[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-04。"],[],[],null,["# Access control with IAM\n\nThis page describes the Identity and Access Management (IAM) roles and permissions\nthat you need to purchase and manage commercial products on Cloud Marketplace.\n\nWith IAM, you manage access control by defining *who* (identity)\nhas *what access* (role) for *which resource*. For commercial apps on\nCloud Marketplace, users in your Google Cloud organization require\nIAM roles to sign up for Cloud Marketplace plans, and to\nmake changes to billing plans.\n\n- [Learn about managing billing for Cloud Marketplace products](/marketplace/docs/manage-billing).\n- [Learn about factors that affect your bill](/marketplace/docs/understanding-billing).\n- [Learn about the basic concepts of IAM](/iam/docs/overview).\n- [Learn about the hierarchy of Google Cloud resources](/resource-manager/docs/cloud-platform-resource-hierarchy).\n\nBefore you begin\n----------------\n\n- To grant Cloud Marketplace roles and permissions using `gcloud`, install the [gcloud CLI](/sdk/docs/downloads-interactive). Otherwise, you can grant roles using the Google Cloud console.\n\nIAM roles for purchasing and managing products\n----------------------------------------------\n\nWe recommend that you assign the\n[Billing Account Administrator](/iam/docs/understanding-roles#billing-roles)\nIAM role to users who are purchasing services from\nCloud Marketplace.\n\nUsers who want to access the services must have the\n[Viewer](/iam/docs/understanding-roles#basic) role, at a minimum.\n\nFor more granular control over users' permissions, you can\n[create custom roles](#custom-roles) with the permissions that you want to\ngrant.\n\n### Product-specific requirements\n\nTo use the following services in a Google Cloud project, you must have the\n[Project Editor](/iam/docs/understanding-roles#basic) role:\n\n- Google Cloud Dataprep by Trifacta\n- Neo4j Aura Professional\n\n### List of IAM roles and permissions\n\nYou can grant users one or more of the following IAM roles.\nDepending on the role you are granting to users, you must also assign the role\nto a Google Cloud billing account, organization, or project. For details,\nsee the section on [Granting IAM roles to users](#grant-roles). \n\nGranting IAM roles to users\n---------------------------\n\nFrom the roles in the [table](#roles-permissions) above, the\n`consumerprocurement.orderAdmin` and `consumerprocurement.orderViewer` roles\nmust be assigned at the billing account or organization level, and the\n`consumerprocurement.entitlementManager` and `consumerprocurement.entitlementViewer`\nroles must be assigned at the project or organization level.\n\nTo grant roles to users using `gcloud`, run one of the following commands: \n\n### Organization\n\nYou must have the [`resourcemanager.organizationAdmin`](/iam/docs/understanding-roles#resource-manager-roles)\nrole to assign roles at the organization level. \n\n gcloud organizations add-iam-policy-binding \u003cvar translate=\"no\"\u003eorganization-id\u003c/var\u003e \\\n --member=\u003cvar translate=\"no\"\u003emember\u003c/var\u003e --role=\u003cvar translate=\"no\"\u003erole-id\u003c/var\u003e\n\nThe placeholder values are:\n\n- \u003cvar translate=\"no\"\u003eorganization-id\u003c/var\u003e: The numeric ID of the organization that you are granting the role for.\n- \u003cvar translate=\"no\"\u003emember\u003c/var\u003e: The user that you are granting access to.\n- \u003cvar translate=\"no\"\u003erole-id\u003c/var\u003e: The role ID, from the previous table.\n\n### Billing account\n\nYou must have the [`billing.admin`](/iam/docs/understanding-roles#billing-roles)\nrole to assign roles at the billing account level. \n\n gcloud beta billing accounts set-iam-policy \u003cvar translate=\"no\"\u003eaccount-id\u003c/var\u003e \\\n \u003cvar translate=\"no\"\u003epolicy-file\u003c/var\u003e\n\nThe placeholder values are:\n\n- \u003cvar translate=\"no\"\u003eaccount-id\u003c/var\u003e: Your billing account ID, which you can get from the [Manage billing accounts page](https://console.cloud.google.com/billing).\n- \u003cvar translate=\"no\"\u003epolicy-file\u003c/var\u003e: [An IAM policy file](/iam/docs/reference/rest/v1/Policy), in JSON or YAML format. The policy file must contain the role IDs from the previous table, and the users that you are assigning the roles to.