Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Halaman ini memberikan petunjuk tentang tugas umum untuk fitur autentikasi IAM bagi Memorystore for Redis Cluster. Untuk mengetahui detail selengkapnya tentang fitur ini, lihat Tentang autentikasi IAM.
Membuat instance dengan autentikasi IAM
Untuk membuat instance Memorystore for Redis Cluster yang menggunakan autentikasi IAM, jalankan perintah create:
INSTANCE_ID adalah ID instance Memorystore for Redis Cluster yang Anda buat. ID instance Anda harus terdiri dari 1 hingga 63 karakter dan hanya menggunakan huruf kecil, angka, atau tanda hubung. ID ini harus dimulai dengan huruf kecil dan diakhiri dengan huruf kecil atau angka.
REGION_ID adalah region tempat Anda ingin menempatkan instance.
NETWORK adalah jaringan yang digunakan untuk membuat instance Anda. Harus menggunakan
format: projects/NETWORK_PROJECT_ID/global/networks/NETWORK_ID. ID
jaringan yang digunakan di sini harus cocok dengan ID jaringan yang digunakan oleh kebijakan
koneksi layanan. Jika tidak, operasi create akan gagal. Untuk mengetahui detail selengkapnya, lihat
Networking.
NODE_TYPE adalah jenis node yang Anda pilih. Nilai yang diterima adalah:
redis-shared-core-nano
redis-standard-small
redis-highmem-medium
redis-highmem-xlarge
SHARD_COUNT menentukan jumlah shard dalam instance Anda. Jumlah partisi menentukan total kapasitas memori untuk menyimpan data cluster. Untuk melihat detail selengkapnya tentang spesifikasi cluster, lihat Spesifikasi cluster dan node.
Memberikan izin untuk autentikasi IAM
Untuk memberikan akses IAM, berikan peran
roles/redis.dbConnectionUser kepada akun utama menggunakan petunjuk Memberikan peran IAM.
Secara default, memberikan peran roles/redis.dbConnectionUser kepada akun utama akan memungkinkan
akun utama tersebut mengakses semua instance di project Anda.
Membuat peran admin IAM terbatas untuk instance
Anda mungkin ingin membuat peran yang dapat mengubah izin IAM koneksi instance tanpa memberikan akses admin IAM penuh. Hal ini dapat dilakukan dengan membuat admin IAM terbatas untuk peran
roles/redis.dbConnectionUser` role. Untuk mengetahui detail selengkapnya, buka Membuat admin IAM terbatas.
Menghubungkan ke instance yang menggunakan autentikasi IAM
Jika Anda belum memiliki VM Compute Engine yang menggunakan jaringan resmi yang sama dengan cluster Redis Anda, buat VM dan hubungkan ke VM tersebut dengan mengikuti Panduan memulai menggunakan VM Linux.
Untuk project Anda, aktifkan cakupan Cloud Platform API. Untuk mengetahui informasi selengkapnya tentang cara mengaktifkan cakupan akses ini, lihat Melampirkan akun layanan dan memperbarui cakupan akses. Untuk mengetahui informasi selengkapnya
tentang praktik terbaik untuk cakupan ini, lihat
Praktik terbaik cakupan.
Untuk project Anda, aktifkan Memorystore for Redis API.
ACCESS_TOKEN adalah token akses IAM yang diambil pada langkah-langkah sebelumnya.
Jalankan perintah CLUSTER SHARDS untuk melihat topologi cluster Anda. Catat salah satu alamat IP dan nomor port node.
Untuk menggunakan redis-cli guna melakukan autentikasi dan terhubung ke node Anda, gunakan
perintah berikut:
redis-cli -h NODE_IP_ADDRESS -p NODE_PORT -a ACCESS_TOKEN -c
Ganti kode berikut:
NODE_IP_ADDRESS: alamat IP node yang Anda temukan pada
langkah sebelumnya
NODE_PORT: nomor port node yang Anda temukan pada langkah
sebelumnya
ACCESS_TOKEN: token akses IAM yang Anda
ambil pada langkah sebelumnya
Untuk memverifikasi bahwa Anda memiliki koneksi yang diautentikasi ke node, jalankan perintah Redis
SET dan GET.
