身分與存取權管理角色和權限

本頁面說明 Cloud Deploy 服務帳戶、角色和權限。

Cloud Deploy 的存取權是透過身分與存取權管理 (IAM) 控管。 IAM 可讓您建立及管理 Google Cloud 資源的權限。Cloud Deploy 提供一組特定的預先定義 IAM 角色，每個角色都包含一組權限。您可以使用這些角色，對特定 Google Cloud 資源授予更精細的存取權，避免未經授權者存取其他資源。IAM 採用最小權限原則，可確保您僅授予使用者必要的資源存取權限。

如要瞭解進階存取權控管安全功能，請參閱「使用 IAM 限制 Cloud Deploy 存取權」。

Cloud Deploy 中的服務帳戶

根據預設，Cloud Deploy 會使用預設的 Compute Engine 服務帳戶運作。如要進一步瞭解如何設定這個服務帳戶以搭配 Cloud Deploy 使用，或選擇其他帳戶，請參閱「Cloud Deploy 執行服務帳戶」文件。

進一步瞭解 Cloud Deploy 如何使用服務帳戶。

預先定義的 Cloud Deploy 角色

若使用 IAM，Cloud Deploy API 中的每個 API 方法都要求提出 API 要求的身分具備使用該資源的適當權限。只要設定政策將角色授予專案主體 (使用者、群組或服務帳戶)，即可授予權限。您可以在同一資源上，將多個角色授予同一個主體。

