IAM 允许您通过设置 IAM 政策来控制谁（身份）对哪些资源具有何种权限（角色）。IAM 政策可为主账号授予一个或多个特定角色，进而授予相应身份特定权限。
例如，您可以为 Google 账号分配给定资源（如项目）的 roles/compute.networkAdmin 角色，此后该账号便可控制项目中网络相关的资源，但无法管理实例和磁盘等其他资源。
Service Catalog IAM 角色
使用 IAM 时，Service Catalog API 和 Service Catalog Producer API 中的每个 API 方法都要求发出 API 请求的身份具有使用相应资源的适当权限。您可以通过设置政策为主账号（用户、群组或服务账号）授予角色，进而授予相应权限。除了 Owner、Editor 和 Viewer 这些基本角色之外，您还可以向主账号分配本页中所述的 Service Catalog 和 Service Catalog Producer 角色。
下面的表列出了 Service Catalog 用户可以使用的 IAM 角色。这些表格整理成了不同的角色。
Catalog Org Admin
角色名称
说明
具有的权限
roles/cloudprivatecatalogproducer.orgAdmin
在 Google Cloud组织级层管理 Service Catalog 设置。创建和管理 Service Catalog 资源，例如解决方案和目录。
cloudprivatecatalogproducer.settings.*
cloudprivatecatalogproducer.catalogs.*
cloudprivatecatalogproducer.associations.*
cloudprivatecatalogproducer.targets.*
cloudprivatecatalogproducer.producerCatalogs.*
cloudprivatecatalogproducer.catalogAssociations.*
cloudprivatecatalogproducer.products.*
cloudprivatecatalog.targets.*
resourcemanager.projects.get
resourcemanager.projects.list
resourcemanager.folders.get
resourcemanager.folders.list
resourcemanager.organizations.get
目录管理员
角色名称
说明
具有的权限
roles/cloudprivatecatalogproducer.admin
创建和管理 Service Catalog 资源，例如解决方案和目录。
cloudprivatecatalogproducer.catalogs.*
cloudprivatecatalogproducer.associations.*
cloudprivatecatalogproducer.targets.*
cloudprivatecatalogproducer.producerCatalogs.*
cloudprivatecatalogproducer.catalogAssociations.*
cloudprivatecatalogproducer.products.*
cloudprivatecatalog.targets.*
resourcemanager.projects.get
resourcemanager.projects.list
resourcemanager.folders.get
resourcemanager.folders.list
resourcemanager.organizations.get
目录管理者
角色名称
说明
具有的权限
roles/cloudprivatecatalogproducer.manager
可查看解决方案和目录，并与 Service Catalog 用户共享目录。
cloudprivatecatalog.targets.get
cloudprivatecatalogproducer.catalogs.get
cloudprivatecatalogproducer.catalogs.list
cloudprivatecatalogproducer.targets.*
cloudprivatecatalogproducer.associations.*
cloudprivatecatalogproducer.producerCatalogs.get
cloudprivatecatalogproducer.producerCatalogs.list
cloudprivatecatalogproducer.catalogAssociations.*
resourcemanager.projects.get
resourcemanager.projects.list
resourcemanager.folders.get
resourcemanager.folders.list
resourcemanager.organizations.get
目录消费者
角色名称
说明
具有的权限
roles/cloudprivatecatalog.consumer
浏览目录。查看和启动解决方案。在目标 Google Cloud 资源（例如组织、项目或文件夹）下运行。
cloudprivatecatalog.targets.get
resourcemanager.projects.get
resourcemanager.projects.list
将用户添加到 Service Catalog IAM 角色
用户、Google 群组或网域必须拥有组织级层的 resourcemanager.organizations.setIamPolicy 权限才能将用户添加到 Service Catalog IAM 角色。您可以向用户或群组授予 Organization Administrator 角色 (roles/resourcemanager.organizationAdmin)，从而将权限授予该用户或群组。
例如，如果您的组织既希望用户获授 Catalog Admin 角色，又希望用户可以向/从其他 Service Catalog IAM 角色中添加/删除用户和群组，那么 Organization Administrator 可以执行以下操作：
为用户创建 Google 群组 (MyCompanyCatalogAdmins)。
为 Google 群组 (MyCompanyCatalogAdmins) 分配 Organization Administrator 角色。
为 Google 群组 (MyCompanyCatalogAdmins) 分配 Catalog Admin 角色。
在该示例中，Google 群组的成员 (MyCompanyCatalogAdmins) 可以为组织中的 IAM 角色分配用户和群组，因为群组在获授 Organization Administrator 角色时已获得 setIamPolicy 权限。新的 Catalog Administrator 加入组织时，请将其添加到 Google 群组 (MyCompanyCatalogAdmins)，以便为其授予所需角色。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-17。"],[],[],null,["# Access control with IAM\n=======================\n\nThis page explains how you grant and manage access to Service Catalog\nusing Identity and Access Management (IAM).\n\n### Before you begin\n\n- You must have Service Catalog [enabled for your Google Cloud organization](/service-catalog/docs/quickstart#before_you_begin).\n- To grant Service Catalog IAM roles, you must have the [Organization Administrator](/resource-manager/docs/access-control-org#using_predefined_roles) (`roles/resourcemanager.organizationAdmin`) role for your Google Cloud organization.\n\nWhat is Identity and Access Management (IAM)?