主账号访问边界政策阻止的权限

当主账号尝试访问它们没有资格访问的资源时，主账号访问边界政策会阻止其使用某些（但不是所有）Identity and Access Management (IAM) 权限来访问该资源。

如果主账号访问权限边界政策阻止某项权限，IAM 会针对该权限强制执行主账号访问权限边界政策。换言之，它会阻止任何没有资格访问资源的主账号使用该权限访问资源。

如果主账号访问边界政策不阻止某项权限，则主账号访问边界政策对主账号能否使用该权限没有任何影响。

IAM 会定期添加新的主账号访问边界强制执行版本，以阻止其他权限。每个新版本还可以阻止上一个版本中的所有权限。

注意：新版本最长可能需要 4 周时间才能成为默认的强制执行版本。对于未指定版本号的新政策以及使用latest 值的政策，系统会使用默认的强制执行版本。

本页面列出了每个强制执行版本可以阻止的权限。

如需详细了解主账号访问边界政策版本号，请参阅主账号访问权限边界政策概览。

强制执行版本 3

强制执行版本为 3 的政策可以阻止以下强制执行版本中列出的所有权限：

• 强制执行版本 1
• 强制执行版本 2

此外，强制执行版本为 3 的政策还可以阻止下表中列出的所有权限。

每行都包含以下信息：

• 具有主账号访问边界政策可以阻止的权限的服务名称。

• 主账号访问边界政策可以阻止的该服务的权限。

  在某些情况下，权限名称的一部分会替换为通配符字符 (*)。此格式表示主账号访问边界政策可以阻止与该模式匹配的所有权限。

服务	权限	异常
重要联系人	essentialcontacts.googleapis.com/contacts.*	无
Identity and Access Management	iam.googleapis.com/serviceAccounts.* iam.googleapis.com/serviceAccountKeys.* iam.googleapis.com/roles.* iam.googleapis.com/denypolicies.*	iam.googleapis.com/serviceAccounts.createTagBinding iam.googleapis.com/serviceAccounts.deleteTagBinding iam.googleapis.com/serviceAccounts.listTagBindings iam.googleapis.com/serviceAccounts.listEffectiveTags iam.googleapis.com/serviceAccounts.getCertificateAs
Dataproc	dataproc.googleapis.com/autoscalingPolicies.* dataproc.googleapis.com/batches.* dataproc.googleapis.com/operations.* dataproc.googleapis.com/sessionTemplates.* dataproc.googleapis.com/sessions.* dataproc.googleapis.com/workflowTemplates.* dataproc.googleapis.com/autoscalingPolicies.* dataproc.googleapis.com/clusters.* dataproc.googleapis.com/jobs.*	无
服务管理	servicemanagement.googleapis.com/services.check servicemanagement.googleapis.com/services.report	无
Bigtable	bigtable.googleapis.com/*.*	无
Cloud Bigtable Admin API	bigtableadmin.googleapis.com/*.*	无
Cloud SQL	cloudsql.googleapis.com/*.*	无
网络服务	networkservices.googleapis.com/endpointPolicies.* networkservices.googleapis.com/gateways.* networkservices.googleapis.com/grpcRoutes.* networkservices.googleapis.com/httpfilters.* networkservices.googleapis.com/httpRoutes.* networkservices.googleapis.com/meshes.* networkservices.googleapis.com/route_views.* networkservices.googleapis.com/serviceBindings.* networkservices.googleapis.com/tcpRoutes.* networkservices.googleapis.com/tlsRoutes.* networkservices.googleapis.com/serviceLbPolicies.*	无
Cloud Service Mesh	trafficdirector.googleapis.com/*.*	无
Network Management API	networkmanagement.googleapis.com/*.*	无
Compute Engine	compute.googleapis.com/healthChecks.* compute.googleapis.com/regionHealthChecks.* compute.googleapis.com/httpHealthChecks.* compute.googleapis.com/httpsHealthChecks.* compute.googleapis.com/forwardingRules.* compute.googleapis.com/globalForwardingRules.* compute.googleapis.com/regionBackendServices.* compute.googleapis.com/targetInstances.* compute.googleapis.com/targetPools.* compute.googleapis.com/firewallPolicies.* compute.googleapis.com/firewalls.* compute.googleapis.com/regionFirewallPolicies.* compute.googleapis.com/backendBuckets.* compute.googleapis.com/backendServices.* compute.googleapis.com/regionSslPolicies.* compute.googleapis.com/regionTargetHttpProxies.* compute.googleapis.com/regionTargetTcpProxies.* compute.googleapis.com/regionUrlMaps.* compute.googleapis.com/sslPolicies.* compute.googleapis.com/targetGrpcProxies.* compute.googleapis.com/targetHttpProxies.* compute.googleapis.com/targetHttpsProxies.* compute.googleapis.com/targetSslProxies.* compute.googleapis.com/targetTcpProxies.* compute.googleapis.com/urlMaps.