角色和權限

本頁面列出 Certificate Manager 所需的權限，以及包含這些權限的 Identity and Access Management 角色。

權限

本節列出在 Certificate Manager 中執行特定作業所需的權限。

作業和方法 資源 權限
建立憑證

certificates.create		 憑證 目標 Google Cloud 專案的certificatemanager.certs.create。如果使用 DNS 授權，則每項相關聯的 DNS 授權也必須具備 certificatemanager.dnsauthorizations.use。
列出憑證

certificates.list		 憑證 目標 Google Cloud 專案的certificatemanager.certs.list
在控制台中查看憑證

serviceusage.quotas.get、
monitoring.timeSeries.list		 憑證 目標 Google Cloud 專案的 serviceusage.quotas.get 和 monitoring.timeSeries.list
擷取憑證

certificates.get		 憑證 目標憑證上的 certificatemanager.certs.get
更新憑證

certificates.patch		 憑證 目標憑證上的 certificatemanager.certs.update
將憑證附加至資源 憑證 目標憑證上的 certificatemanager.certs.use
刪除憑證

certificates.delete		 憑證 目標憑證上的 certificatemanager.certs.delete
建立憑證對應組合

certificateMaps.create		 憑證對應組合 目標 Google Cloud 專案的certificatemanager.certmaps.create
列出憑證對應組合

certificateMaps.list		 憑證對應組合 目標 Google Cloud 專案的certificatemanager.certmaps.list
擷取憑證對應組合

certificateMaps.get		 憑證對應組合 目標憑證對應組合上的 certificatemanager.certmaps.get
更新憑證對應組合

certificateMaps.patch		 憑證對應組合 目標憑證對應組合上的 certificatemanager.certmaps.update
將憑證對應組合附加至資源 憑證對應組合 目標憑證對應組合上的 certificatemanager.certmaps.use
刪除憑證對應組合

certificateMaps.delete		 憑證對應組合 目標憑證對應組合上的 certificatemanager.certmaps.delete
建立憑證對應關係項目

certificateMaps.certificateMapEntries.create		 憑證對應關係 目標憑證對應組合上的 certificatemanager.certmapentries.create，以及每個相關聯憑證上的 certificatemanager.certs.use。
列出憑證對應關係

certificateMaps.certificateMapEntries.list		 憑證對應關係 目標憑證對應組合上的 certificatemanager.certmapentries.list
擷取憑證對應關係

certificateMaps.certificateMapEntries.get		 憑證對應關係 目標憑證對應關係上的 certificatemanager.certmapentries.get
更新憑證對應關係

certificateMaps.certificateMapEntries.patch		 憑證對應關係 目標憑證對應項目上的 certificatemanager.certmapentries.update，以及各個相關聯憑證上的 certificatemanager.certs.use。
刪除憑證對應關係項目

certificateMaps.certificateMapEntries.delete		 憑證對應關係 目標憑證對應關係上的 certificatemanager.certmapentries.delete
建立 DNS 授權

dnsAuthorizations.create		 DNS 授權 目標 Google Cloud 專案的certificatemanager.dnsauthorizations.create
列出 DNS 授權

dnsAuthorizations.list		 DNS 授權 目標 Google Cloud 專案的certificatemanager.dnsauthorizations.list
擷取 DNS 授權

dnsAuthorizations.get		 DNS 授權 目標 DNS 授權的 certificatemanager.dnsauthorizations.get
更新 DNS 授權

dnsAuthorizations.patch		 DNS 授權 目標 DNS 授權的 certificatemanager.dnsauthorizations.update
刪除 DNS 授權

dnsAuthorizations.delete		 DNS 授權 目標 DNS 授權的 certificatemanager.dnsauthorizations.delete
建立憑證核發設定

certificateIssuanceConfigs.create		 憑證核發設定 目標 Google Cloud 專案的certificatemanager.certissuanceconfigs.create
列出憑證核發設定

certificateIssuanceConfigs.list		 憑證核發設定 目標 Google Cloud 專案的certificatemanager.certissuanceconfigs.list
擷取憑證核發設定

certificateIssuanceConfigs.get		 憑證核發設定 目標憑證核發設定的 certificatemanager.certissuanceconfigs.get
刪除憑證核發設定

certificateIssuanceConfigs.delete		 憑證核發設定 目標憑證核發設定的 certificatemanager.certissuanceconfigs.delete
建立信任設定

trustConfigs.create		 信任設定 目標 Google Cloud 專案的certificatemanager.trustconfigs.create
列出信任設定

trustConfigs.list		 信任設定 目標 Google Cloud 專案的certificatemanager.trustconfigs.list
更新信任設定

