Kontrol akses dengan IAM

Lanjutan Standar

Halaman ini menjelaskan opsi kontrol akses yang tersedia untuk Anda di Eventarc.

Ringkasan

Eventarc menggunakan Identity and Access Management (IAM) untuk kontrol akses.

• Untuk mengetahui pengantar IAM dan fitur-fiturnya, lihat Ringkasan IAM.

• Untuk mempelajari cara memberikan dan mencabut akses menggunakan kebijakan izinkan, lihat Mengelola akses ke project, folder, dan organisasi.

• Untuk mengontrol akses publikasi di Eventarc Lanjutan menggunakan akses kebijakan, lihat Mengontrol akses publikasi.

Untuk mengetahui daftar izin dan peran yang didukung Eventarc, lihat bagian berikut.

Agen layanan Eventarc

Beberapa Google Cloud layanan memiliki agen layanan yang memungkinkan layanan mengakses resource Anda jika diberi izin yang sesuai. Jika API memerlukan agen layanan, maka akan membuat agen layanan pada suatu waktu setelah Anda mengaktifkan dan menggunakan API. Google Cloud

Eventarc menggunakan model penyediaan yang membuat agen layanannya hanya saat pertama kali diperlukan—misalnya, saat Anda membuat resource Eventarc untuk pertama kalinya—dan bukan saat API awalnya diaktifkan. Penyediaan agen layanan dan penyebaran perubahan melalui sistem dapat memerlukan waktu beberapa menit. Untuk mengetahui informasi selengkapnya tentang penundaan ini, lihat Izin ditolak saat menggunakan agen layanan Eventarc.

Mengaktifkan Eventarc API

Untuk melihat dan menetapkan peran IAM untuk Eventarc, Anda harus mengaktifkan Eventarc API untuk project Anda. Anda tidak akan dapat melihat peran Eventarc di Google Cloud konsol hingga Anda mengaktifkan API.

Konsol

Login keakun Anda. Google Cloud Jika Anda baru menggunakan Google Cloud, buat akun untuk mengevaluasi performa produk kami dalam skenario dunia nyata. Pelanggan baru juga mendapatkan kredit gratis senilai $300 untuk menjalankan, menguji, dan men-deploy workload.

In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

Roles required to select or create a project

• Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
• Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

Note: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.

Go to project selector

Verify that billing is enabled for your Google Cloud project.

Enable the Eventarc and Eventarc Publishing APIs.

Roles required to enable APIs

To enable APIs, you need the serviceusage.services.enable permission. If you created the project, then you likely already have this permission through the Owner role (roles/owner). Otherwise, you can get this permission through the Service Usage Admin role (roles/serviceusage.serviceUsageAdmin). Learn how to grant roles.

Enable the APIs

In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

Roles required to select or create a project

• Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
• Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

Note: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.

Go to project selector

Verify that billing is enabled for your Google Cloud project.

Enable the Eventarc and Eventarc Publishing APIs.

Roles required to enable APIs

To enable APIs, you need the serviceusage.services.enable permission. If you created the project, then you likely already have this permission through the Owner role (roles/owner). Otherwise, you can get this permission through the Service Usage Admin role (roles/serviceusage.serviceUsageAdmin). Learn how to grant roles.

Enable the APIs

gcloud

Login keakun Anda. Google Cloud Jika Anda baru menggunakan Google Cloud, buat akun untuk mengevaluasi performa produk kami dalam skenario dunia nyata. Pelanggan baru juga mendapatkan kredit gratis senilai $300 untuk menjalankan, menguji, dan men-deploy workload.

Instal Google Cloud CLI.

Jika Anda menggunakan penyedia identitas (IdP) eksternal, Anda harus terlebih dahulu login ke gcloud CLI dengan identitas gabungan Anda.

Untuk melakukan inisialisasi gcloud CLI, jalankan perintah berikut:

gcloud init

Buat atau pilih Google Cloud project.

Peran yang diperlukan untuk memilih atau membuat project

• Memilih project: Memilih project tidak memerlukan peran IAM tertentu Anda dapat memilih project mana pun yang telah diberi peran.
• Membuat project: Untuk membuat project, Anda memerlukan peran Project Creator (roles/resourcemanager.projectCreator), yang berisi izin resourcemanager.projects.create. Pelajari cara memberikan peran.