* compute.googleapis.com/addresses.* compute.googleapis.com/globalAddresses.* compute.googleapis.com/networks.* compute.googleapis.com/packetMirrorings.* compute.googleapis.com/publicAdvertisedPrefixes.* compute.googleapis.com/publicDelegatedPrefixes.* compute.googleapis.com/routes.* compute.googleapis.com/subnetworks.* compute.googleapis.com/externalVpnGateways.* compute.googleapis.com/targetVpnGateways.* compute.googleapis.com/vpnGateways.* compute.googleapis.com/interconnectAttachments.* compute.googleapis.com/interconnectLocations.* compute.googleapis.com/interconnectRemoteLocations.* compute.googleapis.com/interconnects.*	无
Artifact Registry	artifactregistry.googleapis.com/*.*	无
Pub/Sub	pubsub.googleapis.com/*.*	无
Workflows	workflows.googleapis.com/*.*	无
Google Distributed Cloud	gkeonprem.googleapis.com/*.*	无
API 密钥	apikeys.googleapis.com/apikeys.* 注意：在 IAM v1 API 中，这些权限名为 serviceusage.apiKeys.*。 apikeys.googleapis.com/keys.*	无
Cloud DNS	dns.googleapis.com/*.*	无
Datastore	datastore.googleapis.com/backupSchedules.* datastore.googleapis.com/databases.* datastore.googleapis.com/indexes.* datastore.googleapis.com/entities.* datastore.googleapis.com/operations.* datastore.googleapis.com/userCreds.* datastore.googleapis.com/backups.get datastore.googleapis.com/backups.list datastore.googleapis.com/backups.delete datastore.googleapis.com/locations.*	无
Cloud Key Management Service	cloudkms.googleapis.com/ekmConfigs.* cloudkms.googleapis.com/keyRings.* cloudkms.googleapis.com/importJobs.* cloudkms.googleapis.com/cryptoKeyVersions.create cloudkms.googleapis.com/cryptoKeyVersions.get cloudkms.googleapis.com/cryptoKeyVersions.list cloudkms.googleapis.com/cryptoKeyVersions.update cloudkms.googleapis.com/cryptoKeyVersions.restore cloudkms.googleapis.com/cryptoKeyVersions.useToEncrypt cloudkms.googleapis.com/cryptoKeyVersions.useToDecrypt cloudkms.googleapis.com/cryptoKeyVersions.useToSign cloudkms.googleapis.com/cryptoKeyVersions.useToVerify cloudkms.googleapis.com/cryptoKeyVersions.viewPublicKey cloudkms.googleapis.com/cryptoKeyVersions.destroy cloudkms.googleapis.com/keyHandles.* cloudkms.googleapis.com/autokeyConfigs.*	cloudkms.googleapis.com/importJobs.useToImport
组织政策服务	orgpolicy.googleapis.com/*.*	无
Dataplex Universal Catalog	dataplex.googleapis.com/aspectTypes.* dataplex.googleapis.com/datascans.* dataplex.googleapis.com/entries.* dataplex.googleapis.com/entryTypes.* dataplex.googleapis.com/metadataJobs.* dataplex.googleapis.com/entryGroups.import dataplex.googleapis.com/entryGroups.getIamPolicy dataplex.googleapis.com/entryGroups.setIamPolicy dataplex.googleapis.com/entryGroups.create dataplex.googleapis.com/entryGroups.get dataplex.googleapis.com/entryGroups.update dataplex.googleapis.com/entryGroups.delete dataplex.googleapis.com/entryGroups.list dataplex.googleapis.com/entryGroups.useGenericAspect dataplex.googleapis.com/entryGroups.useContactsAspect dataplex.googleapis.com/entryGroups.useOverviewAspect dataplex.googleapis.com/entryGroups.useSchemaAspect dataplex.googleapis.com/entryGroups.useGenericEntry	无
Data Lineage API	datalineage.googleapis.com/locations.* datalineage.googleapis.com/operations.* datalineage.googleapis.com/processes.* datalineage.googleapis.com/runs.* datalineage.googleapis.com/events.*	无
GKE Hub	gkehub.googleapis.com/fleets.*	无
Cloud Run functions	cloudfunctions.googleapis.com/*.*	无
Spanner	spanner.googleapis.com/*.*	无
Google Kubernetes Engine	container.googleapis.com/*.*	无

