Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Dokumen ini menjelaskan opsi kontrol akses untuk Pub/Sub Lite.
Pub/Sub Lite menggunakan Identity and Access Management untuk kontrol akses.
Untuk memberi pengguna atau aplikasi akses ke resource Pub/Sub Lite, berikan
setidaknya satu peran bawaan atau kustom kepada
pengguna atau akun layanan yang digunakan aplikasi. Peran tersebut mencakup
izin untuk melakukan tindakan tertentu pada resource Pub/Sub Lite.
Peran yang telah ditetapkan
Tabel berikut mencantumkan peran yang telah ditetapkan yang memberi Anda akses ke resource Pub/Sub Lite:
Peran
Judul
Deskripsi
Izin
roles/pubsublite.admin
Pub/Sub Lite Admin
Akses penuh ke topik Lite dan langganan Lite.
pubsublite.*
roles/pubsublite.editor
Pub/Sub Lite Editor
Mengubah topik Lite dan langganan Lite, memublikasikan pesan ke topik Lite, dan
menerima pesan dari langganan Lite.
pubsublite.*
roles/pubsublite.publisher
Pub/Sub Lite Publisher
Memublikasikan pesan ke topik Lite.
pubsublite.topics.getPartitions
pubsublite.topics.publish
pubsublite.locations.openKafkaStream
roles/pubsublite.subscriber
Pub/Sub Lite Subscriber
Menerima pesan dari langganan Lite.
pubsublite.operations.get
pubsublite.subscriptions.getCursor
pubsublite.subscriptions.seek
pubsublite.subscriptions.setCursor
pubsublite.subscriptions.subscribe
pubsublite.topics.computeHeadCursor
pubsublite.topics.computeMessageStats
pubsublite.topics.computeTimeCursor
pubsublite.topics.getPartitions
pubsublite.topics.subscribe
pubsublite.locations.openKafkaStream
roles/pubsublite.viewer
Pub/Sub Lite Viewer
Melihat topik Lite dan langganan Lite.
pubsublite.operations.get
pubsublite.operations.list
pubsublite.subscriptions.get
pubsublite.subscriptions.getCursor
pubsublite.subscriptions.list
pubsublite.topics.get
pubsublite.topics.getPartitions
pubsublite.topics.list
pubsublite.topics.listSubscriptions
Peran khusus
Peran khusus dapat mencakup izin apa pun yang Anda tentukan. Anda dapat membuat peran kustom yang menyertakan izin untuk melakukan operasi administratif tertentu, seperti memperbarui topik Lite atau menghapus langganan Lite. Untuk membuat peran khusus, lihat Membuat dan mengelola peran khusus.
Tabel berikut mencantumkan contoh peran kustom:
Deskripsi
Izin
Membuat dan mengelola pemesanan Lite.
pubsublite.reservations.create
pubsublite.reservations.update
pubsublite.reservations.get
pubsublite.reservations.list
pubsublite.reservations.delete
Membuat dan mengelola topik Lite.
pubsublite.topics.create
pubsublite.topics.update
pubsublite.topics.get
pubsublite.topics.getPartitions
pubsublite.topics.list
pubsublite.topics.listSubscriptions
pubsublite.topics.delete
Membuat dan mengelola langganan Lite.
pubsublite.subscriptions.create
pubsublite.topics.subscribe
pubsublite.subscriptions.update
pubsublite.subscriptions.get
pubsublite.subscriptions.list
pubsublite.subscriptions.delete
Membuat topik Lite dan langganan Lite.
pubsublite.topics.create
pubsublite.subscriptions.create
pubsublite.topics.subscribe
Mengubah topik Lite dan langganan Lite.
pubsublite.topics.update
pubsublite.subscriptions.update
Menghapus topik Lite dan langganan Lite.
pubsublite.topics.delete
pubsublite.subscriptions.delete
Memberikan peran
Anda dapat memberikan peran untuk mengakses resource Pub/Sub Lite di level project. Misalnya, Anda dapat memberi akun layanan akses untuk melihat topik Lite apa pun
dalam project, tetapi Anda tidak dapat memberi akun layanan akses untuk melihat satu topik Lite.
Untuk memberikan peran pada project, Anda dapat menggunakan konsol Google Cloud atau Google Cloud CLI.
