Control de acceso con la IAM

Avanzado Estándar

En esta página, se describen las opciones de control de acceso que están disponibles en Eventarc.

Descripción general

Eventarc usa Identity and Access Management (IAM) para el control de acceso.

• Para obtener una introducción a IAM y sus funciones, consulta Descripción general de IAM.

• Si deseas obtener información para otorgar y revocar el acceso con políticas de permisos, consulta Administra el acceso a proyectos, carpetas y organizaciones.

• Para controlar el acceso de publicación en Eventarc Advanced con políticas de acceso, consulta Controla el acceso de publicación.

Para obtener una lista de los permisos y funciones que admite Eventarc, consulta las secciones que se incluyen a continuación.

Agente de servicio de Eventarc

Algunos servicios de Google Cloud tienenagentes de servicio que permiten que el servicio acceda a tus recursos si se le otorgan los permisos adecuados. Si una API requiere un agente de servicio, Google Cloud crea el agente de servicio en algún momento después de que activas y usas la API.

Eventarc usa un modelo de aprovisionamiento que crea su agente de servicio solo cuando es necesario por primera vez, por ejemplo, cuando creas un recurso de Eventarc por primera vez, y no cuando se habilita la API inicialmente. El aprovisionamiento del agente de servicio y la propagación de los cambios en el sistema pueden tardar varios minutos. Para obtener más información sobre esta demora, consulta Se denegó el permiso mientras se usaba el agente de servicio de Eventarc.

Habilita las APIs de Eventarc

Para ver y asignar roles de IAM para Eventarc, debes habilitar las APIs de Eventarc en tu proyecto. No podrás ver los roles de Eventarc en la Google Cloud consola hasta que habilites las APIs.

Console

Sign in to your Google Cloud account. If you're new to Google Cloud, create an account to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.

In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

Roles required to select or create a project

• Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
• Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

Note: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.

Go to project selector

Verify that billing is enabled for your Google Cloud project.

Enable the Eventarc and Eventarc Publishing APIs.

Roles required to enable APIs

To enable APIs, you need the Service Usage Admin IAM role (roles/serviceusage.serviceUsageAdmin), which contains the serviceusage.services.enable permission. Learn how to grant roles.

Enable the APIs

In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

Roles required to select or create a project

• Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
• Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

Note: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.

Go to project selector

Verify that billing is enabled for your Google Cloud project.

Enable the Eventarc and Eventarc Publishing APIs.

Roles required to enable APIs

To enable APIs, you need the Service Usage Admin IAM role (roles/serviceusage.serviceUsageAdmin), which contains the serviceusage.services.enable permission. Learn how to grant roles.

Enable the APIs

gcloud

Sign in to your Google Cloud account. If you're new to Google Cloud, create an account to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.

Install the Google Cloud CLI.

If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity.

To initialize the gcloud CLI, run the following command:

gcloud init

Create or select a Google Cloud project.

Roles required to select or create a project

• Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
• Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

Note: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.

• Create a Google Cloud project:

  gcloud projects create PROJECT_ID

  Replace PROJECT_ID with a name for the Google Cloud project you are creating.

• Select the Google Cloud project that you created:

  gcloud config set project PROJECT_ID

  Replace PROJECT_ID with your Google Cloud project name.

Verify that billing is enabled for your Google Cloud project.

Enable the Eventarc and Eventarc Publishing APIs:

Roles required to enable APIs

To enable APIs, you need the Service Usage Admin IAM role (roles/serviceusage.serviceUsageAdmin), which contains the serviceusage.services.enable permission. Learn how to grant roles.

gcloud services enable eventarc.googleapis.com eventarcpublishing.googleapis.com

Install the Google Cloud CLI.

If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity.

To initialize the gcloud CLI, run the following command:

gcloud init

Create or select a Google Cloud project.

Roles required to select or create a project

• Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
• Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

Note: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.

• Create a Google Cloud project:

  gcloud projects create PROJECT_ID

  Replace PROJECT_ID with a name for the Google Cloud project you are creating.

• Select the Google Cloud project that you created:

  gcloud config set project PROJECT_ID

  Replace PROJECT_ID with your Google Cloud project name.

Verify that billing is enabled for your Google Cloud project.

Enable the Eventarc and Eventarc Publishing APIs:

Roles required to enable APIs

To enable APIs, you need the Service Usage Admin IAM role (roles/serviceusage.serviceUsageAdmin), which contains the serviceusage.services.enable permission. Learn how to grant roles.

gcloud services enable eventarc.googleapis.com eventarcpublishing.googleapis.com

Funciones predefinidas

En la siguiente tabla, se muestran las funciones predefinidas de IAM para Eventarc con la lista correspondiente de todos los permisos que incluye cada una.

