Peran dan izin

Halaman ini mencantumkan izin yang diperlukan oleh Certificate Manager dan peran Identity and Access Management yang merangkumnya.

Izin

Bagian ini mencantumkan izin yang diperlukan untuk melakukan operasi tertentu di Certificate Manager.

Operasi dan metode Resource Izin
Membuat sertifikat

certificates.create		 Sertifikat certificatemanager.certs.create di project Google Cloud target. Jika menggunakan otorisasi DNS, juga memerlukan certificatemanager.dnsauthorizations.use pada setiap otorisasi DNS terkait.
Mencantumkan sertifikat

certificates.list		 Sertifikat certificatemanager.certs.list pada project Google Cloud target
Lihat sertifikat di konsol

serviceusage.quotas.get,
monitoring.timeSeries.list		 Sertifikat serviceusage.quotas.get dan monitoring.timeSeries.list pada project Google Cloud target
Mengambil sertifikat

certificates.get		 Sertifikat certificatemanager.certs.get pada sertifikat target
Memperbarui sertifikat

certificates.patch		 Sertifikat certificatemanager.certs.update pada sertifikat target
Melampirkan sertifikat ke resource Sertifikat certificatemanager.certs.use pada sertifikat target
Menghapus sertifikat

certificates.delete		 Sertifikat certificatemanager.certs.delete pada sertifikat target
Membuat peta sertifikat

certificateMaps.create		 Peta sertifikat certificatemanager.certmaps.create pada project Google Cloud target
Mencantumkan peta sertifikat

certificateMaps.list		 Peta sertifikat certificatemanager.certmaps.list pada project Google Cloud target
Mengambil peta sertifikat

certificateMaps.get		 Peta sertifikat certificatemanager.certmaps.get di peta sertifikat target
Memperbarui peta sertifikat

certificateMaps.patch		 Peta sertifikat certificatemanager.certmaps.update di peta sertifikat target
Melampirkan peta sertifikat ke resource Peta sertifikat certificatemanager.certmaps.use di peta sertifikat target
Menghapus peta sertifikat

certificateMaps.delete		 Peta sertifikat certificatemanager.certmaps.delete di peta sertifikat target
Membuat entri peta sertifikat

certificateMaps.certificateMapEntries.create		 Entri peta sertifikat certificatemanager.certmapentries.create pada peta sertifikat target dan certificatemanager.certs.use pada setiap sertifikat terkait.
Mencantumkan entri peta sertifikat

certificateMaps.certificateMapEntries.list		 Entri peta sertifikat certificatemanager.certmapentries.list pada peta sertifikat target
Mengambil entri peta sertifikat

certificateMaps.certificateMapEntries.get		 Entri peta sertifikat certificatemanager.certmapentries.get pada entri peta sertifikat target
Memperbarui entri peta sertifikat

certificateMaps.certificateMapEntries.patch		 Entri peta sertifikat certificatemanager.certmapentries.update pada entri peta sertifikat target dan certificatemanager.certs.use pada setiap sertifikat terkait.
Menghapus entri peta sertifikat

certificateMaps.certificateMapEntries.delete		 Entri peta sertifikat certificatemanager.certmapentries.delete pada entri peta sertifikat target
Membuat otorisasi DNS

dnsAuthorizations.create		 Otorisasi DNS certificatemanager.dnsauthorizations.create pada project Google Cloud target
Mencantumkan otorisasi DNS

dnsAuthorizations.list		 Otorisasi DNS certificatemanager.dnsauthorizations.list pada project Google Cloud target
Mengambil otorisasi DNS

dnsAuthorizations.get		 Otorisasi DNS certificatemanager.dnsauthorizations.get pada otorisasi DNS target
Memperbarui otorisasi DNS

dnsAuthorizations.patch		 Otorisasi DNS certificatemanager.dnsauthorizations.update pada otorisasi DNS target
Menghapus otorisasi DNS

