Managed Service for Apache Spark Identity and Access Management 角色和权限

借助 Identity and Access Management (IAM)，您可以控制用户和群组对项目资源的访问权限。本文档重点介绍与 Managed Service for Apache Spark 相关的 IAM 权限和授予这些权限的 IAM 角色。

Managed Service for Apache Spark 权限

从 2020 年 8 月 3 日开始实施安全要求 ：Managed Service for Apache Spark 用户必须具有服务账号 ActAs 权限才能部署 Managed Service for Apache Spark 资源，例如创建集群和实例化工作流。如需详细了解服务账号权限，请参阅用于服务账号身份验证的角色。

现有 Managed Service for Apache Spark 用户选择启用 ：从 2020 年 8 月 3 日起，现有 Managed Service for Apache Spark 用户可以选择启用此安全要求（请参阅保护 Managed Service for Apache Spark、Dataflow 和 Cloud Data Fusion）。

Managed Service for Apache Spark 权限允许用户（包括服务账号）对 Managed Service for Apache Spark 集群、作业、操作和工作流模板执行操作。例如，dataproc.clusters.create 权限允许用户在项目中创建 Managed Service for Apache Spark 集群。通常，您不会授予权限，而是授予具有一项或多项权限的角色。

下表列出了调用 Managed Service for Apache Spark API（方法）所需的权限。这些表格根据与每个 Managed Service for Apache Spark 资源（集群、作业、操作和工作流模板）关联的 API 进行整理。

权限范围：下表中列出的 Managed Service for Apache Spark 权限范围是所属的 Google Cloud项目（cloud-platform 范围）。请参阅服务账号权限。

示例：

• dataproc.clusters.create 允许在所属项目中创建 Managed Service for Apache Spark 集群
• dataproc.jobs.create 允许在所属项目中将 Managed Service for Apache Spark 作业提交给 Managed Service for Apache Spark 集群
• dataproc.clusters.list 允许列出所属项目中 Managed Service for Apache Spark 集群的详细信息

集群方法所需的权限

方法	所需权限
projects.regions.clusters.create ^1, 2	dataproc.clusters.create
projects.regions.clusters.get	dataproc.clusters.get
projects.regions.clusters.list	dataproc.clusters.list
projects.regions.clusters.patch ^1, 2, 3	dataproc.clusters.update
projects.regions.clusters.delete ^1	dataproc.clusters.delete
projects.regions.clusters.start	dataproc.clusters.start
projects.regions.clusters.stop	dataproc.clusters.stop
projects.regions.clusters.getIamPolicy	dataproc.clusters.getIamPolicy
projects.regions.clusters.setIamPolicy	dataproc.clusters.setIamPolicy

注意：

1. 如需通过 Google Cloud CLI 获取状态更新，您还需要拥有 dataproc.operations.get 权限。
2. 如需通过 Google Cloud CLI 获取操作结果，您还需要具有 dataproc.clusters.get 权限。
3. 如需在集群上启用自动扩缩政策，您还需要具有 dataproc.autoscalingPolicies.use 权限。

作业方法所需的权限

方法	所需权限
projects.regions.jobs.submit ^1, 2	dataproc.jobs.create dataproc.clusters.use
projects.regions.jobs.get	dataproc.jobs.get
projects.regions.jobs.list	dataproc.jobs.list
projects.regions.jobs.cancel ^1	dataproc.jobs.cancel
projects.regions.jobs.patch ^1	dataproc.jobs.update
projects.regions.jobs.delete ^1	dataproc.jobs.delete
projects.regions.jobs.getIamPolicy	dataproc.jobs.getIamPolicy
projects.regions.jobs.setIamPolicy	dataproc.jobs.setIamPolicy

注意：

1. Google Cloud CLI 还需要具有 jobs submit、jobs wait、jobs update、jobs delete 和 jobs kill 命令的 dataproc.jobs.get 权限。

2. gcloud CLI 还需拥有 dataproc.clusters.get 权限才能提交作业。如需通过示例了解如何使用 Managed Service for Apache Spark Granular IAM 为用户设置在集群上运行 gcloud dataproc jobs submit 所需的权限，请参阅使用精细 IAM 提交作业。

操作方法所需的权限

方法	所需权限
projects.regions.operations.get	dataproc.operations.get
projects.regions.operations.list	dataproc.operations.list
projects.regions.operations.cancel	dataproc.operations.cancel
projects.regions.operations.delete	dataproc.operations.delete
projects.regions.operations.getIamPolicy	dataproc.operations.getIamPolicy
projects.regions.operations.setIamPolicy	dataproc.operations.setIamPolicy

工作流模板方法所需的权限

方法	所需权限
projects.regions.workflowTemplates.instantiate	dataproc.workflowTemplates.instantiate
projects.regions.workflowTemplates.instantiateInline	dataproc.workflowTemplates.instantiateInline
projects.regions.workflowTemplates.create	dataproc.workflowTemplates.create
projects.regions.workflowTemplates.get	dataproc.workflowTemplates.get
projects.regions.workflowTemplates.list	dataproc.workflowTemplates.list
projects.regions.workflowTemplates.update	dataproc.workflowTemplates.update
projects.regions.workflowTemplates.delete	dataproc.workflowTemplates.delete
projects.regions.workflowTemplates.getIamPolicy	dataproc.workflowTemplates.getIamPolicy
projects.regions.workflowTemplates.setIamPolicy	dataproc.workflowTemplates.setIamPolicy