强制执行版本 2

强制执行版本 2 的政策可以阻止强制执行版本 1 中列出的所有权限。此外，强制执行版本 2 的政策还可以阻止下表中列出的所有权限。

每行都包含以下信息：

• 具有主账号访问边界政策可以阻止的权限的服务名称。

• 主账号访问边界政策可以阻止的该服务的权限。

  在某些情况下，权限名称的一部分会替换为通配符字符 (*)。此格式表示主账号访问边界政策可以阻止与该模式匹配的所有权限。

服务	权限	异常
Access Context Manager	accesscontextmanager.googleapis.com/*	无
Artifact Analysis	containeranalysis.googleapis.com/*	无
BigQuery	bigquery.googleapis.com/datasets.* bigquery.googleapis.com/jobs.* bigquery.googleapis.com/models.* bigquery.googleapis.com/routines.* bigquery.googleapis.com/rowAccessPolicies.* bigquery.googleapis.com/tables.*	无
BigQuery Data Policy	bigquerydatapolicy.googleapis.com/*	无
BigQuery Data Transfer Service	bigquerydatatransfer.googleapis.com/transfers.*	无
Chrome Enterprise Premium	beyondcorp.googleapis.com/*	无
Cloud Asset Inventory	cloudasset.googleapis.com/*	无
Cloud Billing	billing.googleapis.com/budgets.*	无
Cloud Build	cloudbuild.googleapis.com/*	无
Cloud Monitoring	monitoring.googleapis.com/*	monitoring.googleapis.com/timeSeries.list monitoring.googleapis.com/metricsScopes.link
Cloud Service Mesh	meshconfig.googleapis.com/*	无
Cloud Storage	storage.googleapis.com/bucketOperations.* storage.googleapis.com/buckets.* storage.googleapis.com/folders.* storage.googleapis.com/hmacKeys.* storage.googleapis.com/managedFolders.* storage.googleapis.com/multipartUploads.* storage.googleapis.com/objects.*	无
Cloud Trace	cloudtrace.googleapis.com/*	无
Compute Engine	compute.googleapis.com/networkAttachments.* compute.googleapis.com/networkEdgeSecurityServices.* compute.googleapis.com/regionSecurityPolicies.* compute.googleapis.com/routers.* compute.googleapis.com/serviceAttachments.* compute.googleapis.com/securityPolicies.*	无
Firebase 规则	firebaserules.googleapis.com/*	无
GKE Multi-cloud	gkemulticloud.googleapis.com/*	无
Identity-Aware Proxy	iap.googleapis.com/*	无
Memorystore for Redis	redis.googleapis.com/*	无
Network Management API	networkmanagement.googleapis.com/*	无
Network Services API	networkservices.googleapis.com/edgeCacheOrigins.* networkservices.googleapis.com/edgeCacheKeysets.* networkservices.googleapis.com/edgeCacheServices.*	无
reCAPTCHA	recaptchaenterprise.googleapis.com/*	无
Resource Manager	cloudresourcemanager.googleapis.com/*	cloudresourcemanager.googleapis.com/*.createPolicyBinding cloudresourcemanager.googleapis.com/*.updatePolicyBinding cloudresourcemanager.googleapis.com/*.deletePolicyBinding cloudresourcemanager.googleapis.com/*.searchPolicyBindings
Video Stitcher API	videostitcher.googleapis.com/*	无