Hapus VM Compute Engine
yang Anda gunakan untuk terhubung ke cluster Redis. Hal ini membantu Anda menghindari biaya yang dikenakan ke akun Penagihan Cloud Anda.
Contoh kode untuk menghubungkan ke instance yang menggunakan autentikasi IAM
Anda dapat melihat contoh kode yang menunjukkan cara mengautentikasi aplikasi Anda menggunakan library klien populer. Selain itu, Anda dapat melihat cara menggunakan contoh kode ini untuk terhubung ke instance yang menggunakan autentikasi IAM.
Memecahkan masalah pesan error dengan autentikasi IAM
Pesan error
Tindakan yang disarankan
Deskripsi
-WRONGPASS invalid username-password pair or user is disabled
Verifikasi nama pengguna dan token akses yang diberikan ke server Memorystore for Redis Cluster
Nama pengguna atau token akses yang diberikan tidak valid. "default" adalah satu-satunya nama pengguna yang didukung. Jika aplikasi Anda sudah menggunakan nama pengguna "default", pastikan token akses belum habis masa berlakunya dan diambil dengan mengikuti petunjuk di Menghubungkan ke instance yang menggunakan autentikasi IAM. Izin IAM mungkin memerlukan waktu beberapa menit untuk diterapkan jika baru-baru ini diubah.
-NOAUTH Authentication required
Periksa apakah aplikasi dikonfigurasi untuk memberikan token akses IAM ke server Memorystore for Redis Cluster
-ERR (ERR_IAM_EXHAUSTED) Memorystore IAM authentication backend quota exceeded. See https://cloud.google.com/memorystore/docs/cluster/manage-iam-auth#error_messages.
Mencoba lagi dengan backoff eksponensial
Backend IAM kelebihan beban dan menampilkan error kuota terlampaui ke server Memorystore for Redis Cluster. Aplikasi harus mencoba lagi error ini dengan backoff eksponensial untuk mencegah kegagalan koneksi lebih lanjut.
-ERR (ERR_IAM_OTHER) Memorystore IAM authentication backend error. See https://cloud.google.com/memorystore/docs/cluster/manage-iam-auth#error_messages.
Mencoba lagi dengan backoff eksponensial
Backend IAM menampilkan error sementara ke server Memorystore for Redis Cluster. Aplikasi harus mencoba lagi error ini dengan backoff eksponensial untuk mencegah kegagalan koneksi lebih lanjut.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-04 UTC."],[],[],null,["# Manage IAM authentication\n\nThis page provides instructions on common tasks for the IAM\nauthentication feature for Memorystore for Redis Cluster. For more details on the feature,\nsee [About IAM authentication](/memorystore/docs/cluster/about-iam-auth).\n\nCreate an instance with IAM authentication\n------------------------------------------\n\nTo create a Memorystore for Redis Cluster instance that uses IAM\nauthentication, run the `create` command: \n\n```\ngcloud redis clusters create INSTANCE_ID --region=REGION_ID --network=NETWORK --node-type=NODE_TYPE --shard-count=SHARD_COUNT --auth-mode=iam-auth\n```\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003eINSTANCE_ID\u003c/var\u003e is the ID of the Memorystore for Redis Cluster instance you're\n creating. Your instance ID must be 1 to 63 characters and use only lowercase\n letters, numbers, or hyphens. It must start with a lowercase letter and end with\n a lowercase letter or number.\n\n- \u003cvar translate=\"no\"\u003eREGION_ID\u003c/var\u003e is the region where you want the instance placed.\n\n | **Note:** You can only create instances in the [supported regions](/memorystore/docs/cluster/locations) for Memorystore for Redis Cluster. Not all of the regions currently supported by Memorystore for Redis are available for Memorystore for Redis Cluster. The `gcloud redis regions list` commands shows supported regions for Memorystore for Redis, not Memorystore for Redis Cluster.\n- \u003cvar translate=\"no\"\u003eNETWORK\u003c/var\u003e is the network used to create your instance. It must use\n the format: `projects/NETWORK_PROJECT_ID/global/networks/NETWORK_ID`. The\n network ID used here must match the network ID used by the service connection\n policy. Otherwise, the `create` operation fails. For more details, see\n [Networking](/memorystore/docs/cluster/networking).