ロールと権限

このページでは、Google Distributed Cloud コネクテッド に必要な権限と、それらをカプセル化する Identity and Access Management（IAM）のロールの一覧を示します。

Distributed Cloud Edge Container API のロールと権限

次の表に、Distributed Cloud Edge Container API の Google Cloud プロジェクト ロール と、カプセル化する Distributed Cloud connected の権限を示します。

Role	Permissions
Edge Container Admin (roles/edgecontainer.admin) Full access to Edge Container all resources.	edgecontainer.* edgecontainer.apikeys.create edgecontainer.apikeys.delete edgecontainer.apikeys.get edgecontainer.apikeys.list edgecontainer.clusters.create edgecontainer.clusters.delete edgecontainer.clusters.generateAccessToken edgecontainer.clusters.generateOfflineCredential edgecontainer.clusters.get edgecontainer.clusters.getIamPolicy edgecontainer.clusters.list edgecontainer.clusters.setIamPolicy edgecontainer.clusters.update edgecontainer.clusters.upgrade edgecontainer.identityproviders.create edgecontainer.identityproviders.delete edgecontainer.identityproviders.get edgecontainer.identityproviders.list edgecontainer.locations.get edgecontainer.locations.list edgecontainer.machines.create edgecontainer.machines.delete edgecontainer.machines.get edgecontainer.machines.getIamPolicy edgecontainer.machines.list edgecontainer.machines.setIamPolicy edgecontainer.machines.update edgecontainer.machines.use edgecontainer.nodePools.create edgecontainer.nodePools.delete edgecontainer.nodePools.get edgecontainer.nodePools.getIamPolicy edgecontainer.nodePools.list edgecontainer.nodePools.setIamPolicy edgecontainer.nodePools.update edgecontainer.operations.cancel edgecontainer.operations.delete edgecontainer.operations.get edgecontainer.operations.list edgecontainer.serverconfig.get edgecontainer.serviceaccounts.create edgecontainer.serviceaccounts.delete edgecontainer.serviceaccounts.describekey edgecontainer.serviceaccounts.disablekey edgecontainer.serviceaccounts.generatekey edgecontainer.serviceaccounts.get edgecontainer.serviceaccounts.list edgecontainer.serviceaccounts.listkeys edgecontainer.vpnConnections.create edgecontainer.vpnConnections.delete edgecontainer.vpnConnections.get edgecontainer.vpnConnections.getIamPolicy edgecontainer.vpnConnections.list edgecontainer.vpnConnections.setIamPolicy edgecontainer.vpnConnections.update edgecontainer.zonalProjects.disable edgecontainer.zonalProjects.enable edgecontainer.zonalProjects.get edgecontainer.zonalProjects.list edgecontainer.zonalservices.disable edgecontainer.zonalservices.enable edgecontainer.zonalservices.get edgecontainer.zonalservices.list edgecontainer.zones.get edgecontainer.zones.getZoneIamPolicy edgecontainer.zones.list edgecontainer.zones.listRoles edgecontainer.zones.setZoneIamPolicy resourcemanager.projects.get resourcemanager.projects.list
Edgecontainer Editor (roles/edgecontainer.editor) Editor role for edgecontainer	edgecontainer.apikeys.* edgecontainer.apikeys.create edgecontainer.apikeys.delete edgecontainer.apikeys.get edgecontainer.apikeys.list edgecontainer.clusters.create edgecontainer.clusters.delete edgecontainer.clusters.generateAccessToken edgecontainer.clusters.get edgecontainer.clusters.getIamPolicy edgecontainer.clusters.list edgecontainer.clusters.update edgecontainer.clusters.upgrade edgecontainer.identityproviders.* edgecontainer.identityproviders.create edgecontainer.identityproviders.delete edgecontainer.identityproviders.get edgecontainer.identityproviders.list edgecontainer.locations.* edgecontainer.locations.get edgecontainer.locations.list edgecontainer.machines.create edgecontainer.machines.delete edgecontainer.machines.get edgecontainer.machines.getIamPolicy edgecontainer.machines.list edgecontainer.machines.update edgecontainer.machines.use edgecontainer.nodePools.create edgecontainer.nodePools.delete edgecontainer.nodePools.get edgecontainer.nodePools.getIamPolicy edgecontainer.nodePools.list edgecontainer.nodePools.update edgecontainer.operations.* edgecontainer.operations.cancel edgecontainer.operations.delete edgecontainer.operations.get edgecontainer.operations.list edgecontainer.serverconfig.get edgecontainer.serviceaccounts.