Catatan: Jika tidak berencana untuk menyimpan resource yang Anda buat dalam prosedur ini, buatlah project, bukan memilih project yang ada. Setelah menyelesaikan langkah ini, Anda dapat menghapus project, yang menghapus semua resource yang terkait dengan project ini.

• Buat Google Cloud project:

  gcloud projects create PROJECT_ID

  Ganti PROJECT_ID dengan nama untuk Google Cloud project yang Anda buat.

• Pilih Google Cloud project yang Anda buat:

  gcloud config set project PROJECT_ID

  Ganti PROJECT_ID dengan nama Google Cloud project Anda.

Pastikan penagihan diaktifkan untuk Google Cloud project Anda.

Aktifkan Eventarc dan Eventarc Publishing API:

Peran yang diperlukan untuk mengaktifkan API

Untuk mengaktifkan API, Anda memerlukan izin serviceusage.services.enable. Jika Anda membuat project, kemungkinan Anda sudah memiliki izin ini melalui peran Pemilik (roles/owner). Jika tidak, Anda bisa mendapatkan izin ini melalui peran Admin Penggunaan Layanan (roles/serviceusage.serviceUsageAdmin). Pelajari cara memberikan peran.

gcloud services enable eventarc.googleapis.com eventarcpublishing.googleapis.com

Instal Google Cloud CLI.

Jika Anda menggunakan penyedia identitas (IdP) eksternal, Anda harus terlebih dahulu login ke gcloud CLI dengan identitas gabungan Anda.

Untuk melakukan inisialisasi gcloud CLI, jalankan perintah berikut:

gcloud init

Buat atau pilih Google Cloud project.

Peran yang diperlukan untuk memilih atau membuat project

• Memilih project: Memilih project tidak memerlukan peran IAM tertentu Anda dapat memilih project mana pun yang telah diberi peran.
• Membuat project: Untuk membuat project, Anda memerlukan peran Project Creator (roles/resourcemanager.projectCreator), yang berisi izin resourcemanager.projects.create. Pelajari cara memberikan peran.

Catatan: Jika tidak berencana untuk menyimpan resource yang Anda buat dalam prosedur ini, buatlah project, bukan memilih project yang ada. Setelah menyelesaikan langkah ini, Anda dapat menghapus project, yang menghapus semua resource yang terkait dengan project ini.

• Buat Google Cloud project:

  gcloud projects create PROJECT_ID

  Ganti PROJECT_ID dengan nama untuk Google Cloud project yang Anda buat.

• Pilih Google Cloud project yang Anda buat:

  gcloud config set project PROJECT_ID

  Ganti PROJECT_ID dengan nama Google Cloud project Anda.

Pastikan penagihan diaktifkan untuk Google Cloud project Anda.

Aktifkan Eventarc dan Eventarc Publishing API:

Peran yang diperlukan untuk mengaktifkan API

Untuk mengaktifkan API, Anda memerlukan izin serviceusage.services.enable. Jika Anda membuat project, kemungkinan Anda sudah memiliki izin ini melalui peran Pemilik (roles/owner). Jika tidak, Anda bisa mendapatkan izin ini melalui peran Admin Penggunaan Layanan (roles/serviceusage.serviceUsageAdmin). Pelajari cara memberikan peran.

gcloud services enable eventarc.googleapis.com eventarcpublishing.googleapis.com

Peran yang telah ditetapkan

Tabel berikut mencantumkan peran IAM bawaan Eventarc beserta daftar terkait dari semua izin yang disertakan dalam setiap peran.

Peran bawaan menangani sebagian besar kasus penggunaan umum. Jika kasus penggunaan Anda tidak tercakup oleh peran yang telah ditetapkan, Anda dapat membuat peran khusus IAM.