\n\n- \u003cvar translate=\"no\"\u003eNODE_TYPE\u003c/var\u003e is your chosen node type. Accepted values are:\n\n - `redis-shared-core-nano`\n - `redis-standard-small`\n - `redis-highmem-medium`\n - `redis-highmem-xlarge`\n\n | **Caution** : We recommend that you use the `redis-shared-core-nano` node type for development or testing purposes only. If you run Memorystore for Redis Cluster in a production environment, then we recommend using the `redis-standard-small`, `redis-highmem-medium`, or `redis-highmem-xlarge` node types. For more information about these node types, see [Choose a node type](/memorystore/docs/cluster/cluster-node-specification#choose_a_node_type).\n- \u003cvar translate=\"no\"\u003eSHARD_COUNT\u003c/var\u003e determines the number of shards in your\n instance. Shard count determines the total memory capacity for storing\n cluster data. To see more details about cluster specification, see [Cluster and node specification](/memorystore/docs/cluster/cluster-node-specification).\n\nGrant permissions for IAM authentication\n----------------------------------------\n\nTo grant an IAM access, grant the principal the\n`roles/redis.dbConnectionUser` role using the [Grant IAM role instructions](/iam/docs/grant-role-console#grant_an_iam_role).\n\nBy default, granting a principal the `roles/redis.dbConnectionUser` role allows\nthe principal to access all instances in your project.\n| **Note:** For instructions on limiting user access on a per-instance basis, see [Grant access to a group of resources based on resource name prefixes](/iam/docs/configuring-resource-based-access#resource-name-instance). When granting limited access for your instance, use the `resource.name` attribute and the following format for the instance name - `projects/PROJECT/locations/REGION/clusters/INSTANCE_NAME`.\n\n### Create a limited IAM admin role for an instance\n\nYou might want to create a role that can modify instance connection\nIAM permissions without granting full IAM admin\naccess. This can be done by creating a limited IAM admin for the\n`roles/redis.dbConnectionUser`\\` role. For more details, visit [Create limited IAM admins](/iam/docs/setting-limits-on-granting-roles#limited-admins-example).\n\nConnect to an instance that uses IAM authentication\n---------------------------------------------------\n\n1. If you don't already have a Compute Engine VM that uses the same\n authorized network as your Redis cluster, create one and connect to it by\n following [Quickstart Using a Linux VM](/compute/docs/create-linux-vm-instance).\n\n2. For your project, enable the Cloud Platform API scope. For more\n information about enabling this access scope, see\n [Attach the service account and update the access scope](/compute/docs/instances/change-service-account#changeserviceaccountandscopes). For more information\n about best practices for this scope, see\n [Scopes best practice](/compute/docs/access/service-accounts#scopes_best_practice).\n\n3. For your project, enable the Memorystore for Redis API.\n\n [Memorystore for Redis API](https://console.cloud.google.com/apis/library/redis.googleapis.com)\n\n \u003cbr /\u003e\n\n4. Install redis-cli on the Compute Engine VM by running the following\n command from the Compute Engine SSH terminal:\n\n ```\n sudo apt-get install redis-tools\n ```\n5. Run the following command to get an access token for your IAM\n user:\n\n ```\n gcloud auth print-access-token\n ```\n | **Note:** Access tokens will expire in one hour. For more information, see [IAM access token timeframe](/memorystore/docs/cluster/about-iam-auth#iam_access_token_time_frame).\n6. Connect to your instance's discovery endpoint:\n\n ```\n redis-cli -h NETWORK_ADDRESS -p PORT -a ACCESS_TOKEN -c\n ```\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eNETWORK_ADDRESS\u003c/var\u003e is the instance's network address. To view the\n network address, see [View instance information](/memorystore/docs/cluster/view-instance-information).\n\n - \u003cvar translate=\"no\"\u003ePORT\u003c/var\u003e is the instances port number. To view the port number, see\n [View instance information](/memorystore/docs/cluster/view-instance-information).