Peran IAM Knowledge Catalog

Dengan pengelolaan identitas dan akses (IAM), Anda dapat mengontrol siapa yang dapat melakukan tindakan apa dalam Knowledge Catalog (sebelumnya Dataplex Universal Catalog). Anda dapat menerapkan prinsip keamanan hak istimewa terendah untuk melindungi data pribadi, menghindari akses tidak sah, mengurangi permukaan serangan, atau memenuhi kepatuhan terhadap peraturan.

Knowledge Catalog menyediakan beberapa peran IAM bawaan, yang masing-masing memiliki serangkaian izin tertentu yang memungkinkan pengguna melakukan tindakan. Anda dapat memberikan peran ini menggunakan kebijakan IAM.

Untuk kontrol yang lebih terperinci, Anda dapat membuat peran IAM khusus dengan memilih izin tertentu dan menetapkan peran baru tersebut kepada pengguna. Peran khusus memungkinkan Anda membuat model akses yang sesuai dengan kebutuhan organisasi.

Dokumen ini menjelaskan peran IAM bawaan dan kustom yang relevan dengan Knowledge Catalog.

Untuk mengetahui deskripsi mendetail tentang IAM dan fitur-fiturnya, lihat dokumentasi IAM.

Jika Anda menggunakan Data Catalog, pemberian akses entri Data Catalog tidak akan otomatis diteruskan ke entri Knowledge Catalog. Anda harus memberikan akses secara eksplisit ke entri Knowledge Catalog sebelum menggunakannya.

Tentang peran Knowledge Catalog

Peran IAM Katalog Pengetahuan adalah paket berisi satu atau beberapa izin. Anda memberikan peran kepada akun utama agar mereka dapat melakukan tindakan pada resource Knowledge Catalog di project Anda. Misalnya, peran Dataplex Viewer berisi izin dataplex.*.get dan dataplex.*.list, yang memungkinkan pengguna mendapatkan dan mencantumkan resource Knowledge Catalog dalam project. Untuk mengetahui informasi selengkapnya, lihat Izin Katalog Pengetahuan.

Anda dapat menerapkan peran Knowledge Catalog ke resource apa pun dalam hierarki layanan, termasuk yang berikut:

• Project
• Data lake, zona data, dan aset
• Pemindaian data, tugas, dan lingkungan
• Grup entri, jenis entri, jenis link entri, jenis aspek, dan glosarium
• Taksonomi data, atribut data, dan pengikatan atribut data

Peran bawaan untuk Knowledge Catalog

Peran bawaan berisi izin yang diperlukan untuk melakukan tugas atau sekelompok tugas terkait.

Peran berikut memberikan akses luas ke resource Knowledge Catalog:

Peran	Deskripsi
Administrator Dataplex (roles/dataplex.admin)	Akses penuh ke resource Knowledge Catalog.
Editor Dataplex (roles/dataplex.editor)	Akses edit ke resource Knowledge Catalog.
Pelihat Dataplex (roles/dataplex.viewer)	Akses hanya baca ke resource Knowledge Catalog.
Dataplex Developer (roles/dataplex.developer)	Memungkinkan Anda menjalankan workload analisis data.

Peran Administrator Dataplex (roles/dataplex.admin), Editor Dataplex (roles/dataplex.editor), dan Pelihat Dataplex (roles/dataplex.viewer) tidak memberikan akses ke resource metadata seperti grup entri, entri, link entri, jenis entri, jenis link entri, dan jenis aspek.

Tabel berikut mencantumkan peran bawaan Knowledge Catalog dan izin yang terkait dengan setiap peran:

