Zugriffssteuerung mit IAM

Auf dieser Seite werden die IAM-Rollen (Identity and Access Management) und Berechtigungen beschrieben, die Sie zum Kauf und zur Verwaltung kommerzieller Produkte in Cloud Marketplace benötigen.

Mit IAM verwalten Sie die Zugriffssteuerung. Sie legen fest, wer (Identität) welchen Zugriff (Rolle) auf welche Ressource hat. Bei kommerziellen Anwendungen auf Cloud Marketplace benötigen Nutzer in Ihrer Google Cloud Organisation IAM-Rollen, um sich für Cloud Marketplace-Pläne anzumelden und Änderungen an Abrechnungstarifen vorzunehmen.

Hinweis

  • Installieren Sie die gcloud CLI, um Cloud Marketplace-Rollen und -Berechtigungen mit gcloud zu gewähren. Andernfalls können Sie Rollen mithilfe der Google Cloud Console zuweisen.

Rollen kaufen und verwalten

Wir empfehlen, die IAM-Rolle „Rechnungskontoadministrator“ Nutzern zuzuweisen, die Dienste aus Cloud Marketplace kaufen.

Nutzer, die auf die Dienste zugreifen möchten, müssen mindestens die Rolle „Betrachter“ haben.

Wenn Sie eine umfassendere Kontrolle über die Berechtigungen der Nutzer benötigen, können Sie benutzerdefinierte Rollen erstellen, deren Berechtigungen Sie erteilen möchten.

Produktspezifische Anforderungen

Wenn Sie die folgenden Dienste in einem Google Cloud Projekt verwenden möchten, benötigen Sie die Rolle „Projektbearbeiter“:

  • Google Cloud Dataprep von Trifacta
  • Neo4j Aura Professional
  • Redis Enterprise Cloud

Liste der IAM-Rollen und -Berechtigungen

Sie können Nutzern eine oder mehrere der folgenden IAM-Rollen zuweisen. Abhängig von der Rolle, die Sie Nutzern zuweisen, müssen Sie die Rolle auch einem Google Cloud Rechnungskonto, einer Organisation oder einem Projekt zuweisen. Weitere Informationen finden Sie unter Nutzern IAM-Rollen zuweisen.

Role Permissions

(roles/consumerprocurement.entitlementManager)

Allows managing entitlements and enabling, disabling, and inspecting service states for a consumer project.

commerceoffercatalog.offers.get

consumerprocurement.consents.check

consumerprocurement.consents.grant

consumerprocurement.consents.list

consumerprocurement.consents.revoke

consumerprocurement.entitlements.*

  • consumerprocurement.entitlements.get
  • consumerprocurement.entitlements.list

consumerprocurement.freeTrials.*

  • consumerprocurement.freeTrials.create
  • consumerprocurement.freeTrials.get
  • consumerprocurement.freeTrials.list

orgpolicy.policy.get

resourcemanager.projects.get

resourcemanager.projects.list

serviceusage.consumerpolicy.*

  • serviceusage.consumerpolicy.analyze
  • serviceusage.consumerpolicy.get
  • serviceusage.consumerpolicy.update

serviceusage.effectivepolicy.get

serviceusage.groups.*

  • serviceusage.groups.list
  • serviceusage.groups.listExpandedMembers
  • serviceusage.groups.listMembers

serviceusage.operations.get

serviceusage.services.disable

serviceusage.services.enable

serviceusage.services.get

serviceusage.services.list

serviceusage.values.test

(roles/consumerprocurement.entitlementViewer)

Allows inspecting entitlements and service states for a consumer project.

commerceoffercatalog.offers.get

consumerprocurement.consents.check

consumerprocurement.consents.list

consumerprocurement.entitlements.*

  • consumerprocurement.entitlements.get
  • consumerprocurement.entitlements.list

consumerprocurement.freeTrials.get

consumerprocurement.freeTrials.list

orgpolicy.policy.get

resourcemanager.projects.get

resourcemanager.projects.list

serviceusage.consumerpolicy.analyze

serviceusage.consumerpolicy.get

serviceusage.effectivepolicy.get

serviceusage.groups.*

  • serviceusage.groups.list
  • serviceusage.groups.listExpandedMembers
  • serviceusage.groups.listMembers

serviceusage.services.get

serviceusage.services.list

serviceusage.values.test

(roles/consumerprocurement.eventsViewer)

Allows viewing key events for an offer

consumerprocurement.events.*

  • consumerprocurement.events.get
  • consumerprocurement.events.list

(roles/consumerprocurement.licensePoolEditor)

Allows managing license pools and license assignments.

consumerprocurement.licensePools.*

  • consumerprocurement.licensePools.assign
  • consumerprocurement.licensePools.enumerateLicensedUsers
  • consumerprocurement.licensePools.get
  • consumerprocurement.licensePools.unassign
  • consumerprocurement.licensePools.update

(roles/consumerprocurement.licensePoolViewer)

Allows viewing license pools and license assignments.

consumerprocurement.licensePools.enumerateLicensedUsers

consumerprocurement.licensePools.get

(roles/consumerprocurement.orderAdmin)

Allows managing purchases.