trustConfigs.patch		 信任設定 目標信任設定的 certificatemanager.trustconfigs.update
取得信任設定的狀態

trustConfigs.get		 信任設定 目標信任設定的 certificatemanager.trustconfigs.get
將信任設定附加至資源 信任設定 目標信任設定的 certificatemanager.trustconfigs.use
刪除信任設定

trustConfigs.delete		 信任設定 目標信任設定的 certificatemanager.trustconfigs.delete
建立外部帳戶金鑰

externalAccountKeys.create		 外部帳戶金鑰 目標 Google Cloud 專案的publicca.externalAccountKeys.create
擷取長時間執行的作業

operations.get		 作業 目標作業的 certificatemanager.operations.get
列出長時間執行的作業

operations.list		 作業 目標 Google Cloud 專案的certificatemanager.operations.list
刪除已完成的長時間執行作業

operations.delete		 作業 目標作業的 certificatemanager.operations.delete

角色

本節列出包含 Certificate Manager 權限的 IAM 角色。

Google Cloud 專案的 Certificate Manager 角色

下表列出 Google Cloud 專案角色及其包含的 Certificate Manager 權限。

Role Permissions

(roles/certificatemanager.admin)

Admin role for Certificate Manager

certificatemanager.*

  • certificatemanager.certissuanceconfigs.create
  • certificatemanager.certissuanceconfigs.createTagBinding
  • certificatemanager.certissuanceconfigs.delete
  • certificatemanager.certissuanceconfigs.deleteTagBinding
  • certificatemanager.certissuanceconfigs.get
  • certificatemanager.certissuanceconfigs.list
  • certificatemanager.certissuanceconfigs.listEffectiveTags
  • certificatemanager.certissuanceconfigs.listTagBindings
  • certificatemanager.certissuanceconfigs.update
  • certificatemanager.certissuanceconfigs.use
  • certificatemanager.certmapentries.create
  • certificatemanager.certmapentries.createTagBinding
  • certificatemanager.certmapentries.delete
  • certificatemanager.certmapentries.deleteTagBinding
  • certificatemanager.certmapentries.get
  • certificatemanager.certmapentries.list
  • certificatemanager.certmapentries.listEffectiveTags
  • certificatemanager.certmapentries.listTagBindings
  • certificatemanager.certmapentries.update
  • certificatemanager.certmaps.create
  • certificatemanager.certmaps.createTagBinding
  • certificatemanager.certmaps.delete
  • certificatemanager.certmaps.deleteTagBinding
  • certificatemanager.certmaps.get
  • certificatemanager.certmaps.list
  • certificatemanager.certmaps.listEffectiveTags
  • certificatemanager.certmaps.listTagBindings
  • certificatemanager.certmaps.update
  • certificatemanager.certmaps.use
  • certificatemanager.certs.create
  • certificatemanager.certs.createTagBinding
  • certificatemanager.certs.delete
  • certificatemanager.certs.deleteTagBinding
  • certificatemanager.certs.get
  • certificatemanager.certs.list
  • certificatemanager.certs.listEffectiveTags
  • certificatemanager.certs.listTagBindings
  • certificatemanager.certs.update
  • certificatemanager.certs.use
  • certificatemanager.dnsauthorizations.create
  • certificatemanager.dnsauthorizations.createTagBinding
  • certificatemanager.dnsauthorizations.delete
  • certificatemanager.dnsauthorizations.deleteTagBinding
  • certificatemanager.dnsauthorizations.get
  • certificatemanager.dnsauthorizations.list
  • certificatemanager.dnsauthorizations.listEffectiveTags
  • certificatemanager.dnsauthorizations.listTagBindings
  • certificatemanager.dnsauthorizations.update
  • certificatemanager.dnsauthorizations.use
  • certificatemanager.locations.get
  • certificatemanager.locations.list
  • certificatemanager.observedcerts.get
  • certificatemanager.observedcerts.list
  • certificatemanager.operations.cancel
  • certificatemanager.operations.delete
  • certificatemanager.operations.get
  • certificatemanager.operations.list
  • certificatemanager.trustconfigs.create
  • certificatemanager.trustconfigs.createTagBinding
  • certificatemanager.trustconfigs.delete
  • certificatemanager.trustconfigs.deleteTagBinding
  • certificatemanager.trustconfigs.get
  • certificatemanager.trustconfigs.list
  • certificatemanager.trustconfigs.listEffectiveTags
  • certificatemanager.trustconfigs.listTagBindings
  • certificatemanager.trustconfigs.update
  • certificatemanager.trustconfigs.use

resourcemanager.projects.get

resourcemanager.projects.list

(roles/certificatemanager.editor)