注意：

1. 工作流模板权限独立于集群和作业权限。 没有 create cluster 或 submit job 权限的用户可以创建并实例化工作流模板。

2. Google Cloud CLI 还需要 dataproc.operations.get 权限才能轮询工作流完成情况。

3. 具有 dataproc.operations.cancel 权限才能取消正在运行的工作流。

自动扩缩政策方法所需的权限

方法	所需权限
projects.regions.autoscalingPolicies.create	dataproc.autoscalingPolicies.create
projects.regions.autoscalingPolicies.get	dataproc.autoscalingPolicies.get
projects.regions.autoscalingPolicies.list	dataproc.autoscalingPolicies.list
projects.regions.autoscalingPolicies.update	dataproc.autoscalingPolicies.update
projects.regions.autoscalingPolicies.delete	dataproc.autoscalingPolicies.delete
projects.regions.autoscalingPolicies.getIamPolicy	dataproc.autoscalingPolicies.getIamPolicy
projects.regions.autoscalingPolicies.setIamPolicy	dataproc.autoscalingPolicies.setIamPolicy

注意：

1. 如需通过 clusters.patch 方法请求在集群上启用自动扩缩政策。您需要具有 dataproc.autoscalingPolicies.use 权限。

节点组方法所需的权限

方法	所需权限
projects.regions.nodeGroups.create	dataproc.nodeGroups.create
projects.regions.nodeGroups.get	dataproc.nodeGroups.get
projects.regions.nodeGroups.resize	dataproc.nodeGroups.update

Managed Service for Apache Spark 角色

Managed Service for Apache Spark IAM 角色包含一个或多个权限。您可以向用户或群组授予角色，以允许他们对项目中的 Managed Service for Apache Spark 资源执行操作。例如，Managed Service for Apache Spark Viewer 角色具有 get 和 list 权限，这些权限允许用户获取和列出项目中的 Managed Service for Apache Spark 集群、作业和操作。

下表列出了包含创建和管理 Managed Service for Apache Spark 集群所需权限的角色。

向以下对象授予角色	角色
用户	向用户授予以下角色： Dataproc 编辑者角色，用于创建和管理 Managed Service for Apache Spark 集群。 Managed Service for Apache Spark 虚拟机服务账号的 Service Account User 角色。
服务账号	向 Managed Service for Apache Spark 虚拟机服务账号授予 Dataproc Worker 角色。

请注意以下几点：

• 您可能需要向 Managed Service for Apache Spark 虚拟机服务账号授予其他预定义角色或自定义角色，这些角色包含其他操作所需的权限，例如在 Cloud Storage、BigQuery、Cloud Logging 和其他 Google Cloud 资源中读写数据。

• 在某些项目中，Managed Service for Apache Spark 虚拟机服务账号可能已被自动授予项目 Editor 角色，该角色包含 Managed Service for Apache Spark Worker 角色权限以及 Managed Service for Apache Spark 数据平面操作不需要的其他权限。为了遵循最小权限原则这一安全方面的最佳实践，请将 Editor 角色替换为 Managed Service for Apache Spark Worker 角色（请参阅查看虚拟机服务账号角色）。

