Conceder acesso a portas individuais do Cloud Workstations
Mantenha tudo organizado com as coleções
Salve e categorize o conteúdo com base nas suas preferências.
É possível usar as condições do IAM para conceder acesso a portas de estações de trabalho individuais. Isso é útil para compartilhar acesso limitado a portas de estações de trabalho
individuais. Por exemplo, é possível usar as condições do IAM para
conceder acesso a um servidor de demonstração em execução em uma porta de estação de trabalho.
O Cloud Workstations é compatível com o atributo destination.port IAM Conditions.
Para mais informações sobre as condições do IAM, consulte os
artigos a seguir:
Antes de conceder acesso a portas individuais da estação de trabalho, você precisa ter o papel de
Administrador de políticas do Cloud Workstations
(roles/workstations.policyAdmin) na estação de trabalho.
Verificar os papéis do IAM na estação de trabalho
Verifique se você tem os papéis Usuário do Cloud Workstations (roles/workstations.user) e
Administrador de políticas do Cloud Workstations (roles/workstations.policyAdmin)
na estação de trabalho. Caso contrário, peça ao administrador do Cloud Workstations da sua organização para conceder esses papéis a você na estação de trabalho.
Iniciar um servidor de demonstração na estação de trabalho
Inicie e conecte-se às suas estações de trabalho usando o guia Iniciar estação de trabalho. Execute o seguinte comando na estação de trabalho para iniciar um servidor de demonstração em uma porta da estação de trabalho.
python3-mhttp.serverWORKSTATIONS_PORT
Substitua:
WORKSTATIONS_PORT: a porta em que o servidor de demonstração vai
detectar. Por exemplo, use 8081.
Atualizar a política condicional do IAM da estação de trabalho
Para conceder acesso a uma porta de estação de trabalho, use o console do Google Cloud ou o comando
iam policies da CLI gcloud.
Console
Para conceder acesso condicional à estação de trabalho:
No Google Cloud console, navegue até a página
Cloud Workstations>Workstations.
Encontre sua estação de trabalho, clique no menu de opções more_vertMais e selecione Adicionar usuários.
Para conceder acesso condicional, insira o e-mail do principal. Por exemplo, 222larabrown@gmail.com.
Confira se Usuário do Cloud Workstations está selecionado como uma função.
Atualize a condição do IAM para conceder acesso específico à porta:
Clique em Adicionar condição do IAM.
Especifique um título como Porta WORKSTATIONS_PORT.
Na guia Editor da condição, insira a seguinte condição:
destination.port == WORKSTATIONS_PORT
Clique em Salvar para concluir a concessão de acesso condicional à porta específica ao principal.
gcloud
Use o comando
workstations get-iam-policy da CLI gcloud para receber a política do IAM da estação de trabalho. Esse comando gera a política no arquivo:
/tmp/WORKSTATIONS_NAME.yaml. Se o arquivo
existir, ele será substituído.
Para conceder acesso condicional a um principal, adicione a seguinte expressão de condição destacada ao arquivo de política que você baixou na etapa anterior.
Não modifique a ETag. Verifique se a versão está especificada como 3, já que essa política inclui o campo condition.
YOUR_ID: seu ID de login. Por exemplo, 222larabrown@gmail.com.
PRINCIPAL: o principal com quem você quer compartilhar
o acesso à porta WORKSTATIONS_PORT da
estação de trabalho. Por exemplo, baklavainthebalkans@gmail.com.
WORKSTATIONS_PORT: a porta da estação de trabalho em que
o servidor de demonstração está detectando.