* edgecontainer.serviceaccounts.create edgecontainer.serviceaccounts.delete edgecontainer.serviceaccounts.describekey edgecontainer.serviceaccounts.disablekey edgecontainer.serviceaccounts.generatekey edgecontainer.serviceaccounts.get edgecontainer.serviceaccounts.list edgecontainer.serviceaccounts.listkeys edgecontainer.vpnConnections.create edgecontainer.vpnConnections.delete edgecontainer.vpnConnections.get edgecontainer.vpnConnections.getIamPolicy edgecontainer.vpnConnections.list edgecontainer.vpnConnections.update edgecontainer.zonalProjects.* edgecontainer.zonalProjects.disable edgecontainer.zonalProjects.enable edgecontainer.zonalProjects.get edgecontainer.zonalProjects.list edgecontainer.zonalservices.* edgecontainer.zonalservices.disable edgecontainer.zonalservices.enable edgecontainer.zonalservices.get edgecontainer.zonalservices.list edgecontainer.zones.get edgecontainer.zones.getZoneIamPolicy edgecontainer.zones.list edgecontainer.zones.listRoles resourcemanager.projects.get resourcemanager.projects.list
Edge Container Viewer (roles/edgecontainer.viewer) Read-only access to Edge Container all resources.	edgecontainer.apikeys.get edgecontainer.apikeys.list edgecontainer.clusters.generateAccessToken edgecontainer.clusters.get edgecontainer.clusters.getIamPolicy edgecontainer.clusters.list edgecontainer.identityproviders.get edgecontainer.identityproviders.list edgecontainer.locations.* edgecontainer.locations.get edgecontainer.locations.list edgecontainer.machines.get edgecontainer.machines.getIamPolicy edgecontainer.machines.list edgecontainer.nodePools.get edgecontainer.nodePools.getIamPolicy edgecontainer.nodePools.list edgecontainer.operations.get edgecontainer.operations.list edgecontainer.serverconfig.get edgecontainer.serviceaccounts.describekey edgecontainer.serviceaccounts.generatekey edgecontainer.serviceaccounts.get edgecontainer.serviceaccounts.list edgecontainer.serviceaccounts.listkeys edgecontainer.vpnConnections.get edgecontainer.vpnConnections.getIamPolicy edgecontainer.vpnConnections.list edgecontainer.zonalProjects.get edgecontainer.zonalProjects.list edgecontainer.zonalservices.get edgecontainer.zonalservices.list edgecontainer.zones.get edgecontainer.zones.getZoneIamPolicy edgecontainer.zones.list edgecontainer.zones.listRoles resourcemanager.projects.get resourcemanager.projects.list
Edge Container API Key Admin (roles/edgecontainer.apiKeyAdmin) Access to manage API Keys.	edgecontainer.apikeys.* edgecontainer.apikeys.create edgecontainer.apikeys.delete edgecontainer.apikeys.get edgecontainer.apikeys.list edgecontainer.locations.* edgecontainer.locations.get edgecontainer.locations.list edgecontainer.operations.* edgecontainer.operations.cancel edgecontainer.operations.delete edgecontainer.operations.get edgecontainer.operations.list
Edge Container API Key Viewer (roles/edgecontainer.apiKeyViewer) Read-only access to API Keys.	edgecontainer.apikeys.get edgecontainer.apikeys.list edgecontainer.locations.* edgecontainer.locations.get edgecontainer.locations.list edgecontainer.operations.get edgecontainer.operations.list
Edge Container Identity Provider Admin (roles/edgecontainer.identityProviderAdmin) Access to manage Identity Providers.	edgecontainer.identityproviders.* edgecontainer.identityproviders.create edgecontainer.identityproviders.delete edgecontainer.identityproviders.get edgecontainer.identityproviders.list edgecontainer.locations.* edgecontainer.locations.get edgecontainer.locations.list
Edge Container Identity Provider Viewer (roles/edgecontainer.identityProviderViewer) Read-only access to Identity Providers.	edgecontainer.identityproviders.get edgecontainer.identityproviders.list edgecontainer.locations.* edgecontainer.locations.get edgecontainer.locations.list
Edge Container Machine User (roles/edgecontainer.machineUser) Access to use Edge Container Machine resources.	edgecontainer.machines.get edgecontainer.machines.getIamPolicy edgecontainer.machines.list edgecontainer.machines.use resourcemanager.projects.get resourcemanager.projects.list
Edge Container Cluster offline Credential User (roles/edgecontainer.offlineCredentialUser) Access to get Edge Container cluster offline credentials	edgecontainer.clusters.generateOfflineCredential resourcemanager.projects.get resourcemanager.projects.list
