IAM으로 액세스 제어

이 페이지에서는 Cloud Marketplace에서 상용 제품을 구입하고 관리하는 데 필요한 ID 및 액세스 관리(IAM) 역할 및 권한에 대해 설명합니다.

IAM을 사용하면 누구(ID)에게 무슨 리소스에 대한 어떤 액세스 권한(역할)이 있는지 정의하여 액세스 제어를 관리할 수 있습니다. Cloud Marketplace의 상용 앱의 경우 Google Cloud 조직의 사용자는 Cloud Marketplace 요금제에 가입하고 결제 요금제를 변경하기 위해 IAM 역할이 필요합니다.

시작하기 전에

  • gcloud를 사용하여 Cloud Marketplace 역할 및 권한을 부여하려면 gcloud CLI를 설치하세요. 그렇지 않으면 Google Cloud 콘솔을 사용하여 역할을 부여해도 됩니다.

제품 구매 및 관리를 위한 IAM 역할

Cloud Marketplace에서 서비스를 구매하는 사용자에게 결제 계정 관리자 IAM 역할을 할당하는 것이 좋습니다.

서비스에 액세스하려는 사용자에게는 최소한 뷰어 역할이 있어야 합니다.

사용자 권한을 더 세밀하게 제어해야 할 경우 부여하려는 권한이 포함된 커스텀 역할을 만들 수 있습니다.

제품별 요구사항

Google Cloud 프로젝트에서 다음 서비스를 사용하려면 프로젝트 편집자 역할이 있어야 합니다.

  • Google Cloud Dataprep by Trifacta
  • Neo4j Aura Professional

IAM 역할 및 권한 목록

다음 IAM 역할 중 하나 이상을 사용자에게 부여할 수 있습니다. 사용자에게 부여하는 역할에 따라 Google Cloud 결제 계정, 조직, 프로젝트에도 역할을 할당해야 합니다. 자세한 내용은 사용자에게 IAM 역할 부여 섹션을 참조하세요.

Role Permissions

(roles/commercebusinessenablement.admin)

Admin of Various Provider Configuration resources

commercebusinessenablement.leadgenConfig.*

  • commercebusinessenablement.leadgenConfig.get
  • commercebusinessenablement.leadgenConfig.update

commercebusinessenablement.partnerAccounts.*

  • commercebusinessenablement.partnerAccounts.get
  • commercebusinessenablement.partnerAccounts.list

commercebusinessenablement.partnerInfo.get

commercebusinessenablement.resellerConfig.*

  • commercebusinessenablement.resellerConfig.get
  • commercebusinessenablement.resellerConfig.update

commercebusinessenablement.resellerRestrictions.*

  • commercebusinessenablement.resellerRestrictions.list
  • commercebusinessenablement.resellerRestrictions.update

resourcemanager.organizations.get

resourcemanager.projects.get

resourcemanager.projects.list

(roles/commercebusinessenablement.paymentConfigAdmin)

Administration of Payment Configuration resource

commercebusinessenablement.partnerInfo.get

commercebusinessenablement.paymentConfig.*

  • commercebusinessenablement.paymentConfig.get
  • commercebusinessenablement.paymentConfig.update

resourcemanager.projects.get

resourcemanager.projects.list

(roles/commercebusinessenablement.paymentConfigViewer)

Viewer of Payment Configuration resource

commercebusinessenablement.partnerInfo.get

commercebusinessenablement.paymentConfig.get

resourcemanager.projects.get

resourcemanager.projects.list

(roles/commercebusinessenablement.rebatesAdmin)

Provides admin access to rebates

commercebusinessenablement.operations.*

  • commercebusinessenablement.operations.cancel
  • commercebusinessenablement.operations.delete
  • commercebusinessenablement.operations.get
  • commercebusinessenablement.operations.list

commercebusinessenablement.partnerInfo.get

commercebusinessenablement.refunds.*

  • commercebusinessenablement.refunds.cancel
  • commercebusinessenablement.refunds.create
  • commercebusinessenablement.refunds.delete
  • commercebusinessenablement.refunds.get
  • commercebusinessenablement.refunds.list
  • commercebusinessenablement.refunds.start
  • commercebusinessenablement.refunds.update