您是否需要授予角色？

根据组织政策，系统可能已授予必需的角色。

查看授予用户的角色

如需查看用户是否已被授予角色，请按照管理对项目、文件夹和组织的访问权限 > 查看当前访问权限中的说明操作。

检查授予服务账号的角色

如需查看服务账号是否已被授予角色，请参阅查看和管理 IAM 服务账号。

检查服务账号已获得的角色

如需查看用户是否已获得服务账号的角色，请按照管理对服务账号的访问权限 > 查看当前访问权限中的说明操作。

查找 Managed Service for Apache Spark 角色和权限

您可以使用以下部分查找 Managed Service for Apache Spark 角色和权限。

Role	Permissions
Dataproc Administrator (roles/dataproc.admin) Full control of Dataproc resources.	cloudkms.keyHandles.* cloudkms.keyHandles.create cloudkms.keyHandles.get cloudkms.keyHandles.list cloudkms.operations.get cloudkms.projects.showEffectiveAutokeyConfig compute.machineTypes.* compute.machineTypes.get compute.machineTypes.list compute.networks.get compute.networks.list compute.projects.get compute.regions.* compute.regions.get compute.regions.list compute.zones.* compute.zones.get compute.zones.list dataproc.autoscalingPolicies.* dataproc.autoscalingPolicies.create dataproc.autoscalingPolicies.delete dataproc.autoscalingPolicies.get dataproc.autoscalingPolicies.getIamPolicy dataproc.autoscalingPolicies.list dataproc.autoscalingPolicies.setIamPolicy dataproc.autoscalingPolicies.update dataproc.autoscalingPolicies.use dataproc.batches.* dataproc.batches.analyze dataproc.batches.cancel dataproc.batches.create dataproc.batches.delete dataproc.batches.get dataproc.batches.list dataproc.batches.sparkApplicationRead dataproc.batches.sparkApplicationWrite dataproc.clusters.* dataproc.clusters.create dataproc.clusters.delete dataproc.clusters.get dataproc.clusters.getIamPolicy dataproc.clusters.list dataproc.clusters.repair dataproc.clusters.setIamPolicy dataproc.clusters.start dataproc.clusters.stop dataproc.clusters.update dataproc.clusters.use dataproc.jobs.* dataproc.jobs.cancel dataproc.jobs.create dataproc.jobs.delete dataproc.jobs.get dataproc.jobs.getIamPolicy dataproc.jobs.list dataproc.jobs.setIamPolicy dataproc.jobs.update dataproc.nodeGroups.* dataproc.nodeGroups.create dataproc.nodeGroups.get dataproc.nodeGroups.update dataproc.operations.* dataproc.operations.cancel dataproc.operations.delete dataproc.operations.get dataproc.operations.getIamPolicy dataproc.operations.list dataproc.operations.setIamPolicy dataproc.sessionTemplates.* dataproc.sessionTemplates.create dataproc.sessionTemplates.delete dataproc.sessionTemplates.get dataproc.sessionTemplates.list dataproc.sessionTemplates.update dataproc.sessions.* dataproc.sessions.create dataproc.sessions.delete dataproc.sessions.get dataproc.sessions.list dataproc.sessions.sparkApplicationRead dataproc.sessions.sparkApplicationWrite dataproc.sessions.terminate dataproc.workflowTemplates.* dataproc.workflowTemplates.create dataproc.workflowTemplates.delete dataproc.workflowTemplates.get dataproc.workflowTemplates.getIamPolicy dataproc.workflowTemplates.instantiate dataproc.workflowTemplates.instantiateInline dataproc.workflowTemplates.list dataproc.workflowTemplates.setIamPolicy dataproc.workflowTemplates.update dataprocrm.nodePools.* dataprocrm.nodePools.create dataprocrm.nodePools.delete dataprocrm.nodePools.deleteNodes dataprocrm.nodePools.get dataprocrm.nodePools.list dataprocrm.nodePools.resize dataprocrm.nodes.get dataprocrm.nodes.heartbeat dataprocrm.nodes.list dataprocrm.nodes.update dataprocrm.operations.get dataprocrm.operations.list dataprocrm.workloads.* dataprocrm.workloads.cancel dataprocrm.workloads.create dataprocrm.workloads.delete dataprocrm.workloads.get dataprocrm.workloads.list resourcemanager.projects.get resourcemanager.projects.list
Dataproc Editor (roles/dataproc.editor) Provides the permissions necessary for viewing the resources required to manage Managed Service for Apache Spark, including machine types, networks, projects, and zones. Lowest-level resources where you can grant this role: Cluster	cloudkms.keyHandles.* cloudkms.keyHandles.create cloudkms.keyHandles.get cloudkms.keyHandles.list cloudkms.operations.get cloudkms.projects.showEffectiveAutokeyConfig compute.machineTypes.* compute.machineTypes.get compute.machineTypes.list compute.networks.get compute.networks.list compute.projects.get compute.regions.* compute.regions.get compute.regions.list compute.zones.* compute.zones.get compute.zones.list dataproc.autoscalingPolicies.create dataproc.autoscalingPolicies.delete dataproc.autoscalingPolicies.get dataproc.autoscalingPolicies.list dataproc.autoscalingPolicies.update dataproc.autoscalingPolicies.use dataproc.batches.* dataproc.batches.analyze dataproc.batches.cancel dataproc.batches.create dataproc.batches.delete dataproc.batches.get dataproc.batches.list dataproc.batches.sparkApplicationRead dataproc.batches.sparkApplicationWrite dataproc.clusters.create dataproc.clusters.delete dataproc.clusters.get dataproc.clusters.list dataproc.clusters.repair dataproc.clusters.start dataproc.clusters.stop dataproc.clusters.update dataproc.clusters.use dataproc.jobs.cancel dataproc.jobs.create dataproc.jobs.delete dataproc.jobs.get dataproc.jobs.list dataproc.jobs.update dataproc.nodeGroups.* dataproc.nodeGroups.create dataproc.nodeGroups.get dataproc.nodeGroups.update dataproc.operations.cancel dataproc.operations.delete dataproc.operations.get dataproc.operations.list dataproc.sessionTemplates.* dataproc.sessionTemplates.create dataproc.sessionTemplates.delete dataproc.sessionTemplates.get dataproc.sessionTemplates.list dataproc.sessionTemplates.update dataproc.sessions.* dataproc.sessions.create dataproc.sessions.delete dataproc.sessions.get dataproc.sessions.list dataproc.sessions.sparkApplicationRead dataproc.sessions.sparkApplicationWrite dataproc.sessions.terminate dataproc.workflowTemplates.create dataproc.workflowTemplates.delete dataproc.workflowTemplates.get dataproc.workflowTemplates.instantiate dataproc.workflowTemplates.instantiateInline dataproc.workflowTemplates.list dataproc.workflowTemplates.update dataprocrm.nodePools.* dataprocrm.nodePools.create dataprocrm.nodePools.delete dataprocrm.nodePools.deleteNodes dataprocrm.nodePools.get dataprocrm.nodePools.list dataprocrm.nodePools.resize dataprocrm.nodes.get dataprocrm.nodes.heartbeat dataprocrm.nodes.list dataprocrm.nodes.update dataprocrm.operations.get dataprocrm.operations.list dataprocrm.workloads.* dataprocrm.workloads.cancel dataprocrm.workloads.create dataprocrm.workloads.delete dataprocrm.workloads.get dataprocrm.workloads.list resourcemanager.projects.get resourcemanager.projects.list
