Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Halaman ini menjelaskan peran Identity and Access Management (IAM) yang diperlukan untuk
mengonfigurasi Kontrol Layanan VPC.
Peran yang diperlukan
Tabel berikut mencantumkan izin dan peran yang diperlukan untuk membuat dan mencantumkan kebijakan akses:
Tindakan
Izin dan peran yang diperlukan
Membuat kebijakan akses tingkat organisasi atau kebijakan terbatas
Izin: accesscontextmanager.policies.create
Peran yang memberikan izin: Peran Access Context Manager Editor
(roles/accesscontextmanager.policyEditor)
Mencantumkan kebijakan akses tingkat organisasi atau kebijakan terbatas
Izin: accesscontextmanager.policies.list
Peran yang memberikan izin:
Peran Access Context Manager Editor (roles/accesscontextmanager.policyEditor)
Peran Access Context Manager Reader (roles/accesscontextmanager.policyReader)
Anda hanya dapat membuat, mencantumkan, atau mendelegasikan kebijakan cakupan jika memiliki izin tersebut di tingkat organisasi. Setelah membuat kebijakan cakupan, Anda dapat memberikan izin untuk
mengelola kebijakan dengan menambahkan binding IAM pada kebijakan cakupan.
Izin yang diberikan di tingkat organisasi berlaku untuk semua kebijakan akses, termasuk
kebijakan tingkat organisasi dan kebijakan cakupan apa pun.
Peran IAM bawaan berikut memberikan izin yang diperlukan untuk melihat atau mengonfigurasi perimeter layanan dan tingkat akses:
Untuk memberikan salah satu peran ini, gunakan Google Cloud konsol atau jalankan salah satu perintah berikut di gcloud CLI. Ganti
ORGANIZATION_ID dengan ID organisasi
Google CloudAnda.
Memberikan peran Admin Pengelola untuk mengizinkan akses baca-tulis
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-08-18 UTC."],[],[],null,["# Access control with IAM\n\nThis page describes the Identity and Access Management (IAM) roles required to\nconfigure VPC Service Controls.\n\nRequired roles\n--------------\n\nThe following table lists the permissions and roles required to create and list\naccess policies:\n\nYou can only create, list, or delegate [scoped policies](/access-context-manager/docs/scoped-policies) if you have those permissions\nat the organization level. After you create a scoped policy, you can grant permission to\nmanage the policy by adding IAM bindings on the scoped policy.\n\nPermissions granted at the organization-level apply to all access policies, including\nthe organization-level policy and any scoped policies.\n| **Note:** Any Access Context Manager permissions granted on folders or projects have no effect on scoped policies as permissions can only be granted at the organization-level or on individual policies. The access control for scoped policies is independent of the projects or folders in their scopes.\n\nThe following predefined IAM roles provide the necessary\npermissions to view or configure service perimeters and access levels:\n\n- Access Context Manager Admin (`roles/accesscontextmanager.policyAdmin`)\n- Access Context Manager Editor (`roles/accesscontextmanager.policyEditor`)\n- Access Context Manager Reader (`roles/accesscontextmanager.policyReader`)\n\nTo grant one of these roles, use [the Google Cloud console](/iam/docs/granting-changing-revoking-access) or run\none of the following commands in the gcloud CLI. Replace\n\u003cvar translate=\"no\"\u003eORGANIZATION_ID\u003c/var\u003e with the ID of your Google Cloud\norganization.\n\n### Grant Manager Admin role to allow read-write access\n\n```bash\ngcloud organizations add-iam-policy-binding ORGANIZATION_ID \\\n --member=\"user:example@customer.org\" \\\n --role=\"roles/accesscontextmanager.policyAdmin\"\n```\n\n### Grant Manager Editor role to allow read-write access\n\n```bash\ngcloud organizations add-iam-policy-binding ORGANIZATION_ID \\\n --member=\"user:example@customer.org\" \\\n --role=\"roles/accesscontextmanager.policyEditor\"\n```\n\n### Grant Manager Reader role to allow read-only access\n\n```bash\ngcloud organizations add-iam-policy-binding ORGANIZATION_ID \\\n --member=\"user:example@customer.org\" \\\n --role=\"roles/accesscontextmanager.policyReader\"\n```"]]