dnsAuthorizations.delete		 Otorisasi DNS certificatemanager.dnsauthorizations.delete pada otorisasi DNS target
Membuat konfigurasi penerbitan sertifikat

certificateIssuanceConfigs.create		 Konfigurasi penerbitan sertifikat certificatemanager.certissuanceconfigs.create pada project Google Cloud target
Mencantumkan konfigurasi penerbitan sertifikat

certificateIssuanceConfigs.list		 Konfigurasi penerbitan sertifikat certificatemanager.certissuanceconfigs.list pada project Google Cloud target
Mengambil konfigurasi penerbitan sertifikat

certificateIssuanceConfigs.get		 Konfigurasi penerbitan sertifikat certificatemanager.certissuanceconfigs.get pada konfigurasi penerbitan sertifikat target
Menghapus konfigurasi penerbitan sertifikat

certificateIssuanceConfigs.delete		 Konfigurasi penerbitan sertifikat certificatemanager.certissuanceconfigs.delete pada konfigurasi penerbitan sertifikat target
Membuat konfigurasi kepercayaan

trustConfigs.create		 Konfigurasi tepercaya certificatemanager.trustconfigs.create pada project Google Cloud target
Mencantumkan konfigurasi kepercayaan

trustConfigs.list		 Konfigurasi tepercaya certificatemanager.trustconfigs.list pada project Google Cloud target
Mengupdate konfigurasi kepercayaan

trustConfigs.patch		 Konfigurasi tepercaya certificatemanager.trustconfigs.update pada konfigurasi kepercayaan target
Mendapatkan status konfigurasi kepercayaan

trustConfigs.get		 Konfigurasi kepercayaan certificatemanager.trustconfigs.get pada konfigurasi kepercayaan target
Melampirkan konfigurasi kepercayaan ke resource Konfigurasi tepercaya certificatemanager.trustconfigs.use pada konfigurasi kepercayaan target
Menghapus konfigurasi kepercayaan

trustConfigs.delete		 Konfigurasi tepercaya certificatemanager.trustconfigs.delete pada konfigurasi kepercayaan target
Membuat kunci akun eksternal

externalAccountKeys.create		 Kunci akun eksternal publicca.externalAccountKeys.create pada project Google Cloud target
Mengambil operasi yang berjalan lama

operations.get		 Operasi certificatemanager.operations.get pada operasi target
Mencantumkan operasi yang berjalan lama

operations.list		 Operasi certificatemanager.operations.list pada project Google Cloud target
Menghapus operasi yang berjalan lama dan telah selesai

operations.delete		 Operasi certificatemanager.operations.delete pada operasi target

Peran

Bagian ini mencantumkan peran IAM yang mencakup izin Certificate Manager.

Peran Certificate Manager untuk project Google Cloud

Tabel berikut mencantumkan peran project Google Cloud dan izin Certificate Manager yang dicakupnya.

Role Permissions

(roles/certificatemanager.admin)