Role	Permissions
Dataplex Administrator (roles/dataplex.admin) Full access to Dataplex Universal Catalog resources, except for catalog resources like entries and entry groups.	cloudasset.assets.analyzeIamPolicy cloudasset.assets.searchAllIamPolicies cloudasset.assets.searchAllResources dataplex.assetActions.list dataplex.assets.create dataplex.assets.delete dataplex.assets.get dataplex.assets.getIamPolicy dataplex.assets.list dataplex.assets.setIamPolicy dataplex.assets.update dataplex.content.* dataplex.content.create dataplex.content.delete dataplex.content.get dataplex.content.getIamPolicy dataplex.content.list dataplex.content.setIamPolicy dataplex.content.update dataplex.dataAssets.* dataplex.dataAssets.create dataplex.dataAssets.delete dataplex.dataAssets.get dataplex.dataAssets.list dataplex.dataAssets.update dataplex.dataAttributeBindings.* dataplex.dataAttributeBindings.create dataplex.dataAttributeBindings.delete dataplex.dataAttributeBindings.get dataplex.dataAttributeBindings.getIamPolicy dataplex.dataAttributeBindings.list dataplex.dataAttributeBindings.setIamPolicy dataplex.dataAttributeBindings.update dataplex.dataAttributes.* dataplex.dataAttributes.bind dataplex.dataAttributes.create dataplex.dataAttributes.delete dataplex.dataAttributes.get dataplex.dataAttributes.getIamPolicy dataplex.dataAttributes.list dataplex.dataAttributes.setIamPolicy dataplex.dataAttributes.update dataplex.dataProducts.* dataplex.dataProducts.create dataplex.dataProducts.delete dataplex.dataProducts.get dataplex.dataProducts.getIamPolicy dataplex.dataProducts.list dataplex.dataProducts.setIamPolicy dataplex.dataProducts.update dataplex.dataTaxonomies.* dataplex.dataTaxonomies.configureDataAccess dataplex.dataTaxonomies.configureResourceAccess dataplex.dataTaxonomies.create dataplex.dataTaxonomies.delete dataplex.dataTaxonomies.get dataplex.dataTaxonomies.getIamPolicy dataplex.dataTaxonomies.list dataplex.dataTaxonomies.setIamPolicy dataplex.dataTaxonomies.update dataplex.datascans.* dataplex.datascans.create dataplex.datascans.delete dataplex.datascans.get dataplex.datascans.getData dataplex.datascans.getIamPolicy dataplex.datascans.list dataplex.datascans.run dataplex.datascans.setIamPolicy dataplex.datascans.update dataplex.entities.* dataplex.entities.create dataplex.entities.delete dataplex.entities.get dataplex.entities.list dataplex.entities.update dataplex.entries.link dataplex.entryGroups.export dataplex.entryGroups.import dataplex.entryGroups.useDefinitionEntryLink dataplex.entryGroups.useRelatedEntryLink dataplex.entryGroups.useSchemaJoinEntryLink dataplex.entryGroups.useSynonymEntryLink dataplex.entryLinks.* dataplex.entryLinks.create dataplex.entryLinks.delete dataplex.entryLinks.get dataplex.entryLinks.reference dataplex.entryLinks.update dataplex.environments.* dataplex.environments.create dataplex.environments.delete dataplex.environments.execute dataplex.environments.get dataplex.environments.getIamPolicy dataplex.environments.list dataplex.environments.setIamPolicy dataplex.environments.update dataplex.glossaries.* dataplex.glossaries.create dataplex.glossaries.delete dataplex.glossaries.get dataplex.glossaries.getIamPolicy dataplex.glossaries.import dataplex.glossaries.list dataplex.glossaries.setIamPolicy dataplex.glossaries.update dataplex.glossaryCategories.* dataplex.glossaryCategories.create dataplex.glossaryCategories.delete dataplex.glossaryCategories.get dataplex.glossaryCategories.list dataplex.glossaryCategories.update dataplex.glossaryTerms.* dataplex.glossaryTerms.create dataplex.glossaryTerms.delete dataplex.glossaryTerms.get dataplex.glossaryTerms.list dataplex.glossaryTerms.update dataplex.glossaryTerms.use dataplex.lakeActions.list dataplex.lakes.* dataplex.lakes.create dataplex.lakes.delete dataplex.lakes.get dataplex.lakes.getIamPolicy dataplex.lakes.list dataplex.lakes.setIamPolicy dataplex.lakes.update dataplex.locations.* dataplex.locations.get dataplex.locations.list dataplex.metadataFeeds.* dataplex.metadataFeeds.create dataplex.metadataFeeds.delete dataplex.metadataFeeds.get dataplex.metadataFeeds.list dataplex.metadataFeeds.update dataplex.metadataJobs.* dataplex.metadataJobs.cancel dataplex.metadataJobs.create dataplex.metadataJobs.get dataplex.metadataJobs.list dataplex.operations.* dataplex.operations.cancel dataplex.operations.delete dataplex.operations.get dataplex.operations.list dataplex.partitions.* dataplex.partitions.create dataplex.partitions.delete dataplex.partitions.get dataplex.partitions.list dataplex.partitions.update dataplex.tasks.* dataplex.tasks.cancel dataplex.tasks.create dataplex.tasks.delete dataplex.tasks.get dataplex.tasks.getIamPolicy dataplex.tasks.list dataplex.tasks.run dataplex.tasks.setIamPolicy dataplex.tasks.update dataplex.zoneActions.list dataplex.zones.* dataplex.zones.create dataplex.zones.delete dataplex.zones.get dataplex.zones.getIamPolicy dataplex.zones.list dataplex.zones.setIamPolicy dataplex.zones.update resourcemanager.projects.get resourcemanager.projects.list
Dataplex DataScan Administrator (roles/dataplex.dataScanAdmin) Full access to DataScan resources.	dataplex.datascans.* dataplex.datascans.create dataplex.datascans.delete dataplex.datascans.get dataplex.datascans.getData dataplex.datascans.getIamPolicy dataplex.datascans.list dataplex.datascans.run dataplex.datascans.setIamPolicy dataplex.datascans.update dataplex.operations.get dataplex.operations.list
Dataplex Editor (roles/dataplex.editor) Write access to Dataplex Universal Catalog resources, except for catalog resources like entries, entry groups, and glossaries.	cloudasset.assets.analyzeIamPolicy dataplex.assetActions.list dataplex.assets.create dataplex.assets.delete dataplex.assets.get dataplex.assets.getIamPolicy dataplex.assets.list dataplex.assets.update dataplex.content.delete dataplex.content.get dataplex.content.getIamPolicy dataplex.content.list dataplex.dataAssets.* dataplex.dataAssets.create dataplex.dataAssets.delete dataplex.dataAssets.get dataplex.dataAssets.list dataplex.dataAssets.update dataplex.dataAttributeBindings.create dataplex.dataAttributeBindings.delete dataplex.dataAttributeBindings.get dataplex.dataAttributeBindings.getIamPolicy dataplex.dataAttributeBindings.list dataplex.dataAttributeBindings.update dataplex.dataAttributes.bind dataplex.dataAttributes.create dataplex.dataAttributes.delete dataplex.dataAttributes.get dataplex.dataAttributes.getIamPolicy dataplex.dataAttributes.list dataplex.dataAttributes.update dataplex.dataProducts.create dataplex.dataProducts.delete dataplex.dataProducts.get dataplex.dataProducts.getIamPolicy dataplex.dataProducts.list dataplex.dataProducts.update dataplex.dataTaxonomies.configureDataAccess dataplex.dataTaxonomies.configureResourceAccess dataplex.dataTaxonomies.create dataplex.dataTaxonomies.delete dataplex.dataTaxonomies.get dataplex.dataTaxonomies.getIamPolicy dataplex.dataTaxonomies.list dataplex.dataTaxonomies.update dataplex.datascans.create dataplex.datascans.delete dataplex.datascans.get dataplex.datascans.getIamPolicy dataplex.datascans.list dataplex.datascans.run dataplex.datascans.update dataplex.environments.create dataplex.environments.delete dataplex.environments.get dataplex.environments.getIamPolicy dataplex.environments.list dataplex.environments.update dataplex.lakeActions.list dataplex.lakes.create dataplex.lakes.delete dataplex.lakes.get dataplex.lakes.getIamPolicy dataplex.lakes.list dataplex.lakes.update dataplex.operations.* dataplex.operations.cancel dataplex.operations.delete dataplex.operations.get dataplex.operations.list dataplex.tasks.cancel dataplex.tasks.create dataplex.tasks.delete dataplex.tasks.get dataplex.tasks.getIamPolicy dataplex.tasks.list dataplex.tasks.run dataplex.tasks.update dataplex.zoneActions.list dataplex.zones.create dataplex.zones.delete dataplex.zones.get dataplex.zones.getIamPolicy dataplex.zones.list dataplex.zones.update
