Cloud Data Loss Prevention (Cloud DLP) kini menjadi bagian dari Sensitive Data Protection. Nama API tetap sama: Cloud Data Loss Prevention API (DLP API). Untuk informasi tentang layanan yang membentuk Perlindungan Data Sensitif, lihat Ringkasan Perlindungan Data Sensitif.
Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Izin IAM
Izin umum
Beberapa metode tidak memiliki izin khusus Sensitive Data Protection. Sebagai gantinya,
mereka menggunakan yang umum, karena metode tersebut dapat menyebabkan peristiwa yang dapat ditagih, tetapi tidak
mengakses resource cloud yang dilindungi.
Semua tindakan yang memicu peristiwa yang dapat ditagih seperti metode
projects.content
memerlukan izin serviceusage.services.use untuk project
yang ditentukan dalam parent. Peran roles/editor, roles/owner, dan
roles/dlp.user berisi izin yang diperlukan atau Anda dapat menentukan
peran khusus Anda sendiri yang berisi izin ini.
Izin ini memastikan Anda berwenang untuk menagih project yang ditentukan.
Akun layanan
Untuk mengakses kedua Google Cloud resource dan mengeksekusi panggilan ke Sensitive Data Protection, Sensitive Data Protection menggunakan kredensial Cloud Data Loss Prevention Service Agent untuk melakukan autentikasi ke API lain. Agen layanan adalah jenis akun layanan khusus yang menjalankan proses internal Google atas nama Anda. Agen layanan dapat diidentifikasi menggunakan email:
Agen Layanan Pencegahan Kebocoran Data Cloud dibuat pertama kali saat diperlukan. Anda dapat membuatnya terlebih dahulu dengan melakukan panggilan ke
InspectContent:
Agen Layanan Pencegahan Kehilangan Data Cloud secara otomatis diberi izin umum pada project yang diperlukan untuk memeriksa resource dan tercantum di bagian IAM di konsol Google Cloud . Agen layanan ada tanpa batas waktu dengan project dan hanya dihapus jika project dihapus.
Sensitive Data Protection mengandalkan agen layanan ini, jadi Anda tidak boleh menghapusnya.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-08-19 UTC."],[],[],null,["# Sensitive Data Protection IAM permissions\n\nIAM permissions\n\n\u003cbr /\u003e\n\nCommon permissions\n------------------\n\nSome methods do not have Sensitive Data Protection-specific permissions. Instead,\nthey use common ones, as the methods can cause billable events, but do not\naccess any protected cloud resources.\n\nAll actions that trigger billable events such as the\n[`projects.content`](/sensitive-data-protection/docs/reference/rest/v2/projects.content)\nmethods require the `serviceusage.services.use` permission for the project\nthat's specified in `parent`. The `roles/editor`, `roles/owner`, and\n`roles/dlp.user` roles contain the required permission or you can define your\nown [custom roles](/iam/docs/creating-custom-roles) containing this permission.\n\nThis permission ensures you are authorized to bill the project you specify.\n\nService account\n---------------\n\nTo access both Google Cloud resources and execute calls to\nSensitive Data Protection,\nSensitive Data Protection uses the credentials of the\nCloud Data Loss Prevention Service Agent to authenticate to other APIs. A\nservice agent is a special type of service account that runs internal Google\nprocesses on your behalf. The service agent is identifiable using the email: \n\n```\nservice-PROJECT_NUMBER@dlp-api.iam.gserviceaccount.com\n```\n\nThe Cloud Data Loss Prevention Service Agent is created the first time it is\nneeded. You can create it in advance by making a call to\n[`InspectContent`](/sensitive-data-protection/docs/reference/rest/v2/projects.content/inspect): \n\n```bash\ncurl --request POST \\\n \"https://dlp.googleapis.com/v2/projects/\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e/locations/us-central1/content:inspect\" \\\n --header \"X-Goog-User-Project: \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e\" \\\n --header \"Authorization: Bearer $(gcloud auth print-access-token)\" \\\n --header 'Accept: application/json' \\\n --header 'Content-Type: application/json' \\\n --data '{\"item\":{\"value\":\"google@google.com\"}}' \\\n --compressed\n```\n\nReplace \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e with the [project ID](/resource-manager/docs/creating-managing-projects#before_you_begin).\n\nThe Cloud Data Loss Prevention Service Agent is automatically granted common\npermissions on the project that are needed for inspecting resources and is\nlisted in the IAM section of the Google Cloud console. The service agent exists\nindefinitely with the project and is only deleted when the project is deleted.\nSensitive Data Protection relies on this service agent, so you should not remove\nit.\n| **Note:** If you are using Sensitive Data Protection to scan critical resources, such as those protected by additional custom Identity and Access Management roles, you must assign those additional IAM roles to the Cloud Data Loss Prevention Service Agent. For example, if you want to use Sensitive Data Protection to inspect files in Google Cloud that are restricted to only a subset of individuals, you must grant the appropriate role to the Cloud Data Loss Prevention Service Agent.\n| **Warning:** If you remove the Cloud Data Loss Prevention Service Agent or revoke its roles, all [jobs](/sensitive-data-protection/docs/reference/rest/v2/projects.dlpJobs) and [job triggers](/sensitive-data-protection/docs/reference/rest/v2/projects.jobTriggers) will fail.\n\nFor more information on how service accounts are used in data profiling\noperations, see [Service agent container and service agent](/sensitive-data-protection/docs/data-profiles#service-agent-container).\n\nJob permissions\n---------------\n\nJob trigger permissions\n-----------------------\n\nInspection template permissions\n-------------------------------\n\nDe-identification template permissions\n--------------------------------------\n\nData profile permissions\n------------------------\n\nEstimate permissions\n--------------------\n\nStored infoType permissions\n---------------------------\n\nSubscription permissions\n------------------------\n\nChart permissions\n-----------------\n\nMiscellaneous permissions\n-------------------------"]]
