[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-11。"],[],[],null,["# Access control with IAM\n\nCloud Workstations uses [Identity and Access Management (IAM)](/iam/docs/overview) to\nmanage access to workstations and workstation configurations. To grant access,\nassign one or more [Identity and Access Management roles](/iam/docs/understanding-roles) to a\nprincipal (user, group, or\n[service account](/iam/docs/overview#service_account)). The policy defines\nwhich roles are assigned to which principals.\n\nEnable required Identity and Access Management roles\n----------------------------------------------------\n\nIf the Identity and Access Management permissions you need haven't yet been set up, follow these\ninstructions to set up one or more of the following roles:\n\n- [Cloud Workstations User](#workstations-user)\n- [Cloud Workstations Creator](#workstations-creator)\n- [Cloud Workstations Admin](#workstations-admin)\n- [Cloud Workstations Network Admin](#workstations-network-admin)\n- [Cloud Workstations Limit Exempted Creator](#workstations-limit-exempted-creator)\n- [Cloud Workstations Policy Admin](#workstations-policy-admin)\n\n### **Cloud Workstations User**: for developers using a workstation\n\n\nTo get the permissions that\nyou need to access a workstation,\n\nask your administrator to grant you the\nfollowing IAM roles:\n\n- [Cloud Workstations User](/iam/docs/roles-permissions/workstations#workstations.user) (`roles/workstations.user`) on the workstation\n- [Cloud Workstations Operation Viewer](/iam/docs/roles-permissions/workstations#workstations.operationViewer) (`roles/workstations.operationViewer`) on the project\n\n\nFor more information about granting roles, see [Manage access to projects, folders, and organizations](/iam/docs/granting-changing-revoking-access).\n\n\nYou might also be able to get\nthe required permissions through [custom\nroles](/iam/docs/creating-custom-roles) or other [predefined\nroles](/iam/docs/roles-overview#predefined).\n\n### **Cloud Workstations Creator**: for developers creating and connecting to workstations\n\n\nTo get the permissions that\nyou need to view workstation configurations, create workstations, and access workstations,\n\nask your administrator to grant you the\nfollowing IAM roles:\n\n- [Cloud Workstations Creator](/iam/docs/roles-permissions/workstations#workstations.workstationCreator) (`roles/workstations.workstationCreator`) on the project or individual workstation configuration\n- [Cloud Workstations Operation Viewer](/iam/docs/roles-permissions/workstations#workstations.operationViewer) (`roles/workstations.operationViewer`) on the project\n\n\nFor more information about granting roles, see [Manage access to projects, folders, and organizations](/iam/docs/granting-changing-revoking-access).\n\n\nYou might also be able to get\nthe required permissions through [custom\nroles](/iam/docs/creating-custom-roles) or other [predefined\nroles](/iam/docs/roles-overview#predefined).\n\nCloud Workstations automatically grants the Cloud Workstations User role\n(`roles/workstations.user`) on any workstation that you create\nas Cloud Workstations Creator.\n\n### **Cloud Workstations Admin**: for administrators creating and updating workstation configurations and workstation clusters\n\n\nTo get the permissions that\nyou need to create the Cloud Workstations resources in your project,\n\nask your administrator to grant you the\n\n\n[Cloud Workstations Admin](/iam/docs/roles-permissions/workstations#workstations.admin) (`roles/workstations.admin`)\nIAM role on the project.\n\n\nFor more information about granting roles, see [Manage access to projects, folders, and organizations](/iam/docs/granting-changing-revoking-access).\n\n\nYou might also be able to get\nthe required permissions through [custom\nroles](/iam/docs/creating-custom-roles) or other [predefined\nroles](/iam/docs/roles-overview#predefined).\n\nFor more information about using the Google Cloud console to change permissions,\nsee the following section,\n[Add users and edit permissions using the console](#add-users-and-edit-permissions-using-the-console).\n\n### **Cloud Workstations Network Admin**: for network administrators creating and updating Shared VPC permissions\n\n\nTo get the permissions that\nyou need to create the Cloud Workstations resources in your Shared VPC,\n\nask your administrator to grant you the\n\n\n[Cloud Workstations Network Admin](/iam/docs/roles-permissions/workstations#workstations.networkAdmin) (`roles/workstations.networkAdmin`)\nIAM role on the project.\n\n\nFor more information about granting roles, see [Manage access to projects, folders, and organizations](/iam/docs/granting-changing-revoking-access).\n\n\nYou might also be able to get\nthe required permissions through [custom\nroles](/iam/docs/creating-custom-roles) or other [predefined\nroles](/iam/docs/roles-overview#predefined).\n\nFor more information about using the Google Cloud console to change permissions,\nsee the following section,\n[Add users and edit permissions using the console](#add-users-and-edit-permissions-using-the-console).\n\n### **Cloud Workstations Limit Exempted Creator**: for developers creating and connecting to workstations\n\n\nTo get the permissions that\nyou need to view workstation configurations, create workstations exempted from \\`maxUsableWorkstations\\` limit, and access workstations,\n\nask your administrator to grant you the\nfollowing IAM roles on the project:\n\n- Cloud Workstations Limit Exempted Creator (`roles/workstations.workstationLimitExemptedCreator`) - the project or individual workstation configuration\n- Cloud Workstations Operation Viewer (`roles/workstations.operationViewer`) - the project\n\n\nFor more information about granting roles, see [Manage access to projects, folders, and organizations](/iam/docs/granting-changing-revoking-access).\n\n\nYou might also be able to get\nthe required permissions through [custom\nroles](/iam/docs/creating-custom-roles) or other [predefined\nroles](/iam/docs/roles-overview#predefined).\n\n### **Cloud Workstations Policy Admin**: for developers updating IAM policy of their workstations\n\n\nTo get the permissions that\nyou need to update IAM policy of the workstation which allows granting access to the entire workstation or its individual ports,\n\nask your administrator to grant you the\n\n\n[Cloud Workstations Policy Admin](/iam/docs/roles-permissions/workstations#workstations.policyAdmin) (`roles/workstations.policyAdmin`)\nIAM role on the workstation.\n\n\nCloud Workstations automatically grants the\nCloud Workstations Policy Admin role\n(`roles/workstations.policyAdmin`) on any workstation that you create as\nCloud Workstations Creator, if the\n**Grant Policy Admin role to workstation creators** option is enabled on the\nCloud Workstations configuration. For more information about this option,\nsee the\n[Add users](/workstations/docs/create-configuration#add_users)\nsection of the [Create a workstation configuration](/workstations/docs/create-configuration)\nguide.\n\nAdd users and edit permissions using the Google Cloud console\n-------------------------------------------------------------\n\nIf you're an administrator for Cloud Workstations, you must have the\nCloud Workstations Admin role (or legacy Editor or Owner role)\nassigned to your account.\n\nTo add users or edit permissions, follow these steps:\n\n1. Navigate to the Cloud Workstations **Workstation configurations** page.\n2. To add new users, click **Add users** next to the name of the configuration, and enter new user information in the **New principals** field.\n3. To change existing permissions on a configuration, click the\n arrow_drop_downexpander arrow on the\n row with the configuration name, select **Edit permissions** , and then select **Add principal**.\n\n\n Figure 1. Add users and edit permissions from the Cloud Workstations **Workstations configurations** pane.\n\n \u003cbr /\u003e\n\nWhat's next\n-----------\n\n- [Limit workstations per developer](/workstations/docs/limit-workstations-per-developer)."]]