(roles/commercebusinessenablement.rebatesViewer)

Provides read-only access to rebates

commercebusinessenablement.operations.get

commercebusinessenablement.operations.list

commercebusinessenablement.partnerInfo.get

commercebusinessenablement.refunds.get

commercebusinessenablement.refunds.list

(roles/commercebusinessenablement.resellerDiscountAdmin)

Provides admin access to reseller discount offers

commercebusinessenablement.partnerAccounts.*

  • commercebusinessenablement.partnerAccounts.get
  • commercebusinessenablement.partnerAccounts.list

commercebusinessenablement.partnerInfo.get

commercebusinessenablement.resellerConfig.get

commercebusinessenablement.resellerDiscountConfig.get

commercebusinessenablement.resellerDiscountOffers.*

  • commercebusinessenablement.resellerDiscountOffers.cancel
  • commercebusinessenablement.resellerDiscountOffers.create
  • commercebusinessenablement.resellerDiscountOffers.list

commercebusinessenablement.resellerPrivateOfferPlans.*

  • commercebusinessenablement.resellerPrivateOfferPlans.cancel
  • commercebusinessenablement.resellerPrivateOfferPlans.create
  • commercebusinessenablement.resellerPrivateOfferPlans.delete
  • commercebusinessenablement.resellerPrivateOfferPlans.get
  • commercebusinessenablement.resellerPrivateOfferPlans.list
  • commercebusinessenablement.resellerPrivateOfferPlans.publish
  • commercebusinessenablement.resellerPrivateOfferPlans.update

resourcemanager.organizations.get

resourcemanager.projects.get

resourcemanager.projects.list

(roles/commercebusinessenablement.resellerDiscountViewer)

Provides read-only access to reseller discount offers

commercebusinessenablement.partnerAccounts.*

  • commercebusinessenablement.partnerAccounts.get
  • commercebusinessenablement.partnerAccounts.list

commercebusinessenablement.partnerInfo.get

commercebusinessenablement.resellerConfig.get

commercebusinessenablement.resellerDiscountConfig.get

commercebusinessenablement.resellerDiscountOffers.list

commercebusinessenablement.resellerPrivateOfferPlans.get

commercebusinessenablement.resellerPrivateOfferPlans.list

resourcemanager.organizations.get

resourcemanager.projects.get

resourcemanager.projects.list

(roles/commercebusinessenablement.viewer)

Viewer of Various Provider Configuration resource

commercebusinessenablement.leadgenConfig.get

commercebusinessenablement.partnerAccounts.*

  • commercebusinessenablement.partnerAccounts.get
  • commercebusinessenablement.partnerAccounts.list

commercebusinessenablement.partnerInfo.get

commercebusinessenablement.resellerConfig.get

commercebusinessenablement.resellerRestrictions.list

resourcemanager.organizations.get

resourcemanager.projects.get

resourcemanager.projects.list

(roles/commerceoffercatalog.offersViewer)

Allows viewing offers

commerceoffercatalog.*

  • commerceoffercatalog.agreements.get
  • commerceoffercatalog.agreements.list
  • commerceoffercatalog.documents.get
  • commerceoffercatalog.documents.list
  • commerceoffercatalog.offers.get

(roles/commerceorggovernance.admin)

Full access to Organization Governance APIs

commerceorggovernance.*

  • commerceorggovernance.collectionRequestApprovals.list
  • commerceorggovernance.collectionRequestApprovals.review
  • commerceorggovernance.collections.create
  • commerceorggovernance.collections.delete
  • commerceorggovernance.collections.get
  • commerceorggovernance.collections.list
  • commerceorggovernance.collections.update
  • commerceorggovernance.consumerSharingPolicies.get
  • commerceorggovernance.consumerSharingPolicies.update
  • commerceorggovernance.organizationSettings.get
  • commerceorggovernance.organizationSettings.update
  • commerceorggovernance.populateCollectionJobs.create
  • commerceorggovernance.populateCollectionJobs.list
  • commerceorggovernance.populateCollectionJobs.run
  • commerceorggovernance.populateCollectionJobs.update
  • commerceorggovernance.services.get
  • commerceorggovernance.services.list
  • commerceorggovernance.services.request

consumerprocurement.entitlements.*

  • consumerprocurement.entitlements.get
  • consumerprocurement.entitlements.list

resourcemanager.projects.get

resourcemanager.projects.list

(roles/commerceorggovernance.user)