Dataplex Viewer (roles/dataplex.viewer) Read access to Dataplex Universal Catalog resources, except for catalog resources like entries, entry groups, and glossaries.	cloudasset.assets.analyzeIamPolicy dataplex.assetActions.list dataplex.assets.get dataplex.assets.getIamPolicy dataplex.assets.list dataplex.content.get dataplex.content.getIamPolicy dataplex.content.list dataplex.dataAssets.get dataplex.dataAssets.list dataplex.dataAttributeBindings.get dataplex.dataAttributeBindings.getIamPolicy dataplex.dataAttributeBindings.list dataplex.dataAttributes.get dataplex.dataAttributes.getIamPolicy dataplex.dataAttributes.list dataplex.dataProducts.get dataplex.dataProducts.getIamPolicy dataplex.dataProducts.list dataplex.dataTaxonomies.get dataplex.dataTaxonomies.getIamPolicy dataplex.dataTaxonomies.list dataplex.datascans.get dataplex.datascans.getIamPolicy dataplex.datascans.list dataplex.environments.get dataplex.environments.getIamPolicy dataplex.environments.list dataplex.lakeActions.list dataplex.lakes.get dataplex.lakes.getIamPolicy dataplex.lakes.list dataplex.operations.get dataplex.operations.list dataplex.tasks.get dataplex.tasks.getIamPolicy dataplex.tasks.list dataplex.zoneActions.list dataplex.zones.get dataplex.zones.getIamPolicy dataplex.zones.list
Dataplex Aspect Type Owner (roles/dataplex.aspectTypeOwner) Grants access to creating and managing Aspect Types. Does not give the right to create/modify Entries.	datacatalog.migrationConfig.get dataplex.aspectTypes.* dataplex.aspectTypes.create dataplex.aspectTypes.delete dataplex.aspectTypes.get dataplex.aspectTypes.getIamPolicy dataplex.aspectTypes.list dataplex.aspectTypes.setIamPolicy dataplex.aspectTypes.update dataplex.aspectTypes.use dataplex.operations.get dataplex.projects.search resourcemanager.projects.get resourcemanager.projects.list
Dataplex Aspect Type User (roles/dataplex.aspectTypeUser) Grants access to use Aspect Types to create/modify Entries with the corresponding aspects.	datacatalog.migrationConfig.get dataplex.aspectTypes.get dataplex.aspectTypes.list dataplex.aspectTypes.use dataplex.projects.search resourcemanager.projects.get resourcemanager.projects.list
Dataplex Binding Administrator (roles/dataplex.bindingAdmin) Full access on DataAttribute Binding resources.	dataplex.dataAttributeBindings.* dataplex.dataAttributeBindings.create dataplex.dataAttributeBindings.delete dataplex.dataAttributeBindings.get dataplex.dataAttributeBindings.getIamPolicy dataplex.dataAttributeBindings.list dataplex.dataAttributeBindings.setIamPolicy dataplex.dataAttributeBindings.update
Dataplex Catalog Admin (roles/dataplex.catalogAdmin) Full access to catalog resources, including entries, entry groups, and glossaries.	datacatalog.migrationConfig.get dataplex.aspectTypes.* dataplex.aspectTypes.create dataplex.aspectTypes.delete dataplex.aspectTypes.get dataplex.aspectTypes.getIamPolicy dataplex.aspectTypes.list dataplex.aspectTypes.setIamPolicy dataplex.aspectTypes.update dataplex.aspectTypes.use dataplex.entries.* dataplex.entries.create dataplex.entries.delete dataplex.entries.get dataplex.entries.getData dataplex.entries.link dataplex.entries.list dataplex.entries.update dataplex.entryGroups.* dataplex.entryGroups.create dataplex.entryGroups.delete dataplex.entryGroups.export dataplex.entryGroups.get dataplex.entryGroups.getIamPolicy dataplex.entryGroups.import dataplex.entryGroups.list dataplex.entryGroups.setIamPolicy dataplex.entryGroups.update dataplex.entryGroups.useContactsAspect dataplex.entryGroups.useDataProfileAspect dataplex.entryGroups.useDataQualityScorecardAspect dataplex.entryGroups.useDefinitionEntryLink dataplex.entryGroups.useDescriptionsAspect dataplex.entryGroups.useGenericAspect dataplex.entryGroups.useGenericEntry dataplex.entryGroups.useOverviewAspect dataplex.entryGroups.useQueriesAspect dataplex.entryGroups.useRefreshCadenceAspect dataplex.entryGroups.useRelatedEntryLink dataplex.entryGroups.useSchemaAspect dataplex.entryGroups.useSchemaJoinAspect dataplex.entryGroups.useSchemaJoinEntryLink dataplex.entryGroups.useStorageAspect dataplex.entryGroups.useSynonymEntryLink dataplex.entryLinks.* dataplex.entryLinks.create dataplex.entryLinks.delete dataplex.entryLinks.get dataplex.entryLinks.reference dataplex.entryLinks.update dataplex.entryTypes.* dataplex.entryTypes.create dataplex.entryTypes.delete dataplex.entryTypes.get dataplex.entryTypes.getIamPolicy dataplex.entryTypes.list dataplex.entryTypes.setIamPolicy dataplex.entryTypes.update dataplex.entryTypes.use dataplex.glossaries.* dataplex.glossaries.create dataplex.glossaries.delete dataplex.glossaries.get dataplex.glossaries.getIamPolicy dataplex.glossaries.import dataplex.glossaries.list dataplex.glossaries.setIamPolicy dataplex.glossaries.update dataplex.glossaryCategories.* dataplex.glossaryCategories.create dataplex.glossaryCategories.delete dataplex.glossaryCategories.get dataplex.glossaryCategories.list dataplex.glossaryCategories.update dataplex.glossaryTerms.* dataplex.glossaryTerms.create dataplex.glossaryTerms.delete dataplex.glossaryTerms.get dataplex.glossaryTerms.list dataplex.glossaryTerms.update dataplex.glossaryTerms.use dataplex.operations.get dataplex.projects.search resourcemanager.projects.get resourcemanager.projects.list
Dataplex Catalog Editor (roles/dataplex.catalogEditor) Write access to catalog resources, including entries, entry groups, and glossaries. Cannot set IAM policies on resources.	datacatalog.migrationConfig.get dataplex.aspectTypes.create dataplex.aspectTypes.delete dataplex.aspectTypes.get dataplex.aspectTypes.getIamPolicy dataplex.aspectTypes.list dataplex.aspectTypes.update dataplex.aspectTypes.use dataplex.entries.* dataplex.entries.create dataplex.entries.delete dataplex.entries.get dataplex.entries.getData dataplex.entries.link dataplex.entries.list dataplex.entries.update dataplex.entryGroups.create dataplex.entryGroups.delete dataplex.entryGroups.get dataplex.entryGroups.getIamPolicy dataplex.entryGroups.list dataplex.entryGroups.update dataplex.entryGroups.useContactsAspect dataplex.entryGroups.useDataProfileAspect dataplex.entryGroups.useDataQualityScorecardAspect dataplex.entryGroups.useDefinitionEntryLink dataplex.entryGroups.useDescriptionsAspect dataplex.entryGroups.useGenericAspect dataplex.entryGroups.useGenericEntry dataplex.entryGroups.useOverviewAspect dataplex.entryGroups.useQueriesAspect dataplex.entryGroups.useRefreshCadenceAspect dataplex.entryGroups.useRelatedEntryLink dataplex.entryGroups.useSchemaAspect dataplex.entryGroups.useSchemaJoinAspect dataplex.entryGroups.useSchemaJoinEntryLink dataplex.entryGroups.useStorageAspect dataplex.entryGroups.useSynonymEntryLink dataplex.entryLinks.create dataplex.entryLinks.delete dataplex.entryLinks.get dataplex.entryLinks.update dataplex.entryTypes.create dataplex.entryTypes.delete dataplex.entryTypes.get dataplex.entryTypes.getIamPolicy dataplex.entryTypes.list dataplex.entryTypes.update dataplex.entryTypes.use dataplex.glossaries.create dataplex.glossaries.delete dataplex.glossaries.get dataplex.glossaries.getIamPolicy dataplex.glossaries.list dataplex.glossaries.update dataplex.glossaryCategories.* dataplex.glossaryCategories.create dataplex.glossaryCategories.delete dataplex.glossaryCategories.get dataplex.glossaryCategories.list dataplex.glossaryCategories.update dataplex.glossaryTerms.* dataplex.glossaryTerms.create dataplex.glossaryTerms.delete dataplex.glossaryTerms.get dataplex.glossaryTerms.list dataplex.glossaryTerms.update dataplex.glossaryTerms.use dataplex.operations.get dataplex.projects.search resourcemanager.projects.get resourcemanager.projects.list