IAM 說明文件提供可搜尋的參考資料，列出所有預先定義的角色。

下表列出 Cloud Deploy IAM 角色及這些角色所具備的權限：

Role	Permissions
Cloud Deploy Admin (roles/clouddeploy.admin) Full control of Cloud Deploy resources.	clouddeploy.* clouddeploy.automationRuns.cancel clouddeploy.automationRuns.get clouddeploy.automationRuns.list clouddeploy.automations.create clouddeploy.automations.delete clouddeploy.automations.get clouddeploy.automations.list clouddeploy.automations.update clouddeploy.config.get clouddeploy.customTargetTypes.create clouddeploy.customTargetTypes.delete clouddeploy.customTargetTypes.get clouddeploy.customTargetTypes.getIamPolicy clouddeploy.customTargetTypes.list clouddeploy.customTargetTypes.setIamPolicy clouddeploy.customTargetTypes.update clouddeploy.deliveryPipelines.create clouddeploy.deliveryPipelines.createTagBinding clouddeploy.deliveryPipelines.delete clouddeploy.deliveryPipelines.deleteTagBinding clouddeploy.deliveryPipelines.get clouddeploy.deliveryPipelines.getIamPolicy clouddeploy.deliveryPipelines.list clouddeploy.deliveryPipelines.listEffectiveTags clouddeploy.deliveryPipelines.listTagBindings clouddeploy.deliveryPipelines.setIamPolicy clouddeploy.deliveryPipelines.update clouddeploy.deployPolicies.create clouddeploy.deployPolicies.delete clouddeploy.deployPolicies.get clouddeploy.deployPolicies.getIamPolicy clouddeploy.deployPolicies.list clouddeploy.deployPolicies.override clouddeploy.deployPolicies.setIamPolicy clouddeploy.deployPolicies.update clouddeploy.jobRuns.get clouddeploy.jobRuns.list clouddeploy.jobRuns.terminate clouddeploy.locations.get clouddeploy.locations.list clouddeploy.operations.cancel clouddeploy.operations.delete clouddeploy.operations.get clouddeploy.operations.list clouddeploy.releases.abandon clouddeploy.releases.create clouddeploy.releases.get clouddeploy.releases.list clouddeploy.rollouts.advance clouddeploy.rollouts.approve clouddeploy.rollouts.cancel clouddeploy.rollouts.create clouddeploy.rollouts.get clouddeploy.rollouts.ignoreJob clouddeploy.rollouts.list clouddeploy.rollouts.retryJob clouddeploy.rollouts.rollback clouddeploy.targets.create clouddeploy.targets.createTagBinding clouddeploy.targets.delete clouddeploy.targets.deleteTagBinding clouddeploy.targets.get clouddeploy.targets.getIamPolicy clouddeploy.targets.list clouddeploy.targets.listEffectiveTags clouddeploy.targets.listTagBindings clouddeploy.targets.setIamPolicy clouddeploy.targets.update resourcemanager.projects.get resourcemanager.projects.list
Clouddeploy Editor (roles/clouddeploy.editor) Editor role for clouddeploy	clouddeploy.automationRuns.* clouddeploy.automationRuns.cancel clouddeploy.automationRuns.get clouddeploy.automationRuns.list clouddeploy.automations.* clouddeploy.automations.create clouddeploy.automations.delete clouddeploy.automations.get clouddeploy.automations.list clouddeploy.automations.update clouddeploy.config.get clouddeploy.customTargetTypes.create clouddeploy.customTargetTypes.delete clouddeploy.customTargetTypes.get clouddeploy.customTargetTypes.getIamPolicy clouddeploy.customTargetTypes.list clouddeploy.customTargetTypes.update clouddeploy.deliveryPipelines.create clouddeploy.deliveryPipelines.delete clouddeploy.deliveryPipelines.get clouddeploy.deliveryPipelines.getIamPolicy clouddeploy.deliveryPipelines.list clouddeploy.deliveryPipelines.listEffectiveTags clouddeploy.deliveryPipelines.listTagBindings clouddeploy.deliveryPipelines.update clouddeploy.deployPolicies.create clouddeploy.deployPolicies.delete clouddeploy.deployPolicies.get clouddeploy.deployPolicies.getIamPolicy clouddeploy.deployPolicies.list clouddeploy.deployPolicies.override clouddeploy.deployPolicies.update clouddeploy.jobRuns.* clouddeploy.jobRuns.get clouddeploy.jobRuns.list clouddeploy.jobRuns.terminate clouddeploy.locations.* clouddeploy.locations.get clouddeploy.locations.list clouddeploy.operations.* clouddeploy.operations.cancel clouddeploy.operations.delete clouddeploy.operations.get clouddeploy.operations.list clouddeploy.releases.* clouddeploy.releases.abandon clouddeploy.releases.create clouddeploy.releases.get clouddeploy.releases.list clouddeploy.rollouts.* clouddeploy.rollouts.advance clouddeploy.rollouts.approve clouddeploy.rollouts.cancel clouddeploy.rollouts.create clouddeploy.rollouts.get clouddeploy.rollouts.ignoreJob clouddeploy.rollouts.list clouddeploy.rollouts.retryJob clouddeploy.rollouts.rollback clouddeploy.targets.create clouddeploy.targets.delete clouddeploy.targets.get clouddeploy.targets.getIamPolicy clouddeploy.targets.list clouddeploy.targets.listEffectiveTags clouddeploy.targets.listTagBindings clouddeploy.targets.update resourcemanager.projects.get resourcemanager.projects.list
