Looker (Google Cloud Core) 使用 Identity and Access Management (IAM) 通过一组 IAM 角色预配用户和管理员访问权限。如需详细了解 Google Cloud IAM，请参阅 IAM 文档。
什么是 Identity and Access Management (IAM)？
借助 IAM，您可以控制谁有权访问 Google Cloud 项目中的资源。IAM 允许您采用最小权限安全原则，您只需授予对您资源的必要访问权限。
主账号指的是 IAM 适用的“谁”。主账号可以是个人用户、群组或 Workspace 网域。主账号被授予角色，使他们能够在 Looker (Google Cloud Core) 以及整个 Google Cloud 中执行操作。每个角色都是一项或多项权限的集合。权限是 IAM 的基本单位：每项权限允许主账号执行一种特定的操作。
如需获得分配 Looker (Google Cloud Core) IAM 角色所需的权限，请让您的管理员为您授予创建实例的项目中的 Project IAM Admin (roles/resourcemanager.projectIamAdmin) IAM 角色。
如需详细了解如何授予角色，请参阅管理对项目、文件夹和组织的访问权限。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-25。"],[],[],null,["# Looker (Google Cloud core) access control with IAM\n\nLooker (Google Cloud core) uses Identity and Access Management (IAM) to provision user and admin access through a set of [IAM roles](#iam-roles). For a detailed description of Google Cloud IAM, see the [IAM documentation](/iam/docs).\n\nWhat is Identity and Access Management (IAM)\n--------------------------------------------\n\nIAM lets you control who has access to the resources in your Google Cloud project. IAM lets you adopt the\n[security principle of least privilege](https://en.wikipedia.org/wiki/Principle_of_least_privilege),\nso you grant only the necessary access to your resources.\n\nPrincipals are the \"who\" of IAM. Principals can be individual users, groups, or Workspace domains. Principals are granted roles, which give them the ability to perform actions with Looker (Google Cloud core) as well as Google Cloud more generally. Each role is a collection of one or more permissions. Permissions are the basic units of IAM: each permission allows a principal to perform a certain action.\n\nFor example, the `looker.instances.login` permission lets a principal log in to Looker (Google Cloud core) instances. This permission is included in several [predefined](/iam/docs/roles-overview#role-types) roles, including the Looker Admin role (`roles/looker.admin`) and the Looker Instance User role (`roles/looker.instanceUser`).\n\nRequired role\n-------------\n\n\nTo get the permissions that\nyou need to assign Looker (Google Cloud core) IAM roles,\n\nask your administrator to grant you the\n\n\n[Project IAM Admin](/iam/docs/roles-permissions/resourcemanager#resourcemanager.projectIamAdmin) (`roles/resourcemanager.projectIamAdmin`)\nIAM role on the project in which the instance was created.\n\n\nFor more information about granting roles, see [Manage access to projects, folders, and organizations](/iam/docs/granting-changing-revoking-access).\n\n\nYou might also be able to get\nthe required permissions through [custom\nroles](/iam/docs/creating-custom-roles) or other [predefined\nroles](/iam/docs/roles-overview#predefined).\n| **Note:** [IAM basic\n| roles](/iam/docs/roles-overview#basic) might also contain permissions to assign Looker (Google Cloud core) IAM roles. You shouldn't grant basic roles in a production environment, but you can grant them in a development or test environment.\n\nIAM roles versus Looker roles\n-----------------------------\n\nTwo different kinds of roles grant permissions for Looker (Google Cloud core): IAM roles and Looker roles.\n\n- **Looker IAM roles:** These kinds of roles govern the following abilities:\n\n - Users' capabilities within the Google Cloud console with regard to Looker (Google Cloud core)\n\n When used together with [OAuth](/looker/docs/looker-core-oauth-authentication), they also govern the following abilities:\n - Users' abilities to sign in to a Looker (Google Cloud core) instance\n - Whether or not users are automatically assigned the **Admin via IAM** Looker role once they sign in to a Looker (Google Cloud core) instance. For more information, see the [Authentication and authorization with OAuth and IAM](/looker/docs/looker-core-oauth-authentication#auth) documentation.\n\n See the [IAM documentation](/iam/docs/manage-access-other-resources#grant-single-role) for information on how to grant IAM roles.\n- **Looker roles:** These kinds of roles govern what users can do once they sign in to a Looker (Google Cloud core) instance. See the [Roles](/looker/docs/admin-panel-users-roles) and [Groups](/looker/docs/admin-panel-users-groups) documentation pages for information on how to grant Looker roles.\n\nLooker roles are assigned or revoked within a Looker (Google Cloud core) instance, with the exception of the **Admin via IAM** Looker role, which can be assigned or revoked only through IAM. IAM roles can be assigned or revoked only in the Google Cloud console.\n\nLooker (Google Cloud core) IAM roles\n------------------------------------\n\n| **Note:** To learn more about roles, see the [Basic and predefined roles reference](/iam/docs/understanding-roles#looker-roles).\n\nThree predefined roles for Looker (Google Cloud core) users are available. These roles are granted at the Google Cloud project level and will control access uniformly for all Looker (Google Cloud core) instances within a Google Cloud project. If a user is authenticating with [OAuth](/looker/docs/looker-core-oauth-authentication), the IAM role assigned to each principal also affects which [Looker roles are assigned](/looker/docs/looker-core-oauth-authentication#auth) at sign into the instance.\n\nAt least one principal must have the Looker Admin (`roles/looker.admin`) IAM role.\n\nIf the predefined roles don't provide the set of permissions that you want, you can also create your own [custom roles](/iam/docs/creating-custom-roles).\n| **Warning:** The Looker Service Agent IAM role is intended only for the Looker [service account](/iam/docs/service-agents#looker-service-account) and is automatically assigned to the service account when the [Looker API is enabled](/looker/docs/looker-core-instance-create#before_you_begin). Don't grant [service agent](/iam/docs/service-agents) roles to any principals except service agents. Instead, choose a different [predefined role](/iam/docs/understanding-roles#predefined_roles), or create a [custom role](/iam/docs/understanding-custom-roles) with the permissions that you need.\n\nWhat's next\n-----------\n\n- [Use Google OAuth for Looker (Google Cloud core) user authentication](/looker/docs/looker-core-oauth-authentication)\n- [Manage users within Looker (Google Cloud core)](/looker/docs/looker-core-user-management)\n- [Configure a Looker (Google Cloud core) instance](/looker/docs/looker-core-instance-setup)\n- [Looker (Google Cloud core) admin settings](/looker/docs/looker-core-admin-looker)\n- [Administer a Looker (Google Cloud core) instance from the Google Cloud console](/looker/docs/looker-core-admin-console)"]]