Dataplex Catalog Viewer (roles/dataplex.catalogViewer) Read access to catalog resources, including entries, entry groups, and glossaries. Can view IAM policies on catalog resources.	datacatalog.migrationConfig.get dataplex.aspectTypes.get dataplex.aspectTypes.getIamPolicy dataplex.aspectTypes.list dataplex.entries.get dataplex.entries.list dataplex.entryGroups.get dataplex.entryGroups.getIamPolicy dataplex.entryGroups.list dataplex.entryLinks.get dataplex.entryTypes.get dataplex.entryTypes.getIamPolicy dataplex.entryTypes.list dataplex.glossaries.get dataplex.glossaries.getIamPolicy dataplex.glossaries.list dataplex.glossaryCategories.get dataplex.glossaryCategories.list dataplex.glossaryTerms.get dataplex.glossaryTerms.list dataplex.projects.search resourcemanager.projects.get resourcemanager.projects.list
Dataplex Data Owner (roles/dataplex.dataOwner) Owner access to data. To be granted to Dataplex Universal Catalog resources Lake, Zone or Asset only.	dataplex.assets.ownData dataplex.assets.readData dataplex.assets.writeData
Dataplex Data Products Admin ^Beta (roles/dataplex.dataProductsAdmin) Full access to Data Products.	dataplex.dataAssets.* dataplex.dataAssets.create dataplex.dataAssets.delete dataplex.dataAssets.get dataplex.dataAssets.list dataplex.dataAssets.update dataplex.dataProducts.* dataplex.dataProducts.create dataplex.dataProducts.delete dataplex.dataProducts.get dataplex.dataProducts.getIamPolicy dataplex.dataProducts.list dataplex.dataProducts.setIamPolicy dataplex.dataProducts.update dataplex.operations.get resourcemanager.projects.get resourcemanager.projects.list
Dataplex Data Products Consumer ^Beta (roles/dataplex.dataProductsConsumer) Restricted read access, intended for consumers of Data Products.	dataplex.dataAssets.get dataplex.dataAssets.list dataplex.dataProducts.get resourcemanager.projects.get resourcemanager.projects.list
Dataplex Data Products Editor ^Beta (roles/dataplex.dataProductsEditor) Write access to Data Products.	dataplex.dataAssets.* dataplex.dataAssets.create dataplex.dataAssets.delete dataplex.dataAssets.get dataplex.dataAssets.list dataplex.dataAssets.update dataplex.dataProducts.create dataplex.dataProducts.delete dataplex.dataProducts.get dataplex.dataProducts.getIamPolicy dataplex.dataProducts.list dataplex.dataProducts.update dataplex.operations.get resourcemanager.projects.get resourcemanager.projects.list
Dataplex Data Products Viewer ^Beta (roles/dataplex.dataProductsViewer) Read access to Data Products.	dataplex.dataAssets.get dataplex.dataAssets.list dataplex.dataProducts.get dataplex.dataProducts.getIamPolicy dataplex.dataProducts.list resourcemanager.projects.get resourcemanager.projects.list
Dataplex Data Reader (roles/dataplex.dataReader) Read only access to data. To be granted to Dataplex Universal Catalog resources Lake, Zone or Asset only.	dataplex.assets.readData
Dataplex DataScan Creator (roles/dataplex.dataScanCreator) Access to create new DataScan resources.	dataplex.datascans.create dataplex.datascans.get dataplex.datascans.list dataplex.operations.get
Dataplex DataScan DataViewer (roles/dataplex.dataScanDataViewer) Read access to DataScan resources, including the results.	dataplex.datascans.get dataplex.datascans.getData dataplex.datascans.getIamPolicy dataplex.datascans.list
Dataplex DataScan Editor (roles/dataplex.dataScanEditor) Write access to DataScan resources.	dataplex.datascans.create dataplex.datascans.delete dataplex.datascans.get dataplex.datascans.getData dataplex.datascans.getIamPolicy dataplex.datascans.list dataplex.datascans.run dataplex.datascans.update dataplex.operations.get dataplex.operations.list
Dataplex DataScan Viewer (roles/dataplex.dataScanViewer) Read access to DataScan resources, excluding the results.	dataplex.datascans.get dataplex.datascans.getIamPolicy dataplex.datascans.list
Dataplex Data Writer (roles/dataplex.dataWriter) Write access to data. To be granted to Dataplex Universal Catalog resources Lake, Zone or Asset only.	dataplex.assets.writeData
Dataplex Developer (roles/dataplex.developer) Allows running data analytics workloads in a lake.	dataplex.content.* dataplex.content.create dataplex.content.delete dataplex.content.get dataplex.content.getIamPolicy dataplex.content.list dataplex.content.setIamPolicy dataplex.content.update dataplex.environments.execute dataplex.environments.get dataplex.environments.list dataplex.tasks.cancel dataplex.tasks.create dataplex.tasks.delete dataplex.tasks.get dataplex.tasks.list dataplex.tasks.run dataplex.tasks.update
Dataplex Encryption Admin (roles/dataplex.encryptionAdmin) Gives user permissions to manage encryption configurations.	dataplex.encryptionConfig.* dataplex.encryptionConfig.create dataplex.encryptionConfig.delete dataplex.encryptionConfig.get dataplex.encryptionConfig.list dataplex.encryptionConfig.update dataplex.operations.get dataplex.operations.list
Dataplex Entry Group Exporter (roles/dataplex.entryGroupExporter) Grants access to export this entry group for Metadata Job processing.	dataplex.entryGroups.export dataplex.entryGroups.get resourcemanager.projects.get resourcemanager.projects.list
Dataplex Entry Group Importer (roles/dataplex.entryGroupImporter) Grants access to import this entry group for Metadata Job processing.	dataplex.entryGroups.get dataplex.entryGroups.import resourcemanager.projects.get resourcemanager.projects.list
Dataplex Entry Group Owner (roles/dataplex.entryGroupOwner) Owns Entry Groups and Entries inside of them.	datacatalog.migrationConfig.get dataplex.aspectTypes.get dataplex.aspectTypes.list dataplex.aspectTypes.use dataplex.entries.* dataplex.entries.create dataplex.entries.delete dataplex.entries.get dataplex.entries.getData dataplex.entries.link dataplex.entries.list dataplex.entries.update dataplex.entryGroups.* dataplex.entryGroups.create dataplex.entryGroups.delete dataplex.entryGroups.export dataplex.entryGroups.get dataplex.entryGroups.getIamPolicy dataplex.entryGroups.import dataplex.entryGroups.list dataplex.entryGroups.setIamPolicy dataplex.entryGroups.update dataplex.entryGroups.useContactsAspect dataplex.entryGroups.useDataProfileAspect dataplex.entryGroups.useDataQualityScorecardAspect dataplex.entryGroups.useDefinitionEntryLink dataplex.entryGroups.useDescriptionsAspect dataplex.entryGroups.useGenericAspect dataplex.entryGroups.useGenericEntry dataplex.entryGroups.useOverviewAspect dataplex.entryGroups.useQueriesAspect dataplex.entryGroups.useRefreshCadenceAspect dataplex.entryGroups.useRelatedEntryLink dataplex.entryGroups.useSchemaAspect dataplex.entryGroups.useSchemaJoinAspect dataplex.entryGroups.useSchemaJoinEntryLink dataplex.entryGroups.useStorageAspect dataplex.entryGroups.useSynonymEntryLink dataplex.entryLinks.* dataplex.entryLinks.create dataplex.entryLinks.delete dataplex.entryLinks.get dataplex.entryLinks.reference dataplex.entryLinks.update dataplex.entryTypes.get dataplex.entryTypes.list dataplex.entryTypes.use dataplex.operations.get dataplex.projects.search resourcemanager.projects.get resourcemanager.projects.list