Edit access to Certificate Manager all resources.

certificatemanager.*

  • certificatemanager.certissuanceconfigs.create
  • certificatemanager.certissuanceconfigs.createTagBinding
  • certificatemanager.certissuanceconfigs.delete
  • certificatemanager.certissuanceconfigs.deleteTagBinding
  • certificatemanager.certissuanceconfigs.get
  • certificatemanager.certissuanceconfigs.list
  • certificatemanager.certissuanceconfigs.listEffectiveTags
  • certificatemanager.certissuanceconfigs.listTagBindings
  • certificatemanager.certissuanceconfigs.update
  • certificatemanager.certissuanceconfigs.use
  • certificatemanager.certmapentries.create
  • certificatemanager.certmapentries.createTagBinding
  • certificatemanager.certmapentries.delete
  • certificatemanager.certmapentries.deleteTagBinding
  • certificatemanager.certmapentries.get
  • certificatemanager.certmapentries.list
  • certificatemanager.certmapentries.listEffectiveTags
  • certificatemanager.certmapentries.listTagBindings
  • certificatemanager.certmapentries.update
  • certificatemanager.certmaps.create
  • certificatemanager.certmaps.createTagBinding
  • certificatemanager.certmaps.delete
  • certificatemanager.certmaps.deleteTagBinding
  • certificatemanager.certmaps.get
  • certificatemanager.certmaps.list
  • certificatemanager.certmaps.listEffectiveTags
  • certificatemanager.certmaps.listTagBindings
  • certificatemanager.certmaps.update
  • certificatemanager.certmaps.use
  • certificatemanager.certs.create
  • certificatemanager.certs.createTagBinding
  • certificatemanager.certs.delete
  • certificatemanager.certs.deleteTagBinding
  • certificatemanager.certs.get
  • certificatemanager.certs.list
  • certificatemanager.certs.listEffectiveTags
  • certificatemanager.certs.listTagBindings
  • certificatemanager.certs.update
  • certificatemanager.certs.use
  • certificatemanager.dnsauthorizations.create
  • certificatemanager.dnsauthorizations.createTagBinding
  • certificatemanager.dnsauthorizations.delete
  • certificatemanager.dnsauthorizations.deleteTagBinding
  • certificatemanager.dnsauthorizations.get
  • certificatemanager.dnsauthorizations.list
  • certificatemanager.dnsauthorizations.listEffectiveTags
  • certificatemanager.dnsauthorizations.listTagBindings
  • certificatemanager.dnsauthorizations.update
  • certificatemanager.dnsauthorizations.use
  • certificatemanager.locations.get
  • certificatemanager.locations.list
  • certificatemanager.observedcerts.get
  • certificatemanager.observedcerts.list
  • certificatemanager.operations.cancel
  • certificatemanager.operations.delete
  • certificatemanager.operations.get
  • certificatemanager.operations.list
  • certificatemanager.trustconfigs.create
  • certificatemanager.trustconfigs.createTagBinding
  • certificatemanager.trustconfigs.delete
  • certificatemanager.trustconfigs.deleteTagBinding
  • certificatemanager.trustconfigs.get
  • certificatemanager.trustconfigs.list
  • certificatemanager.trustconfigs.listEffectiveTags
  • certificatemanager.trustconfigs.listTagBindings
  • certificatemanager.trustconfigs.update
  • certificatemanager.trustconfigs.use

resourcemanager.projects.get

resourcemanager.projects.list

(roles/certificatemanager.viewer)

Read-only access to Certificate Manager all resources.

certificatemanager.certissuanceconfigs.get

certificatemanager.certissuanceconfigs.list

certificatemanager.certissuanceconfigs.listEffectiveTags

certificatemanager.certissuanceconfigs.listTagBindings

certificatemanager.certmapentries.get

certificatemanager.certmapentries.list

certificatemanager.certmapentries.listEffectiveTags

certificatemanager.certmapentries.listTagBindings

certificatemanager.certmaps.get

certificatemanager.certmaps.list

certificatemanager.certmaps.listEffectiveTags

certificatemanager.certmaps.listTagBindings

certificatemanager.certs.get

certificatemanager.certs.list

certificatemanager.certs.listEffectiveTags

certificatemanager.certs.listTagBindings

certificatemanager.dnsauthorizations.get

certificatemanager.dnsauthorizations.list

certificatemanager.dnsauthorizations.listEffectiveTags

certificatemanager.dnsauthorizations.listTagBindings

certificatemanager.locations.*

  • certificatemanager.locations.get
  • certificatemanager.locations.list

certificatemanager.observedcerts.*

  • certificatemanager.observedcerts.get
  • certificatemanager.observedcerts.list

certificatemanager.operations.get

certificatemanager.operations.list

certificatemanager.trustconfigs.get

certificatemanager.trustconfigs.list

certificatemanager.trustconfigs.listEffectiveTags

certificatemanager.trustconfigs.listTagBindings

resourcemanager.projects.get

resourcemanager.projects.list

(roles/certificatemanager.owner)

