Controllo dell'accesso con IAM

Per impostazione predefinita, tutti i progetti della console Google Cloud includono un solo utente: il creatore originale del progetto. Nessun altro utente ha accesso al progetto e, di conseguenza, alle risorse Google Cloud , finché un utente non viene aggiunto come membro del team del progetto. Questa pagina descrive i diversi modi in cui puoi aggiungere nuovi utenti al tuo progetto.

Descrive inoltre come Deployment Manager esegue l'autenticazione ad altre Google Cloud API per tuo conto per creare risorse.

Prima di iniziare

Controllo dell'accesso per gli utenti

Per concedere agli utenti l'accesso al progetto in modo che possano creare configurazioni e deployment, aggiungili come membri del team del progetto e concedi loro i ruoli IAM (Identity and Access Management) appropriati.

Per informazioni su come aggiungere membri del team, consulta la documentazione relativa all'aggiunta di membri del team.

Ruoli di Deployment Manager

Role Permissions

(roles/deploymentmanager.admin)

Admin role for Deployment Manager.

deploymentmanager.*

  • deploymentmanager.compositeTypes.create
  • deploymentmanager.compositeTypes.delete
  • deploymentmanager.compositeTypes.get
  • deploymentmanager.compositeTypes.list
  • deploymentmanager.compositeTypes.update
  • deploymentmanager.deployments.cancelPreview
  • deploymentmanager.deployments.create
  • deploymentmanager.deployments.delete
  • deploymentmanager.deployments.get
  • deploymentmanager.deployments.getIamPolicy
  • deploymentmanager.deployments.list
  • deploymentmanager.deployments.setIamPolicy
  • deploymentmanager.deployments.stop
  • deploymentmanager.deployments.update
  • deploymentmanager.manifests.get
  • deploymentmanager.manifests.list
  • deploymentmanager.operations.get
  • deploymentmanager.operations.list
  • deploymentmanager.resources.get
  • deploymentmanager.resources.list
  • deploymentmanager.typeProviders.create
  • deploymentmanager.typeProviders.delete
  • deploymentmanager.typeProviders.get
  • deploymentmanager.typeProviders.getType
  • deploymentmanager.typeProviders.list
  • deploymentmanager.typeProviders.listTypes
  • deploymentmanager.typeProviders.update
  • deploymentmanager.types.create
  • deploymentmanager.types.delete
  • deploymentmanager.types.get
  • deploymentmanager.types.list
  • deploymentmanager.types.update

resourcemanager.projects.get

resourcemanager.projects.list

serviceusage.consumerpolicy.analyze

serviceusage.consumerpolicy.get

serviceusage.effectivepolicy.get

serviceusage.groups.*

  • serviceusage.groups.list
  • serviceusage.groups.listExpandedMembers
  • serviceusage.groups.listMembers

serviceusage.quotas.get

serviceusage.services.get

serviceusage.services.list

serviceusage.values.test

(roles/deploymentmanager.editor)

Provides the permissions necessary to create and manage deployments.

Lowest-level resources where you can grant this role:

  • Project

deploymentmanager.compositeTypes.*

  • deploymentmanager.compositeTypes.create
  • deploymentmanager.compositeTypes.delete
  • deploymentmanager.compositeTypes.get
  • deploymentmanager.compositeTypes.list
  • deploymentmanager.compositeTypes.update

deploymentmanager.deployments.cancelPreview

deploymentmanager.deployments.create

deploymentmanager.deployments.delete

deploymentmanager.deployments.get

deploymentmanager.deployments.list

deploymentmanager.deployments.stop

deploymentmanager.deployments.update

deploymentmanager.manifests.*

  • deploymentmanager.manifests.get
  • deploymentmanager.manifests.list

deploymentmanager.operations.*

  • deploymentmanager.operations.get
  • deploymentmanager.operations.list

deploymentmanager.resources.*

  • deploymentmanager.resources.get
  • deploymentmanager.resources.list

deploymentmanager.typeProviders.*

  • deploymentmanager.typeProviders.create
  • deploymentmanager.typeProviders.delete
  • deploymentmanager.typeProviders.get
  • deploymentmanager.typeProviders.getType
  • deploymentmanager.typeProviders.list
  • deploymentmanager.typeProviders.listTypes
  • deploymentmanager.typeProviders.update