Peran Eventarc

Role	Permissions
Eventarc Admin (roles/eventarc.admin) Full control over all Eventarc resources. Lowest-level resources where you can grant this role: Project	eventarc.* eventarc.channelConnections.create eventarc.channelConnections.createTagBinding eventarc.channelConnections.delete eventarc.channelConnections.deleteTagBinding eventarc.channelConnections.get eventarc.channelConnections.getIamPolicy eventarc.channelConnections.list eventarc.channelConnections.listEffectiveTags eventarc.channelConnections.listTagBindings eventarc.channelConnections.publish eventarc.channelConnections.setIamPolicy eventarc.channels.attach eventarc.channels.create eventarc.channels.createTagBinding eventarc.channels.delete eventarc.channels.deleteTagBinding eventarc.channels.get eventarc.channels.getIamPolicy eventarc.channels.list eventarc.channels.listEffectiveTags eventarc.channels.listTagBindings eventarc.channels.publish eventarc.channels.setIamPolicy eventarc.channels.undelete eventarc.channels.update eventarc.enrollments.create eventarc.enrollments.delete eventarc.enrollments.get eventarc.enrollments.getIamPolicy eventarc.enrollments.list eventarc.enrollments.setIamPolicy eventarc.enrollments.update eventarc.events.receiveAuditLogWritten eventarc.events.receiveEvent eventarc.googleApiSources.create eventarc.googleApiSources.delete eventarc.googleApiSources.get eventarc.googleApiSources.getIamPolicy eventarc.googleApiSources.list eventarc.googleApiSources.setIamPolicy eventarc.googleApiSources.update eventarc.googleChannelConfigs.get eventarc.googleChannelConfigs.update eventarc.kafkaSources.create eventarc.kafkaSources.delete eventarc.kafkaSources.get eventarc.kafkaSources.getIamPolicy eventarc.kafkaSources.list eventarc.kafkaSources.setIamPolicy eventarc.locations.get eventarc.locations.list eventarc.messageBuses.create eventarc.messageBuses.delete eventarc.messageBuses.get eventarc.messageBuses.getIamPolicy eventarc.messageBuses.list eventarc.messageBuses.publish eventarc.messageBuses.setIamPolicy eventarc.messageBuses.update eventarc.messageBuses.use eventarc.multiProjectSources.collectGoogleApiEvents eventarc.operations.cancel eventarc.operations.delete eventarc.operations.get eventarc.operations.list eventarc.pipelines.create eventarc.pipelines.delete eventarc.pipelines.get eventarc.pipelines.getIamPolicy eventarc.pipelines.list eventarc.pipelines.setIamPolicy eventarc.pipelines.update eventarc.providers.get eventarc.providers.list eventarc.triggers.create eventarc.triggers.createTagBinding eventarc.triggers.delete eventarc.triggers.deleteTagBinding eventarc.triggers.get eventarc.triggers.getIamPolicy eventarc.triggers.list eventarc.triggers.listEffectiveTags eventarc.triggers.listTagBindings eventarc.triggers.setIamPolicy eventarc.triggers.undelete eventarc.triggers.update resourcemanager.projects.get resourcemanager.projects.list
Eventarc Editor (roles/eventarc.editor) Editor role for eventarc	eventarc.channelConnections.create eventarc.channelConnections.delete eventarc.channelConnections.get eventarc.channelConnections.getIamPolicy eventarc.channelConnections.list eventarc.channelConnections.listEffectiveTags eventarc.channelConnections.listTagBindings eventarc.channelConnections.publish eventarc.channels.attach eventarc.channels.create eventarc.channels.delete eventarc.channels.get eventarc.channels.getIamPolicy eventarc.channels.list eventarc.channels.listEffectiveTags eventarc.channels.listTagBindings eventarc.channels.publish eventarc.channels.undelete eventarc.channels.update eventarc.enrollments.create eventarc.enrollments.delete eventarc.enrollments.get eventarc.enrollments.getIamPolicy eventarc.enrollments.list eventarc.enrollments.update eventarc.events.receiveEvent eventarc.googleApiSources.create eventarc.googleApiSources.delete eventarc.googleApiSources.get eventarc.googleApiSources.getIamPolicy eventarc.googleApiSources.list eventarc.googleApiSources.update eventarc.googleChannelConfigs.* eventarc.googleChannelConfigs.get eventarc.googleChannelConfigs.update eventarc.kafkaSources.create eventarc.kafkaSources.delete eventarc.kafkaSources.get eventarc.kafkaSources.getIamPolicy eventarc.kafkaSources.list eventarc.locations.* eventarc.locations.get eventarc.locations.list eventarc.messageBuses.create eventarc.messageBuses.delete eventarc.messageBuses.get eventarc.messageBuses.getIamPolicy eventarc.messageBuses.list eventarc.messageBuses.publish eventarc.messageBuses.update eventarc.messageBuses.use eventarc.multiProjectSources.collectGoogleApiEvents eventarc.operations.* eventarc.operations.cancel eventarc.operations.delete eventarc.operations.get eventarc.operations.list eventarc.pipelines.create eventarc.pipelines.delete eventarc.pipelines.get eventarc.pipelines.getIamPolicy eventarc.pipelines.list eventarc.pipelines.update eventarc.providers.* eventarc.providers.get eventarc.providers.list eventarc.triggers.create eventarc.triggers.delete eventarc.triggers.get eventarc.triggers.getIamPolicy eventarc.triggers.list eventarc.triggers.listEffectiveTags eventarc.triggers.listTagBindings eventarc.triggers.undelete eventarc.triggers.update resourcemanager.projects.get resourcemanager.projects.list
