Controle de acesso com o IAM

Nesta página, descrevemos os papéis do Identity and Access Management (IAM) que podem ser usados para configurar o Secret Manager. Os papéis limitam a capacidade de um principal acessar recursos. Sempre conceda o conjunto mínimo de permissões necessárias para executar uma determinada tarefa.

Papéis do Secret Manager

Confira a seguir os papéis do IAM associados ao Secret Manager. Para saber como conceder, alterar ou revogar o acesso a recursos usando papéis do IAM, consulte Como conceder, alterar e revogar o acesso a recursos.

Role Permissions

(roles/secretmanager.admin)

Full access to administer Secret Manager resources.

Lowest-level resources where you can grant this role:

  • Secret

cloudkms.keyHandles.*

  • cloudkms.keyHandles.create
  • cloudkms.keyHandles.get
  • cloudkms.keyHandles.list

cloudkms.operations.get

cloudkms.projects.showEffectiveAutokeyConfig

resourcemanager.projects.get

resourcemanager.projects.list

secretmanager.*

  • secretmanager.locations.get
  • secretmanager.locations.list
  • secretmanager.secrets.create
  • secretmanager.secrets.createTagBinding
  • secretmanager.secrets.delete
  • secretmanager.secrets.deleteTagBinding
  • secretmanager.secrets.enableManagedRotation
  • secretmanager.secrets.get
  • secretmanager.secrets.getIamPolicy
  • secretmanager.secrets.list
  • secretmanager.secrets.listEffectiveTags
  • secretmanager.secrets.listTagBindings
  • secretmanager.secrets.rotate
  • secretmanager.secrets.setIamPolicy
  • secretmanager.secrets.update
  • secretmanager.versions.access
  • secretmanager.versions.add
  • secretmanager.versions.destroy
  • secretmanager.versions.disable
  • secretmanager.versions.enable
  • secretmanager.versions.get
  • secretmanager.versions.list

(roles/secretmanager.editor)

Editor role for secretmanager

resourcemanager.projects.get

resourcemanager.projects.list

secretmanager.locations.*

  • secretmanager.locations.get
  • secretmanager.locations.list

secretmanager.secrets.create

secretmanager.secrets.delete

secretmanager.secrets.enableManagedRotation

secretmanager.secrets.get

secretmanager.secrets.getIamPolicy

secretmanager.secrets.list

secretmanager.secrets.listEffectiveTags

secretmanager.secrets.listTagBindings

secretmanager.secrets.rotate

secretmanager.secrets.update

secretmanager.versions.add

secretmanager.versions.destroy

secretmanager.versions.disable

secretmanager.versions.enable

secretmanager.versions.get

secretmanager.versions.list

(roles/secretmanager.secretAccessor)

Allows accessing the payload of secrets.

Lowest-level resources where you can grant this role:

  • Secret

resourcemanager.projects.get

resourcemanager.projects.list

secretmanager.versions.access