Las funciones predefinidas abordan los casos de uso más típicos. Si las funciones predefinidas no cubren tu caso de uso, puedes crear una función personalizada de IAM.

Funciones de Eventarc

Role	Permissions
Eventarc Admin (roles/eventarc.admin) Full control over all Eventarc resources. Lowest-level resources where you can grant this role: Project	eventarc.* eventarc.channelConnections.create eventarc.channelConnections.delete eventarc.channelConnections.get eventarc.channelConnections.getIamPolicy eventarc.channelConnections.list eventarc.channelConnections.publish eventarc.channelConnections.setIamPolicy eventarc.channels.attach eventarc.channels.create eventarc.channels.delete eventarc.channels.get eventarc.channels.getIamPolicy eventarc.channels.list eventarc.channels.publish eventarc.channels.setIamPolicy eventarc.channels.undelete eventarc.channels.update eventarc.enrollments.create eventarc.enrollments.delete eventarc.enrollments.get eventarc.enrollments.getIamPolicy eventarc.enrollments.list eventarc.enrollments.setIamPolicy eventarc.enrollments.update eventarc.events.receiveAuditLogWritten eventarc.events.receiveEvent eventarc.googleApiSources.create eventarc.googleApiSources.delete eventarc.googleApiSources.get eventarc.googleApiSources.getIamPolicy eventarc.googleApiSources.list eventarc.googleApiSources.setIamPolicy eventarc.googleApiSources.update eventarc.googleChannelConfigs.get eventarc.googleChannelConfigs.update eventarc.kafkaSources.create eventarc.kafkaSources.delete eventarc.kafkaSources.get eventarc.kafkaSources.getIamPolicy eventarc.kafkaSources.list eventarc.kafkaSources.setIamPolicy eventarc.locations.get eventarc.locations.list eventarc.messageBuses.create eventarc.messageBuses.delete eventarc.messageBuses.get eventarc.messageBuses.getIamPolicy eventarc.messageBuses.list eventarc.messageBuses.publish eventarc.messageBuses.setIamPolicy eventarc.messageBuses.update eventarc.messageBuses.use eventarc.multiProjectSources.collectGoogleApiEvents eventarc.operations.cancel eventarc.operations.delete eventarc.operations.get eventarc.operations.list eventarc.pipelines.create eventarc.pipelines.delete eventarc.pipelines.get eventarc.pipelines.getIamPolicy eventarc.pipelines.list eventarc.pipelines.setIamPolicy eventarc.pipelines.update eventarc.providers.get eventarc.providers.list eventarc.triggers.create eventarc.triggers.delete eventarc.triggers.get eventarc.triggers.getIamPolicy eventarc.triggers.list eventarc.triggers.setIamPolicy eventarc.triggers.undelete eventarc.triggers.update resourcemanager.projects.get resourcemanager.projects.list
Eventarc Connection Publisher ^Beta (roles/eventarc.connectionPublisher) Can publish events to Eventarc channel connections. Lowest-level resources where you can grant this role: Project	eventarc.channelConnections.get eventarc.channelConnections.list eventarc.channelConnections.publish resourcemanager.projects.get resourcemanager.projects.list
Eventarc Developer (roles/eventarc.developer) Access to read and write Eventarc resources. Lowest-level resources where you can grant this role: Project	eventarc.channelConnections.create eventarc.channelConnections.delete eventarc.channelConnections.get eventarc.channelConnections.getIamPolicy eventarc.channelConnections.list eventarc.channelConnections.publish eventarc.channels.attach eventarc.channels.create eventarc.channels.delete eventarc.channels.get eventarc.channels.getIamPolicy eventarc.channels.list eventarc.channels.publish eventarc.channels.undelete eventarc.channels.update eventarc.enrollments.create eventarc.enrollments.delete eventarc.enrollments.get eventarc.enrollments.getIamPolicy eventarc.enrollments.list eventarc.enrollments.update eventarc.googleApiSources.create eventarc.googleApiSources.delete eventarc.googleApiSources.get eventarc.googleApiSources.getIamPolicy eventarc.googleApiSources.list eventarc.googleApiSources.update eventarc.googleChannelConfigs.* eventarc.googleChannelConfigs.get eventarc.googleChannelConfigs.update eventarc.kafkaSources.create eventarc.kafkaSources.delete eventarc.kafkaSources.get eventarc.kafkaSources.getIamPolicy eventarc.kafkaSources.list eventarc.locations.* eventarc.locations.get eventarc.locations.list eventarc.operations.* eventarc.operations.cancel eventarc.operations.delete eventarc.operations.get eventarc.operations.list eventarc.pipelines.create eventarc.pipelines.delete eventarc.pipelines.get eventarc.pipelines.getIamPolicy eventarc.pipelines.list eventarc.pipelines.update eventarc.providers.* eventarc.providers.get eventarc.providers.list eventarc.triggers.create eventarc.triggers.delete eventarc.triggers.get eventarc.triggers.getIamPolicy eventarc.triggers.list eventarc.triggers.undelete eventarc.triggers.update resourcemanager.projects.get resourcemanager.projects.list