Konsol
Untuk memberikan peran kepada pengguna, akun layanan, atau anggota lain, ikuti langkah-langkah berikut:
Anda juga bisa mendapatkan file JSON atau YAML dengan kebijakan IAM saat ini, menambahkan beberapa peran atau anggota ke file, lalu memperbarui kebijakan.
Untuk membaca dan mengelola kebijakan, gunakan Google Cloud CLI, IAM API, atau IAM. Untuk mengetahui detailnya, lihat Mengontrol akses secara terprogram.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-01-31 UTC."],[],[],null,["# Access control with IAM\n\n| **Note:** Pub/Sub Lite is deprecated. Effective March 18, 2026, Pub/Sub Lite will be turned down. \n|\n| - Current customers: Pub/Sub Lite remains functional until March 18, 2026. \n| If you have not used Pub/Sub Lite within the 90-day period preceding July 15, 2025 (April 15, 2025 - July 15, 2025), you won't be able to access Pub/Sub Lite starting on July 15, 2025.\n| - New customers: Pub/Sub Lite is no longer available for new customers after September 24, 2024.\n|\n| You can migrate your Pub/Sub Lite service to\n| [Google Cloud Managed Service for Apache Kafka](/pubsub/lite/docs/migrate-pubsub-lite-to-managed-service-for-apache-kafka)\n| or [Pub/Sub](/pubsub/lite/docs/migrate-pubsub-lite-to-pubsub).\n\nThis document describes the access control options for Pub/Sub Lite.\nPub/Sub Lite uses [Identity and Access Management](/iam/docs) for access control.\n\nTo give a user or application access to Pub/Sub Lite resources, grant\nat least one [predefined](#predefined_roles) or [custom](#custom_roles) role to\nthe user or the service account that the application uses. The roles include\npermissions to perform specific actions on Pub/Sub Lite resources.\n\nPredefined roles\n----------------\n\nThe following table lists the predefined roles that give you access to\nPub/Sub Lite resources:\n\nCustom roles\n------------\n\nCustom roles can include any permissions that you specify. You can create custom\nroles that include permissions to perform specific administrative operations,\nlike updating Lite topics or deleting Lite subscriptions. To create custom\nroles, see [Creating and managing custom\nroles](/iam/docs/creating-custom-roles).\n\nThe following table lists examples of custom roles:\n\nGranting roles\n--------------\n\nYou can grant roles to access Pub/Sub Lite resources at the project\nlevel. For example, you can give a service account access to view any Lite topic\nin a project, but you can't give a service account access to view a single Lite topic.\n\nTo grant a role on a project, you can use the Google Cloud console or the\nGoogle Cloud CLI. \n\n### Console\n\nTo grant a role to a user, service account, or other member, follow these\nsteps:\n\n1. In the Google Cloud console, go to the IAM page.\n\n[Go to IAM](https://console.cloud.google.com/iam-admin)\n\n1. Click **Add**.\n\n2. Enter the email address of a user, service account, or other member.\n\n3. Select a role.\n\n4. Click **Save**.\n\n### gcloud\n\nTo grant a role to a user, service account, or other member, run the\n[`gcloud projects\nadd-iam-policy-binding`](/sdk/gcloud/reference/projects/add-iam-policy-binding)\ncommand: \n\n```bash\ngcloud projects add-iam-policy-binding PROJECT_ID \\\n--member=MEMBER \\\n--role=ROLE_ID\n```\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003eMEMBER\u003c/var\u003e: an [identifier for the\n member](/iam/docs/reference/rest/v1/Policy#Binding), like `serviceAccount:test123@example.domain.com`\n- \u003cvar translate=\"no\"\u003eROLE_ID\u003c/var\u003e: the name of the [predefined](#predefined_roles) or [custom](#custom_role) role\n\nYou can also get a JSON or YAML file with the current IAM\npolicy, add multiple roles or members to the file, and then update the policy.\nTo read and manage the policy, use the Google Cloud CLI, the IAM API,\nor the IAM. For details, see [Controlling access\nprogrammatically](/iam/docs/granting-changing-revoking-access#programmatic).\n\nWhat's next\n-----------\n\n- Get an [overview of IAM](/iam/docs/overview).\n- Refer to the [authentication methods that Pub/Sub Lite\n supports](/pubsub/lite/docs).\n- Learn more about [managing access to\n resources](/iam/docs/granting-changing-revoking-access)."]]