billing.accounts.get

billing.accounts.getIamPolicy

billing.accounts.list

billing.accounts.redeemPromotion

billing.credits.list

billing.resourceAssociations.create

commerceoffercatalog.*

  • commerceoffercatalog.agreements.get
  • commerceoffercatalog.agreements.list
  • commerceoffercatalog.documents.get
  • commerceoffercatalog.documents.list
  • commerceoffercatalog.offers.get

consumerprocurement.accounts.*

  • consumerprocurement.accounts.create
  • consumerprocurement.accounts.delete
  • consumerprocurement.accounts.get
  • consumerprocurement.accounts.list

consumerprocurement.consents.check

consumerprocurement.consents.grant

consumerprocurement.consents.list

consumerprocurement.consents.revoke

consumerprocurement.events.*

  • consumerprocurement.events.get
  • consumerprocurement.events.list

consumerprocurement.licensePools.*

  • consumerprocurement.licensePools.assign
  • consumerprocurement.licensePools.enumerateLicensedUsers
  • consumerprocurement.licensePools.get
  • consumerprocurement.licensePools.unassign
  • consumerprocurement.licensePools.update

consumerprocurement.orderAttributions.*

  • consumerprocurement.orderAttributions.get
  • consumerprocurement.orderAttributions.list
  • consumerprocurement.orderAttributions.update

consumerprocurement.orders.*

  • consumerprocurement.orders.cancel
  • consumerprocurement.orders.get
  • consumerprocurement.orders.list
  • consumerprocurement.orders.modify
  • consumerprocurement.orders.place

discoveryengine.billingAccountLicenseConfigs.*

  • discoveryengine.billingAccountLicenseConfigs.distribute
  • discoveryengine.billingAccountLicenseConfigs.get
  • discoveryengine.billingAccountLicenseConfigs.list
  • discoveryengine.billingAccountLicenseConfigs.retract

(roles/consumerprocurement.orderViewer)

Allows inspecting purchases.

billing.accounts.get

billing.accounts.getIamPolicy

billing.accounts.list

billing.credits.list

commerceoffercatalog.*

  • commerceoffercatalog.agreements.get
  • commerceoffercatalog.agreements.list
  • commerceoffercatalog.documents.get
  • commerceoffercatalog.documents.list
  • commerceoffercatalog.offers.get

consumerprocurement.accounts.get

consumerprocurement.accounts.list

consumerprocurement.consents.check

consumerprocurement.consents.list

consumerprocurement.licensePools.enumerateLicensedUsers

consumerprocurement.licensePools.get

consumerprocurement.orderAttributions.get

consumerprocurement.orderAttributions.list

consumerprocurement.orders.get

consumerprocurement.orders.list

discoveryengine.billingAccountLicenseConfigs.get

discoveryengine.billingAccountLicenseConfigs.list

(roles/consumerprocurement.procurementAdmin)

Allows managing purchases, consents at both billing account and project level.

billing.accounts.get

billing.accounts.getIamPolicy

billing.accounts.list

billing.accounts.redeemPromotion

billing.credits.list

billing.resourceAssociations.create

commerceoffercatalog.*

  • commerceoffercatalog.agreements.get
  • commerceoffercatalog.agreements.list
  • commerceoffercatalog.documents.get
  • commerceoffercatalog.documents.list
  • commerceoffercatalog.offers.get

consumerprocurement.*

  • consumerprocurement.accounts.create
  • consumerprocurement.accounts.delete
  • consumerprocurement.accounts.get
  • consumerprocurement.accounts.list
  • consumerprocurement.consents.allowProjectGrant
  • consumerprocurement.consents.check
  • consumerprocurement.consents.grant
  • consumerprocurement.consents.list
  • consumerprocurement.consents.revoke
  • consumerprocurement.entitlements.get
  • consumerprocurement.entitlements.list
  • consumerprocurement.events.get
  • consumerprocurement.events.list
  • consumerprocurement.freeTrials.create
  • consumerprocurement.freeTrials.get
  • consumerprocurement.freeTrials.list
  • consumerprocurement.licensePools.assign
  • consumerprocurement.licensePools.enumerateLicensedUsers
  • consumerprocurement.licensePools.get
  • consumerprocurement.licensePools.unassign
  • consumerprocurement.licensePools.update
  • consumerprocurement.orderAttributions.get
  • consumerprocurement.orderAttributions.list
  • consumerprocurement.orderAttributions.update
  • consumerprocurement.orders.cancel
  • consumerprocurement.orders.get
  • consumerprocurement.orders.list
  • consumerprocurement.orders.modify
  • consumerprocurement.orders.place

discoveryengine.billingAccountLicenseConfigs.*

  • discoveryengine.billingAccountLicenseConfigs.distribute
  • discoveryengine.billingAccountLicenseConfigs.get
  • discoveryengine.billingAccountLicenseConfigs.list
  • discoveryengine.billingAccountLicenseConfigs.retract

orgpolicy.policy.get

resourcemanager.projects.get

resourcemanager.projects.list

serviceusage.consumerpolicy.*

  • serviceusage.consumerpolicy.analyze
  • serviceusage.consumerpolicy.get
  • serviceusage.consumerpolicy.update

serviceusage.effectivepolicy.get

serviceusage.groups.*

  • serviceusage.groups.list
  • serviceusage.groups.listExpandedMembers
  • serviceusage.groups.listMembers

serviceusage.operations.get

serviceusage.services.disable

serviceusage.services.enable

serviceusage.services.get

serviceusage.services.list

serviceusage.values.test

(roles/consumerprocurement.procurementViewer)

Allows inspecting purchases, consents and entitlements and service states for a consumer project.

billing.accounts.get

billing.accounts.getIamPolicy

billing.accounts.list

billing.credits.list