Eventarc Event Receiver (roles/eventarc.eventReceiver) Can receive events from all event providers. Lowest-level resources where you can grant this role: Project	eventarc.events.* eventarc.events.receiveAuditLogWritten eventarc.events.receiveEvent
Eventarc Message Bus Admin (roles/eventarc.messageBusAdmin) Full control over Message Buses resources.	eventarc.messageBuses.create eventarc.messageBuses.delete eventarc.messageBuses.get eventarc.messageBuses.getIamPolicy eventarc.messageBuses.list eventarc.messageBuses.publish eventarc.messageBuses.update eventarc.messageBuses.use
Eventarc Message Bus User (roles/eventarc.messageBusUser) Access to publish to or bind to a Message Bus.	eventarc.messageBuses.get eventarc.messageBuses.list eventarc.messageBuses.publish eventarc.messageBuses.use
Eventarc Event Collector ^Beta (roles/eventarc.multiProjectEventCollector) Can collect events from multiple projects in an org for a source resource.	eventarc.multiProjectSources.collectGoogleApiEvents
Eventarc Publisher ^Beta (roles/eventarc.publisher) Can publish events to Eventarc channels. Lowest-level resources where you can grant this role: Project	eventarc.channels.get eventarc.channels.list eventarc.channels.publish resourcemanager.projects.get resourcemanager.projects.list
Eventarc Service Agent (roles/eventarc.serviceAgent) Gives Eventarc service account access to managed resources. Warning: Do not grant service agent roles to any principals except service agents.	cloudfunctions.functions.get compute.instanceGroupManagers.get compute.networkAttachments.get compute.networkAttachments.update compute.networkAttachments.use compute.regionOperations.get container.clusters.connect container.clusters.get container.deployments.create container.deployments.delete container.deployments.get container.deployments.list container.deployments.update container.namespaces.create container.namespaces.delete container.namespaces.get container.namespaces.list container.serviceAccounts.create container.serviceAccounts.delete container.serviceAccounts.get container.serviceAccounts.list container.services.get container.services.list dns.networks.targetWithPeeringZone eventarc.channels.publish eventarc.messageBuses.publish eventarc.operations.get iam.serviceAccounts.actAs iam.serviceAccounts.getAccessToken iam.serviceAccounts.getOpenIdToken monitoring.timeSeries.create pubsub.subscriptions.consume pubsub.subscriptions.create pubsub.subscriptions.delete pubsub.subscriptions.get pubsub.subscriptions.list pubsub.subscriptions.update pubsub.topics.attachSubscription pubsub.topics.create pubsub.topics.delete pubsub.topics.get pubsub.topics.list pubsub.topics.publish pubsub.topics.update run.jobs.get run.services.get serviceusage.services.use storage.buckets.get storage.buckets.update workflows.workflows.get
Eventarc Viewer (roles/eventarc.viewer) Can view the state of all Eventarc resources, including IAM policies. Lowest-level resources where you can grant this role: Project	eventarc.channelConnections.get eventarc.channelConnections.getIamPolicy eventarc.channelConnections.list eventarc.channels.get eventarc.channels.getIamPolicy eventarc.channels.list eventarc.enrollments.get eventarc.enrollments.getIamPolicy eventarc.enrollments.list eventarc.googleApiSources.get eventarc.googleApiSources.getIamPolicy eventarc.googleApiSources.list eventarc.googleChannelConfigs.get eventarc.kafkaSources.get eventarc.kafkaSources.getIamPolicy eventarc.kafkaSources.list eventarc.locations.* eventarc.locations.get eventarc.locations.list eventarc.messageBuses.get eventarc.messageBuses.getIamPolicy eventarc.messageBuses.list eventarc.messageBuses.use eventarc.multiProjectSources.collectGoogleApiEvents eventarc.operations.get eventarc.operations.list eventarc.pipelines.get eventarc.pipelines.getIamPolicy eventarc.pipelines.list eventarc.providers.* eventarc.providers.get eventarc.providers.list eventarc.triggers.get eventarc.triggers.getIamPolicy eventarc.triggers.list resourcemanager.projects.get resourcemanager.projects.list

Administración de IAM a nivel de proyecto

A nivel del proyecto, puedes otorgar, cambiar y revocar roles de IAM con la consola de Google Cloud , la API de IAM o Google Cloud CLI. Para obtener instrucciones, consulta Administra el acceso a proyectos, carpetas y organizaciones.