Full access to Governed Marketplace features.

commerceorggovernance.services.*

  • commerceorggovernance.services.get
  • commerceorggovernance.services.list
  • commerceorggovernance.services.request

consumerprocurement.entitlements.*

  • consumerprocurement.entitlements.get
  • consumerprocurement.entitlements.list

resourcemanager.projects.get

resourcemanager.projects.list

(roles/commerceorggovernance.viewer)

Full access to Organization Governance read-only APIs.

commerceorggovernance.collections.get

commerceorggovernance.collections.list

commerceorggovernance.consumerSharingPolicies.get

commerceorggovernance.organizationSettings.get

commerceorggovernance.populateCollectionJobs.list

commerceorggovernance.services.get

commerceorggovernance.services.list

consumerprocurement.entitlements.*

  • consumerprocurement.entitlements.get
  • consumerprocurement.entitlements.list

resourcemanager.projects.get

resourcemanager.projects.list

(roles/commercepricemanagement.eventsViewer)

Allows viewing key events for an offer

commerceprice.events.*

  • commerceprice.events.get
  • commerceprice.events.list

resourcemanager.projects.get

resourcemanager.projects.list

(roles/commercepricemanagement.privateOffersAdmin)

Allows managing private offers

commerceagreementpublishing.*

  • commerceagreementpublishing.agreements.create
  • commerceagreementpublishing.agreements.delete
  • commerceagreementpublishing.agreements.get
  • commerceagreementpublishing.agreements.list
  • commerceagreementpublishing.agreements.update
  • commerceagreementpublishing.documents.create
  • commerceagreementpublishing.documents.delete
  • commerceagreementpublishing.documents.get
  • commerceagreementpublishing.documents.list
  • commerceagreementpublishing.documents.update

commerceprice.*

  • commerceprice.events.get
  • commerceprice.events.list
  • commerceprice.privateoffers.cancel
  • commerceprice.privateoffers.create
  • commerceprice.privateoffers.delete
  • commerceprice.privateoffers.get
  • commerceprice.privateoffers.list
  • commerceprice.privateoffers.publish
  • commerceprice.privateoffers.sendEmail
  • commerceprice.privateoffers.update

resourcemanager.projects.get

resourcemanager.projects.list

serviceusage.services.get

serviceusage.services.list

(roles/commercepricemanagement.viewer)

Allows viewing offers, free trials, skus

commerceagreementpublishing.agreements.get

commerceagreementpublishing.agreements.list

commerceagreementpublishing.documents.get

commerceagreementpublishing.documents.list

commerceprice.privateoffers.get

commerceprice.privateoffers.list

resourcemanager.projects.get

resourcemanager.projects.list

serviceusage.services.get

serviceusage.services.list

(roles/commerceproducer.admin)

Grants full access to all resources in Cloud Commerce Producer API.

commercebusinessenablement.partnerInfo.get

resourcemanager.projects.get

resourcemanager.projects.list

(roles/commerceproducer.viewer)

Grants read access to all resources in Cloud Commerce Producer API.

commercebusinessenablement.partnerInfo.get

resourcemanager.projects.get

resourcemanager.projects.list

(roles/consumerprocurement.entitlementManager)

Allows managing entitlements and enabling, disabling, and inspecting service states for a consumer project.