Dataproc Viewer (roles/dataproc.viewer) Provides read-only access to Managed Service for Apache Spark resources. Lowest-level resources where you can grant this role: Cluster	compute.machineTypes.get compute.regions.* compute.regions.get compute.regions.list compute.zones.* compute.zones.get compute.zones.list dataproc.autoscalingPolicies.get dataproc.autoscalingPolicies.list dataproc.batches.analyze dataproc.batches.get dataproc.batches.list dataproc.batches.sparkApplicationRead dataproc.clusters.get dataproc.clusters.list dataproc.jobs.get dataproc.jobs.list dataproc.nodeGroups.get dataproc.operations.get dataproc.operations.list dataproc.sessionTemplates.get dataproc.sessionTemplates.list dataproc.sessions.get dataproc.sessions.list dataproc.sessions.sparkApplicationRead dataproc.workflowTemplates.get dataproc.workflowTemplates.list resourcemanager.projects.get resourcemanager.projects.list
Dataproc Hub Agent (roles/dataproc.hubAgent) Allows management of Dataproc resources. Intended for service accounts running Dataproc Hub instances.	compute.instances.get compute.instances.setMetadata compute.instances.setTags compute.zoneOperations.get compute.zones.list dataproc.autoscalingPolicies.get dataproc.autoscalingPolicies.list dataproc.autoscalingPolicies.use dataproc.clusters.create dataproc.clusters.delete dataproc.clusters.get dataproc.clusters.list dataproc.clusters.repair dataproc.clusters.update dataproc.operations.cancel dataproc.operations.delete dataproc.operations.get dataproc.operations.list iam.serviceAccounts.actAs iam.serviceAccounts.get iam.serviceAccounts.list logging.buckets.get logging.buckets.list logging.exclusions.get logging.exclusions.list logging.links.get logging.links.list logging.locations.* logging.locations.get logging.locations.list logging.logEntries.create logging.logEntries.list logging.logEntries.route logging.logMetrics.get logging.logMetrics.list logging.logScopes.get logging.logScopes.list logging.logServiceIndexes.list logging.logServices.list logging.logs.list logging.operations.get logging.operations.list logging.queries.getShared logging.queries.listShared logging.queries.usePrivate logging.sinks.get logging.sinks.list logging.usage.get logging.views.get logging.views.list observability.scopes.get resourcemanager.projects.get resourcemanager.projects.list storage.buckets.get storage.objects.get storage.objects.list
Dataproc Serverless Editor (roles/dataproc.serverlessEditor) Permissions needed to run serverless sessions and batches as a user	cloudkms.keyHandles.* cloudkms.keyHandles.create cloudkms.keyHandles.get cloudkms.keyHandles.list cloudkms.operations.get cloudkms.projects.showEffectiveAutokeyConfig compute.projects.get compute.regions.* compute.regions.get compute.regions.list compute.zones.* compute.zones.get compute.zones.list dataproc.batches.* dataproc.batches.analyze dataproc.batches.cancel dataproc.batches.create dataproc.batches.delete dataproc.batches.get dataproc.batches.list dataproc.batches.sparkApplicationRead dataproc.batches.sparkApplicationWrite dataproc.operations.cancel dataproc.operations.delete dataproc.operations.get dataproc.operations.list dataproc.sessionTemplates.* dataproc.sessionTemplates.create dataproc.sessionTemplates.delete dataproc.sessionTemplates.get dataproc.sessionTemplates.list dataproc.sessionTemplates.update dataproc.sessions.* dataproc.sessions.create dataproc.sessions.delete dataproc.sessions.get dataproc.sessions.list dataproc.sessions.sparkApplicationRead dataproc.sessions.sparkApplicationWrite dataproc.sessions.terminate dataprocrm.nodePools.* dataprocrm.nodePools.create dataprocrm.nodePools.delete dataprocrm.nodePools.deleteNodes dataprocrm.nodePools.get dataprocrm.nodePools.list dataprocrm.nodePools.resize dataprocrm.nodes.get dataprocrm.nodes.heartbeat dataprocrm.nodes.list dataprocrm.nodes.update dataprocrm.operations.get dataprocrm.operations.list dataprocrm.workloads.* dataprocrm.workloads.cancel dataprocrm.workloads.create dataprocrm.workloads.delete dataprocrm.workloads.get dataprocrm.workloads.list resourcemanager.projects.get resourcemanager.projects.list
Dataproc Serverless Node. (roles/dataproc.serverlessNode) Node access to Dataproc Serverless sessions and batches. Intended for service accounts.	dataproc.batches.sparkApplicationWrite dataproc.sessions.sparkApplicationRead dataproc.sessions.sparkApplicationWrite dataprocrm.nodePools.* dataprocrm.nodePools.create dataprocrm.nodePools.delete dataprocrm.nodePools.deleteNodes dataprocrm.nodePools.get dataprocrm.nodePools.list dataprocrm.nodePools.resize dataprocrm.nodes.list dataprocrm.operations.get
Dataproc Serverless Viewer (roles/dataproc.serverlessViewer) Permissions needed to view serverless sessions and batches	compute.projects.get compute.regions.* compute.regions.get compute.regions.list compute.zones.* compute.zones.get compute.zones.list dataproc.batches.get dataproc.batches.list dataproc.sessionTemplates.get dataproc.sessionTemplates.list dataproc.sessions.get dataproc.sessions.list resourcemanager.projects.get resourcemanager.projects.list
Dataproc Worker (roles/dataproc.worker) Provides worker access to Managed Service for Apache Spark resources. Intended for service accounts.	cloudprofiler.profiles.create cloudprofiler.profiles.update datalineage.locations.processOpenLineageMessage dataproc.agents.* dataproc.agents.create dataproc.agents.delete dataproc.agents.get dataproc.agents.list dataproc.agents.update dataproc.batches.sparkApplicationWrite dataproc.sessions.sparkApplicationWrite dataproc.tasks.* dataproc.tasks.lease dataproc.tasks.listInvalidatedLeases dataproc.tasks.reportStatus dataprocrm.nodePools.* dataprocrm.nodePools.create dataprocrm.nodePools.delete dataprocrm.nodePools.deleteNodes dataprocrm.nodePools.get dataprocrm.nodePools.list dataprocrm.nodePools.resize dataprocrm.nodes.get dataprocrm.nodes.heartbeat dataprocrm.nodes.list dataprocrm.nodes.mintOAuthToken dataprocrm.operations.get logging.logEntries.create logging.logEntries.route monitoring.metricDescriptors.create monitoring.metricDescriptors.get monitoring.metricDescriptors.list monitoring.monitoredResourceDescriptors.* monitoring.monitoredResourceDescriptors.get monitoring.monitoredResourceDescriptors.list monitoring.timeSeries.create storage.buckets.get storage.folders.* storage.folders.create storage.folders.delete storage.folders.get storage.folders.list storage.folders.rename storage.managedFolders.create storage.managedFolders.delete storage.managedFolders.get storage.managedFolders.list storage.multipartUploads.* storage.multipartUploads.abort storage.multipartUploads.create storage.multipartUploads.list storage.multipartUploads.listParts storage.objects.create storage.objects.createContext storage.objects.delete storage.objects.deleteContext storage.objects.get storage.objects.getIamPolicy storage.objects.list storage.objects.overrideUnlockedRetention storage.objects.restore storage.objects.setIamPolicy storage.objects.setRetention storage.objects.update storage.objects.updateContext telemetry.metrics.write