Edge Container Service Account Admin (roles/edgecontainer.serviceAccountAdmin) Access to manage Service Accounts.	edgecontainer.locations.* edgecontainer.locations.get edgecontainer.locations.list edgecontainer.serviceaccounts.create edgecontainer.serviceaccounts.delete edgecontainer.serviceaccounts.get edgecontainer.serviceaccounts.list
Edge Container Service Account Key Admin (roles/edgecontainer.serviceAccountKeyAdmin) Access to manage Service Account Keys.	edgecontainer.serviceaccounts.describekey edgecontainer.serviceaccounts.disablekey edgecontainer.serviceaccounts.generatekey edgecontainer.serviceaccounts.get edgecontainer.serviceaccounts.list edgecontainer.serviceaccounts.listkeys
Edge Container Service Account Key Viewer (roles/edgecontainer.serviceAccountKeyViewer) Access to view Service Account Keys.	edgecontainer.serviceaccounts.describekey edgecontainer.serviceaccounts.get edgecontainer.serviceaccounts.list edgecontainer.serviceaccounts.listkeys
Edge Container Service Account Viewer (roles/edgecontainer.serviceAccountViewer) Read-only access to Service Accounts.	edgecontainer.locations.* edgecontainer.locations.get edgecontainer.locations.list edgecontainer.serviceaccounts.get edgecontainer.serviceaccounts.list
Edge Container Zonal Project Admin (roles/edgecontainer.zonalProjectAdmin) Access to manage zonal projects.	edgecontainer.locations.* edgecontainer.locations.get edgecontainer.locations.list edgecontainer.operations.* edgecontainer.operations.cancel edgecontainer.operations.delete edgecontainer.operations.get edgecontainer.operations.list edgecontainer.zonalProjects.* edgecontainer.zonalProjects.disable edgecontainer.zonalProjects.enable edgecontainer.zonalProjects.get edgecontainer.zonalProjects.list edgecontainer.zones.get edgecontainer.zones.list
Edge Container Zonal Project Viewer (roles/edgecontainer.zonalProjectViewer) Read-only access to zonal projects.	edgecontainer.locations.* edgecontainer.locations.get edgecontainer.locations.list edgecontainer.operations.get edgecontainer.operations.list edgecontainer.zonalProjects.get edgecontainer.zonalProjects.list edgecontainer.zones.get edgecontainer.zones.list
Edge Container Zonal Service Admin (roles/edgecontainer.zonalServiceAdmin) Access to mutate zonal service.	edgecontainer.locations.* edgecontainer.locations.get edgecontainer.locations.list edgecontainer.operations.* edgecontainer.operations.cancel edgecontainer.operations.delete edgecontainer.operations.get edgecontainer.operations.list edgecontainer.zonalservices.* edgecontainer.zonalservices.disable edgecontainer.zonalservices.enable edgecontainer.zonalservices.get edgecontainer.zonalservices.list
Edge Container Zonal Service Viewer (roles/edgecontainer.zonalServiceViewer) Read-only access to zonal services.	edgecontainer.locations.* edgecontainer.locations.get edgecontainer.locations.list edgecontainer.operations.get edgecontainer.operations.list edgecontainer.zonalservices.get edgecontainer.zonalservices.list
Edge Container Zone Iam Policy Admin (roles/edgecontainer.zoneIamAdmin) Access to manage Iam Policy in the zone.	edgecontainer.locations.* edgecontainer.locations.get edgecontainer.locations.list edgecontainer.zones.getZoneIamPolicy edgecontainer.zones.listRoles edgecontainer.zones.setZoneIamPolicy
Edge Container Zone Iam Policy Viewer (roles/edgecontainer.zoneIamViewer) Read-only access to Iam Policy in the zone.	edgecontainer.locations.* edgecontainer.locations.get edgecontainer.locations.list edgecontainer.zones.getZoneIamPolicy
Edge Container Roles Viewer (roles/edgecontainer.zoneRolesViewer) Read-only access to Roles in the zone.	edgecontainer.locations.* edgecontainer.locations.get edgecontainer.locations.list edgecontainer.zones.listRoles
Edge Container Zone Viewer (roles/edgecontainer.zoneViewer) Read-only access to zones.	edgecontainer.locations.* edgecontainer.locations.get edgecontainer.locations.list edgecontainer.operations.get edgecontainer.operations.list edgecontainer.zones.get edgecontainer.zones.list

