[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-11。"],[],[],null,["# VMware Engine IAM roles and permissions\n=======================================\n\nWhen you add a new member to your project, you can use an [Identity and Access Management (IAM)](/iam) policy to give that member one or more\nIAM roles. Each IAM role contains permissions\nthat grant the member access to VMware Engine resources.\n\nThis document focuses on the IAM permissions relevant to\nVMware Engine and the\n[IAM roles](/iam/docs/understanding-roles) that grant those\npermissions. For a detailed description of IAM\nand its features, see the\n[Identity and Access Management Overview](/iam/docs/overview) and [Granting, changing,\nand revoking access to resources](/iam/docs/granting-changing-revoking-access).\n\nRole types\n----------\n\nYou grant access to a resource by setting an IAM policy on the\nresource. The policy binds one or more members, such as a user or a service\naccount, to one or more roles. Each role contains a list of permissions that let\nthe member interact with the resource.\n\nThere are three types of roles in IAM:\n\n- **Predefined roles** provide granular access for a specific service and are managed by Google Cloud. Predefined roles are designed to support common use cases and access control patterns.\n- **Custom roles** provide granular access according to a user-specified list of permissions.\n- **Basic roles** are project-level roles which include broad permissions that apply to all of your Google Cloud resources. Basic roles include the Owner, Editor, and Viewer roles that existed prior to the introduction of IAM.\n\nWe recommend using a *predefined role* or a *custom role* whenever possible, as\nthey include more fine-grained permissions that apply only to\nVMware Engine.\n\n### Predefined roles\n\nA predefined role contains a set of permissions that's suitable for a specific\ntask. Specific permissions and roles apply only to Google Cloud CLI and\nVMware Engine API. To view a comprehensive list of predefined roles for\nVMware Engine, go to the\n[VMware Engine roles reference](/iam/docs/understanding-roles#vmwareengine-roles) on the IAM\ndocumentation.\n\n### Custom roles\n\nIf the predefined roles for VMware Engine don't meet your needs, then\nyou can create a custom role that contains only the permissions that you\nspecify. Identify the tasks that you need to perform, then add the permissions\nthat are required for each task to the custom role.\n\nTo view a comprehensive list of permissions for VMware Engine, go to\nthe [Permissions reference](/iam/docs/permissions-reference) and search for the prefix\n`vmwareengine`.\n\nFor more details on creating a custom role, see [Creating and managing custom\nroles](/iam/docs/creating-custom-roles).\n\nGrant or revoke access to VMware Engine\n---------------------------------------\n\nRoles apply to VMware Engine resources at the project level. A role\ncannot be applied to an individual private cloud if a project contains multiple\nprivate clouds.\n\n### Grant access\n\nTo add a team member to a project and grant them a VMware Engine\nrole, do the following:\n\n1. In the Google Cloud console, go to **IAM \\& Admin \\\u003e IAM**.\n\n [Go to the IAM page](https://console.cloud.google.com/iam-admin/iam)\n2. Click **Add**.\n\n3. Enter an email address. You can add individuals, service accounts, or\n Google Groups as members.\n\n4. Select the `VMware Engine Service Viewer` or `VMware Engine Service Admin` role based on the type of access that\n the user or group needs.\n\n5. Click **Save**.\n\n### Revoke access\n\nTo remove a role and its corresponding permissions from a user or group, do the\nfollowing:\n\n1. In the Google Cloud console, go to **IAM \\& Admin \\\u003e IAM**.\n\n [Go to the IAM page](https://console.cloud.google.com/iam-admin/iam)\n2. Locate the user or group from which you want to revoke access and click\n **Edit member**.\n\n3. For each role you want to revoke, click **Delete**.\n\n4. Click **Save**.\n\nVMware Engine permissions\n-------------------------\n\nTo view a comprehensive list of permissions for VMware Engine, go to\nthe [Permissions reference](/iam/docs/permissions-reference) and search for the prefix\n`vmwareengine`.\n\nPermissions let users perform specific actions to VMware Engine\nresources. You don't directly give users permissions; instead, you grant them\n[predefined roles](#vmware-engine-roles) or [custom roles](#custom-roles), which\nhave one or more permissions associated with them."]]