Dataplex Entry and EntryLink Owner (roles/dataplex.entryOwner) Owns Metadata Entries and EntryLinks.	datacatalog.migrationConfig.get dataplex.aspectTypes.get dataplex.aspectTypes.list dataplex.aspectTypes.use dataplex.entries.* dataplex.entries.create dataplex.entries.delete dataplex.entries.get dataplex.entries.getData dataplex.entries.link dataplex.entries.list dataplex.entries.update dataplex.entryGroups.get dataplex.entryGroups.useContactsAspect dataplex.entryGroups.useDataProfileAspect dataplex.entryGroups.useDataQualityScorecardAspect dataplex.entryGroups.useDefinitionEntryLink dataplex.entryGroups.useDescriptionsAspect dataplex.entryGroups.useGenericAspect dataplex.entryGroups.useGenericEntry dataplex.entryGroups.useOverviewAspect dataplex.entryGroups.useQueriesAspect dataplex.entryGroups.useRefreshCadenceAspect dataplex.entryGroups.useRelatedEntryLink dataplex.entryGroups.useSchemaAspect dataplex.entryGroups.useSchemaJoinAspect dataplex.entryGroups.useSchemaJoinEntryLink dataplex.entryGroups.useStorageAspect dataplex.entryGroups.useSynonymEntryLink dataplex.entryLinks.* dataplex.entryLinks.create dataplex.entryLinks.delete dataplex.entryLinks.get dataplex.entryLinks.reference dataplex.entryLinks.update dataplex.entryTypes.get dataplex.entryTypes.list dataplex.entryTypes.use dataplex.projects.search resourcemanager.projects.get resourcemanager.projects.list
Dataplex Entry Type Owner (roles/dataplex.entryTypeOwner) Grants access to creating and managing Entry Types. Does not give the right to create/modify Entries.	datacatalog.migrationConfig.get dataplex.entryTypes.* dataplex.entryTypes.create dataplex.entryTypes.delete dataplex.entryTypes.get dataplex.entryTypes.getIamPolicy dataplex.entryTypes.list dataplex.entryTypes.setIamPolicy dataplex.entryTypes.update dataplex.entryTypes.use dataplex.operations.get dataplex.projects.search resourcemanager.projects.get resourcemanager.projects.list
Dataplex Entry Type User (roles/dataplex.entryTypeUser) Grants access to use Entry Types to create/modify Entries of those types.	datacatalog.migrationConfig.get dataplex.entryTypes.get dataplex.entryTypes.list dataplex.entryTypes.use dataplex.projects.search resourcemanager.projects.get resourcemanager.projects.list
Dataplex Metadata Feed Owner (roles/dataplex.metadataFeedOwner) Grants access to creating and managing Metadata Feeds. Does not give the right to create/modify Entry Groups.	dataplex.metadataFeeds.* dataplex.metadataFeeds.create dataplex.metadataFeeds.delete dataplex.metadataFeeds.get dataplex.metadataFeeds.list dataplex.metadataFeeds.update dataplex.operations.get resourcemanager.projects.get resourcemanager.projects.list
Dataplex Metadata Feed Viewer (roles/dataplex.metadataFeedViewer) Read access to Metadata Feed resources.	dataplex.metadataFeeds.get dataplex.metadataFeeds.list dataplex.operations.get resourcemanager.projects.get resourcemanager.projects.list
Dataplex Metadata Job Owner (roles/dataplex.metadataJobOwner) Grants access to creating and managing Metadata Jobs. Does not give the right to create/modify Entry Groups.	dataplex.metadataJobs.* dataplex.metadataJobs.cancel dataplex.metadataJobs.create dataplex.metadataJobs.get dataplex.metadataJobs.list dataplex.operations.get resourcemanager.projects.get resourcemanager.projects.list
Dataplex Metadata Job Viewer (roles/dataplex.metadataJobViewer) Read access to Metadata Job resources.	dataplex.metadataJobs.get dataplex.metadataJobs.list dataplex.operations.get resourcemanager.projects.get resourcemanager.projects.list
Dataplex Metadata Reader (roles/dataplex.metadataReader) Read only access to metadata within table and fileset entities and partitions.	dataplex.assets.get dataplex.assets.list dataplex.entities.get dataplex.entities.list dataplex.partitions.get dataplex.partitions.list dataplex.zones.get dataplex.zones.list resourcemanager.projects.get resourcemanager.projects.list
Dataplex Metadata Writer (roles/dataplex.metadataWriter) Write and read access to metadata within table and fileset entities and partitions.	dataplex.assets.get dataplex.assets.list dataplex.entities.* dataplex.entities.create dataplex.entities.delete dataplex.entities.get dataplex.entities.list dataplex.entities.update dataplex.partitions.* dataplex.partitions.create dataplex.partitions.delete dataplex.partitions.get dataplex.partitions.list dataplex.partitions.update dataplex.zones.get dataplex.zones.list resourcemanager.projects.get resourcemanager.projects.list
Dataplex Security Administrator (roles/dataplex.securityAdmin) Permissions configure ResourceAccess and DataAccess Specs on Data Attributes.	dataplex.dataTaxonomies.configureDataAccess dataplex.dataTaxonomies.configureResourceAccess
Dataplex Storage Data Owner (roles/dataplex.storageDataOwner) Owner access to data. Should not be used directly. This role is granted by Dataplex to managed resources like Cloud Storage buckets, BigQuery datasets etc.	bigquery.datasets.get bigquery.models.create bigquery.models.delete bigquery.models.export bigquery.models.getData bigquery.models.getMetadata bigquery.models.list bigquery.models.updateData bigquery.models.updateMetadata bigquery.routines.create bigquery.routines.delete bigquery.routines.get bigquery.routines.list bigquery.routines.update bigquery.tables.create bigquery.tables.createSnapshot bigquery.tables.delete bigquery.tables.deleteSnapshot bigquery.tables.export bigquery.tables.get bigquery.tables.getData bigquery.tables.list bigquery.tables.restoreSnapshot bigquery.tables.update bigquery.tables.updateData storage.buckets.get storage.objects.create storage.objects.delete storage.objects.get storage.objects.list storage.objects.update
Dataplex Storage Data Reader (roles/dataplex.storageDataReader) Read only access to data. Should not be used directly. This role is granted by Dataplex to managed resources like Cloud Storage buckets, BigQuery datasets etc.	bigquery.datasets.get bigquery.models.export bigquery.models.getData bigquery.models.getMetadata bigquery.models.list bigquery.routines.get bigquery.routines.list bigquery.tables.export bigquery.tables.get bigquery.tables.getData bigquery.tables.list storage.buckets.get storage.objects.get storage.objects.list
Dataplex Storage Data Writer (roles/dataplex.storageDataWriter) Write access to data. Should not be used directly. This role is granted by Dataplex to managed resources like Cloud Storage buckets, BigQuery datasets etc.	bigquery.tables.updateData storage.objects.create storage.objects.delete storage.objects.update
Dataplex Taxonomy Administrator (roles/dataplex.taxonomyAdmin) Full access to DataTaxonomy, DataAttribute resources.	dataplex.dataAttributes.* dataplex.dataAttributes.bind dataplex.dataAttributes.create dataplex.dataAttributes.delete dataplex.dataAttributes.get dataplex.dataAttributes.getIamPolicy dataplex.dataAttributes.list dataplex.dataAttributes.setIamPolicy dataplex.dataAttributes.update dataplex.dataTaxonomies.create dataplex.dataTaxonomies.delete dataplex.dataTaxonomies.get dataplex.dataTaxonomies.getIamPolicy dataplex.dataTaxonomies.list dataplex.dataTaxonomies.setIamPolicy dataplex.dataTaxonomies.update
Dataplex Taxonomy Viewer (roles/dataplex.taxonomyViewer) Read access on DataTaxonomy, DataAttribute resources.	dataplex.dataAttributes.get dataplex.dataAttributes.getIamPolicy dataplex.dataAttributes.list dataplex.dataTaxonomies.get dataplex.dataTaxonomies.getIamPolicy dataplex.dataTaxonomies.list