Service agent roles

Service agent roles should only be granted to service agents.

Role

Permissions

Dataproc Service Agent (roles/dataproc.serviceAgent) Gives Dataproc Service Account access to service accounts, compute resources, storage resources, and kubernetes resources. Includes access to service accounts. Warning: Do not grant service agent roles to any principals except service agents.

backupdr.backupPlanAssociations.createForComputeDisk backupdr.backupPlanAssociations.createForComputeInstance backupdr.backupPlanAssociations.deleteForComputeDisk backupdr.backupPlanAssociations.deleteForComputeInstance backupdr.backupPlanAssociations.fetchForComputeDisk backupdr.backupPlanAssociations.getForComputeDisk backupdr.backupPlanAssociations.list backupdr.backupPlanAssociations.triggerBackupForComputeDisk backupdr.backupPlanAssociations.triggerBackupForComputeInstance backupdr.backupPlanAssociations.updateForComputeDisk backupdr.backupPlanAssociations.updateForComputeInstance backupdr.backupPlans.get backupdr.backupPlans.list backupdr.backupPlans.useForComputeDisk backupdr.backupPlans.useForComputeInstance backupdr.backupVaults.get backupdr.backupVaults.list backupdr.locations.list backupdr.operations.get backupdr.operations.list backupdr.serviceConfig.initialize cloudaicompanion.instances.completeTask compute.acceleratorTypes.* compute.acceleratorTypes.get compute.acceleratorTypes.list compute.addresses.createInternal compute.addresses.deleteInternal compute.addresses.get compute.addresses.list compute.addresses.listEffectiveTags compute.addresses.listTagBindings compute.addresses.use compute.addresses.useInternal compute.autoscalers.* compute.autoscalers.create compute.autoscalers.delete compute.autoscalers.get compute.autoscalers.list compute.autoscalers.update compute.diskSettings.get compute.diskTypes.* compute.diskTypes.get compute.diskTypes.list compute.disks.create compute.disks.createSnapshot compute.disks.createTagBinding compute.disks.delete compute.disks.get compute.disks.list compute.disks.resize compute.disks.setLabels compute.disks.startAsyncReplication compute.disks.stopAsyncReplication compute.disks.stopGroupAsyncReplication compute.disks.update compute.disks.updateKmsKey compute.disks.use compute.disks.useReadOnly compute.firewalls.get compute.firewalls.list compute.globalAddresses.get compute.globalAddresses.list compute.globalAddresses.listEffectiveTags compute.globalAddresses.listTagBindings compute.globalAddresses.use compute.globalNetworkEndpointGroups.* compute.globalNetworkEndpointGroups.attachNetworkEndpoints compute.globalNetworkEndpointGroups.create compute.globalNetworkEndpointGroups.createTagBinding compute.globalNetworkEndpointGroups.delete compute.globalNetworkEndpointGroups.deleteTagBinding compute.globalNetworkEndpointGroups.detachNetworkEndpoints compute.globalNetworkEndpointGroups.get compute.globalNetworkEndpointGroups.list compute.globalNetworkEndpointGroups.listEffectiveTags compute.globalNetworkEndpointGroups.listTagBindings compute.globalNetworkEndpointGroups.use compute.globalOperations.get compute.globalOperations.list compute.images.get compute.images.getFromFamily compute.images.list compute.images.useReadOnly compute.instanceGroupManagers.* compute.instanceGroupManagers.create compute.instanceGroupManagers.createTagBinding compute.instanceGroupManagers.delete compute.instanceGroupManagers.deleteTagBinding compute.instanceGroupManagers.get compute.instanceGroupManagers.list compute.instanceGroupManagers.listEffectiveTags compute.instanceGroupManagers.listTagBindings compute.instanceGroupManagers.update compute.instanceGroupManagers.use compute.instanceGroups.* compute.instanceGroups.create compute.instanceGroups.createTagBinding compute.instanceGroups.delete compute.instanceGroups.deleteTagBinding compute.instanceGroups.get compute.instanceGroups.list compute.instanceGroups.listEffectiveTags compute.instanceGroups.listTagBindings compute.instanceGroups.update compute.instanceGroups.use compute.instanceSettings.get compute.instanceTemplates.* compute.instanceTemplates.create compute.instanceTemplates.delete compute.instanceTemplates.get compute.instanceTemplates.getIamPolicy compute.instanceTemplates.list compute.instanceTemplates.setIamPolicy compute.instanceTemplates.useReadOnly compute.instances.* compute.instances.addAccessConfig compute.instances.addNetworkInterface compute.instances.addResourcePolicies compute.instances.attachDisk compute.instances.create compute.instances.createTagBinding compute.instances.delete compute.instances.deleteAccessConfig compute.instances.deleteNetworkInterface compute.instances.deleteTagBinding compute.instances.detachDisk compute.instances.get compute.instances.getEffectiveFirewalls compute.instances.getGuestAttributes compute.instances.getIamPolicy compute.instances.getScreenshot compute.instances.getSerialPortOutput compute.instances.getShieldedInstanceIdentity compute.instances.getShieldedVmIdentity compute.instances.list compute.instances.listEffectiveTags compute.instances.listReferrers compute.instances.listTagBindings compute.instances.osAdminLogin compute.instances.osLogin compute.instances.pscInterfaceCreate compute.instances.removeResourcePolicies compute.instances.reset compute.instances.resume compute.instances.sendDiagnosticInterrupt compute.instances.setDeletionProtection compute.instances.setDiskAutoDelete compute.instances.setIamPolicy compute.instances.setLabels compute.instances.setMachineResources compute.instances.setMachineType compute.instances.setMetadata compute.instances.setMinCpuPlatform compute.instances.setName compute.instances.setScheduling compute.instances.setSecurityPolicy compute.instances.setServiceAccount compute.instances.setShieldedInstanceIntegrityPolicy compute.instances.setShieldedVmIntegrityPolicy compute.instances.setTags compute.instances.simulateMaintenanceEvent compute.instances.start compute.instances.startWithEncryptionKey compute.instances.stop compute.instances.suspend compute.instances.update compute.instances.updateAccessConfig compute.instances.updateDisplayDevice compute.instances.updateNetworkInterface compute.instances.updateSecurity compute.instances.updateShieldedInstanceConfig compute.instances.updateShieldedVmConfig compute.instances.use compute.instances.useReadOnly compute.licenses.get compute.licenses.list compute.licenses.listEffectiveTags compute.licenses.listTagBindings compute.machineImages.