Cloud Deploy Viewer (roles/clouddeploy.viewer) Can view Cloud Deploy resources.	clouddeploy.automationRuns.get clouddeploy.automationRuns.list clouddeploy.automations.get clouddeploy.automations.list clouddeploy.config.get clouddeploy.customTargetTypes.get clouddeploy.customTargetTypes.getIamPolicy clouddeploy.customTargetTypes.list clouddeploy.deliveryPipelines.get clouddeploy.deliveryPipelines.getIamPolicy clouddeploy.deliveryPipelines.list clouddeploy.deliveryPipelines.listEffectiveTags clouddeploy.deliveryPipelines.listTagBindings clouddeploy.deployPolicies.get clouddeploy.deployPolicies.getIamPolicy clouddeploy.deployPolicies.list clouddeploy.jobRuns.get clouddeploy.jobRuns.list clouddeploy.locations.* clouddeploy.locations.get clouddeploy.locations.list clouddeploy.operations.get clouddeploy.operations.list clouddeploy.releases.get clouddeploy.releases.list clouddeploy.rollouts.get clouddeploy.rollouts.list clouddeploy.targets.get clouddeploy.targets.getIamPolicy clouddeploy.targets.list clouddeploy.targets.listEffectiveTags clouddeploy.targets.listTagBindings resourcemanager.projects.get resourcemanager.projects.list
Cloud Deploy Approver (roles/clouddeploy.approver) Permission to approve or reject rollouts.	clouddeploy.config.get clouddeploy.jobRuns.get clouddeploy.jobRuns.list clouddeploy.locations.* clouddeploy.locations.get clouddeploy.locations.list clouddeploy.operations.* clouddeploy.operations.cancel clouddeploy.operations.delete clouddeploy.operations.get clouddeploy.operations.list clouddeploy.rollouts.approve clouddeploy.rollouts.get clouddeploy.rollouts.list resourcemanager.projects.get resourcemanager.projects.list
Cloud Deploy Custom Target Type Admin (roles/clouddeploy.customTargetTypeAdmin) Permission to manage CustomTargetType resources	clouddeploy.config.get clouddeploy.customTargetTypes.* clouddeploy.customTargetTypes.create clouddeploy.customTargetTypes.delete clouddeploy.customTargetTypes.get clouddeploy.customTargetTypes.getIamPolicy clouddeploy.customTargetTypes.list clouddeploy.customTargetTypes.setIamPolicy clouddeploy.customTargetTypes.update resourcemanager.projects.get resourcemanager.projects.list
Cloud Deploy Developer (roles/clouddeploy.developer) Permission to manage deployment configuration without permission to access operational resources, such as targets.	clouddeploy.automationRuns.get clouddeploy.automationRuns.list clouddeploy.automations.get clouddeploy.automations.list clouddeploy.config.get clouddeploy.deliveryPipelines.create clouddeploy.deliveryPipelines.createTagBinding clouddeploy.deliveryPipelines.delete clouddeploy.deliveryPipelines.deleteTagBinding clouddeploy.deliveryPipelines.get clouddeploy.deliveryPipelines.getIamPolicy clouddeploy.deliveryPipelines.list clouddeploy.deliveryPipelines.listEffectiveTags clouddeploy.deliveryPipelines.listTagBindings clouddeploy.deliveryPipelines.update clouddeploy.deployPolicies.get clouddeploy.deployPolicies.list clouddeploy.jobRuns.get clouddeploy.jobRuns.list clouddeploy.locations.* clouddeploy.locations.get clouddeploy.locations.list clouddeploy.operations.* clouddeploy.operations.cancel clouddeploy.operations.delete clouddeploy.operations.get clouddeploy.operations.list clouddeploy.releases.* clouddeploy.releases.abandon clouddeploy.releases.create clouddeploy.releases.get clouddeploy.releases.list clouddeploy.rollouts.get clouddeploy.rollouts.list resourcemanager.projects.get resourcemanager.projects.list
Cloud Deploy Runner (roles/clouddeploy.jobRunner) Permission to execute Cloud Deploy work without permission to deliver to a target.	clouddeploy.config.get logging.logEntries.create storage.objects.create storage.objects.get storage.objects.list