Service agent roles

Service agent roles should only be granted to service agents.

Role	Permissions
Edge Container Cluster Service Agent (roles/edgecontainer.clusterServiceAgent) Grants the Edge Container Cluster Service Account access to manage resources. Warning: Do not grant service agent roles to any principals except service agents.	cloudnotifications.activities.list gkehub.endpoints.connect gkehub.features.create gkehub.features.get gkehub.features.list gkehub.features.update gkehub.fleet.create gkehub.fleet.delete gkehub.fleet.get gkehub.locations.* gkehub.locations.get gkehub.locations.list gkehub.memberships.create gkehub.memberships.delete gkehub.memberships.generateConnectManifest gkehub.memberships.get gkehub.memberships.list gkehub.memberships.update gkehub.operations.* gkehub.operations.cancel gkehub.operations.delete gkehub.operations.get gkehub.operations.list kubernetesmetadata.* kubernetesmetadata.metadata.config kubernetesmetadata.metadata.publish kubernetesmetadata.metadata.snapshot logging.logEntries.create monitoring.alertPolicies.get monitoring.alertPolicies.list monitoring.alertPolicies.listEffectiveTags monitoring.alertPolicies.listTagBindings monitoring.alerts.* monitoring.alerts.get monitoring.alerts.list monitoring.dashboards.create monitoring.dashboards.delete monitoring.dashboards.get monitoring.dashboards.list monitoring.dashboards.listEffectiveTags monitoring.dashboards.listTagBindings monitoring.dashboards.update monitoring.groups.get monitoring.groups.list monitoring.metricDescriptors.create monitoring.metricDescriptors.get monitoring.metricDescriptors.list monitoring.monitoredResourceDescriptors.* monitoring.monitoredResourceDescriptors.get monitoring.monitoredResourceDescriptors.list monitoring.notificationChannelDescriptors.* monitoring.notificationChannelDescriptors.get monitoring.notificationChannelDescriptors.list monitoring.notificationChannels.get monitoring.notificationChannels.list monitoring.services.get monitoring.services.list monitoring.slos.get monitoring.slos.list monitoring.snoozes.get monitoring.snoozes.list monitoring.timeSeries.* monitoring.timeSeries.create monitoring.timeSeries.list monitoring.uptimeCheckConfigs.get monitoring.uptimeCheckConfigs.list opsconfigmonitoring.* opsconfigmonitoring.resourceMetadata.list opsconfigmonitoring.resourceMetadata.write resourcemanager.projects.get resourcemanager.projects.list serviceusage.consumerpolicy.analyze serviceusage.consumerpolicy.get serviceusage.contentsecuritypolicy.get serviceusage.effectivemcppolicy.get serviceusage.effectivepolicy.get serviceusage.groups.* serviceusage.groups.list serviceusage.groups.listExpandedMembers serviceusage.groups.listMembers serviceusage.mcppolicy.get serviceusage.operations.get serviceusage.quotas.get serviceusage.services.enable serviceusage.services.get serviceusage.services.list serviceusage.values.test stackdriver.projects.get stackdriver.resourceMetadata.* stackdriver.resourceMetadata.list stackdriver.resourceMetadata.write storage.buckets.create storage.buckets.get storage.buckets.list storage.buckets.update storage.objects.create storage.objects.delete storage.objects.get storage.objects.list storage.objects.update
Edge Container Service Agent (roles/edgecontainer.serviceAgent) Grants the Edge Container Service Account access to manage resources. Warning: Do not grant service agent roles to any principals except service agents.	compute.externalVpnGateways.create compute.externalVpnGateways.delete compute.externalVpnGateways.get compute.externalVpnGateways.use compute.globalOperations.get compute.networks.get compute.networks.updatePolicy compute.regionOperations.get compute.routers.create compute.routers.delete compute.routers.get compute.routers.list compute.routers.update compute.routers.use compute.vpnGateways.create compute.vpnGateways.delete compute.vpnGateways.get compute.vpnGateways.use compute.vpnTunnels.create compute.vpnTunnels.delete compute.vpnTunnels.get gkehub.features.create gkehub.features.get gkehub.features.update gkehub.memberships.create gkehub.memberships.delete gkehub.memberships.generateConnectManifest gkehub.memberships.get gkehub.memberships.list gkehub.memberships.update gkehub.operations.cancel gkehub.operations.get serviceusage.services.get serviceusage.services.list