deploymentmanager.types.*

  • deploymentmanager.types.create
  • deploymentmanager.types.delete
  • deploymentmanager.types.get
  • deploymentmanager.types.list
  • deploymentmanager.types.update

resourcemanager.projects.get

resourcemanager.projects.list

serviceusage.consumerpolicy.analyze

serviceusage.consumerpolicy.get

serviceusage.effectivepolicy.get

serviceusage.groups.*

  • serviceusage.groups.list
  • serviceusage.groups.listExpandedMembers
  • serviceusage.groups.listMembers

serviceusage.quotas.get

serviceusage.services.get

serviceusage.services.list

serviceusage.values.test

(roles/deploymentmanager.viewer)

Provides read-only access to all Deployment Manager-related resources.

Lowest-level resources where you can grant this role:

  • Project

deploymentmanager.compositeTypes.get

deploymentmanager.compositeTypes.list

deploymentmanager.deployments.get

deploymentmanager.deployments.list

deploymentmanager.manifests.*

  • deploymentmanager.manifests.get
  • deploymentmanager.manifests.list

deploymentmanager.operations.*

  • deploymentmanager.operations.get
  • deploymentmanager.operations.list

deploymentmanager.resources.*

  • deploymentmanager.resources.get
  • deploymentmanager.resources.list

deploymentmanager.typeProviders.get

deploymentmanager.typeProviders.getType

deploymentmanager.typeProviders.list

deploymentmanager.typeProviders.listTypes

deploymentmanager.types.get

deploymentmanager.types.list

resourcemanager.projects.get

resourcemanager.projects.list

serviceusage.consumerpolicy.analyze

serviceusage.consumerpolicy.get

serviceusage.effectivepolicy.get

serviceusage.groups.*

  • serviceusage.groups.list
  • serviceusage.groups.listExpandedMembers
  • serviceusage.groups.listMembers

serviceusage.quotas.get

serviceusage.services.get

serviceusage.services.list

serviceusage.values.test

(roles/deploymentmanager.typeEditor)

Provides read and write access to all Type Registry resources.

Lowest-level resources where you can grant this role:

  • Project

deploymentmanager.compositeTypes.*

  • deploymentmanager.compositeTypes.create
  • deploymentmanager.compositeTypes.delete
  • deploymentmanager.compositeTypes.get
  • deploymentmanager.compositeTypes.list
  • deploymentmanager.compositeTypes.update

deploymentmanager.operations.get

deploymentmanager.typeProviders.*

  • deploymentmanager.typeProviders.create
  • deploymentmanager.typeProviders.delete
  • deploymentmanager.typeProviders.get
  • deploymentmanager.typeProviders.getType
  • deploymentmanager.typeProviders.list
  • deploymentmanager.typeProviders.listTypes
  • deploymentmanager.typeProviders.update

deploymentmanager.types.*

  • deploymentmanager.types.create
  • deploymentmanager.types.delete
  • deploymentmanager.types.get
  • deploymentmanager.types.list
  • deploymentmanager.types.update

resourcemanager.projects.get

resourcemanager.projects.list

serviceusage.consumerpolicy.analyze

serviceusage.consumerpolicy.get

serviceusage.effectivepolicy.get

serviceusage.groups.*

  • serviceusage.groups.list
  • serviceusage.groups.listExpandedMembers
  • serviceusage.groups.listMembers

serviceusage.quotas.get

serviceusage.services.get

serviceusage.values.test

(roles/deploymentmanager.typeViewer)

Provides read-only access to all Type Registry resources.

