主體存取邊界政策封鎖的權限

當主體嘗試存取不符合存取資格的資源時，主體存取邊界政策會禁止主體使用部分 (而非全部) Identity and Access Management (IAM) 權限存取資源。

如果主體存取邊界政策封鎖了某項權限，IAM 就會強制執行該權限的主體存取邊界政策。換句話說，這項功能可防止不符合資源存取資格的主體，使用該權限存取資源。

如果主體存取邊界政策未封鎖權限，主體存取邊界政策就不會影響主體是否能使用該權限。

身分與存取權管理系統會定期新增主體存取邊界強制執行版本，這些版本可能會封鎖額外權限。新版本也可以封鎖舊版本的所有權限。

這個頁面列出各個強制執行版本可封鎖的權限。

如要進一步瞭解主體存取邊界政策版本號碼，請參閱主體存取邊界政策總覽。

預設強制規定版本

下列主體存取權範圍政策會使用預設強制執行版本：

• 未指定版本號碼的新政策
• 使用 latest 值做為版本的政策

目前的預設強制執行版本為 3 版。

強制規定版本 4

強制執行版本為 4 的政策可以封鎖下列強制執行版本中列出的所有權限：

• 強制規定版本 1
• 強制規定版本 2
• 強制規定版本 3

此外，如果政策的強制執行版本為 4，也可能會封鎖下表列出的所有權限。

每個資料列都包含下列資訊：

• 主體存取邊界政策可封鎖的服務名稱。

• 主體存取邊界政策可封鎖的服務權限。

  在某些情況下，權限名稱的某個部分會替換為萬用字元 (*)。這種格式表示主體存取邊界政策可以封鎖符合該模式的所有權限。

服務	權限	例外狀況
BigQuery sharing	analyticshub.googleapis.com/dataExchanges.*	無
BigQuery	bigquery.googleapis.com/capacityCommitments.* bigquery.googleapis.com/datasources.* bigquery.googleapis.com/readsessions.* bigquery.googleapis.com/reservations.* bigquery.googleapis.com/transfers.*	無
Cloud Deploy	clouddeploy.googleapis.com/*.*	無
Filestore	file.googleapis.com/*.*	無
Network Connectivity Center	networkconnectivity.googleapis.com/groups.* networkconnectivity.googleapis.com/hubRouteTables.* networkconnectivity.googleapis.com/hubRoutes.* networkconnectivity.googleapis.com/hubs.* networkconnectivity.googleapis.com/internalRanges.* networkconnectivity.googleapis.com/policyBasedRoutes.* networkconnectivity.googleapis.com/regionalEndpoints.* networkconnectivity.googleapis.com/spokes.*	無
憑證授權單位服務	privateca.googleapis.com/*.*	無
Identity and Access Management	iam.googleapis.com/oauthClientCredentials.* iam.googleapis.com/oauthClients.* iam.googleapis.com/workforcePoolProviderKeys.* iam.googleapis.com/workforcePoolProviders.* iam.googleapis.com/workforcePoolSubjects.* iam.googleapis.com/workforcePools.* iam.googleapis.com/workloadIdentityPoolNamespaces.* iam.googleapis.com/workloadIdentityPoolProviderKeys.* iam.googleapis.com/workloadIdentityPoolProviders.* iam.googleapis.com/workloadIdentityPools.*	iam.googleapis.com/*.createPolicyBinding iam.googleapis.com/*.deletePolicyBinding iam.googleapis.com/*.searchPolicyBindings iam.googleapis.com/*.updatePolicyBinding
直播	livestream.googleapis.com/*.*	無
Document AI	documentai.googleapis.com/*.*	無
Security Center Management API	securitycentermanagement.googleapis.com/*.*	無
Web Security Scanner	cloudsecurityscanner.googleapis.com/*.*	無
Security Command Center	securitycenter.googleapis.com/*.*	無
Cloud Quotas	cloudquotas.googleapis.com/*.*	無
推薦功能	recommender.googleapis.com/*.*	無
AlloyDB for PostgreSQL	alloydb.googleapis.com/*.*	alloydb.googleapis.com/databases.*
App Hub	apphub.googleapis.com/*.*	無
雲端整合	integrations.googleapis.com/*.*	integrations.googleapis.com/apigeeauthconfigs.* integrations.googleapis.com/apigeecertificates.* integrations.googleapis.com/apigeeintegrations.* integrations.googleapis.com/apigeeintegrationvers.* integrations.googleapis.com/apigeeproducts.* integrations.googleapis.com/apigeesfdcchannels.* integrations.googleapis.com/apigeesfdcinstances.* integrations.googleapis.com/apigeesuspensions.* integrations.googleapis.com/integrations.deploy integrations.googleapis.com/integrations.update integrations.googleapis.com/locations.* integrations.googleapis.com/securityauthconfigs.* integrations.googleapis.com/securityexecutions.* integrations.googleapis.com/securityintegrations.* integrations.googleapis.com/securityintegrationvers.delete integrations.googleapis.com/securityintegrationvers.deploy integrations.googleapis.com/securityintegrationvers.list integrations.googleapis.com/securityintegtemps.* integrations.googleapis.com/securityproducts.* integrations.googleapis.com/sfdcchannels.create integrations.googleapis.com/sfdcchannels.list integrations.googleapis.com/workflows.*
GKE 備份	gkebackup.googleapis.com/*.*	無
Managed Service for Apache Airflow	composer.googleapis.com/*.*	無
Cloud Data Fusion	datafusion.googleapis.com/instances.* datafusion.googleapis.com/locations.* datafusion.googleapis.com/namespaces.getIamPolicy datafusion.googleapis.com/namespaces.list datafusion.googleapis.com/namespaces.setIamPolicy datafusion.googleapis.com/operations.*	無
Cloud Key Management Service	cloudkms.googleapis.com/*.*	cloudkms.googleapis.com/locations.get cloudkms.googleapis.com/locations.list
Firebase 儲存	firebasestorage.googleapis.com/*.*	無
翻譯	cloudtranslate.googleapis.com/*.*	cloudtranslate.googleapis.com/custommodels.* cloudtranslate.googleapis.com/translationmemories.*