* compute.machineImages.create compute.machineImages.createTagBinding compute.machineImages.delete compute.machineImages.deleteTagBinding compute.machineImages.get compute.machineImages.getIamPolicy compute.machineImages.list compute.machineImages.listEffectiveTags compute.machineImages.listTagBindings compute.machineImages.setIamPolicy compute.machineImages.setLabels compute.machineImages.useReadOnly compute.machineTypes.* compute.machineTypes.get compute.machineTypes.list compute.multiMig.* compute.multiMig.create compute.multiMig.delete compute.multiMig.get compute.multiMig.list compute.multiMigMembers.* compute.multiMigMembers.get compute.multiMigMembers.list compute.networkEndpointGroups.* compute.networkEndpointGroups.attachNetworkEndpoints compute.networkEndpointGroups.create compute.networkEndpointGroups.createTagBinding compute.networkEndpointGroups.delete compute.networkEndpointGroups.deleteTagBinding compute.networkEndpointGroups.detachNetworkEndpoints compute.networkEndpointGroups.get compute.networkEndpointGroups.list compute.networkEndpointGroups.listEffectiveTags compute.networkEndpointGroups.listTagBindings compute.networkEndpointGroups.use compute.networks.get compute.networks.getEffectiveFirewalls compute.networks.list compute.networks.listEffectiveTags compute.networks.listTagBindings compute.networks.setFirewallPolicy compute.networks.use compute.networks.useExternalIp compute.nodeGroups.get compute.nodeTypes.get compute.projects.get compute.regionFirewallPolicies.create compute.regionFirewallPolicies.createTagBinding compute.regionFirewallPolicies.delete compute.regionFirewallPolicies.deleteTagBinding compute.regionFirewallPolicies.get compute.regionFirewallPolicies.update compute.regionFirewallPolicies.use compute.regionNetworkEndpointGroups.* compute.regionNetworkEndpointGroups.attachNetworkEndpoints compute.regionNetworkEndpointGroups.create compute.regionNetworkEndpointGroups.createTagBinding compute.regionNetworkEndpointGroups.delete compute.regionNetworkEndpointGroups.deleteTagBinding compute.regionNetworkEndpointGroups.detachNetworkEndpoints compute.regionNetworkEndpointGroups.get compute.regionNetworkEndpointGroups.list compute.regionNetworkEndpointGroups.listEffectiveTags compute.regionNetworkEndpointGroups.listTagBindings compute.regionNetworkEndpointGroups.use compute.regionOperations.get compute.regionOperations.list compute.regions.* compute.regions.get compute.regions.list compute.reservationBlocks.get compute.reservationBlocks.list compute.reservationSubBlocks.* compute.reservationSubBlocks.get compute.reservationSubBlocks.list compute.reservationSubBlocks.performMaintenance compute.reservationSubBlocks.reportFaulty compute.reservations.get compute.reservations.list compute.reservations.listEffectiveTags compute.reservations.listTagBindings compute.resourcePolicies.list compute.resourcePolicies.useReadOnly compute.storagePools.get compute.storagePools.list compute.storagePools.listEffectiveTags compute.storagePools.listTagBindings compute.storagePools.use compute.subnetworks.get compute.subnetworks.list compute.subnetworks.listEffectiveTags compute.subnetworks.listTagBindings compute.subnetworks.setPrivateIpGoogleAccess compute.subnetworks.use compute.subnetworks.useExternalIp compute.targetPools.get compute.targetPools.list compute.targetPools.listEffectiveTags compute.targetPools.listTagBindings compute.zoneOperations.get compute.zoneOperations.list compute.zones.* compute.zones.get compute.zones.list container.clusterRoleBindings.* container.clusterRoleBindings.create container.clusterRoleBindings.delete container.clusterRoleBindings.get container.clusterRoleBindings.list container.clusterRoleBindings.update container.clusterRoles.* container.clusterRoles.bind container.clusterRoles.create container.clusterRoles.delete container.clusterRoles.escalate container.clusterRoles.get container.clusterRoles.list container.clusterRoles.update container.clusters.connect container.clusters.get container.clusters.update container.customResourceDefinitions.create container.customResourceDefinitions.delete container.customResourceDefinitions.get container.customResourceDefinitions.list container.customResourceDefinitions.update container.namespaces.create container.namespaces.delete container.namespaces.get container.namespaces.list container.namespaces.update container.operations.get container.roleBindings.* container.roleBindings.create container.roleBindings.delete container.roleBindings.get container.roleBindings.list container.roleBindings.update container.roles.bind container.roles.escalate dataproc.autoscalingPolicies.create dataproc.autoscalingPolicies.delete dataproc.autoscalingPolicies.get dataproc.autoscalingPolicies.getIamPolicy dataproc.autoscalingPolicies.list dataproc.autoscalingPolicies.update dataproc.autoscalingPolicies.use dataproc.clusters.