Distributed Cloud Edge Network API のロールと権限

次の表に、Distributed Cloud Edge Network API の Google Cloud プロジェクト ロール と、カプセル化する Distributed Cloud connected の権限を示します。

Role	Permissions
Edge Network Admin (roles/edgenetwork.admin) Full access to Edge Network all resources.	edgenetwork.* edgenetwork.interconnectAttachments.create edgenetwork.interconnectAttachments.delete edgenetwork.interconnectAttachments.get edgenetwork.interconnectAttachments.getIamPolicy edgenetwork.interconnectAttachments.list edgenetwork.interconnectAttachments.setIamPolicy edgenetwork.interconnectAttachments.update edgenetwork.interconnects.get edgenetwork.interconnects.getDiagnostics edgenetwork.interconnects.getIamPolicy edgenetwork.interconnects.list edgenetwork.interconnects.setIamPolicy edgenetwork.locations.get edgenetwork.locations.list edgenetwork.networks.create edgenetwork.networks.delete edgenetwork.networks.get edgenetwork.networks.getIamPolicy edgenetwork.networks.getStatus edgenetwork.networks.list edgenetwork.networks.setIamPolicy edgenetwork.networks.update edgenetwork.operations.cancel edgenetwork.operations.delete edgenetwork.operations.get edgenetwork.operations.list edgenetwork.routers.create edgenetwork.routers.delete edgenetwork.routers.get edgenetwork.routers.getIamPolicy edgenetwork.routers.getRouterStatus edgenetwork.routers.list edgenetwork.routers.patch edgenetwork.routers.setIamPolicy edgenetwork.routers.update edgenetwork.routes.create edgenetwork.routes.delete edgenetwork.routes.get edgenetwork.routes.list edgenetwork.subnetworks.create edgenetwork.subnetworks.delete edgenetwork.subnetworks.get edgenetwork.subnetworks.getIamPolicy edgenetwork.subnetworks.getStatus edgenetwork.subnetworks.list edgenetwork.subnetworks.setIamPolicy edgenetwork.subnetworks.update edgenetwork.zones.get edgenetwork.zones.initialize edgenetwork.zones.list resourcemanager.projects.get resourcemanager.projects.list
Edge Network Editor (roles/edgenetwork.editor) Editor role for Edge Network	edgenetwork.interconnectAttachments.create edgenetwork.interconnectAttachments.delete edgenetwork.interconnectAttachments.get edgenetwork.interconnectAttachments.getIamPolicy edgenetwork.interconnectAttachments.list edgenetwork.interconnectAttachments.update edgenetwork.interconnects.get edgenetwork.interconnects.getDiagnostics edgenetwork.interconnects.getIamPolicy edgenetwork.interconnects.list edgenetwork.locations.* edgenetwork.locations.get edgenetwork.locations.list edgenetwork.networks.create edgenetwork.networks.delete edgenetwork.networks.get edgenetwork.networks.getIamPolicy edgenetwork.networks.getStatus edgenetwork.networks.list edgenetwork.networks.update edgenetwork.operations.* edgenetwork.operations.cancel edgenetwork.operations.delete edgenetwork.operations.get edgenetwork.operations.list edgenetwork.routers.create edgenetwork.routers.delete edgenetwork.routers.get edgenetwork.routers.getIamPolicy edgenetwork.routers.getRouterStatus edgenetwork.routers.list edgenetwork.routers.patch edgenetwork.routers.update edgenetwork.routes.* edgenetwork.routes.create edgenetwork.routes.delete edgenetwork.routes.get edgenetwork.routes.list edgenetwork.subnetworks.create edgenetwork.subnetworks.delete edgenetwork.subnetworks.get edgenetwork.subnetworks.getIamPolicy edgenetwork.subnetworks.getStatus edgenetwork.subnetworks.list edgenetwork.subnetworks.update edgenetwork.zones.* edgenetwork.zones.get edgenetwork.zones.initialize edgenetwork.zones.list resourcemanager.projects.get resourcemanager.projects.list
Edge Network Viewer (roles/edgenetwork.viewer) Read-only access to Edge Network all resources.	edgenetwork.interconnectAttachments.get edgenetwork.interconnectAttachments.getIamPolicy edgenetwork.interconnectAttachments.list edgenetwork.interconnects.get edgenetwork.interconnects.getDiagnostics edgenetwork.interconnects.getIamPolicy edgenetwork.interconnects.list edgenetwork.locations.* edgenetwork.locations.get edgenetwork.locations.list edgenetwork.networks.get edgenetwork.networks.getIamPolicy edgenetwork.networks.getStatus edgenetwork.networks.list edgenetwork.operations.get edgenetwork.operations.list edgenetwork.routers.get edgenetwork.routers.getIamPolicy edgenetwork.routers.getRouterStatus edgenetwork.routers.list edgenetwork.routes.get edgenetwork.routes.list edgenetwork.subnetworks.get edgenetwork.subnetworks.getIamPolicy edgenetwork.subnetworks.getStatus edgenetwork.subnetworks.list edgenetwork.zones.get edgenetwork.zones.list resourcemanager.projects.get resourcemanager.projects.list

GDC Hardware Management API のロールと権限

次の表に、GDC Hardware Management API の Google Cloud プロジェクト ロール と、カプセル化する Distributed Cloud connected の権限を示します。

