Storage Transfer Service 使用 Identity and Access Management (IAM) 权限和角色来控制哪些用户可以访问 Storage Transfer Service 资源。Storage Transfer Service 中可用的主要资源类型是作业、操作和代理池。在 IAM 政策层次结构中，作业是项目的子资源，而操作则是作业的子资源。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-18。"],[],[],null,["# Permissions and roles\n\nStorage Transfer Service uses\n[Identity and Access Management (IAM)](https://cloud.google.com/iam/)\npermissions and roles to control who can access Storage Transfer Service\nresources. The main types of resources available in Storage Transfer Service\nare jobs, operations, and agent pools. In the\n[IAM policy hierarchy](/iam/docs/overview#policy_hierarchy), jobs are child\nresources of projects, and operations are child resources of jobs.\n\nTo grant access to a resource, you assign one or more\n[permissions](/iam/docs/overview#permissions) or\n[roles](/iam/docs/understanding-roles) to a user, group, or a\n[service account](/iam/docs/overview#service_account).\n\nPermissions\n-----------\n\nYou can grant the following Storage Transfer Service permissions:\n\n### Transfer project permission\n\n### Transfer job permissions\n\nThe following table describes permissions for Storage Transfer Service jobs:\n\n### Transfer operations permissions\n\nThe following table describes permissions for Storage Transfer Service\noperations:\n\n### Transfer agent pool permissions\n\nThe following table describes permissions for file system transfer agent\npools:\n\nPredefined roles\n----------------\n\nThis section describes the predefined roles for Storage Transfer Service. Roles\nare the preferred way of setting IAM permissions.\n\n### Role comparison\n\nYou can assign the following project role or Storage Transfer Service predefined\nroles:\n\n### Role details\n\nThe following table describes in detail the predefined roles for\nStorage Transfer Service:\n\nCustom roles\n------------\n\nYou can create and apply\n[custom IAM roles](/iam/docs/understanding-custom-roles) to meet your\norganization's access requirements.\n\nWhen creating custom roles, we recommend using a combination of\n[predefined roles](#predefined-roles) to ensure that the correct permissions\nare included together.\n\nThe Google Cloud console will not work properly if the custom role is missing\nrequired permissions. For example, some parts of the Google Cloud console\nassume a role has read access to display an item before editing it, so a role\nwith only write permissions may encounter Google Cloud console screens that\ndon't work."]]