* dataproc.clusters.create dataproc.clusters.delete dataproc.clusters.get dataproc.clusters.getIamPolicy dataproc.clusters.list dataproc.clusters.repair dataproc.clusters.setIamPolicy dataproc.clusters.start dataproc.clusters.stop dataproc.clusters.update dataproc.clusters.use dataproc.jobs.* dataproc.jobs.cancel dataproc.jobs.create dataproc.jobs.delete dataproc.jobs.get dataproc.jobs.getIamPolicy dataproc.jobs.list dataproc.jobs.setIamPolicy dataproc.jobs.update dataproc.nodeGroups.* dataproc.nodeGroups.create dataproc.nodeGroups.get dataproc.nodeGroups.update dataproc.operations.cancel dataproc.sessionTemplates.get dataproc.sessions.* dataproc.sessions.create dataproc.sessions.delete dataproc.sessions.get dataproc.sessions.list dataproc.sessions.sparkApplicationRead dataproc.sessions.sparkApplicationWrite dataproc.sessions.terminate dataprocrm.nodePools.* dataprocrm.nodePools.create dataprocrm.nodePools.delete dataprocrm.nodePools.deleteNodes dataprocrm.nodePools.get dataprocrm.nodePools.list dataprocrm.nodePools.resize dataprocrm.nodes.* dataprocrm.nodes.get dataprocrm.nodes.heartbeat dataprocrm.nodes.list dataprocrm.nodes.mintOAuthToken dataprocrm.nodes.update dataprocrm.operations.cancel dataprocrm.operations.get dataprocrm.operations.list dataprocrm.workloads.* dataprocrm.workloads.cancel dataprocrm.workloads.create dataprocrm.workloads.delete dataprocrm.workloads.get dataprocrm.workloads.list firebase.projects.get iam.serviceAccounts.actAs iam.serviceAccounts.getAccessToken metastore.services.get monitoring.metricDescriptors.list monitoring.monitoredResourceDescriptors.list monitoring.timeSeries.* monitoring.timeSeries.create monitoring.timeSeries.list orgpolicy.policy.get recommender.iamPolicyInsights.* recommender.iamPolicyInsights.get recommender.iamPolicyInsights.list recommender.iamPolicyInsights.update recommender.iamPolicyRecommendations.* recommender.iamPolicyRecommendations.get recommender.iamPolicyRecommendations.list recommender.iamPolicyRecommendations.update recommender.storageBucketSoftDeleteInsights.* recommender.storageBucketSoftDeleteInsights.get recommender.storageBucketSoftDeleteInsights.list recommender.storageBucketSoftDeleteInsights.update recommender.storageBucketSoftDeleteRecommendations.* recommender.storageBucketSoftDeleteRecommendations.get recommender.storageBucketSoftDeleteRecommendations.list recommender.storageBucketSoftDeleteRecommendations.update resourcemanager.hierarchyNodes.listEffectiveTags resourcemanager.projects.get resourcemanager.projects.list resourcemanager.tagKeys.create resourcemanager.tagKeys.get resourcemanager.tagKeys.getIamPolicy resourcemanager.tagKeys.setIamPolicy resourcemanager.tagValueBindings.* resourcemanager.tagValueBindings.create resourcemanager.tagValueBindings.delete resourcemanager.tagValues.create resourcemanager.tagValues.get serviceusage.consumerpolicy.analyze serviceusage.consumerpolicy.get serviceusage.effectivepolicy.get serviceusage.groups.* serviceusage.groups.list serviceusage.groups.listExpandedMembers serviceusage.groups.listMembers serviceusage.quotas.get serviceusage.services.get serviceusage.services.list serviceusage.services.use serviceusage.values.test storage.anywhereCaches.* storage.anywhereCaches.create storage.anywhereCaches.disable storage.anywhereCaches.get storage.anywhereCaches.list storage.anywhereCaches.pause storage.anywhereCaches.resume storage.anywhereCaches.update storage.bucketOperations.* storage.bucketOperations.cancel storage.bucketOperations.get storage.bucketOperations.list storage.buckets.* storage.buckets.create storage.buckets.createTagBinding storage.buckets.delete storage.buckets.deleteTagBinding storage.buckets.enableObjectRetention storage.buckets.get storage.buckets.getIamPolicy storage.buckets.getIpFilter storage.buckets.getObjectInsights storage.buckets.list storage.buckets.listEffectiveTags storage.buckets.listTagBindings storage.buckets.relocate storage.buckets.restore storage.buckets.setIamPolicy storage.buckets.setIpFilter storage.buckets.update storage.buckets.viewIntelligenceDetails storage.folders.* storage.folders.create storage.folders.delete storage.folders.get storage.folders.list storage.folders.rename storage.intelligenceConfigs.* storage.intelligenceConfigs.get storage.intelligenceConfigs.update storage.managedFolders.* storage.managedFolders.create storage.managedFolders.delete storage.managedFolders.get storage.managedFolders.getIamPolicy storage.managedFolders.list storage.managedFolders.setIamPolicy storage.multipartUploads.* storage.multipartUploads.abort storage.multipartUploads.create storage.multipartUploads.list storage.multipartUploads.listParts storage.objects.* storage.objects.create storage.objects.createContext storage.objects.delete storage.objects.deleteContext storage.objects.get storage.objects.getIamPolicy storage.objects.list storage.objects.move storage.objects.overrideUnlockedRetention storage.objects.restore storage.objects.setIamPolicy storage.objects.setRetention storage.objects.update storage.objects.updateContext storagebatchoperations.* storagebatchoperations.bucketOperations.get storagebatchoperations.bucketOperations.list storagebatchoperations.jobs.cancel storagebatchoperations.jobs.create storagebatchoperations.jobs.delete storagebatchoperations.jobs.get storagebatchoperations.jobs.list storagebatchoperations.locations.get storagebatchoperations.locations.list storagebatchoperations.operations.cancel storagebatchoperations.operations.delete storagebatchoperations.operations.get storagebatchoperations.operations.list