Service agent roles

Service agent roles should only be granted to service agents.

Role	Permissions
Dataplex Discovery BigLake Publishing Service Agent (roles/dataplex.discoveryBigLakePublishingServiceAgent) Gives the Dataplex Discovery Service Agent permissions to use bigquery connection. Warning: Do not grant service agent roles to any principals except service agents.	bigquery.connections.delegate bigquery.connections.use
Dataplex Discovery Publishing Service Agent (roles/dataplex.discoveryPublishingServiceAgent) Gives the Dataplex Discovery Service Agent dataset create and get permissions. Warning: Do not grant service agent roles to any principals except service agents.	bigquery.datasets.create bigquery.datasets.get
Dataplex Discovery Service Agent (roles/dataplex.discoveryServiceAgent) Gives the Dataplex Discovery Service Agent bucket read permissions. Warning: Do not grant service agent roles to any principals except service agents.	storage.buckets.get storage.objects.get storage.objects.list
Cloud Dataplex Service Agent (roles/dataplex.serviceAgent) Gives the Dataplex service account access to project resources. This access will be used in data discovery, data management and data workload management. Warning: Do not grant service agent roles to any principals except service agents.	biglake.catalogs.get biglake.tables.get biglake.tables.getData bigquery.bireservations.* bigquery.bireservations.get bigquery.bireservations.update bigquery.capacityCommitments.* bigquery.capacityCommitments.create bigquery.capacityCommitments.delete bigquery.capacityCommitments.get bigquery.capacityCommitments.list bigquery.capacityCommitments.update bigquery.config.* bigquery.config.get bigquery.config.update bigquery.connections.* bigquery.connections.create bigquery.connections.delegate bigquery.connections.delete bigquery.connections.get bigquery.connections.getIamPolicy bigquery.connections.list bigquery.connections.setIamPolicy bigquery.connections.update bigquery.connections.updateTag bigquery.connections.use bigquery.dataPolicies.attach bigquery.dataPolicies.create bigquery.dataPolicies.delete bigquery.dataPolicies.get bigquery.dataPolicies.getIamPolicy bigquery.dataPolicies.list bigquery.dataPolicies.setIamPolicy bigquery.dataPolicies.update bigquery.datasets.* bigquery.datasets.create bigquery.datasets.createTagBinding bigquery.datasets.delete bigquery.datasets.deleteTagBinding bigquery.datasets.get bigquery.datasets.getIamPolicy bigquery.datasets.link bigquery.datasets.listEffectiveTags bigquery.datasets.listSharedDatasetUsage bigquery.datasets.listTagBindings bigquery.datasets.setIamPolicy bigquery.datasets.update bigquery.datasets.updateTag bigquery.jobs.* bigquery.jobs.create bigquery.jobs.createGlobalQuery bigquery.jobs.delete bigquery.jobs.get bigquery.jobs.list bigquery.jobs.listAll bigquery.jobs.listExecutionMetadata bigquery.jobs.update bigquery.models.* bigquery.models.create bigquery.models.delete bigquery.models.export bigquery.models.getData bigquery.models.getMetadata bigquery.models.list bigquery.models.updateData bigquery.models.updateMetadata bigquery.models.updateTag bigquery.objectRefs.* bigquery.objectRefs.read bigquery.objectRefs.write bigquery.readsessions.* bigquery.readsessions.create bigquery.readsessions.getData bigquery.readsessions.update bigquery.reservationAssignments.* bigquery.reservationAssignments.create bigquery.reservationAssignments.delete bigquery.reservationAssignments.list bigquery.reservationAssignments.search bigquery.reservationGroups.* bigquery.reservationGroups.create bigquery.reservationGroups.delete bigquery.reservationGroups.get bigquery.reservationGroups.list bigquery.reservations.* bigquery.reservations.create bigquery.reservations.delete bigquery.reservations.get bigquery.reservations.getIamPolicy bigquery.reservations.list bigquery.reservations.listFailoverDatasets bigquery.reservations.setIamPolicy bigquery.reservations.update bigquery.reservations.use bigquery.routines.* bigquery.routines.create bigquery.routines.delete bigquery.routines.get bigquery.routines.list bigquery.routines.update bigquery.routines.updateTag bigquery.rowAccessPolicies.create bigquery.rowAccessPolicies.delete bigquery.rowAccessPolicies.get bigquery.rowAccessPolicies.getIamPolicy bigquery.rowAccessPolicies.list bigquery.rowAccessPolicies.overrideTimeTravelRestrictions bigquery.rowAccessPolicies.setIamPolicy bigquery.rowAccessPolicies.update bigquery.savedqueries.* bigquery.savedqueries.create bigquery.savedqueries.delete bigquery.savedqueries.get bigquery.savedqueries.list bigquery.savedqueries.update bigquery.tables.* bigquery.tables.create bigquery.tables.createIndex bigquery.tables.createSnapshot bigquery.tables.createTagBinding bigquery.tables.delete bigquery.tables.deleteIndex bigquery.tables.deleteSnapshot bigquery.tables.deleteTagBinding bigquery.tables.export bigquery.tables.get bigquery.tables.getData bigquery.tables.getIamPolicy bigquery.tables.list bigquery.tables.listEffectiveTags bigquery.tables.listTagBindings bigquery.tables.replicateData bigquery.tables.restoreSnapshot bigquery.tables.setCategory bigquery.tables.setColumnDataPolicy bigquery.tables.setIamPolicy bigquery.tables.update bigquery.tables.updateData bigquery.tables.updateIndex bigquery.tables.updateTag bigquery.transfers.* bigquery.transfers.get bigquery.transfers.update bigquerymigration.translation.translate datacatalog.catalogs.searchAll datacatalog.categories.getIamPolicy datacatalog.categories.setIamPolicy datacatalog.entries.get datacatalog.taxonomies.create datacatalog.taxonomies.delete datacatalog.taxonomies.get datacatalog.taxonomies.list datacatalog.taxonomies.update dataform.* dataform.commentThreads.create dataform.commentThreads.delete dataform.commentThreads.get dataform.commentThreads.list dataform.commentThreads.update dataform.comments.create dataform.comments.delete dataform.comments.get dataform.comments.list dataform.comments.update dataform.compilationResults.create dataform.compilationResults.get dataform.compilationResults.list dataform.compilationResults.query dataform.config.get dataform.config.update dataform.folders.addContents dataform.folders.create dataform.folders.delete dataform.folders.deleteTree dataform.folders.get dataform.folders.getIamPolicy dataform.folders.move dataform.folders.queryContents dataform.folders.setIamPolicy dataform.folders.update dataform.locations.get dataform.locations.list dataform.operations.cancel dataform.operations.delete dataform.operations.get dataform.operations.list dataform.releaseConfigs.create dataform.releaseConfigs.delete dataform.releaseConfigs.get dataform.releaseConfigs.list dataform.releaseConfigs.update dataform.repositories.commit dataform.repositories.computeAccessTokenStatus dataform.repositories.create dataform.repositories.delete dataform.repositories.fetchHistory dataform.repositories.fetchRemoteBranches dataform.repositories.get dataform.repositories.getIamPolicy dataform.repositories.list dataform.repositories.move dataform.repositories.queryDirectoryContents dataform.repositories.readFile dataform.repositories.scheduleRelease dataform.repositories.scheduleWorkflow dataform.repositories.setIamPolicy dataform.repositories.update dataform.teamFolders.create dataform.teamFolders.delete dataform.teamFolders.deleteTree dataform.teamFolders.get dataform.teamFolders.getIamPolicy dataform.teamFolders.setIamPolicy dataform.teamFolders.update dataform.workflowConfigs.create dataform.workflowConfigs.delete dataform.workflowConfigs.get dataform.workflowConfigs.list dataform.workflowConfigs.update dataform.workflowInvocations.cancel dataform.workflowInvocations.create dataform.workflowInvocations.delete dataform.workflowInvocations.get dataform.workflowInvocations.list dataform.workflowInvocations.query dataform.workspaces.commit dataform.workspaces.create dataform.workspaces.delete dataform.workspaces.fetchFileDiff dataform.workspaces.fetchFileGitStatuses dataform.workspaces.fetchGitAheadBehind dataform.workspaces.get dataform.workspaces.getIamPolicy dataform.workspaces.installNpmPackages dataform.workspaces.list dataform.workspaces.makeDirectory dataform.workspaces.moveDirectory dataform.workspaces.moveFile dataform.workspaces.pull dataform.workspaces.push dataform.workspaces.queryDirectoryContents dataform.workspaces.readFile dataform.workspaces.removeDirectory dataform.workspaces.removeFile dataform.workspaces.reset dataform.workspaces.searchFiles dataform.workspaces.setIamPolicy dataform.workspaces.writeFile dataplex.assets.getIamPolicy dataplex.datascans.* dataplex.datascans.create dataplex.datascans.delete dataplex.datascans.get dataplex.datascans.getData dataplex.datascans.getIamPolicy dataplex.datascans.list dataplex.datascans.run dataplex.datascans.setIamPolicy dataplex.datascans.update dataplex.environments.execute dataplex.environments.get dataplex.environments.list dataplex.lakes.get dataplex.lakes.getIamPolicy dataplex.operations.get dataplex.operations.list dataplex.projects.search dataplex.zones.getIamPolicy dataproc.batches.cancel dataproc.batches.create dataproc.batches.get dataproc.operations.cancel dataproc.operations.get dataproc.operations.list firebase.projects.get iam.serviceAccounts.actAs logging.logEntries.create logging.logEntries.route metastore.services.get monitoring.metricDescriptors.create monitoring.metricDescriptors.get monitoring.metricDescriptors.list monitoring.monitoredResourceDescriptors.* monitoring.monitoredResourceDescriptors.get monitoring.monitoredResourceDescriptors.list monitoring.timeSeries.create orgpolicy.policy.get recommender.iamPolicyInsights.* recommender.iamPolicyInsights.get recommender.iamPolicyInsights.list recommender.iamPolicyInsights.update recommender.iamPolicyRecommendations.* recommender.iamPolicyRecommendations.get recommender.iamPolicyRecommendations.list recommender.iamPolicyRecommendations.update recommender.storageBucketSoftDeleteInsights.* recommender.storageBucketSoftDeleteInsights.get recommender.storageBucketSoftDeleteInsights.list recommender.storageBucketSoftDeleteInsights.update recommender.storageBucketSoftDeleteRecommendations.* recommender.storageBucketSoftDeleteRecommendations.get recommender.storageBucketSoftDeleteRecommendations.list recommender.storageBucketSoftDeleteRecommendations.update resourcemanager.hierarchyNodes.listEffectiveTags resourcemanager.projects.get resourcemanager.projects.list servicemanagement.services.report serviceusage.services.use storage.anywhereCaches.* storage.anywhereCaches.create storage.anywhereCaches.disable storage.anywhereCaches.get storage.anywhereCaches.list storage.anywhereCaches.pause storage.anywhereCaches.resume storage.anywhereCaches.update storage.bucketOperations.* storage.bucketOperations.cancel storage.bucketOperations.get storage.bucketOperations.list storage.buckets.* storage.buckets.create storage.buckets.createTagBinding storage.buckets.delete storage.buckets.deleteTagBinding storage.buckets.enableObjectRetention storage.buckets.get storage.buckets.getIamPolicy storage.buckets.getIpFilter storage.buckets.getObjectInsights storage.buckets.list storage.buckets.listEffectiveTags storage.buckets.listTagBindings storage.buckets.relocate storage.buckets.restore storage.buckets.setIamPolicy storage.buckets.setIpFilter storage.buckets.update storage.buckets.viewIntelligenceDetails storage.folders.* storage.folders.create storage.folders.delete storage.folders.get storage.folders.list storage.folders.rename storage.intelligenceConfigs.* storage.intelligenceConfigs.get storage.intelligenceConfigs.update storage.managedFolders.* storage.managedFolders.create storage.managedFolders.delete storage.managedFolders.get storage.managedFolders.getIamPolicy storage.managedFolders.list storage.managedFolders.setIamPolicy storage.multipartUploads.* storage.multipartUploads.abort storage.multipartUploads.create storage.multipartUploads.list storage.multipartUploads.listParts storage.objects.* storage.objects.create storage.objects.createContext storage.objects.delete storage.objects.deleteContext storage.objects.get storage.objects.getIamPolicy storage.objects.list storage.objects.move storage.objects.overrideUnlockedRetention storage.objects.restore storage.objects.setIamPolicy storage.objects.setRetention storage.objects.update storage.objects.updateContext storagebatchoperations.* storagebatchoperations.bucketOperations.get storagebatchoperations.bucketOperations.list storagebatchoperations.jobs.cancel storagebatchoperations.jobs.create storagebatchoperations.jobs.delete storagebatchoperations.jobs.get storagebatchoperations.jobs.list storagebatchoperations.locations.get storagebatchoperations.locations.list storagebatchoperations.operations.cancel storagebatchoperations.operations.delete storagebatchoperations.operations.get storagebatchoperations.operations.list telemetry.metrics.write