Full access to Certificate Manager all resources.

certificatemanager.*

  • certificatemanager.certissuanceconfigs.create
  • certificatemanager.certissuanceconfigs.createTagBinding
  • certificatemanager.certissuanceconfigs.delete
  • certificatemanager.certissuanceconfigs.deleteTagBinding
  • certificatemanager.certissuanceconfigs.get
  • certificatemanager.certissuanceconfigs.list
  • certificatemanager.certissuanceconfigs.listEffectiveTags
  • certificatemanager.certissuanceconfigs.listTagBindings
  • certificatemanager.certissuanceconfigs.update
  • certificatemanager.certissuanceconfigs.use
  • certificatemanager.certmapentries.create
  • certificatemanager.certmapentries.createTagBinding
  • certificatemanager.certmapentries.delete
  • certificatemanager.certmapentries.deleteTagBinding
  • certificatemanager.certmapentries.get
  • certificatemanager.certmapentries.list
  • certificatemanager.certmapentries.listEffectiveTags
  • certificatemanager.certmapentries.listTagBindings
  • certificatemanager.certmapentries.update
  • certificatemanager.certmaps.create
  • certificatemanager.certmaps.createTagBinding
  • certificatemanager.certmaps.delete
  • certificatemanager.certmaps.deleteTagBinding
  • certificatemanager.certmaps.get
  • certificatemanager.certmaps.list
  • certificatemanager.certmaps.listEffectiveTags
  • certificatemanager.certmaps.listTagBindings
  • certificatemanager.certmaps.update
  • certificatemanager.certmaps.use
  • certificatemanager.certs.create
  • certificatemanager.certs.createTagBinding
  • certificatemanager.certs.delete
  • certificatemanager.certs.deleteTagBinding
  • certificatemanager.certs.get
  • certificatemanager.certs.list
  • certificatemanager.certs.listEffectiveTags
  • certificatemanager.certs.listTagBindings
  • certificatemanager.certs.update
  • certificatemanager.certs.use
  • certificatemanager.dnsauthorizations.create
  • certificatemanager.dnsauthorizations.createTagBinding
  • certificatemanager.dnsauthorizations.delete
  • certificatemanager.dnsauthorizations.deleteTagBinding
  • certificatemanager.dnsauthorizations.get
  • certificatemanager.dnsauthorizations.list
  • certificatemanager.dnsauthorizations.listEffectiveTags
  • certificatemanager.dnsauthorizations.listTagBindings
  • certificatemanager.dnsauthorizations.update
  • certificatemanager.dnsauthorizations.use
  • certificatemanager.locations.get
  • certificatemanager.locations.list
  • certificatemanager.observedcerts.get
  • certificatemanager.observedcerts.list
  • certificatemanager.operations.cancel
  • certificatemanager.operations.delete
  • certificatemanager.operations.get
  • certificatemanager.operations.list
  • certificatemanager.trustconfigs.create
  • certificatemanager.trustconfigs.createTagBinding
  • certificatemanager.trustconfigs.delete
  • certificatemanager.trustconfigs.deleteTagBinding
  • certificatemanager.trustconfigs.get
  • certificatemanager.trustconfigs.list
  • certificatemanager.trustconfigs.listEffectiveTags
  • certificatemanager.trustconfigs.listTagBindings
  • certificatemanager.trustconfigs.update
  • certificatemanager.trustconfigs.use

resourcemanager.projects.get

resourcemanager.projects.list

Service agent roles

Service agent roles should only be granted to service agents.

Role Permissions

(roles/certificatemanager.serviceAgent)

Grants Certificate Manager access to services and APIs in the user project.

certificatemanager.locations.get

Google Cloud 專案的公開 CA 角色

下列角色和其包含的權限，是公開 CA 作業的必要項目：

角色 權限
公開 CA 外部帳戶金鑰建立者
(roles/publicca.externalAccountKeyCreator)

建立公開 CA 外部金鑰帳戶資源的存取權。

 resourcemanager.projects.get
resourcemanager.projects.list
publicca.externalAccountKeys.create

自訂角色

Google Cloud 還可讓您建立自訂角色，封裝業務需求專屬的權限，例如最小必要權限原則。如需操作說明，請參閱「建立及管理自訂角色」。

後續步驟