commerceoffercatalog.offers.get

consumerprocurement.consents.check

consumerprocurement.consents.grant

consumerprocurement.consents.list

consumerprocurement.consents.revoke

consumerprocurement.entitlements.*

  • consumerprocurement.entitlements.get
  • consumerprocurement.entitlements.list

consumerprocurement.freeTrials.*

  • consumerprocurement.freeTrials.create
  • consumerprocurement.freeTrials.get
  • consumerprocurement.freeTrials.list

orgpolicy.policy.get

resourcemanager.projects.get

resourcemanager.projects.list

serviceusage.services.disable

serviceusage.services.enable

serviceusage.services.get

serviceusage.services.list

(roles/consumerprocurement.entitlementViewer)

Allows inspecting entitlements and service states for a consumer project.

commerceoffercatalog.offers.get

consumerprocurement.consents.check

consumerprocurement.consents.list

consumerprocurement.entitlements.*

  • consumerprocurement.entitlements.get
  • consumerprocurement.entitlements.list

consumerprocurement.freeTrials.get

consumerprocurement.freeTrials.list

orgpolicy.policy.get

resourcemanager.projects.get

resourcemanager.projects.list

serviceusage.services.get

serviceusage.services.list

(roles/consumerprocurement.eventsViewer)

Allows viewing key events for an offer

consumerprocurement.events.*

  • consumerprocurement.events.get
  • consumerprocurement.events.list

(roles/consumerprocurement.licensePoolEditor)

Allows managing license pools and license assignments.

consumerprocurement.licensePools.*

  • consumerprocurement.licensePools.assign
  • consumerprocurement.licensePools.enumerateLicensedUsers
  • consumerprocurement.licensePools.get
  • consumerprocurement.licensePools.unassign
  • consumerprocurement.licensePools.update

(roles/consumerprocurement.licensePoolViewer)

Allows viewing license pools and license assignments.

consumerprocurement.licensePools.enumerateLicensedUsers

consumerprocurement.licensePools.get

(roles/consumerprocurement.orderAdmin)

Allows managing purchases.

billing.accounts.get

billing.accounts.getIamPolicy

billing.accounts.list

billing.accounts.redeemPromotion

billing.credits.list

billing.resourceAssociations.create

commerceoffercatalog.*

  • commerceoffercatalog.agreements.get
  • commerceoffercatalog.agreements.list
  • commerceoffercatalog.documents.get
  • commerceoffercatalog.documents.list
  • commerceoffercatalog.offers.get

consumerprocurement.accounts.*

  • consumerprocurement.accounts.create
  • consumerprocurement.accounts.delete
  • consumerprocurement.accounts.get
  • consumerprocurement.accounts.list

consumerprocurement.consents.check

consumerprocurement.consents.grant

consumerprocurement.consents.list

consumerprocurement.consents.revoke

consumerprocurement.events.*

  • consumerprocurement.events.get
  • consumerprocurement.events.list

consumerprocurement.licensePools.*

  • consumerprocurement.licensePools.assign
  • consumerprocurement.licensePools.enumerateLicensedUsers
  • consumerprocurement.licensePools.get
  • consumerprocurement.licensePools.unassign
  • consumerprocurement.licensePools.update

consumerprocurement.orderAttributions.*

  • consumerprocurement.orderAttributions.get
  • consumerprocurement.orderAttributions.list
  • consumerprocurement.orderAttributions.update

consumerprocurement.orders.*

  • consumerprocurement.orders.cancel
  • consumerprocurement.orders.get
  • consumerprocurement.orders.list
  • consumerprocurement.orders.modify
  • consumerprocurement.orders.place

(roles/consumerprocurement.orderViewer)

Allows inspecting purchases.

billing.accounts.get

billing.accounts.getIamPolicy

billing.accounts.list

billing.credits.list

commerceoffercatalog.*

  • commerceoffercatalog.agreements.get
  • commerceoffercatalog.agreements.list
  • commerceoffercatalog.documents.get
  • commerceoffercatalog.documents.list
  • commerceoffercatalog.offers.get

consumerprocurement.accounts.get

consumerprocurement.accounts.list

consumerprocurement.consents.check

consumerprocurement.consents.list

consumerprocurement.licensePools.enumerateLicensedUsers

consumerprocurement.licensePools.get

consumerprocurement.orderAttributions.get

consumerprocurement.orderAttributions.list

consumerprocurement.orders.get

consumerprocurement.orders.list

(roles/consumerprocurement.procurementAdmin)