[[["Fácil de entender","easyToUnderstand","thumb-up"],["Meu problema foi resolvido","solvedMyProblem","thumb-up"],["Outro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Informações incorretas ou exemplo de código","incorrectInformationOrSampleCode","thumb-down"],["Não contém as informações/amostras de que eu preciso","missingTheInformationSamplesINeed","thumb-down"],["Problema na tradução","translationIssue","thumb-down"],["Outro","otherDown","thumb-down"]],["Última atualização 2025-08-11 UTC."],[],[],null,["# Grant access to individual Cloud Workstations ports\n\nYou can use IAM Conditions to grant access to individual\nworkstation ports. This is useful for sharing limited access to individual\nworkstation ports. For example, you can use IAM Conditions to\ngrant access to a demo server running on a workstation port.\n\nCloud Workstations supports `destination.port` IAM Conditions\nattribute.\n\nFor more information about IAM Conditions, see the\nfollowing:\n\n- [Conditions overview](/iam/docs/conditions-overview)\n- [Managing conditional role bindings](/iam/docs/managing-conditional-policies)\n\nBefore you begin\n----------------\n\nBefore you can grant access to individual workstation ports, you must have the\nCloud Workstations Policy Admin\n(`roles/workstations.policyAdmin`) role on the workstation.\n\n### Check IAM roles on the workstation\n\nBe sure that you have the Cloud Workstations User (`roles/workstations.user`) and\nCloud Workstations Policy Admin (`roles/workstations.policyAdmin`) roles\non the workstation. If you don't, ask your organization's\nCloud Workstations Admin to grant you those roles on the workstation.\n| **Tip:** [--grant-workstation-admin-role-on-create](/sdk/gcloud/reference/workstations/configs/create#--grant-workstation-admin-role-on-create) option is recommended on Cloud Workstations configuration because it lets creators of workstations to update IAM policy of the workstation that they create. For details on this option, see the [Add users](/workstations/docs/create-configuration#add_users) section.\n\n### Start a demo server in workstation\n\nStart and connect to your workstations using the [Launch workstation](/workstations/docs/create-workstation#launch_a_workstation)\nguide. Run the following command on the workstation to start a demo server on\na workstation port. \n\n python3 -m http.server \u003cvar translate=\"no\"\u003eWORKSTATIONS_PORT\u003c/var\u003e\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003eWORKSTATIONS_PORT\u003c/var\u003e: the port on which the demo server will listen. For example, use 8081.\n\nUpdate conditional IAM policy of workstation\n--------------------------------------------\n\nTo grant access to a workstation port, you can use Google Cloud console or\n`gcloud` CLI [`iam policies`](/sdk/gcloud/reference/iam/policies)\ncommand. \n\n### Console\n\nTo grant conditional access to the workstation:\n\n1. In the Google Cloud console, navigate to the\n **Cloud Workstations** \\\u003e **Workstations**\n page.\n\n\n [Go to Workstations](https://console.cloud.google.com/workstations/list)\n\n \u003cbr /\u003e\n\n2. Find your workstation and then click themore_vert**More** options menu, and select **Add Users**.\n\n3. To grant conditional access, enter the email for the principal. For example,\n `222larabrown@gmail.com`.\n\n4. Ensure **Cloud Workstations User** is selected as a Role.\n\n5. Update the IAM condition to grant port-specific access:\n\n 1. Click **Add IAM Condition**.\n\n 2. Specify a title such as **Port \u003cvar scope=\"WORKSTATIONS_PORT\" translate=\"no\"\u003eWORKSTATIONS_PORT\u003c/var\u003e**.\n\n 3. In the **Condition Editor** tab, enter the following condition:\n\n destination.port == \u003cvar translate=\"no\"\u003eWORKSTATIONS_PORT\u003c/var\u003e\n\n 1. Click **Save** to finalize granting conditional access to the specific port to the principal.\n\n### gcloud\n\n1. Get the workstation IAM policy by using the\n `gcloud` CLI [`workstations get-iam-policy`](/sdk/gcloud/reference/workstations/get-iam-policy)\n command. This command outputs the policy to the file:\n `/tmp/`\u003cvar scope=\"WORKSTATIONS_NAME\" class=\"edit\" translate=\"no\"\u003eWORKSTATIONS_NAME\u003c/var\u003e`.yaml`. If the file\n exists, it will be overwritten.\n\n gcloud workstations get-iam-policy \u003cvar translate=\"no\"\u003eWORKSTATIONS_NAME\u003c/var\u003e \\\n --cluster=\u003cvar translate=\"no\"\u003eWORKSTATIONS_CLUSTER_NAME\u003c/var\u003e \\\n --config=\u003cvar translate=\"no\"\u003eWORKSTATIONS_CONFIG_NAME\u003c/var\u003e \\\n --region=\u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e \\\n --project=\u003cvar translate=\"no\"\u003eWORKSTATIONS_PROJECT_ID\u003c/var\u003e \\\n \u003e /tmp/\u003cvar translate=\"no\"\u003eWORKSTATIONS_NAME\u003c/var\u003e.yaml\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eWORKSTATIONS_NAME\u003c/var\u003e: the name of the workstation.