Admin role for Certificate Manager

certificatemanager.*

  • certificatemanager.certissuanceconfigs.create
  • certificatemanager.certissuanceconfigs.createTagBinding
  • certificatemanager.certissuanceconfigs.delete
  • certificatemanager.certissuanceconfigs.deleteTagBinding
  • certificatemanager.certissuanceconfigs.get
  • certificatemanager.certissuanceconfigs.list
  • certificatemanager.certissuanceconfigs.listEffectiveTags
  • certificatemanager.certissuanceconfigs.listTagBindings
  • certificatemanager.certissuanceconfigs.update
  • certificatemanager.certissuanceconfigs.use
  • certificatemanager.certmapentries.create
  • certificatemanager.certmapentries.createTagBinding
  • certificatemanager.certmapentries.delete
  • certificatemanager.certmapentries.deleteTagBinding
  • certificatemanager.certmapentries.get
  • certificatemanager.certmapentries.list
  • certificatemanager.certmapentries.listEffectiveTags
  • certificatemanager.certmapentries.listTagBindings
  • certificatemanager.certmapentries.update
  • certificatemanager.certmaps.create
  • certificatemanager.certmaps.createTagBinding
  • certificatemanager.certmaps.delete
  • certificatemanager.certmaps.deleteTagBinding
  • certificatemanager.certmaps.get
  • certificatemanager.certmaps.list
  • certificatemanager.certmaps.listEffectiveTags
  • certificatemanager.certmaps.listTagBindings
  • certificatemanager.certmaps.update
  • certificatemanager.certmaps.use
  • certificatemanager.certs.create
  • certificatemanager.certs.createTagBinding
  • certificatemanager.certs.delete
  • certificatemanager.certs.deleteTagBinding
  • certificatemanager.certs.get
  • certificatemanager.certs.list
  • certificatemanager.certs.listEffectiveTags
  • certificatemanager.certs.listTagBindings
  • certificatemanager.certs.update
  • certificatemanager.certs.use
  • certificatemanager.dnsauthorizations.create
  • certificatemanager.dnsauthorizations.createTagBinding
  • certificatemanager.dnsauthorizations.delete
  • certificatemanager.dnsauthorizations.deleteTagBinding
  • certificatemanager.dnsauthorizations.get
  • certificatemanager.dnsauthorizations.list
  • certificatemanager.dnsauthorizations.listEffectiveTags
  • certificatemanager.dnsauthorizations.listTagBindings
  • certificatemanager.dnsauthorizations.update
  • certificatemanager.dnsauthorizations.use
  • certificatemanager.locations.get
  • certificatemanager.locations.list
  • certificatemanager.observedcerts.get
  • certificatemanager.observedcerts.list
  • certificatemanager.operations.cancel
  • certificatemanager.operations.delete
  • certificatemanager.operations.get
  • certificatemanager.operations.list
  • certificatemanager.trustconfigs.create
  • certificatemanager.trustconfigs.createTagBinding
  • certificatemanager.trustconfigs.delete
  • certificatemanager.trustconfigs.deleteTagBinding
  • certificatemanager.trustconfigs.get
  • certificatemanager.trustconfigs.list
  • certificatemanager.trustconfigs.listEffectiveTags
  • certificatemanager.trustconfigs.listTagBindings
  • certificatemanager.trustconfigs.update
  • certificatemanager.trustconfigs.use

resourcemanager.projects.get

resourcemanager.projects.list

(roles/certificatemanager.editor)

Edit access to Certificate Manager all resources.