Cloud Deploy Operator (roles/clouddeploy.operator) Permission to manage deployment configuration.	clouddeploy.automationRuns.* clouddeploy.automationRuns.cancel clouddeploy.automationRuns.get clouddeploy.automationRuns.list clouddeploy.automations.* clouddeploy.automations.create clouddeploy.automations.delete clouddeploy.automations.get clouddeploy.automations.list clouddeploy.automations.update clouddeploy.config.get clouddeploy.customTargetTypes.get clouddeploy.customTargetTypes.getIamPolicy clouddeploy.customTargetTypes.list clouddeploy.deliveryPipelines.create clouddeploy.deliveryPipelines.createTagBinding clouddeploy.deliveryPipelines.delete clouddeploy.deliveryPipelines.deleteTagBinding clouddeploy.deliveryPipelines.get clouddeploy.deliveryPipelines.getIamPolicy clouddeploy.deliveryPipelines.list clouddeploy.deliveryPipelines.listEffectiveTags clouddeploy.deliveryPipelines.listTagBindings clouddeploy.deliveryPipelines.update clouddeploy.deployPolicies.get clouddeploy.deployPolicies.getIamPolicy clouddeploy.deployPolicies.list clouddeploy.jobRuns.* clouddeploy.jobRuns.get clouddeploy.jobRuns.list clouddeploy.jobRuns.terminate clouddeploy.locations.* clouddeploy.locations.get clouddeploy.locations.list clouddeploy.operations.* clouddeploy.operations.cancel clouddeploy.operations.delete clouddeploy.operations.get clouddeploy.operations.list clouddeploy.releases.* clouddeploy.releases.abandon clouddeploy.releases.create clouddeploy.releases.get clouddeploy.releases.list clouddeploy.rollouts.advance clouddeploy.rollouts.cancel clouddeploy.rollouts.create clouddeploy.rollouts.get clouddeploy.rollouts.ignoreJob clouddeploy.rollouts.list clouddeploy.rollouts.retryJob clouddeploy.rollouts.rollback clouddeploy.targets.create clouddeploy.targets.createTagBinding clouddeploy.targets.delete clouddeploy.targets.deleteTagBinding clouddeploy.targets.get clouddeploy.targets.getIamPolicy clouddeploy.targets.list clouddeploy.targets.listEffectiveTags clouddeploy.targets.listTagBindings clouddeploy.targets.update resourcemanager.projects.get resourcemanager.projects.list
Cloud Deploy Policy Admin (roles/clouddeploy.policyAdmin) Permission to manage Deploy Policies.	clouddeploy.deployPolicies.* clouddeploy.deployPolicies.create clouddeploy.deployPolicies.delete clouddeploy.deployPolicies.get clouddeploy.deployPolicies.getIamPolicy clouddeploy.deployPolicies.list clouddeploy.deployPolicies.override clouddeploy.deployPolicies.setIamPolicy clouddeploy.deployPolicies.update clouddeploy.locations.* clouddeploy.locations.get clouddeploy.locations.list clouddeploy.operations.* clouddeploy.operations.cancel clouddeploy.operations.delete clouddeploy.operations.get clouddeploy.operations.list resourcemanager.projects.get resourcemanager.projects.list
Cloud Deploy Policy Overrider (roles/clouddeploy.policyOverrider) Permission to override Deploy Policies.	clouddeploy.deployPolicies.get clouddeploy.deployPolicies.list clouddeploy.deployPolicies.override clouddeploy.locations.* clouddeploy.locations.get clouddeploy.locations.list clouddeploy.operations.* clouddeploy.operations.cancel clouddeploy.operations.delete clouddeploy.operations.get clouddeploy.operations.list resourcemanager.projects.get resourcemanager.projects.list
Cloud Deploy Releaser (roles/clouddeploy.releaser) Permission to create Cloud Deploy releases and rollouts.	clouddeploy.config.get clouddeploy.customTargetTypes.get clouddeploy.deliveryPipelines.get clouddeploy.jobRuns.get clouddeploy.jobRuns.list clouddeploy.locations.* clouddeploy.locations.get clouddeploy.locations.list clouddeploy.operations.* clouddeploy.operations.cancel clouddeploy.operations.delete clouddeploy.operations.get clouddeploy.operations.list clouddeploy.releases.create clouddeploy.releases.get clouddeploy.releases.list clouddeploy.rollouts.advance clouddeploy.rollouts.cancel clouddeploy.rollouts.create clouddeploy.rollouts.get clouddeploy.rollouts.list clouddeploy.rollouts.rollback clouddeploy.targets.get resourcemanager.projects.get resourcemanager.projects.list