Allows managing purchases, consents at both billing account and project level.

billing.accounts.get

billing.accounts.getIamPolicy

billing.accounts.list

billing.accounts.redeemPromotion

billing.credits.list

billing.resourceAssociations.create

commerceoffercatalog.*

  • commerceoffercatalog.agreements.get
  • commerceoffercatalog.agreements.list
  • commerceoffercatalog.documents.get
  • commerceoffercatalog.documents.list
  • commerceoffercatalog.offers.get

consumerprocurement.*

  • consumerprocurement.accounts.create
  • consumerprocurement.accounts.delete
  • consumerprocurement.accounts.get
  • consumerprocurement.accounts.list
  • consumerprocurement.consents.allowProjectGrant
  • consumerprocurement.consents.check
  • consumerprocurement.consents.grant
  • consumerprocurement.consents.list
  • consumerprocurement.consents.revoke
  • consumerprocurement.entitlements.get
  • consumerprocurement.entitlements.list
  • consumerprocurement.events.get
  • consumerprocurement.events.list
  • consumerprocurement.freeTrials.create
  • consumerprocurement.freeTrials.get
  • consumerprocurement.freeTrials.list
  • consumerprocurement.licensePools.assign
  • consumerprocurement.licensePools.enumerateLicensedUsers
  • consumerprocurement.licensePools.get
  • consumerprocurement.licensePools.unassign
  • consumerprocurement.licensePools.update
  • consumerprocurement.orderAttributions.get
  • consumerprocurement.orderAttributions.list
  • consumerprocurement.orderAttributions.update
  • consumerprocurement.orders.cancel
  • consumerprocurement.orders.get
  • consumerprocurement.orders.list
  • consumerprocurement.orders.modify
  • consumerprocurement.orders.place

orgpolicy.policy.get

resourcemanager.projects.get

resourcemanager.projects.list

serviceusage.services.disable

serviceusage.services.enable

serviceusage.services.get

serviceusage.services.list

(roles/consumerprocurement.procurementViewer)

Allows inspecting purchases, consents and entitlements and service states for a consumer project.

billing.accounts.get

billing.accounts.getIamPolicy

billing.accounts.list

billing.credits.list

commerceoffercatalog.*

  • commerceoffercatalog.agreements.get
  • commerceoffercatalog.agreements.list
  • commerceoffercatalog.documents.get
  • commerceoffercatalog.documents.list
  • commerceoffercatalog.offers.get

consumerprocurement.accounts.get

consumerprocurement.accounts.list

consumerprocurement.consents.check

consumerprocurement.consents.list

consumerprocurement.entitlements.*

  • consumerprocurement.entitlements.get
  • consumerprocurement.entitlements.list

consumerprocurement.freeTrials.get

consumerprocurement.freeTrials.list

consumerprocurement.licensePools.enumerateLicensedUsers

consumerprocurement.licensePools.get

consumerprocurement.orderAttributions.get

consumerprocurement.orderAttributions.list

consumerprocurement.orders.get

consumerprocurement.orders.list

orgpolicy.policy.get

resourcemanager.projects.get

resourcemanager.projects.list

serviceusage.services.get

serviceusage.services.list

사용자에게 IAM 역할 부여

위 표의 역할에서 consumerprocurement.orderAdmin 및 consumerprocurement.orderViewer 역할은 결제 계정 또는 조직 수준에서 할당되어야 하고, consumerprocurement.entitlementManager 및 consumerprocurement.entitlementViewer 역할은 프로젝트 또는 조직 수준에서 할당되어야 합니다.

gcloud를 사용하여 사용자에게 역할을 부여하려면 다음 명령어 중 하나를 실행합니다.