\n\n### Project\n\nYou must have the [`resourcemanager.folderAdmin`](/iam/docs/understanding-roles#resource-manager-roles)\nrole to assign roles at the project level. \n\n gcloud projects add-iam-policy-binding \u003cvar translate=\"no\"\u003eproject-id\u003c/var\u003e \\\n --member=\u003cvar translate=\"no\"\u003emember\u003c/var\u003e --role=\u003cvar translate=\"no\"\u003erole-id\u003c/var\u003e\n\nThe placeholder values are:\n\n- \u003cvar translate=\"no\"\u003eproject-id\u003c/var\u003e: The project that you are granting the role for.\n- \u003cvar translate=\"no\"\u003emember\u003c/var\u003e: The user that you are granting access to.\n- \u003cvar translate=\"no\"\u003erole-id\u003c/var\u003e: The role ID, from the previous table.\n\nTo grant roles to users using the Google Cloud console, see the IAM\ndocumentation on [Granting, changing, and revoking access for users](/iam/docs/granting-changing-revoking-access).\n\n### Using custom roles with Cloud Marketplace\n\nIf you want granular control over the permissions you grant users, you can\n[create custom roles](/iam/docs/creating-custom-roles) with the permissions\nthat you want to grant.\n\nIf you're creating a custom role for users who purchase services from\nCloud Marketplace, the role must include these permissions for the\nbilling account they use to purchase services:\n\n- `billing.accounts.get`, which is typically granted with the [`roles/consumerprocurement.orderAdmin`](/iam/docs/understanding-roles#billing-roles) role.\n- `consumerprocurement.orders.get`, which is typically granted with the [`roles/consumerprocurement.orderAdmin`](#roles-permissions) role.\n- `consumerprocurement.orders.list`, which is typically granted with the [`roles/consumerprocurement.orderAdmin`](#roles-permissions) role.\n- `consumerprocurement.orders.place`, which is typically granted with the [`roles/consumerprocurement.orderAdmin`](#roles-permissions) role.\n- `consumerprocurement.accounts.get`, which is typically granted with the [`roles/consumerprocurement.orderAdmin`](#roles-permissions) role.\n- `consumerprocurement.accounts.list`, which is typically granted with the [`roles/consumerprocurement.orderAdmin`](#roles-permissions) role.\n- `consumerprocurement.accounts.create`, which is typically granted with the [`roles/consumerprocurement.orderAdmin`](#roles-permissions) role.\n\nAccessing partner websites with Single Sign-on (SSO)\n----------------------------------------------------\n\nCertain Marketplace products support Single Sign-on (SSO) to a partner's\nexternal website. Authorized users within the organization have access to\na \"MANAGE ON PROVIDER\" button on the product details page. This\nbutton directs users to the partner's website. In some cases, users are\nprompted to \"Sign in with Google\". In other cases, users are signed in a\nshared account context.\n\nIn order to access the SSO capability, users navigate to the product\ndetails page, and select an appropriate project. The project must be linked to\na billing account where the plan has been purchased. For details about Marketplace\nplan management, see\n[Managing billing plans](/marketplace/docs/manage-billing#manage_billing_plan).\n\nAdditionally, the user must have sufficient IAM permissions within the selected\nproject. For most products, the [`roles/consumerprocurement.entitlementManager`](#roles-permissions) (or\n[`roles/editor`](#roles-permissions)\n[basic role](/iam/docs/understanding-roles#basic)) is currently required.\n\n### Minimal permissions for specific products\n\nThe following products can operate on a different set of permissions to access\nSSO capabilities:\n\n- Apache Kafka on Confluent Cloud\n- DataStax Astra for Apache Cassandra\n- Elastic Cloud\n- Neo4j Aura Professional\n- Redis Enterprise Cloud\n\nFor these products, you can use the following minimal permissions:\n\n- `consumerprocurement.entitlements.get`\n- `consumerprocurement.entitlements.list`\n- `serviceusage.services.get`\n- `serviceusage.services.list`\n- `resourcemanager.projects.get`\n\nThese permissions are typically granted with the\n[`roles/consumerprocurement.entitlementManager`](#roles-permissions) or\n[`roles/consumerprocurement.entitlementViewer`](#roles-permissions) roles."]]