注意：

• 使用 Google Cloud 控制台或 gcloud CLI Google Cloud CLI 时，需要或建议拥有 compute 权限，才能创建和查看 Managed Service for Apache Spark 集群。
• 如要允许用户上传文件，请授予 Storage Object Creator 角色。 如需允许用户查看作业输出，请授予 Storage Object Viewer 角色。
• 用户必须拥有 monitoring.timeSeries.list 权限才能在 Google Cloud 控制台→Managed Service for Apache Spark→集群详情概览标签页上查看图表。
• 用户必须拥有 compute.instances.list 权限才能在Google Cloud 控制台→Managed Service for Apache Spark→集群详情虚拟机实例标签页上查看实例状态和主实例 SSH 菜单。如需了解 Compute Engine 角色，请参阅 Compute Engine→可用的 IAM 角色。
• 如需使用用户指定的服务账号创建集群，指定的服务账号必须具有由 Managed Service for Apache Spark Worker 角色授予的所有权限，包括对 Managed Service for Apache Spark 暂存存储分区和临时存储分区的访问权限。视配置的功能而定，可能需要其他角色。 如需了解详情，请参阅创建使用自定义虚拟机服务账号的集群。

项目角色

您还可以使用 IAM 项目角色在项目级层设置权限。下表列出了与 IAM 项目角色关联的权限：

项目角色	权限
Project Viewer	拥有不会修改状态的只读操作（获取、列出）的所有项目权限
Project Editor	拥有所有“Project Viewer”权限，外加可修改状态的操作（创建、删除、更新、使用、取消、停止、启动）的所有项目权限
Project Owner	拥有所有“项目修改者”权限，外加为项目管理访问控制的权限（获取/设置 IamPolicy）和设置项目结算的权限

IAM 角色和 Managed Service for Apache Spark 操作汇总

下表列出了与项目和 Managed Service for Apache Spark 角色关联的 Managed Service for Apache Spark 操作。

操作	Project Editor	Project Viewer	Managed Service for Apache Spark 管理员	Managed Service for Apache Spark 编辑器	Managed Service for Apache Spark 查看器
获取/设置 Managed Service for Apache Spark IAM 权限	否	否	是	否	否
创建集群	是	否	是	是	否
列出集群	是	是	是	是	是
获取集群详情	是	是	是^1, 2	是^1, 2	是^1, 2
更新集群	是	否	是	是	否
删除集群	是	否	是	是	否
启动/停止集群	是	否	是	是	否
提交作业	是	否	是^3	是^3	否
列出作业	是	是	是	是	是
获取作业详情	是	是	是^4	是^4	是^4
取消作业	是	否	是	是	否
删除作业	是	否	是	是	否
列出操作	是	是	是	是	是
获取操作详情	是	是	是	是	是
删除操作	是	否	是	是	否

注意：

1. 除非用户还拥有包含 monitoring.timeSeries.list 权限的角色，否则将无法使用性能图表。
2. 除非用户还拥有包含 compute.instances.list 权限的角色，否则集群中的虚拟机列表将不包含主实例的状态信息或 SSH 链接。
3. 上传文件的作业要求用户具有 Storage Object Creator 角色或具有对 Managed Service for Apache Spark 暂存存储桶的写入权限。
4. 除非用户还具有“存储对象查看者”角色或已被授予项目的暂存存储分区的读取权限，否则将无法访问作业输出。

Managed Service for Apache Spark 虚拟机的访问范围

虚拟机访问权限范围和 IAM 角色协同工作，以限制虚拟机对 Google CloudAPI 的访问权限。例如，如果仅向集群虚拟机授予 https://www.googleapis.com/auth/storage-full 范围，则在集群虚拟机上运行的应用可以调用 Cloud Storage API，但是它们无法向 BigQuery 发出请求，即使用于运行它们的虚拟机服务账号已被授予具有广泛权限的 BigQuery 角色也不例外。

最佳做法是向虚拟机授予广泛的 cloud-platform 范围 (https://www.googleapis.com/auth/cloud-platform)，然后通过向虚拟机服务账号授予特定的 IAM 角色来限制虚拟机访问权限（请参阅范围最佳实践）。

注意： cloud-platform 范围在默认情况下被应用于使用 Managed Service for Apache Spark 映像版本 2.1 及更高版本创建的 Managed Service for Apache Spark 集群虚拟机。

默认的 Managed Service for Apache Spark 虚拟机范围。如果在创建集群时未指定范围（请参阅 gcloud dataproc cluster create --scopes），Managed Service for Apache Spark 虚拟机将具有以下默认范围集：

https://www.googleapis.com/auth/cloud-platform (clusters created with image version 2.1+).
https://www.googleapis.com/auth/bigquery
https://www.googleapis.com/auth/bigtable.admin.table
https://www.googleapis.com/auth/bigtable.data
https://www.googleapis.com/auth/cloud.useraccounts.readonly
https://www.googleapis.com/auth/devstorage.full_control
https://www.googleapis.com/auth/devstorage.read_write
https://www.googleapis.com/auth/logging.write

如果您在创建集群时指定了范围，则集群虚拟机将拥有您指定的范围以及下面的必需的最小范围集（即使您未指定这些范围）：

https://www.googleapis.com/auth/cloud-platform (clusters created with image version 2.1+).
https://www.googleapis.com/auth/cloud.useraccounts.readonly
https://www.googleapis.com/auth/devstorage.read_write
https://www.googleapis.com/auth/logging.write

IAM 允许政策管理

您可以使用允许政策向正文授予 IAM 角色。您可以使用 Google Cloud 控制台、IAM API 或 Google Cloud CLI 来获取和设置允许政策。

• 对于 Google Cloud 控制台，请参阅使用 Google Cloud 控制台进行访问权限控制。
• 对于 API，请参阅使用 API 进行访问控制。
• 对于 Google Cloud CLI，请参阅使用 Google Cloud CLI 进行访问权限控制。

后续步骤

• 了解 Managed Service for Apache Spark 主账号和角色
• 了解 Managed Service for Apache Spark Granular IAM
• 详细了解 IAM。
• 了解 Managed Service for Apache Spark 中的服务账号