Role	Permissions
GDC Hardware Management Admin ^Beta (roles/gdchardwaremanagement.admin) Full access to GDC Hardware Management resources.	gdchardwaremanagement.* gdchardwaremanagement.changeLogEntries.get gdchardwaremanagement.changeLogEntries.list gdchardwaremanagement.comments.create gdchardwaremanagement.comments.get gdchardwaremanagement.comments.list gdchardwaremanagement.hardware.create gdchardwaremanagement.hardware.delete gdchardwaremanagement.hardware.get gdchardwaremanagement.hardware.list gdchardwaremanagement.hardware.update gdchardwaremanagement.hardwareGroups.create gdchardwaremanagement.hardwareGroups.delete gdchardwaremanagement.hardwareGroups.get gdchardwaremanagement.hardwareGroups.list gdchardwaremanagement.hardwareGroups.update gdchardwaremanagement.locations.get gdchardwaremanagement.locations.list gdchardwaremanagement.operations.cancel gdchardwaremanagement.operations.delete gdchardwaremanagement.operations.get gdchardwaremanagement.operations.list gdchardwaremanagement.orders.create gdchardwaremanagement.orders.delete gdchardwaremanagement.orders.get gdchardwaremanagement.orders.list gdchardwaremanagement.orders.submit gdchardwaremanagement.orders.update gdchardwaremanagement.sites.create gdchardwaremanagement.sites.delete gdchardwaremanagement.sites.get gdchardwaremanagement.sites.list gdchardwaremanagement.sites.update gdchardwaremanagement.skus.get gdchardwaremanagement.skus.list gdchardwaremanagement.zones.create gdchardwaremanagement.zones.delete gdchardwaremanagement.zones.get gdchardwaremanagement.zones.list gdchardwaremanagement.zones.update resourcemanager.projects.get resourcemanager.projects.list
Gdchardwaremanagement Viewer ^Beta (roles/gdchardwaremanagement.viewer) Viewer role for gdchardwaremanagement	gdchardwaremanagement.changeLogEntries.* gdchardwaremanagement.changeLogEntries.get gdchardwaremanagement.changeLogEntries.list gdchardwaremanagement.comments.get gdchardwaremanagement.comments.list gdchardwaremanagement.hardware.get gdchardwaremanagement.hardware.list gdchardwaremanagement.hardwareGroups.get gdchardwaremanagement.hardwareGroups.list gdchardwaremanagement.locations.* gdchardwaremanagement.locations.get gdchardwaremanagement.locations.list gdchardwaremanagement.operations.get gdchardwaremanagement.operations.list gdchardwaremanagement.orders.get gdchardwaremanagement.orders.list gdchardwaremanagement.sites.get gdchardwaremanagement.sites.list gdchardwaremanagement.skus.* gdchardwaremanagement.skus.get gdchardwaremanagement.skus.list gdchardwaremanagement.zones.get gdchardwaremanagement.zones.list resourcemanager.projects.get resourcemanager.projects.list