Lowest-level resources where you can grant this role:

  • Project

deploymentmanager.compositeTypes.get

deploymentmanager.compositeTypes.list

deploymentmanager.typeProviders.get

deploymentmanager.typeProviders.getType

deploymentmanager.typeProviders.list

deploymentmanager.typeProviders.listTypes

deploymentmanager.types.get

deploymentmanager.types.list

resourcemanager.projects.get

resourcemanager.projects.list

serviceusage.consumerpolicy.analyze

serviceusage.consumerpolicy.get

serviceusage.effectivepolicy.get

serviceusage.groups.*

  • serviceusage.groups.list
  • serviceusage.groups.listExpandedMembers
  • serviceusage.groups.listMembers

serviceusage.quotas.get

serviceusage.services.get

serviceusage.values.test

Service agent roles

Service agent roles should only be granted to service agents.

Role Permissions

(roles/clouddeploymentmanager.serviceAgent)

Allows Deployment Manager service to actuate resources across DM projects and folders

accesscontextmanager.accessLevels.create

accesscontextmanager.accessLevels.delete

accesscontextmanager.accessLevels.get

accesscontextmanager.accessLevels.update

accesscontextmanager.policies.list

accesscontextmanager.servicePerimeters.create

accesscontextmanager.servicePerimeters.delete

accesscontextmanager.servicePerimeters.get

accesscontextmanager.servicePerimeters.update

appengine.applications.get

appengine.operations.get

appengine.services.update

appengine.versions.create

appengine.versions.delete

appengine.versions.get

appengine.versions.list

artifactregistry.repositories.create

artifactregistry.repositories.delete

artifactregistry.repositories.get

artifactregistry.repositories.update

bigquery.connections.get

bigquery.datasets.create

bigquery.datasets.delete

bigquery.datasets.get

bigquery.datasets.getIamPolicy

bigquery.datasets.update

bigquery.jobs.create

bigquery.routines.create

bigquery.routines.get

bigquery.routines.update

bigquery.tables.create

bigquery.tables.delete

bigquery.tables.get

bigquery.tables.getData

bigquery.tables.setCategory

bigquery.tables.update

bigquery.tables.updateData

bigtable.instances.create

bigtable.instances.delete

bigtable.instances.get

bigtable.instances.update

bigtable.tables.create

bigtable.tables.delete

bigtable.tables.get

bigtable.tables.update

billing.resourceAssociations.create

billing.resourcebudgets.write

cloudbuild.builds.create

cloudbuild.builds.get

cloudfunctions.functions.call

cloudfunctions.functions.create

cloudfunctions.functions.delete

cloudfunctions.functions.get

cloudfunctions.functions.getIamPolicy

cloudfunctions.functions.list

cloudfunctions.functions.update

cloudfunctions.operations.get

cloudprivatecatalog.targets.get

cloudscheduler.jobs.create

cloudscheduler.jobs.delete

cloudscheduler.jobs.get

cloudscheduler.jobs.update

cloudsql.backupRuns.create

cloudsql.databases.*

  • cloudsql.databases.create
  • cloudsql.databases.delete
  • cloudsql.databases.get
  • cloudsql.databases.list
  • cloudsql.databases.update

cloudsql.instances.create

cloudsql.instances.delete

cloudsql.instances.get

cloudsql.instances.import

cloudsql.instances.restart

cloudsql.instances.update

cloudsql.sslCerts.create

cloudsql.sslCerts.delete

cloudsql.sslCerts.get

cloudsql.users.create

cloudsql.users.delete

cloudtasks.queues.create

cloudtasks.queues.delete

cloudtasks.queues.get

compute.addresses.create

compute.addresses.createInternal

compute.addresses.delete

compute.addresses.deleteInternal

compute.addresses.get

compute.addresses.list

compute.addresses.setLabels

compute.addresses.use

compute.addresses.useInternal

compute.autoscalers.create

compute.autoscalers.delete

compute.autoscalers.get

compute.autoscalers.update

compute.backendBuckets.create

compute.backendBuckets.delete

compute.backendBuckets.get

compute.backendBuckets.update

compute.backendBuckets.use

compute.backendServices.create

compute.backendServices.delete

compute.backendServices.get

compute.backendServices.setSecurityPolicy

compute.backendServices.update

compute.backendServices.use

compute.disks.addResourcePolicies

compute.disks.create

compute.disks.delete

compute.disks.get

compute.disks.removeResourcePolicies