certificatemanager.*

  • certificatemanager.certissuanceconfigs.create
  • certificatemanager.certissuanceconfigs.createTagBinding
  • certificatemanager.certissuanceconfigs.delete
  • certificatemanager.certissuanceconfigs.deleteTagBinding
  • certificatemanager.certissuanceconfigs.get
  • certificatemanager.certissuanceconfigs.list
  • certificatemanager.certissuanceconfigs.listEffectiveTags
  • certificatemanager.certissuanceconfigs.listTagBindings
  • certificatemanager.certissuanceconfigs.update
  • certificatemanager.certissuanceconfigs.use
  • certificatemanager.certmapentries.create
  • certificatemanager.certmapentries.createTagBinding
  • certificatemanager.certmapentries.delete
  • certificatemanager.certmapentries.deleteTagBinding
  • certificatemanager.certmapentries.get
  • certificatemanager.certmapentries.list
  • certificatemanager.certmapentries.listEffectiveTags
  • certificatemanager.certmapentries.listTagBindings
  • certificatemanager.certmapentries.update
  • certificatemanager.certmaps.create
  • certificatemanager.certmaps.createTagBinding
  • certificatemanager.certmaps.delete
  • certificatemanager.certmaps.deleteTagBinding
  • certificatemanager.certmaps.get
  • certificatemanager.certmaps.list
  • certificatemanager.certmaps.listEffectiveTags
  • certificatemanager.certmaps.listTagBindings
  • certificatemanager.certmaps.update
  • certificatemanager.certmaps.use
  • certificatemanager.certs.create
  • certificatemanager.certs.createTagBinding
  • certificatemanager.certs.delete
  • certificatemanager.certs.deleteTagBinding
  • certificatemanager.certs.get
  • certificatemanager.certs.list
  • certificatemanager.certs.listEffectiveTags
  • certificatemanager.certs.listTagBindings
  • certificatemanager.certs.update
  • certificatemanager.certs.use
  • certificatemanager.dnsauthorizations.create
  • certificatemanager.dnsauthorizations.createTagBinding
  • certificatemanager.dnsauthorizations.delete
  • certificatemanager.dnsauthorizations.deleteTagBinding
  • certificatemanager.dnsauthorizations.get
  • certificatemanager.dnsauthorizations.list
  • certificatemanager.dnsauthorizations.listEffectiveTags
  • certificatemanager.dnsauthorizations.listTagBindings
  • certificatemanager.dnsauthorizations.update
  • certificatemanager.dnsauthorizations.use
  • certificatemanager.locations.get
  • certificatemanager.locations.list
  • certificatemanager.observedcerts.get
  • certificatemanager.observedcerts.list
  • certificatemanager.operations.cancel
  • certificatemanager.operations.delete
  • certificatemanager.operations.get
  • certificatemanager.operations.list
  • certificatemanager.trustconfigs.create
  • certificatemanager.trustconfigs.createTagBinding
  • certificatemanager.trustconfigs.delete
  • certificatemanager.trustconfigs.deleteTagBinding
  • certificatemanager.trustconfigs.get
  • certificatemanager.trustconfigs.list
  • certificatemanager.trustconfigs.listEffectiveTags
  • certificatemanager.trustconfigs.listTagBindings
  • certificatemanager.trustconfigs.update
  • certificatemanager.trustconfigs.use

resourcemanager.projects.get

resourcemanager.projects.list

(roles/certificatemanager.viewer)

Read-only access to Certificate Manager all resources.

certificatemanager.certissuanceconfigs.get

certificatemanager.certissuanceconfigs.list

certificatemanager.certissuanceconfigs.listEffectiveTags

certificatemanager.certissuanceconfigs.listTagBindings

certificatemanager.certmapentries.get

certificatemanager.certmapentries.list

certificatemanager.certmapentries.listEffectiveTags

certificatemanager.certmapentries.listTagBindings

certificatemanager.certmaps.get

certificatemanager.certmaps.list

certificatemanager.certmaps.listEffectiveTags

certificatemanager.certmaps.listTagBindings

certificatemanager.certs.get

certificatemanager.certs.list

certificatemanager.certs.listEffectiveTags

certificatemanager.certs.listTagBindings

certificatemanager.dnsauthorizations.get

certificatemanager.dnsauthorizations.list

certificatemanager.dnsauthorizations.listEffectiveTags

certificatemanager.dnsauthorizations.listTagBindings

certificatemanager.locations.*

  • certificatemanager.locations.get
  • certificatemanager.locations.list

certificatemanager.observedcerts.*

  • certificatemanager.observedcerts.get
  • certificatemanager.observedcerts.list

certificatemanager.operations.get

certificatemanager.operations.list

certificatemanager.trustconfigs.get

certificatemanager.trustconfigs.list

certificatemanager.trustconfigs.listEffectiveTags

certificatemanager.trustconfigs.listTagBindings

resourcemanager.projects.get

resourcemanager.projects.list

(roles/certificatemanager.owner)

Full access to Certificate Manager all resources.