\n - \u003cvar translate=\"no\"\u003eWORKSTATIONS_CONFIG_NAME\u003c/var\u003e: the name of the workstation configuration.\n - \u003cvar translate=\"no\"\u003eWORKSTATIONS_CLUSTER_NAME\u003c/var\u003e: the name of the workstation cluster.\n - \u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e: the region name for your workstation cluster.\n - \u003cvar translate=\"no\"\u003eWORKSTATIONS_PROJECT_ID\u003c/var\u003e: the ID of the Cloud Workstations project containing your workstation.\n\n The YAML format of the policy is downloaded into `/tmp/`\u003cvar scope=\"WORKSTATIONS_NAME\" translate=\"no\"\u003eWORKSTATIONS_NAME\u003c/var\u003e`.yaml`: \n\n bindings:\n - members:\n - user:222larabrown@gmail.com\n role: roles/workstations.user\n etag: BwYdnV9Eg7Y=\n version: 1\n\n2. To grant conditional access to a principal, add the following highlighted\n condition expression to the policy file that you downloaded in the previous\n step.\n\n Do not modify the etag. Ensure the version is specified as `3`, since this policy includes the `condition` field.\n\n For example: \n\n bindings:\n - members:\n - user:\u003cvar translate=\"no\"\u003eYOUR_ID\u003c/var\u003e\n role: roles/workstations.user\n - condition:\n expression: destination.port == \u003cvar translate=\"no\"\u003eWORKSTATIONS_PORT\u003c/var\u003e\n title: Port \u003cvar translate=\"no\"\u003eWORKSTATIONS_PORT\u003c/var\u003e\n members:\n - user:\u003cvar translate=\"no\"\u003ePRINCIPAL\u003c/var\u003e\n role: roles/workstations.user\n etag: BwYlui8uSXo=\n version: 3\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eYOUR_ID\u003c/var\u003e: your own login ID. For example, `222larabrown@gmail.com`.\n - \u003cvar translate=\"no\"\u003ePRINCIPAL\u003c/var\u003e: the principal with whom you want share access of the port \u003cvar scope=\"WORKSTATIONS_PORT\" translate=\"no\"\u003eWORKSTATIONS_PORT\u003c/var\u003e of the workstation. For example, `baklavainthebalkans@gmail.com`.\n - \u003cvar translate=\"no\"\u003eWORKSTATIONS_PORT\u003c/var\u003e: the workstation port on which the demo server is listening.\n3. Set IAM policy of workstation using the\n `gcloud` CLI [`workstations set-iam-policy`](/sdk/gcloud/reference/workstations/set-iam-policy)\n command.\n\n gcloud workstations set-iam-policy \u003cvar translate=\"no\"\u003eWORKSTATIONS_NAME\u003c/var\u003e \\\n --cluster=\u003cvar translate=\"no\"\u003eWORKSTATIONS_CLUSTER_NAME\u003c/var\u003e \\\n --config=\u003cvar translate=\"no\"\u003eWORKSTATIONS_CONFIG_NAME\u003c/var\u003e \\\n --region=\u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e \\\n --project=\u003cvar translate=\"no\"\u003eWORKSTATIONS_PROJECT_ID\u003c/var\u003e \\\n /tmp/\u003cvar translate=\"no\"\u003eWORKSTATIONS_NAME\u003c/var\u003e.yaml\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eWORKSTATIONS_NAME\u003c/var\u003e: the name of the workstation.\n - \u003cvar translate=\"no\"\u003eWORKSTATIONS_CONFIG_NAME\u003c/var\u003e: the name of the workstation configuration.\n - \u003cvar translate=\"no\"\u003eWORKSTATIONS_CLUSTER_NAME\u003c/var\u003e: the name of the workstation cluster.\n - \u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e: the region name for your workstation cluster.\n - \u003cvar translate=\"no\"\u003eWORKSTATIONS_PROJECT_ID\u003c/var\u003e: the ID of the Cloud Workstations project containing your workstation.\n\nAfter the IAM policy of the workstation is updated, the principal\nwill be able to access the specified port of the workstation.\n| **Note:** Even if you revoke the IAM access, the principal may be able to access the specified port for up to 24 hours, or until the workstation is shut down.\n\nShare URL of workstation\n------------------------\n\nThe principal will be able to access the specified port with the following\nworkstation URL: \n\n https://\u003cvar translate=\"no\"\u003eWORKSTATIONS_PORT\u003c/var\u003e-\u003cvar translate=\"no\"\u003eWORKSTATIONS_NAME\u003c/var\u003e.\u003cvar translate=\"no\"\u003eWORKSTATIONS_CLUSTER_NAME\u003c/var\u003e.cloudworkstations.dev\n\nThe placeholders represent the following:\n\n- \u003cvar translate=\"no\"\u003eWORKSTATIONS_PORT\u003c/var\u003e: the port on which the demo server is listening.\n- \u003cvar translate=\"no\"\u003eWORKSTATIONS_NAME\u003c/var\u003e: the workstation name.\n- \u003cvar translate=\"no\"\u003eWORKSTATIONS_CLUSTER_NAME\u003c/var\u003e: the randomly generated cluster identifier.\n- `cloudworkstations.dev`: the default domain name for a workstation.\n\nThe principal won't be able to access other ports of the workstation they\ndon't have access to."]]
