resource type\n- Principal type\n- Role\n- Project\n- Folder\n- Organization\n\nFor more information, see [Searching IAM allow policies](/asset-inventory/docs/searching-iam-policies)."]]