조직

조직 수준에서 역할을 할당하려면 resourcemanager.organizationAdmin 역할이 있어야 합니다.

gcloud organizations add-iam-policy-binding organization-id \
--member=member --role=role-id

자리 표시자 값은 다음과 같습니다.

  • organization-id: 역할을 부여할 조직의 숫자 ID입니다.
  • member: 액세스 권한을 부여할 사용자입니다.
  • role-id: 이전 표의 역할 ID입니다.

결제 계정

결제 계정 수준에서 역할을 할당하려면 billing.admin 역할이 있어야 합니다.

gcloud beta billing accounts set-iam-policy account-id \
policy-file

자리 표시자 값은 다음과 같습니다.

  • account-id: 결제 계정 관리 페이지에서 확인할 수 있는 결제 계정 ID입니다.
  • policy-file: JSON 또는 YAML 형식의 IAM 정책 파일입니다. 정책 파일에는 이전 표의 역할 ID와 역할을 할당할 사용자가 포함되어야 합니다.

프로젝트

프로젝트 수준에서 역할을 할당하려면 resourcemanager.folderAdmin 역할이 있어야 합니다.

gcloud projects add-iam-policy-binding project-id \
--member=member --role=role-id

자리 표시자 값은 다음과 같습니다.

  • project-id: 역할을 부여할 프로젝트입니다.
  • member: 액세스 권한을 부여할 사용자입니다.
  • role-id: 이전 표의 역할 ID입니다.

Google Cloud 콘솔을 사용하여 사용자에게 역할을 부여하려면 사용자에 대한 액세스 권한 부여, 변경, 취소에 관한 IAM 문서를 참조하세요.

Cloud Marketplace로 커스텀 역할 사용

사용자에게 부여하는 권한을 세밀하게 제어하려면 부여할 권한이 포함된 커스텀 역할을 만들 수 있습니다.

Cloud Marketplace에서 서비스를 구매하는 사용자를 위한 커스텀 역할을 만드는 경우 역할에는 서비스를 구매하는 데 사용하는 결제 계정에 대한 다음 권한이 포함되어야 합니다.

싱글 사인온(SSO)으로 파트너 웹사이트에 액세스

특정 Marketplace 제품은 파트너의 외부 웹사이트에 싱글 사인온(SSO)을 지원합니다. 조직 내 승인된 사용자는 제품 세부정보 페이지의 '제공업체에서 관리' 버튼에 액세스할 수 있습니다. 이 버튼은 사용자를 파트너의 웹사이트로 안내합니다. 경우에 따라 사용자에게 'Google 계정으로 로그인' 메시지가 표시됩니다. 다른 경우에는 사용자가 공유 계정 컨텍스트에 로그인됩니다.

SSO 기능에 액세스하는 경우 사용자는 제품 세부정보 페이지로 이동하여 적절한 프로젝트를 선택합니다. 프로젝트는 요금제를 구매한 결제 계정에 연결되어 있어야 합니다. Marketplace 요금제 관리에 대한 자세한 내용은 결제 요금제 관리를 참조하세요.

또한 사용자는 선택한 프로젝트 내에서 충분한 IAM 권한을 가지고 있어야 합니다. 대부분의 제품에는 현재 roles/consumerprocurement.entitlementManager(또는 roles/editor 기본 역할)이 필요합니다.

특정 제품에 대한 최소 권한

다음 제품은 SSO 기능에 액세스하기 위해 다양한 권한 집합으로 작동할 수 있습니다.

  • Confluent Cloud의 Apache Kafka
  • Apache Cassandra용 DataStax Astra
  • Elastic Cloud
  • Neo4j Aura Professional
  • Redis Enterprise Cloud

이러한 제품의 경우 다음과 같은 최소 권한을 사용할 수 있습니다.

  • consumerprocurement.entitlements.get
  • consumerprocurement.entitlements.list
  • serviceusage.services.get
  • serviceusage.services.list
  • resourcemanager.projects.get

이러한 권한은 일반적으로 roles/consumerprocurement.entitlementManager 또는 roles/consumerprocurement.entitlementViewer 역할로 부여됩니다.