Eventarc Event Receiver (roles/eventarc.eventReceiver) Can receive events from all event providers. Lowest-level resources where you can grant this role: Project	eventarc.events.* eventarc.events.receiveAuditLogWritten eventarc.events.receiveEvent
Eventarc Viewer (roles/eventarc.viewer) Can view the state of all Eventarc resources, including IAM policies. Lowest-level resources where you can grant this role: Project	eventarc.channelConnections.get eventarc.channelConnections.getIamPolicy eventarc.channelConnections.list eventarc.channelConnections.listEffectiveTags eventarc.channelConnections.listTagBindings eventarc.channels.get eventarc.channels.getIamPolicy eventarc.channels.list eventarc.channels.listEffectiveTags eventarc.channels.listTagBindings eventarc.enrollments.get eventarc.enrollments.getIamPolicy eventarc.enrollments.list eventarc.googleApiSources.get eventarc.googleApiSources.getIamPolicy eventarc.googleApiSources.list eventarc.googleChannelConfigs.get eventarc.kafkaSources.get eventarc.kafkaSources.getIamPolicy eventarc.kafkaSources.list eventarc.locations.* eventarc.locations.get eventarc.locations.list eventarc.messageBuses.get eventarc.messageBuses.getIamPolicy eventarc.messageBuses.list eventarc.messageBuses.use eventarc.multiProjectSources.collectGoogleApiEvents eventarc.operations.get eventarc.operations.list eventarc.pipelines.get eventarc.pipelines.getIamPolicy eventarc.pipelines.list eventarc.providers.* eventarc.providers.get eventarc.providers.list eventarc.triggers.get eventarc.triggers.getIamPolicy eventarc.triggers.list eventarc.triggers.listEffectiveTags eventarc.triggers.listTagBindings resourcemanager.projects.get resourcemanager.projects.list
Eventarc Connection Publisher ^Beta (roles/eventarc.connectionPublisher) Can publish events to Eventarc channel connections. Lowest-level resources where you can grant this role: Project	eventarc.channelConnections.get eventarc.channelConnections.list eventarc.channelConnections.publish resourcemanager.projects.get resourcemanager.projects.list
Eventarc Developer (roles/eventarc.developer) Access to read and write Eventarc resources. Lowest-level resources where you can grant this role: Project	eventarc.channelConnections.create eventarc.channelConnections.createTagBinding eventarc.channelConnections.delete eventarc.channelConnections.deleteTagBinding eventarc.channelConnections.get eventarc.channelConnections.getIamPolicy eventarc.channelConnections.list eventarc.channelConnections.listEffectiveTags eventarc.channelConnections.listTagBindings eventarc.channelConnections.publish eventarc.channels.attach eventarc.channels.create eventarc.channels.createTagBinding eventarc.channels.delete eventarc.channels.deleteTagBinding eventarc.channels.get eventarc.channels.getIamPolicy eventarc.channels.list eventarc.channels.listEffectiveTags eventarc.channels.listTagBindings eventarc.channels.publish eventarc.channels.undelete eventarc.channels.update eventarc.enrollments.create eventarc.enrollments.delete eventarc.enrollments.get eventarc.enrollments.getIamPolicy eventarc.enrollments.list eventarc.enrollments.update eventarc.googleApiSources.create eventarc.googleApiSources.delete eventarc.googleApiSources.get eventarc.googleApiSources.getIamPolicy eventarc.googleApiSources.list eventarc.googleApiSources.update eventarc.googleChannelConfigs.* eventarc.googleChannelConfigs.get eventarc.googleChannelConfigs.update eventarc.kafkaSources.create eventarc.kafkaSources.delete eventarc.kafkaSources.get eventarc.kafkaSources.getIamPolicy eventarc.kafkaSources.list eventarc.locations.* eventarc.locations.get eventarc.locations.list eventarc.operations.* eventarc.operations.cancel eventarc.operations.delete eventarc.operations.get eventarc.operations.list eventarc.pipelines.create eventarc.pipelines.delete eventarc.pipelines.get eventarc.pipelines.getIamPolicy eventarc.pipelines.list eventarc.pipelines.update eventarc.providers.* eventarc.providers.get eventarc.providers.list eventarc.triggers.create eventarc.triggers.createTagBinding eventarc.triggers.delete eventarc.triggers.deleteTagBinding eventarc.triggers.get eventarc.triggers.getIamPolicy eventarc.triggers.list eventarc.triggers.listEffectiveTags eventarc.triggers.listTagBindings eventarc.triggers.undelete eventarc.triggers.update resourcemanager.projects.get resourcemanager.projects.list
Eventarc Message Bus Admin (roles/eventarc.messageBusAdmin) Full control over Message Buses resources.	eventarc.messageBuses.create eventarc.messageBuses.delete eventarc.messageBuses.get eventarc.messageBuses.getIamPolicy eventarc.messageBuses.list eventarc.messageBuses.publish eventarc.messageBuses.update eventarc.messageBuses.use
Eventarc Message Bus User (roles/eventarc.messageBusUser) Access to publish to or bind to a Message Bus.	eventarc.messageBuses.get eventarc.messageBuses.list eventarc.messageBuses.publish eventarc.messageBuses.use
Eventarc Event Collector ^Beta (roles/eventarc.multiProjectEventCollector) Can collect events from multiple projects in an org for a source resource.	eventarc.multiProjectSources.collectGoogleApiEvents
Eventarc Publisher ^Beta (roles/eventarc.publisher) Can publish events to Eventarc channels. Lowest-level resources where you can grant this role: Project	eventarc.channels.get eventarc.channels.list eventarc.channels.publish resourcemanager.projects.get resourcemanager.projects.list