\n\n - \u003cvar translate=\"no\"\u003eACCESS_TOKEN\u003c/var\u003e is the IAM access token retrieved in previous\n steps.\n\n | **Note:** Authenticated connections are valid for 12 hours. For more information, see [IAMaccess token time frame](/memorystore/docs/cluster/about-iam-auth#iam_access_token_time_frame).\n7. Run the `CLUSTER SHARDS` command to view your cluster topology. Take a note\n of one of the node's IP addresses and port numbers.\n\n8. To use `redis-cli` to authenticate and connect to your node, use the\n following command:\n\n ```\n redis-cli -h NODE_IP_ADDRESS -p NODE_PORT -a ACCESS_TOKEN -c\n ```\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eNODE_IP_ADDRESS\u003c/var\u003e: the node's IP address that you found in the previous step\n - \u003cvar translate=\"no\"\u003eNODE_PORT\u003c/var\u003e: the node's port number that you found in the previous step\n - \u003cvar translate=\"no\"\u003eACCESS_TOKEN\u003c/var\u003e: the IAM access token that you retrieved in previous steps\n\n | **Note:** Authenticated connections are valid for 12 hours. For more information, see [IAM access token time frame](/memorystore/docs/cluster/about-iam-auth#iam_access_token_time_frame).\n9. To verify that you have an authenticated connection to your node, run a Redis\n `SET` and `GET` command.\n\n10. [Delete the Compute Engine VM](/compute/docs/create-linux-vm-instance#clean-up)\n that you used to connect to the Redis cluster. This helps you avoid incurring\n charges to your Cloud Billing account.\n\nAutomate access token retrieval\n-------------------------------\n\n| **Note:**We strongly recommend that you automate access\n| token retrieval in your application. Because of the short lifetime of an access\n| token, it's difficult to hardcode the token.\n|\n| For a code sample that shows how you can authenticate your application by using\n| popular client libraries, see [IAM\n| authentication client library code sample](/memorystore/docs/cluster/client-library-connection#iam_authentication_client_library_code_sample).\n\n1. **(Optional)** If you haven't already, create a service account for your application (see [Creating and managing a service account](/iam/docs/creating-managing-service-accounts)).\n\n ```\n gcloud iam service-accounts create SA_NAME \\\n --description=\"DESCRIPTION\" \\\n --display-name=\"DISPLAY_NAME\"\n ```\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eSA_NAME\u003c/var\u003e is the name of the service account.\n - \u003cvar translate=\"no\"\u003eDESCRIPTION\u003c/var\u003e is an optional description of the service account.\n - \u003cvar translate=\"no\"\u003eDISPLAY_NAME\u003c/var\u003e is a service account name to display in the Google Cloud console.\n2. Grant your service account `redis.dbConnectionUser` permission on your\n project.\n\n ```\n gcloud projects add-iam-policy-binding PROJECT_ID \\\n --member=\"serviceAccount:SA_NAME@PROJECT_ID.iam.gserviceaccount.com\" \\\n --role=\"ROLE_NAME\"\n ```\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: the project ID\n - \u003cvar translate=\"no\"\u003eSA_NAME\u003c/var\u003e: the name of the service account\n - \u003cvar translate=\"no\"\u003eROLE_NAME\u003c/var\u003e: a role name, such as `redis.dbConnectionUser`\n3. [Authenticate your application](#connect_to_an_instance_that_uses_iam_authentication) as the given service account. For more\n information, see [Service accounts](/docs/authentication#service-accounts).\n\nCode sample for connecting to an instance that uses IAM authentication\n----------------------------------------------------------------------\n\nYou can view a [code sample](/memorystore/docs/cluster/client-library-connection#iam_authentication_client_library_code_sample) that\nshows you how you can authenticate your\napplication by using popular client libraries. In addition, you can see how to\nuse this code sample to connect to an instance that uses IAM authentication.\n\nTroubleshooting error messages with IAM authentication\n------------------------------------------------------"]]