certificatemanager.*

  • certificatemanager.certissuanceconfigs.create
  • certificatemanager.certissuanceconfigs.createTagBinding
  • certificatemanager.certissuanceconfigs.delete
  • certificatemanager.certissuanceconfigs.deleteTagBinding
  • certificatemanager.certissuanceconfigs.get
  • certificatemanager.certissuanceconfigs.list
  • certificatemanager.certissuanceconfigs.listEffectiveTags
  • certificatemanager.certissuanceconfigs.listTagBindings
  • certificatemanager.certissuanceconfigs.update
  • certificatemanager.certissuanceconfigs.use
  • certificatemanager.certmapentries.create
  • certificatemanager.certmapentries.createTagBinding
  • certificatemanager.certmapentries.delete
  • certificatemanager.certmapentries.deleteTagBinding
  • certificatemanager.certmapentries.get
  • certificatemanager.certmapentries.list
  • certificatemanager.certmapentries.listEffectiveTags
  • certificatemanager.certmapentries.listTagBindings
  • certificatemanager.certmapentries.update
  • certificatemanager.certmaps.create
  • certificatemanager.certmaps.createTagBinding
  • certificatemanager.certmaps.delete
  • certificatemanager.certmaps.deleteTagBinding
  • certificatemanager.certmaps.get
  • certificatemanager.certmaps.list
  • certificatemanager.certmaps.listEffectiveTags
  • certificatemanager.certmaps.listTagBindings
  • certificatemanager.certmaps.update
  • certificatemanager.certmaps.use
  • certificatemanager.certs.create
  • certificatemanager.certs.createTagBinding
  • certificatemanager.certs.delete
  • certificatemanager.certs.deleteTagBinding
  • certificatemanager.certs.get
  • certificatemanager.certs.list
  • certificatemanager.certs.listEffectiveTags
  • certificatemanager.certs.listTagBindings
  • certificatemanager.certs.update
  • certificatemanager.certs.use
  • certificatemanager.dnsauthorizations.create
  • certificatemanager.dnsauthorizations.createTagBinding
  • certificatemanager.dnsauthorizations.delete
  • certificatemanager.dnsauthorizations.deleteTagBinding
  • certificatemanager.dnsauthorizations.get
  • certificatemanager.dnsauthorizations.list
  • certificatemanager.dnsauthorizations.listEffectiveTags
  • certificatemanager.dnsauthorizations.listTagBindings
  • certificatemanager.dnsauthorizations.update
  • certificatemanager.dnsauthorizations.use
  • certificatemanager.locations.get
  • certificatemanager.locations.list
  • certificatemanager.observedcerts.get
  • certificatemanager.observedcerts.list
  • certificatemanager.operations.cancel
  • certificatemanager.operations.delete
  • certificatemanager.operations.get
  • certificatemanager.operations.list
  • certificatemanager.trustconfigs.create
  • certificatemanager.trustconfigs.createTagBinding
  • certificatemanager.trustconfigs.delete
  • certificatemanager.trustconfigs.deleteTagBinding
  • certificatemanager.trustconfigs.get
  • certificatemanager.trustconfigs.list
  • certificatemanager.trustconfigs.listEffectiveTags
  • certificatemanager.trustconfigs.listTagBindings
  • certificatemanager.trustconfigs.update
  • certificatemanager.trustconfigs.use

resourcemanager.projects.get

resourcemanager.projects.list

Service agent roles

Service agent roles should only be granted to service agents.

Role Permissions

(roles/certificatemanager.serviceAgent)

Grants Certificate Manager access to services and APIs in the user project.

certificatemanager.locations.get

Peran CA Publik untuk project Google Cloud

Peran berikut dan izin yang dicakupnya diperlukan secara khusus untuk operasi Public CA:

Peran Izin
Public CA External Account Key Creator
(roles/publicca.externalAccountKeyCreator)

Membuat akses untuk resource akun kunci eksternal Public CA.

 resourcemanager.projects.get
resourcemanager.projects.list
publicca.externalAccountKeys.create

Peran khusus

Google Cloud juga memungkinkan Anda membuat peran khusus yang mencakup izin khusus untuk kebutuhan bisnis Anda, seperti prinsip hak istimewa yang paling tidak diperlukan. Untuk mengetahui petunjuknya, lihat Membuat dan mengelola peran khusus.

Langkah berikutnya