Service agent roles

Service agent roles should only be granted to service agents.

Role

Permissions

Eventarc Service Agent (roles/eventarc.serviceAgent) Gives Eventarc service account access to managed resources. Warning: Do not grant service agent roles to any principals except service agents.

cloudfunctions.functions.get compute.instanceGroupManagers.get compute.networkAttachments.get compute.networkAttachments.update compute.networkAttachments.use compute.regionOperations.get container.clusters.connect container.clusters.get container.deployments.create container.deployments.delete container.deployments.get container.deployments.list container.deployments.update container.namespaces.create container.namespaces.delete container.namespaces.get container.namespaces.list container.serviceAccounts.create container.serviceAccounts.delete container.serviceAccounts.get container.serviceAccounts.list container.services.get container.services.list dns.networks.targetWithPeeringZone eventarc.channels.publish eventarc.messageBuses.publish eventarc.operations.get iam.serviceAccounts.actAs iam.serviceAccounts.getAccessToken iam.serviceAccounts.getOpenIdToken monitoring.timeSeries.create pubsub.subscriptions.consume pubsub.subscriptions.create pubsub.subscriptions.delete pubsub.subscriptions.get pubsub.subscriptions.list pubsub.subscriptions.update pubsub.topics.attachSubscription pubsub.topics.create pubsub.topics.delete pubsub.topics.get pubsub.topics.list pubsub.topics.publish pubsub.topics.update run.jobs.get run.services.get serviceusage.services.use storage.buckets.get storage.buckets.update workflows.workflows.get

Pengelolaan IAM di tingkat project

Di tingkat project, Anda dapat memberikan, mengubah, dan mencabut peran IAM menggunakan Google Cloud konsol, IAM API, atau Google Cloud CLI. Untuk mengetahui petunjuknya, lihat Mengelola akses ke project, folder, dan organisasi.