Peran Pemilik Entri dan EntryLink Dataplex

Peran Dataplex Entry and EntryLink Owner (roles/dataplex.entryOwner) mencakup fitur berikut:

• Memberikan akses penuh ke operasi terkait entri.
• Memberikan akses penuh ke operasi terkait link entri.
• Memberikan izin untuk menambahkan aspek ke entri dari beberapa jenis aspek sistem, seperti Schema, Generic, Overview, dan Contacts.
• Memberikan izin untuk menambahkan aspek ke link entri dari beberapa jenis aspek sistem, seperti SchemaJoin.
• Memberikan izin untuk membuat entri jenis GenericEntry.
• Memberikan izin untuk membuat link entri jenis schema-join.
• Peran ini memungkinkan Anda membuat entri dengan jenis entri dan jenis aspek, dengan jenis entri dan jenis aspek ditentukan dalam project yang sama dengan entri. Jika tidak, Anda juga harus memberikan peran Pengguna Jenis Entri Dataplex (roles/dataplex.entryTypeUser) dan Pengguna Jenis Aspek Dataplex (roles/dataplex.aspectTypeUser) di project tempat jenis entri dan aspek ditentukan.
• Peran ini memungkinkan Anda membuat semua link entri yang tersedia dengan aspek yang diperlukan.
• Peran ini tidak memberikan izin untuk membaca entri yang dibuat dari resource Google Cloud di luar Knowledge Catalog, seperti entri BigQuery, saat menggunakan metode LookupEntry, SearchEntries, atau ModifyEntry. Untuk membaca atau mengubah entri ini, Anda harus memiliki izin baca atau update metadata yang sesuai pada resource sistem sumber. Atau, Anda dapat membaca entri dengan hanya peran Pemilik Entri dan EntryLink Dataplex (roles/dataplex.entryOwner) menggunakan metode GetEntry, atau mengubah entri menggunakan metode UpdateEntry.

Pertimbangan peran

• Tidak ada peran yang memberikan izin untuk menambahkan atau menghapus entri Katalog Pengetahuan dari grup entri yang ditentukan sistem, seperti @bigquery dan @dataplex.

• Untuk melihat aspek data yang dilampirkan ke entri, Anda memerlukan izin untuk membaca data dari aset sumber yang diwakili oleh entri tersebut, selain izin untuk melihat entri. Jika Anda memiliki izin untuk melihat entri, tetapi tidak memiliki izin baca data untuk aset sumber, Anda tetap dapat melihat semua metadata lain pada entri. Namun, Knowledge Catalog menyembunyikan konten aspek data terlampir.

• Peran Admin Katalog Dataplex (roles/dataplex.catalogAdmin) dan Editor Katalog Dataplex (roles/dataplex.catalogEditor) memberikan izin untuk melihat entri kustom.

• Untuk menelusuri entri menggunakan metode SearchEntries, Anda harus memiliki setidaknya salah satu peran IAM berikut di project yang digunakan dalam permintaan API: Dataplex Catalog Admin (roles/dataplex.catalogAdmin), Dataplex Catalog Editor (roles/dataplex.catalogEditor), atau Dataplex Catalog Viewer (roles/dataplex.catalogViewer). Izin pada hasil penelusuran diperiksa secara terpisah dari project yang dipilih.

