角色。对于 Memorystore IAM 身份验证，用户需要 memorystore.instances.connect 权限才能通过实例进行身份验证。如需获取此权限，您可以将用户或服务账号绑定到预定义的 Memorystore DB Connection User (roles/memorystore.dbConnectionUser) 角色。如需详细了解 IAM 角色，请参阅角色。
资源。主账号有权访问的资源是 Memorystore 实例。默认情况下，IAM 政策绑定在项目级层应用，以便主账号获得项目中所有 Memorystore 实例的角色权限。不过，IAM 政策绑定可以限制为仅供特定实例使用。如需查看相关说明，请参阅管理 IAM 身份验证的权限。
Valkey AUTH 命令
IAM 身份验证功能使用 Valkey AUTH 命令与 IAM 集成，从而允许客户端提供 IAM 访问令牌，该令牌将由 Valkey 实例进行验证，然后才能访问数据。
启用 IAM 身份验证会限制每秒建立的客户端连接数。这是因为 Google Cloud 的 IAM 身份验证必须对每个新连接进行身份验证。在稳定状态下，应用会启用连接池，因此这种影响可以忽略不计。不过，当客户端应用重新启动或部署时，可能会出现大量新连接。如果您逐步更新客户端并实现指数退避算法，则可以应对这种降低的速率。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-04。"],[],[],null,["# About IAM authentication\n\nMemorystore provides the Identity and Access Management (IAM) authentication feature that\nleverages IAM to help you better manage\nlogin access for users and service accounts. IAM-based\nauthentication integrates with Valkey AUTH, letting you seamlessly rotate\ncredentials (IAM tokens) without relying on static passwords.\n\nFor instructions on setting up IAM authentication for your\nMemorystore instance, see [Manage IAM authentication](/memorystore/docs/valkey/manage-iam-auth).\n\nIAM authentication for Valkey\n-----------------------------\n\nWhen using IAM authentication, permission to access a Memorystore instance\nisn't granted directly to the end user. Instead, permissions are grouped into\nroles, and roles are granted to principals. For more information, see the\n[IAM overview](/iam/docs/overview).\n| **Note:** Memorystore lets you restrict access to an instance by granting the **roles/memorystore.dbConnectionUser** role the users you choose. For information about limiting user access on a per-instance basis, see [Grant access to a group of resources based on resource name prefixes](/iam/docs/configuring-resource-based-access#resource-name-instance). For more information about granting permissions for IAM authentication, see [Grant permissions for IAM authentication](/memorystore/docs/valkey/manage-iam-auth#grant_permissions_for_iam_authentication).\n\nAdministrators who authenticate with IAM can use\nMemorystore IAM authentication to centrally manage\naccess control to their instances using IAM policies.\nIAM policies involve the following entities:\n\n- *Principals* . In Memorystore, you can use two types of principals:\n A user account, and a service account (for applications). Other principal types,\n such as Google groups, Google Workspace domains, or Cloud Identity domains are\n not yet supported for IAM authentication. For more information,\n see [Concepts related to identity](/iam/docs/overview#concepts_related_identity).\n\n- *Roles* . For Memorystore IAM authentication, a\n user requires the **memorystore.instances.connect** permission to authenticate with an instance. To get this permission, you can bind the user or service account to the\n predefined Memorystore DB Connection User\n (**roles/memorystore.dbConnectionUser** ) role. For more information about\n IAM roles, see [Roles](/iam/docs/overview#roles).\n\n- *Resources* . The resources that principals access are Memorystore\n instances. By default, IAM policy bindings are applied at the\n project-level, such that principals receive role permissions for all\n Memorystore instances in the project. However, IAM\n policy bindings can be restricted to a particular instance. For instructions, see\n [Manage permissions for IAM authentication](/memorystore/docs/valkey/manage-iam-auth#manage_permissions_for_iam_authentication).\n\nValkey AUTH command\n-------------------\n\nThe IAM authentication feature uses the Valkey AUTH command to\nintegrate with IAM, allowing clients to provide an\nIAM access token that will be verified by the\nValkey instance before allowing access to data.\n\nLike every command, the AUTH command is sent unencrypted unless [In Transit Encryption](/memorystore/docs/valkey/about-in-transit-encryption) is enabled.\n\nFor an example of what the AUTH command can look like, see [Connect to an instance that uses IAM authentication](/memorystore/docs/valkey/manage-iam-auth#connect_to_an_instance_that_uses_iam_authentication).\n\n### IAM access token time frame\n\nThe IAM access token that you retrieve as a part of\nauthentication expires 1 hour after it is retrieved by default. Alternatively,\nyou can define the access token expire time when [Generating the access token](/iam/docs/create-short-lived-credentials-direct#create-access).\nA valid token needs to be presented via the AUTH command when establishing a new\nValkey connection. If the token has expired, you will need to get a new access\ntoken to establish new connections.\n\n### End an authenticated connection\n\nTo end a connection, use the Valkey [`CLIENT KILL`](https://valkey.io/commands/client-kill/) command. First, run [`CLIENT LIST`](https://valkey.io/commands/client-list/) to\nidentify the connection, and then run `CLIENT KILL` to end it.\n\n### Enable IAM authentication\n\nEnabling IAM authentication doesn't degrade steady state\nperformance. However, it does affect the rate that you can establish a\nconnection.\n\nEnabling IAM authentication throttles the rate of client\nconnections that are established every second. This is because Google Cloud's\nIAM authentication must authenticate each new connection. In\nsteady state, an application enables connection pools so this impact is\nnegligible. However, when client applications are restarted or deployed, there\nmight be a surge of new connections. If you update your clients gradually and\nyou implement exponential backoff, then you can absorb this reduced rate.\n\nTo view a code sample of how to use IAM authentication, see\n[Code sample for both IAM authentication and in-transit encryption](/memorystore/docs/valkey/client-library-code-samples#iam_auth_and_in_transit_encryption).\n\nSecurity and privacy\n--------------------\n\nIAM authentication helps you ensure that your Valkey instance is\nonly accessible by authorized IAM principals. TLS encryption is\nnot provided unless [In Transit Encryption](/memorystore/docs/valkey/about-in-transit-encryption)\nenabled. For this reason, it is recommended that In Transit Encryption\nbe turned on when using IAM authentication.\n\nConnecting with a Compute Engine VM\n-----------------------------------\n\nIf you are using a Compute Engine VM to [Connect to an instance that uses IAM authentication](/memorystore/docs/valkey/manage-iam-auth#connect_to_an_instance_that_uses_iam_authentication) you must enable the following access scopes and APIs for your project:\n\n- **Cloud Platform API scope** . For instructions on enabling this scope, see [Attach the service account and update the access scope](/compute/docs/instances/change-service-account#changeserviceaccountandscopes). For a description of best practices for this access scope, see [Scopes best practice](/compute/docs/access/service-accounts#scopes_best_practice).\n\n- **Memorystore for Valkey API** . For a link to enable the API, click the following button:\n\n [Memorystore for Valkey](https://console.cloud.google.com/apis/library/memorystore.googleapis.com)"]]