\n---------------------------------------------\n\nGoogle Cloud offers [Identity and Access Management (IAM)](https://cloud.google.com/iam/),\nwhich lets you give more granular access to specific Google Cloud resources\nand prevents unwanted access to other resources. IAM lets you\nadopt the [security principle of least privilege](https://en.wikipedia.org/wiki/Principle_of_least_privilege)\n,\nso you grant only the necessary access to your resources.\n\nIAM lets you control **who (identity)** has **what (roles)**\npermissions to **which** resources by setting IAM policies.\nIAM policies grant specific role(s) to a principal, giving the\nidentity certain permissions.\n\nFor example, for a given resource, such as a project, you can assign the\n`roles/compute.networkAdmin` role to a Google account and that account can\ncontrol network-related resources in the project, but cannot manage other\nresources, like instances and disks.\n\nService Catalog IAM roles\n-------------------------\n\nWith IAM, every API method in both the Service Catalog API\nand Service Catalog Producer API require that the identity making the API\nrequest has the appropriate permissions to use the resource. Permissions are\ngranted by setting policies that grant roles to a principal, such as a user,\ngroup, or service account. In addition to the basic roles,\n[Owner, Editor, and Viewer](/iam/docs/understanding-roles#basic),\nyou can assign the Service Catalog and Service Catalog\nProducer roles described in this page to principals.\n| **Note:** You can grant multiple roles to a principal on the same resource. For example, you can grant both `roles/cloudprivatecatalogproducer.admin` and `roles/cloudprivatecatalogproducer.manager` to your cloud admin team's [Google group](https://cloud.google.com/iam/docs/overview#google_group).\n\nThe following tables list the IAM roles available to\nService Catalog users. The tables are organized into different roles.\n\n### Catalog Org Admin\n\n### Catalog Admin\n\n### Catalog Manager\n\n### Catalog Consumer\n\nAdding users to Service Catalog IAM roles\n-----------------------------------------\n\nUsers, Google Groups, or domains must have the `resourcemanager.organizations.setIamPolicy`\npermission on the organization to add users to the Service Catalog\nIAM roles. You can give a user or group that permission by\ngranting them the Organization Administrator role\n(`roles/resourcemanager.organizationAdmin`).\n\nFor example, if your organization would like users granted the Catalog\nAdmin role to *also* be able to add and remove users and groups from\nthe other Service Catalog IAM roles, then an Organization\nAdministrator can do the following:\n\n- Create a Google Group for the users (`MyCompanyCatalogAdmins`).\n- Assign the Google Group (`MyCompanyCatalogAdmins`) the Organization Administrator role.\n- Assign the Google Group (`MyCompanyCatalogAdmins`) the Catalog Admin role.\n\nIn the example, members of the Google Group (`MyCompanyCatalogAdmins`)\ncan assign users and groups to IAM roles in the organization\nbecause the group has been granted the `setIamPolicy` permission when\ngranted the Organization Administrator role. As new Catalog Administrators join\nthe organization, add them to the Google Group (`MyCompanyCatalogAdmins`) to grant\nthem the desired roles.\n\nTo add a user, group, or domain to a Service Catalog IAM\nrole, follow these steps.\n\n1. Sign in to the Google Cloud console [IAM \\& admin page](https://console.cloud.google.com/iam-admin) as an Organization Administrator. \n [Go to the Google Cloud console IAM \\& admin page](https://console.cloud.google.com/iam-admin)\n2. Select **Cloud Private Catalog** from the side menu.\n3. Select the role to assign:\n - **Catalog Admin**\n - **Catalog Manager**\n - **Catalog Consumer**\n4. Specify the users, groups, or domains to add.\n\nWhat's next\n-----------\n\n- [Create a catalog](/service-catalog/docs/create-catalog)."]]
