使用 IAM 进行访问权限控制

本页面介绍您在 Cloud Marketplace 上购买和管理商业产品所需的 Identity and Access Management (IAM) 角色和权限。

借助 IAM，您可以通过定义谁（身份）对哪些资源具有哪种访问权限（角色）来管理访问权限控制。对于 Cloud Marketplace 上的商业应用，您的 Google Cloud 组织中的用户需要 IAM 角色，才能注册 Cloud Marketplace 方案和更改结算方案。

准备工作

  • 如需使用 gcloud 授予 Cloud Marketplace 角色和权限，请安装 gcloud CLI。否则，您可以使用 Google Cloud 控制台授予角色。

购买和管理角色

我们建议您为从 Cloud Marketplace 购买服务的用户分配 Billing Account Administrator IAM 角色。

用户如需访问这些服务，必须至少具有 Viewer 角色。

如需更精细地控制用户权限，您可以使用要授予的权限创建自定义角色。

具体产品的要求

如需在 Google Cloud 项目中使用以下服务，您必须拥有项目编辑者角色：

  • Google Cloud Dataprep by Trifacta
  • Neo4j Aura Professional
  • Redis Enterprise Cloud

IAM 角色和权限列表

您可以为用户授予以下一个或多个 IAM 角色。根据您向用户授予的角色，您还必须将角色分配给 Google Cloud 结算账号、组织或项目。如需了解详情，请参阅向用户授予 IAM 角色部分。

Role Permissions

(roles/consumerprocurement.entitlementManager)

Allows managing entitlements and enabling, disabling, and inspecting service states for a consumer project.

commerceoffercatalog.offers.get

consumerprocurement.consents.check

consumerprocurement.consents.grant

consumerprocurement.consents.list

consumerprocurement.consents.revoke

consumerprocurement.entitlements.*

  • consumerprocurement.entitlements.get
  • consumerprocurement.entitlements.list

consumerprocurement.freeTrials.*

  • consumerprocurement.freeTrials.create
  • consumerprocurement.freeTrials.get
  • consumerprocurement.freeTrials.list

orgpolicy.policy.get

resourcemanager.projects.get

resourcemanager.projects.list

serviceusage.consumerpolicy.*

  • serviceusage.consumerpolicy.analyze
  • serviceusage.consumerpolicy.get
  • serviceusage.consumerpolicy.update

serviceusage.effectivepolicy.get

serviceusage.groups.*

  • serviceusage.groups.list
  • serviceusage.groups.listExpandedMembers
  • serviceusage.groups.listMembers

serviceusage.operations.get

serviceusage.services.disable

serviceusage.services.enable

serviceusage.services.get

serviceusage.services.list

serviceusage.values.test

(roles/consumerprocurement.entitlementViewer)

Allows inspecting entitlements and service states for a consumer project.

commerceoffercatalog.offers.get

consumerprocurement.consents.check

consumerprocurement.consents.list

consumerprocurement.entitlements.*

  • consumerprocurement.entitlements.get
  • consumerprocurement.entitlements.list

consumerprocurement.freeTrials.get

consumerprocurement.freeTrials.list

orgpolicy.policy.get

resourcemanager.projects.get

resourcemanager.projects.list

serviceusage.consumerpolicy.analyze

serviceusage.consumerpolicy.get

serviceusage.effectivepolicy.get

serviceusage.groups.*

  • serviceusage.groups.list
  • serviceusage.groups.listExpandedMembers
  • serviceusage.groups.listMembers

serviceusage.services.get

serviceusage.services.list

serviceusage.values.test

(roles/consumerprocurement.eventsViewer)

Allows viewing key events for an offer

consumerprocurement.events.*

  • consumerprocurement.events.get
  • consumerprocurement.events.list

(roles/consumerprocurement.licensePoolEditor)

Allows managing license pools and license assignments.

consumerprocurement.licensePools.*

  • consumerprocurement.licensePools.assign
  • consumerprocurement.licensePools.enumerateLicensedUsers
  • consumerprocurement.licensePools.get
  • consumerprocurement.licensePools.unassign
  • consumerprocurement.licensePools.