如果 Migrate to Virtual Machines 环境使用共享 VPC，您必须确保正确配置权限，以便可以将迁移后的虚拟机部署到 Compute Engine 目标项目。
例如，假设您拥有以下环境：
项目 A - Migrate to Virtual Machines 宿主项目
项目 B - 共享 VPC 宿主项目和子网定义
项目 C - Migrate to Virtual Machines 目标项目和共享 VPC 服务项目
在此示例中，您要在项目 B 中定义共享 VPC。项目 B 即为共享 VPC 宿主项目。
然后，您将虚拟机迁移到项目 C 的 Migrate to Virtual Machines 目标项目中的 Compute Engine 实例，其中项目 C 会访问共享 VPC。在此示例中，项目 C 被称为共享 VPC 服务项目。在部署 Compute Engine 实例之前，您必须已按照预配共享 VPC 中的说明，将项目 C 配置为项目 B 的函数即服务项目。
但是，在部署 Compute Engine 实例之前，您还必须确保项目 A 的 Migrate to Virtual Machines 默认服务账号具有所需的权限。具体来说，Migrate to Virtual Machines 需要共享 VPC 宿主项目中子网的 compute.networkUser 角色。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-19。"],[],[],null,["# Configure permissions for a Shared VPC\n\n[Shared VPC](/vpc/docs/shared-vpc) allows an organization to connect\nresources from multiple projects to a common [Virtual Private Cloud (VPC) network](/vpc/docs/vpc)\nso that they can communicate with each other securely and efficiently using\ninternal IPs from that network.\n\nWhen you use Shared VPC, you designate a project as a\n*Shared VPC host project* and attach one or more *service projects* to\nit. The VPC networks in the Shared VPC host project are\ncalled *Shared VPC networks* . [Eligible resources](/vpc/docs/shared-vpc#resources_that_can_be_attached_to_shared_vpc_networks_from_a_service_project)\nfrom service projects can use subnets in the Shared VPC network.\n| **Note:** Both Migrate to Virtual Machines and Shared VPC use the term *host* project. For Migrate to Virtual Machines, you use the *host* project to perform migrations. For Shared VPC, you use the *host* project to define the VPC network.\n\nUse Shared VPC with Migrate to Virtual Machines\n-----------------------------------------------\n\nWhen your Migrate to Virtual Machines environment uses a Shared VPC, you must\nensure that you have configured permissions correctly so that you can deploy a\nmigrated VM to the Compute Engine target project.\n\nFor example, you have the following environment:\n\n- Project A - Migrate to Virtual Machines host project\n- Project B - Shared VPC host project and subnet definitions\n- Project C - Migrate to Virtual Machines target project and Shared VPC service project\n\nIn this example, you define a Shared VPC in Project B. Project B is\nreferred to as the Shared VPC *host project*.\n\nYou then migrate a VM to a Compute Engine instance in Project C, the\nMigrate to Virtual Machines target project, where Project C accesses the\nShared VPC. In this example, Project C is referred to as the\nShared VPC *service project* . You must have already configured Project C\nto function as a service project of Project B, as described in [Provisioning Shared VPC](/vpc/docs/provisioning-shared-vpc#create-shared), before you deploy the Compute Engine\ninstance.\n\nHowever, before you can deploy the Compute Engine instance, you must also\nensure that the Migrate to Virtual Machines default service account on Project A has\nthe required permissions. Specifically, Migrate to Virtual Machines requires the\n`compute.networkUser` role on the subnetworks in the Shared VPC host\nproject.\n\nThe following section describes how to configure the Migrate to Virtual Machines\ndefault service account.\n\nConfigure the Migrate to Virtual Machines default service account\n-----------------------------------------------------------------\n\nA default service account is created on the host project during the creation of\nthe first migration, as described in [Install the Migrate Connector](/migrate/virtual-machines/docs/5.0/migrate/migrate-connector).\n\nTo deploy a Compute Engine instance to a target project that accesses a\nShared VPC, you must add the `compute.networkUser` role on the\nsubnetworks in the Shared VPC host project to the Migrate to Virtual Machines\ndefault service account. You have two options for how you add this role:\n\n- Assign the Migrate to Virtual Machines default service account to be a\n *Service Project Admin* with access to only some of the subnets in the\n Shared VPC host project. This option provides a granular means to\n define Service Project Admins by granting them the `compute.networkUser` role\n for only some subnets in the Shared VPC host project.\n\n See [Service Project Admins for some subnets](/vpc/docs/provisioning-shared-vpc#networkuseratsubnet)\n for the steps to this procedure.\n- Allow the Migrate to Virtual Machines default service account to be a\n *Service Project Admin* with access to all subnets in the Shared VPC\n host project. In this case, you grant the role of `compute.networkUser` for\n the Shared VPC host project to the Migrate to Virtual Machines default\n service account. The default service account then has access to all the\n existing and future subnets in the Shared VPC host project.\n\nTo configure the Migrate to Virtual Machines default service account for access to\n**all subnets** in the Shared VPC host project:\n\n1. Open the Migrate to Virtual Machines page in the Google Cloud console:\n\n [Go to the Migrate to Virtual Machines page](https://console.cloud.google.com/compute/mfce)\n2. Select the **Targets** tab.\n\n At the top of the page is an information box showing the email address of the\n Migrate to Virtual Machines default service account in the form:\n\n `service-`\u003cvar translate=\"no\"\u003eM4CE_HOST_PROJECT_NUMBER\u003c/var\u003e`@gcp-sa-vmmigration.iam.gserviceaccount.com`\n3. Copy the email address.\n\n4. Use that email address to grant the `compute.networkUser` role on the\n Shared VPC host project to the Migrate to Virtual Machines default service account:\n\n ```\n gcloud projects add-iam-policy-binding VPC_HOST_PROJECT_ID \\\n --member=serviceAccount:service-M4CE_HOST_PROJECT_NUMBER@gcp-sa-vmmigration.iam.gserviceaccount.com \\\n --role=roles/compute.networkUser\n ```\n\nFor more on assigning roles and permissions to a user account, see\n[Granting, changing, and revoking access to resources](/iam/docs/granting-changing-revoking-access)."]]
