API 密钥使用 Identity and Access Management 来管理对密钥的访问权限。本页面介绍了与 API 密钥相关的 IAM 角色和权限，以及如何使用这些角色和权限来控制访问。
IAM 权限
下表显示了每个 API Keys API 方法所需的权限。API 参考中亦记录了此信息。
| 方法 | 所需权限 |
|---|---|
projects.locations.keys.create |
apikeys.keys.create
|
projects.locations.keys.delete |
apikeys.keys.delete |
projects.locations.keys.get |
apikeys.keys.get |
projects.locations.keys.getKeyString |
apikeys.keys.getKeyString |
projects.locations.keys.list |
apikeys.keys.list |
projects.locations.keys.patch |
apikeys.keys.update |
projects.locations.keys.undelete |
apikeys.keys.undelete |
operations.get |
serviceusage.operations.get |
keys.lookupKey |
apikeys.keys.undelete |
IAM 角色
Identity and Access Management 支持将用户绑定到角色来授予权限。如需详细了解角色和权限，请参阅了解角色。
下表列出了适用于 API 密钥的预定义角色。
| 角色 | 权限 |
|---|---|
roles/viewer |
apikeys.keys.get apikeys.keys.lookup apikeys.keys.list apikeys.keys.getKeyString |
roles/editor 和roles/owner |
apikeys.keys.get apikeys.keys.lookup apikeys.keys.list apikeys.keys.getKeyString apikeys.keys.create apikeys.keys.delete apikeys.keys.undelete apikeys.keys.update serviceusage.operations.get |
roles/serviceusage.apiKeysViewer |
apikeys.keys.get apikeys.keys.lookup apikeys.keys.list apikeys.keys.getKeyString |
roles/serviceusage.apiKeysAdmin |
apikeys.keys.get apikeys.keys.lookup apikeys.keys.list apikeys.keys.getKeyString apikeys.keys.create apikeys.keys.delete apikeys.keys.undelete apikeys.keys.update serviceusage.operations.get |