强制执行版本 1

下表列出了强制执行版本为 1 的主账号访问边界政策可以阻止的权限。

每行都包含以下信息：

• 具有主账号访问边界政策可以阻止的权限的服务名称。

• 主账号访问边界政策可以阻止的该服务的权限。

  在某些情况下，权限名称的一部分会替换为通配符字符 (*)。此格式表示主账号访问边界政策可以阻止与该模式匹配的所有权限。

• 主账号访问边界无法阻止的服务权限（即使这些权限与支持的权限模式之一匹配也无法阻止）。

服务	权限	异常
Access Approval	accessapproval.googleapis.com/serviceaccounts.get accessapproval.googleapis.com/settings.* accessapproval.googleapis.com/requests.list	无
Access Context Manager	accesscontextmanager.googleapis.com/*	accesscontextmanager.googleapis.com/gcpUserAccessBindings.*
BigQuery	bigquery.googleapis.com/datasets.create bigquery.googleapis.com/datasets.delete bigquery.googleapis.com/datasets.get bigquery.googleapis.com/datasets.update bigquery.googleapis.com/datasets.setIamPolicy bigquery.googleapis.com/jobs.get bigquery.googleapis.com/jobs.create bigquery.googleapis.com/jobs.delete bigquery.googleapis.com/jobs.list bigquery.googleapis.com/models.create bigquery.googleapis.com/models.delete bigquery.googleapis.com/models.list bigquery.googleapis.com/models.updateMetadata bigquery.googleapis.com/routines.create bigquery.googleapis.com/routines.delete bigquery.googleapis.com/routines.list bigquery.googleapis.com/routines.update	无
Binary Authorization	binaryauthorization.googleapis.com/*	无
Cloud Logging	logging.googleapis.com/logEntries.create logging.googleapis.com/logMetrics.*	无
Cloud Run	run.googleapis.com/authorizeddomains.* run.googleapis.com/configurations.get run.googleapis.com/configurations.list run.googleapis.com/domainmappings.* run.googleapis.com/executions.* run.googleapis.com/jobs.create run.googleapis.com/jobs.delete run.googleapis.com/jobs.get run.googleapis.com/jobs.list run.googleapis.com/jobs.run run.googleapis.com/revisions.* run.googleapis.com/routes.get run.googleapis.com/routes.list run.googleapis.com/services.create run.googleapis.com/services.delete run.googleapis.com/services.get run.googleapis.com/services.list run.googleapis.com/services.update run.googleapis.com/tasks.*	无
Cloud Storage	storage.googleapis.com/buckets.get storage.googleapis.com/buckets.update storage.googleapis.com/buckets.list storage.googleapis.com/buckets.getIamPolicy storage.googleapis.com/buckets.setIamPolicy storage.googleapis.com/hmacKeys.update storage.googleapis.com/objects.get storage.googleapis.com/objects.setRetention storage.googleapis.com/objects.delete	无
Dataflow	dataflow.googleapis.com/jobs.* dataflow.googleapis.com/metrics.get dataflow.googleapis.com/workItems.* dataflow.googleapis.com/messages.list dataflow.googleapis.com/snapshots.list	dataflow.googleapis.com/jobs.snapshot
Datastore	datastore.googleapis.com/databases.get datastore.googleapis.com/databases.getMetadata datastore.googleapis.com/databases.create datastore.googleapis.com/databases.delete datastore.googleapis.com/databases.list	无
Firebase 安全规则	firebaserules.googleapis.com/*	无
GKE Hub	gkehub.googleapis.com/features.* gkehub.googleapis.com/fleet.create gkehub.googleapis.com/fleet.get gkehub.googleapis.com/fleet.patch gkehub.googleapis.com/locations.* gkehub.googleapis.com/membershipbindings.* gkehub.googleapis.com/memberships.* gkehub.googleapis.com/rbacrolebindings.* gkehub.googleapis.com/scopes.*	gkehub.googleapis.com/*.createTagBinding gkehub.googleapis.com/*.deleteTagBinding gkehub.googleapis.com/*.listEffectiveTags gkehub.googleapis.com/*.listTagBindings
Pub/Sub	pubsub.googleapis.com/*	pubsub.googleapis.com/schemas.delete pubsub.googleapis.com/schemas.validate pubsub.googleapis.com/subscriptions.consume pubsub.googleapis.com/*.getIamPolicy pubsub.googleapis.com/*.setIamPolicy
Memorystore for Redis	redis.googleapis.com/instances.create redis.googleapis.com/instances.delete redis.googleapis.com/instances.get redis.googleapis.com/instances.failover redis.googleapis.com/instances.getAuthString redis.googleapis.com/instances.list redis.googleapis.com/instances.upgrade redis.googleapis.com/instances.update	无
Vertex AI	aiplatform.googleapis.com/*	aiplatform.googleapis.com/operations.*