Peran bawaan untuk silsilah data

Untuk mengakses silsilah data untuk entri Knowledge Catalog apa pun, Anda memerlukan peran pelihat di resource sistem yang sesuai atau peran Dataplex Catalog Viewer (roles/dataplex.catalogViewer) di project yang menyimpan entri Knowledge Catalog. Bagian ini menjelaskan peran yang diperlukan untuk menggunakan silsilah.

Role	Permissions
Data Lineage Administrator (roles/datalineage.admin) Grants full access to all resources in Data Lineage API	datalineage.* datalineage.configs.get datalineage.configs.update datalineage.events.create datalineage.events.delete datalineage.events.get datalineage.events.getFields datalineage.events.list datalineage.locations.processOpenLineageMessage datalineage.locations.searchLinks datalineage.operations.get datalineage.processes.create datalineage.processes.delete datalineage.processes.get datalineage.processes.list datalineage.processes.update datalineage.runs.create datalineage.runs.delete datalineage.runs.get datalineage.runs.list datalineage.runs.update resourcemanager.projects.get resourcemanager.projects.list
Data Lineage Editor (roles/datalineage.editor) Grants edit access to all resources in Data Lineage API	datalineage.events.* datalineage.events.create datalineage.events.delete datalineage.events.get datalineage.events.getFields datalineage.events.list datalineage.locations.* datalineage.locations.processOpenLineageMessage datalineage.locations.searchLinks datalineage.operations.get datalineage.processes.create datalineage.processes.get datalineage.processes.list datalineage.processes.update datalineage.runs.create datalineage.runs.get datalineage.runs.list datalineage.runs.update resourcemanager.projects.get resourcemanager.projects.list
Data Lineage Viewer (roles/datalineage.viewer) Grants read access to all resources in Data Lineage API	datalineage.events.get datalineage.events.getFields datalineage.events.list datalineage.locations.searchLinks datalineage.processes.get datalineage.processes.list datalineage.runs.get datalineage.runs.list resourcemanager.projects.get resourcemanager.projects.list
Data Lineage Events Producer (roles/datalineage.producer) Grants access to creating all resources in Data Lineage API	datalineage.events.create datalineage.locations.processOpenLineageMessage datalineage.processes.create datalineage.processes.get datalineage.processes.update datalineage.runs.create datalineage.runs.get datalineage.runs.update resourcemanager.projects.get resourcemanager.projects.list

Peran pelihat silsilah

Peran Pelihat Silsilah Data (roles/datalineage.viewer) memungkinkan Anda melihat silsilah Knowledge Catalog di konsol Google Cloud dan membaca informasi silsilah menggunakan Data Lineage API. Semua proses dan peristiwa untuk proses tertentu disimpan dalam project yang sama dengan proses tersebut. Dalam kasus urutan otomatis, proses, eksekusi, dan peristiwa disimpan dalam project tempat tugas yang membuat urutan sedang berjalan. Misalnya, ini bisa berupa project tempat tugas BigQuery dijalankan.

Untuk melihat silsilah antar-aset, Anda memerlukan peran Pelihat Silsilah Data (roles/datalineage.viewer) di project tempat Anda melihat silsilah dan project tempat silsilah dicatat. Secara khusus, Anda memerlukan peran di project berikut:

• Project tempat Anda melihat silsilah (dikenal sebagai project aktif), yaitu, project di drop-down di bagian atas konsol Google Cloud atau project tempat panggilan API dilakukan. Project ini biasanya merupakan project yang berisi resource yang Anda buat di Katalog Pengetahuan atau yang Anda akses di sistem lain dengan API. Google Cloud
• Project tempat asal direkam (dikenal sebagai project komputasi). Silsilah disimpan dalam project tempat proses yang sesuai dijalankan, seperti yang dijelaskan sebelumnya. Project ini dapat berbeda dari project yang menyimpan aset yang silsilahnya Anda lihat.

Untuk melihat metadata aset, Anda memerlukan peran yang sama dengan yang digunakan untuk mengakses entri metadata di Knowledge Catalog.

Bergantung pada kasus penggunaan, berikan peran Pelihat Silsilah Data (roles/datalineage.viewer) di tingkat folder atau organisasi untuk memastikan akses ke silsilah (lihat Memberi atau mencabut satu peran).

Catatan: Untuk melihat pernyataan SQL untuk proses BigQuery, Anda harus memiliki izin bigquery.jobs.get untuk tugas yang sesuai. Untuk melihat pernyataan SQL untuk definisi tampilan BigQuery, Anda harus memiliki izin bigquery.tables.get untuk tampilan yang sesuai.

Peran untuk melihat metadata aset saat melihat silsilah

Untuk melihat metadata tentang aset yang disimpan di Knowledge Catalog, Anda harus memiliki peran pelihat di resource sistem yang sesuai atau peran Dataplex Catalog Viewer (roles/dataplex.catalogViewer) di project yang menyimpan entri Knowledge Catalog. Anda mungkin memiliki akses ke aset pada grafik atau daftar asal melalui peran pelihat yang sesuai, tetapi tidak memiliki akses ke asal di antara aset tersebut. Hal ini terjadi jika Anda tidak memiliki peran Pelihat Silsilah Data (roles/datalineage.viewer) di project tempat silsilah direkam. Dalam kasus ini, Data Lineage API dan konsol Google Cloud tidak menampilkan silsilah data atau menampilkan error. Hal ini mencegah kebocoran informasi tentang keberadaan silsilah. Oleh karena itu, tidak adanya silsilah untuk aset tidak berarti tidak ada silsilah, tetapi Anda mungkin tidak memiliki izin untuk melihatnya.

Catatan: Jika aset berada di organisasi yang bukan merupakan anggota Anda, asal data mungkin tidak dapat mengambil metadata untuk aset tersebut.

Peran metadata

Peran metadata memberikan izin untuk melihat dan memperbarui metadata, seperti skema tabel.

Peran	Deskripsi
Dataplex Metadata Writer (roles/dataplex.metadataWriter)	Memungkinkan Anda memperbarui metadata resource.
Dataplex Metadata Reader (roles/dataplex.metadataReader)	Memungkinkan Anda membaca metadata, misalnya, untuk membuat kueri tabel.

Catatan: Peran Dataplex Metadata Reader (roles/dataplex.metadataReader) memberikan izin ke metadata hanya baca. Peran Dataplex Data Reader (roles/dataplex.dataReader), yang dijelaskan di bagian Peran data, mencakup semua izin roles/dataplex.metadataReader ditambah izin untuk membaca data sebenarnya.

Peran data

Knowledge Catalog menentukan peran IAM berikut yang berlaku untuk resource apa pun yang dikelola oleh Knowledge Catalog. Untuk mengetahui informasi selengkapnya tentang izin yang terkait dengan setiap peran, lihat bagian Peran yang telah ditetapkan dalam dokumen ini.

Peran	Deskripsi
Pemilik Data Dataplex (roles/dataplex.dataOwner)	Akses penuh ke resource terkelola dan turunannya. Izin mencakup memperbarui metadata, membuat resource turunan, dan memberikan izin terperinci.
Dataplex Data Reader (roles/dataplex.dataReader)	Akses baca ke data dan metadata di resource terkelola dan turunannya.
Dataplex Data Writer (roles/dataplex.dataWriter)	Akses tulis ke data di resource terkelola. Hal ini mencakup pembuatan, pembaruan, dan penghapusan data, tetapi bukan metadata.

Langkah berikutnya

• Pelajari cara membuat peran IAM kustom.
• Pelajari cara memberikan dan mengelola peran.
• Lihat izin IAM Katalog Pengetahuan.