Service agent roles

Service agent roles should only be granted to service agents.

Role	Permissions
Cloud Deploy Service Agent (roles/clouddeploy.serviceAgent) Gives Cloud Deploy Service Account access to managed resources. Warning: Do not grant service agent roles to any principals except service agents.	cloudbuild.builds.create cloudbuild.builds.get cloudbuild.builds.list cloudbuild.builds.update cloudbuild.workerpools.use iam.serviceAccounts.actAs iam.serviceAccounts.getAccessToken logging.logEntries.create pubsub.topics.get pubsub.topics.publish servicemanagement.services.report serviceusage.services.use storage.buckets.create storage.buckets.get storage.objects.get

注意： 如果在目標上指定替代服務帳戶，具備 roles/clouddeploy.admin、.developer 和 .operator 角色的使用者，也必須擁有在推出目標中指定服務帳戶的 iam.serviceAccounts.actAs 權限。

除了 Cloud Deploy 預先定義的角色，基本的檢視者、編輯者和擁有者角色也包含與 Cloud Deploy 相關的權限。不過，我們建議您盡可能授予預先定義的角色，以符合最小權限原則。

權限

下表列出了呼叫者在呼叫每個方法時必須具備的權限：

API 方法	必要權限	說明
automations.create()	clouddeploy.automations.create	建立新的自動化資源。
automations.delete()	clouddeploy.automations.delete	刪除現有的自動化資源。
automations.get()	clouddeploy.automations.get	擷取個別自動化資源的詳細資料。
automations.list()	clouddeploy.automations.list	列出自動化資源及其中繼資料。
automations.update()	clouddeploy.automations.update	更新現有的自動化資源。
automationRuns.cancel()	clouddeploy.automationRuns.cancel	取消正在執行的自動化作業。
automationRuns.get()	clouddeploy.automationRuns.get	擷取個別自動化執行作業的詳細資料。
automationRuns.list()	clouddeploy.automationRuns.list	列出自動化執行作業及其相關中繼資料。
customTargetTypes.create()	clouddeploy.customTargetTypes.create	建立自訂目標類型資源。
customTargetTypes.delete()	clouddeploy.customTargetTypes.delete	刪除自訂目標類型資源。
customTargetTypes.get()	clouddeploy.customTargetTypes.get	擷取自訂目標類型的詳細資料。
customTargetTypes.getIamPolicy()	clouddeploy.customTargetTypes.getIamPolicy	取得自訂目標類型資源的 IAM 政策。
customTargetTypes.list()	clouddeploy.customTargetTypes.list	列出可用的自訂目標類型及其中繼資料。
customTargetTypes.patch()	clouddeploy.customTargetTypes.patch	更新現有自訂目標類型。
customTargetTypes.setIamPolicy()	clouddeploy.customTargetTypes.setIamPolicy	為自訂目標類型資源設定 IAM 政策。
deliveryPipelines.create()	clouddeploy.deliveryPipelines.create	建立新的推送管道資源。
deliveryPipelines.delete()	clouddeploy.deliveryPipelines.delete	刪除現有的推送管道資源。
deliveryPipelines.get()	clouddeploy.deliveryPipelines.get	擷取個別推送管道的詳細資料。
deliveryPipelines.getIamPolicy()	clouddeploy.deliveryPipelines.getIamPolicy	取得交付管道資源的 IAM 政策。
deliveryPipelines.list()	clouddeploy.deliveryPipelines.list	列出放送管道及其相關中繼資料。
deliveryPipelines.rollbackTarget()	clouddeploy.rollouts.rollback	復原目標。
deliveryPipelines.setIamPolicy()	clouddeploy.deliveryPipelines.setIamPolicy	設定交付管道資源的 IAM 政策。
deliveryPipelines.update()	clouddeploy.deliveryPipelines.update	更新現有的交付管道資源。
deployPolicies.create()	clouddeploy.deployPolicies.create	建立部署政策資源。