GDC Hardware Management Operator ^Beta (roles/gdchardwaremanagement.operator) Create, read, and update access to GDC Hardware Management resources that support those operations. Also grants delete access to HardwareGroup resource.	gdchardwaremanagement.changeLogEntries.* gdchardwaremanagement.changeLogEntries.get gdchardwaremanagement.changeLogEntries.list gdchardwaremanagement.comments.* gdchardwaremanagement.comments.create gdchardwaremanagement.comments.get gdchardwaremanagement.comments.list gdchardwaremanagement.hardware.* gdchardwaremanagement.hardware.create gdchardwaremanagement.hardware.delete gdchardwaremanagement.hardware.get gdchardwaremanagement.hardware.list gdchardwaremanagement.hardware.update gdchardwaremanagement.hardwareGroups.* gdchardwaremanagement.hardwareGroups.create gdchardwaremanagement.hardwareGroups.delete gdchardwaremanagement.hardwareGroups.get gdchardwaremanagement.hardwareGroups.list gdchardwaremanagement.hardwareGroups.update gdchardwaremanagement.locations.* gdchardwaremanagement.locations.get gdchardwaremanagement.locations.list gdchardwaremanagement.operations.get gdchardwaremanagement.operations.list gdchardwaremanagement.orders.create gdchardwaremanagement.orders.get gdchardwaremanagement.orders.list gdchardwaremanagement.orders.update gdchardwaremanagement.sites.create gdchardwaremanagement.sites.get gdchardwaremanagement.sites.list gdchardwaremanagement.sites.update gdchardwaremanagement.skus.* gdchardwaremanagement.skus.get gdchardwaremanagement.skus.list gdchardwaremanagement.zones.* gdchardwaremanagement.zones.create gdchardwaremanagement.zones.delete gdchardwaremanagement.zones.get gdchardwaremanagement.zones.list gdchardwaremanagement.zones.update resourcemanager.projects.get resourcemanager.projects.list
GDC Hardware Management Reader ^Beta (roles/gdchardwaremanagement.reader) Readonly access to GDC Hardware Management resources.	gdchardwaremanagement.changeLogEntries.* gdchardwaremanagement.changeLogEntries.get gdchardwaremanagement.changeLogEntries.list gdchardwaremanagement.comments.get gdchardwaremanagement.comments.list gdchardwaremanagement.hardware.get gdchardwaremanagement.hardware.list gdchardwaremanagement.hardwareGroups.get gdchardwaremanagement.hardwareGroups.list gdchardwaremanagement.locations.* gdchardwaremanagement.locations.get gdchardwaremanagement.locations.list gdchardwaremanagement.operations.get gdchardwaremanagement.operations.list gdchardwaremanagement.orders.get gdchardwaremanagement.orders.list gdchardwaremanagement.sites.get gdchardwaremanagement.sites.list gdchardwaremanagement.skus.* gdchardwaremanagement.skus.get gdchardwaremanagement.skus.list gdchardwaremanagement.zones.get gdchardwaremanagement.zones.list resourcemanager.projects.get resourcemanager.projects.list