deployPolicies.delete()	clouddeploy.deployPolicies.delete	刪除部署政策資源。
deployPolicies.get()	clouddeploy.deployPolicies.get	擷取部署政策資源的詳細資料。
deployPolicies.list()	clouddeploy.deployPolicies.list	列出可用的部署政策及其相關中繼資料。
jobRuns.get()	clouddeploy.jobRuns.get	擷取 JobRuns 資源。
jobRuns.list()	clouddeploy.jobRuns.list	列出 JobRuns 資源及其相關中繼資料。
jobRuns.terminate()	clouddeploy.jobRuns.terminate	終止執行中的工作。
operations.cancel()	clouddeploy.operations.cancel	取消長時間執行的作業。
operation.delete()	clouddeploy.operations.delete	刪除一個長時間執行的作業。
operations.get()	clouddeploy.operations.get	取得特定長時間執行的作業 (例如，傳回發行內容建立作業的狀態)。
operations.list()	clouddeploy.operations.list	列出長時間執行的作業。
releases.abandon()	clouddeploy.releases.abandon	捨棄版本，並防止針對該版本進一步推出。
releases.create()	clouddeploy.releases.create	建立新的發行資源。呼叫方也必須擁有用於轉譯資訊清單的服務帳戶 iam.serviceAccounts.actAs 權限。
releases.get()	clouddeploy.releases.get	擷取個別發行內容的詳細資料。
releases.list()	clouddeploy.releases.list	列出發行內容和中繼資料。
rollouts.advance()	clouddeploy.rollouts.advance	讓推出作業進展至下一階段。
rollouts.approve()	clouddeploy.rollouts.approve	核准或拒絕核准狀態為 required 的推出作業。
rollouts.cancel()	clouddeploy.rollouts.cancel	取消推出作業。
rollouts.create()	clouddeploy.rollouts.create	建立新的推出作業資源或升級版本。呼叫者也必須具備專案或用於部署的服務帳戶的 iam.serviceAccounts.actAs 權限。
rollouts.get()	clouddeploy.rollouts.get	擷取個別推出作業的詳細資料。
rollouts.ignoreJob()	clouddeploy.rollouts.ignoreJob	忽略失敗的工作。
rollouts.list()	clouddeploy.rollouts.list	列出推出作業和中繼資料。
rollouts.retryJob()	clouddeploy.rollouts.retryJob	重試失敗的工作。
rollouts.advance()、rollouts.approve()、rollouts.cancel()、rollouts.create()、rollouts.ignoreJob()、rollouts.retryJob()、deliveryPipelines.rollbackTarget()、jobRuns.terminate()	clouddeploy.deployPolicies.override	覆寫部署政策資源。
deployPolicies.update()	clouddeploy.deployPolicies.update	更新現有的部署政策資源。
targets.create()	clouddeploy.targets.create	建立新的目標資源。
targets.delete()	clouddeploy.targets.delete	刪除現有目標資源。
targets.get()	clouddeploy.targets.get	擷取個別目標的詳細資料。
targets.getIamPolicy()	clouddeploy.targets.getIamPolicy	取得目標資源的 IAM 政策。
targets.list()	clouddeploy.targets.list	列出目標及其相關中繼資料。
targets.setIamPolicy()	clouddeploy.targets.setIamPolicy	為目標資源設定 IAM 政策。
targets.update()	clouddeploy.targets.update	更新現有的目標資源。

使用 IAM 限制對 Cloud Deploy 資源執行的動作

您可以透過下列方式，使用 IAM 保護 Cloud Deploy 資源：

• IAM 中繼 API

  使用 Cloud Deploy 資源上的 setIamPolicy，限制對這些資源執行的動作。

• 有條件的 IAM

  以程式輔助方式套用存取政策，包括授予或拒絕存取權的條件。

您可以使用這些政策和條件，限制對 Cloud Deploy 資源執行的下列動作：

• 建立推送管道或目標

  您可以將這項存取權授予特定使用者或群組。

• 更新或刪除特定推送管道

  您可以將這項存取權授予特定使用者或群組。

• 為特定推送管道建立版本

  您可以將這項存取權授予特定使用者或群組。

• 更新或刪除特定目標

  您可以將這項存取權授予特定使用者或群組。

• 建立或核准推出作業，或升級版本

  您可以將這項存取權授予特定使用者或群組，讓他們存取特定目標或放送管道。

  您也可以設定條件，將存取權限制在指定時間範圍內。

後續步驟

• 瞭解身分與存取權管理。
• 進一步瞭解如何在 IAM 中使用條件
• 進一步瞭解 Cloud Deploy 服務帳戶。