Connect Gateway のロールと権限

次のリストは、 Google Cloud Connect Gateway がクラスタにアクセスするために必要な プロジェクト ロールを示しています。

• Connect Gateway 管理者 （roles/gkehub.gatewayAdmin）: Connect Gateway API へのアクセス権を付与します。このロールを使用すると、kubectl コマンドライン ツールを使用してクラスタを管理できます。
• Connect Gateway 編集者 （roles/gkehub.gatewayEditor）: クラスタに対する読み取り / 書き込みアクセス権を付与します。
• Connect Gateway 読み取り （roles/gkehub.gatewayReader）: クラスタに対する読み取り専用アクセス権を付与します。
• GKE Hub 閲覧者 （roles/gkehub.viewer）: クラスタから kubeconfig ファイルを取得する権限を付与します。

Config Sync フリート パッケージのロールと権限

次のリストは、フリート パッケージの作成 と管理に必要なプロジェクト ロールを示しています。 Google Cloud

• Config Delivery 管理者 （roles/configdelivery.admin）: フリート パッケージとロールアウトの作成と管理に必要です。
• Developer Connect 管理者 （roles/developerconnect.admin）: リポジトリ接続の作成と管理に必要です。
• プロジェクト IAM 管理者 （roles/resourcemanager.projectIamAdmin）: サービス アカウントに必要なロールを付与するために必要です。

フリート パッケージ サービス アカウントのロール

• Config Delivery リソース バンドル パブリッシャー （roles/configdelivery.resourceBundlePublisher）: サービス アカウントでリソース バンドルとリリースを作成して管理できます。
• Cloud Build 接続ユーザー （roles/cloudbuild.connectionUser）: サービス アカウントで Cloud Build リポジトリ接続を使用できます。
• Logging ログ書き込み （roles/logging.logWriter）: サービス アカウントでビルドログを書き込むことができます。
• Artifact Registry 書き込み （roles/artifactregistry.writer）: サービス アカウントでバージョン管理されたパッケージ バンドルを Artifact Registry に push できます。
• Developer Connect 接続ユーザー （roles/developerconnect.connectionUser）: サービス アカウントで Developer Connect 接続を使用できます。

GDC 上の VM ランタイムのクラスタ内 RBAC ロール

GDC 上の VM ランタイムは、ロールベース アクセス制御（RBAC）を使用して、クラスタ内のマネージド リソースに対する権限を設定および適用します。権限は、Identity and Access Management からローカル Kubernetes RBAC にマッピングされ、フリート メンバーシップを通じて管理されます。

GDC 上の VM ランタイムには、事前構成済みの ClusterRole が 4 つ用意されています。これらのロールについて説明します。

• kubevm.admin: VM 関連のすべてのリソースに対する完全なアクセス権を付与します。
• kubevm.edit: VM 関連のすべてのリソースに対する読み取り / 書き込みアクセス権を付与します。
• kubevm.view: VM 関連のすべてのリソースに対する読み取りアクセス権を付与します。
• kubevm.cluster.view: クラスタ全体のリソースに対する読み取りアクセス権を付与します。

これらのロールは、次の Kubernetes のデフォルト ロールに集約されます。

• kubevm.admin は admin にマッピングされます。
• kubevm.edit は edit にマッピングされます。
• kubevm.view は view にマッピングされます。

デフォルトの edit ロールを持つユーザーには、kubevm.edit 権限が自動的に付与されます。