Cloud Workstations	workstations.googleapis.com/*.*	無
機密運算	confidentialcomputing.googleapis.com/*.*	無
Google Cloud Contact Center as a Service	contactcenteraiplatform.googleapis.com/*.*	無
資料庫移轉服務	datamigration.googleapis.com/*.*	datamigration.googleapis.com/mappingrules.*
Dataform	dataform.googleapis.com/*.*	dataform.googleapis.com/comments.* dataform.googleapis.com/commentsnested.* dataform.googleapis.com/commentthreads.* dataform.googleapis.com/commentthreadsnested.*
Datastream	datastream.googleapis.com/*.*	無
Infrastructure Manager	config.googleapis.com/*.*	無
Parallelstore	parallelstore.googleapis.com/*.*	無
Policy Simulator	policysimulator.googleapis.com/*.*	無
Secret Manager	secretmanager.googleapis.com/*.*	無
無伺服器虛擬私有雲存取	vpcaccess.googleapis.com/*.*	無
服務使用情形	serviceusage.googleapis.com/*.*	無
Cloud Asset Inventory	cloudasset.googleapis.com/*.*	無
Kubernetes Metadata API	kubernetesmetadata.googleapis.com/*.*	無
服務管理	servicemanagement.googleapis.com/consumers.getIamPolicy servicemanagement.googleapis.com/consumers.setIamPolicy servicemanagement.googleapis.com/services.create servicemanagement.googleapis.com/services.delete servicemanagement.googleapis.com/services.get servicemanagement.googleapis.com/services.getIamPolicy servicemanagement.googleapis.com/services.list servicemanagement.googleapis.com/services.setIamPolicy servicemanagement.googleapis.com/services.update	無
備份和災難復原	backupdr.googleapis.com/backupPlanAssociations.create backupdr.googleapis.com/backupPlanAssociations.createForAlloydbCluster backupdr.googleapis.com/backupPlanAssociations.createForCloudSqlInstance backupdr.googleapis.com/backupPlanAssociations.createForComputeDisk backupdr.googleapis.com/backupPlanAssociations.createForComputeInstance backupdr.googleapis.com/backupPlanAssociations.deleteForAlloydbCluster backupdr.googleapis.com/backupPlanAssociations.deleteForCloudSqlInstance backupdr.googleapis.com/backupPlanAssociations.deleteForComputeDisk backupdr.googleapis.com/backupPlanAssociations.deleteForComputeInstance backupdr.googleapis.com/backupPlanAssociations.fetchForAlloydbCluster backupdr.googleapis.com/backupPlanAssociations.fetchForCloudSqlInstance backupdr.googleapis.com/backupPlanAssociations.fetchForComputeDisk backupdr.googleapis.com/backupPlanAssociations.fetchForComputeInstance backupdr.googleapis.com/backupPlanAssociations.getForAlloydbCluster backupdr.googleapis.com/backupPlanAssociations.getForCloudSqlInstance backupdr.googleapis.com/backupPlanAssociations.getForComputeDisk backupdr.googleapis.com/backupPlanAssociations.getForComputeInstance backupdr.googleapis.com/backupPlanAssociations.list backupdr.googleapis.com/backupPlanRevisions.* backupdr.googleapis.com/backupPlans.* backupdr.googleapis.com/backupVaults.* backupdr.googleapis.com/bvbackups.* backupdr.googleapis.com/bvdataSources.abandonBackup backupdr.googleapis.com/bvdataSources.fetchAccessToken backupdr.googleapis.com/bvdataSources.finalizeBackup backupdr.googleapis.com/bvdataSources.get backupdr.googleapis.com/bvdataSources.initiateBackup backupdr.googleapis.com/bvdataSources.list backupdr.googleapis.com/bvdataSources.remove backupdr.googleapis.com/bvdataSources.setInternalStatus backupdr.googleapis.com/bvdataSources.update backupdr.googleapis.com/compute.* backupdr.googleapis.com/dataSourceReferences.fetchForAlloydbCluster backupdr.googleapis.com/dataSourceReferences.fetchForCloudSqlInstance backupdr.googleapis.com/dataSourceReferences.fetchForFilestoreInstance backupdr.googleapis.com/dataSourceReferences.list backupdr.googleapis.com/locations.* backupdr.googleapis.com/managementServers.create backupdr.googleapis.com/managementServers.createConnection backupdr.googleapis.com/managementServers.delete backupdr.googleapis.com/managementServers.get backupdr.googleapis.com/managementServers.getIamPolicy backupdr.googleapis.com/managementServers.list backupdr.googleapis.com/managementServers.setIamPolicy backupdr.googleapis.com/managementServers.update backupdr.googleapis.com/operations.* backupdr.googleapis.com/serviceConfig.*	backupdr.googleapis.com/bvbackups.useReadOnlyForAlloydbCluster backupdr.googleapis.com/bvbackups.useReadOnlyForCloudSqlInstance backupdr.googleapis.com/bvbackups.useReadOnlyForFilestoreInstance
Sensitive Data Protection	dlp.googleapis.com/charts.* dlp.googleapis.com/columnDataProfiles.* dlp.googleapis.com/connections.* dlp.googleapis.com/deidentifyTemplates.* dlp.googleapis.com/estimates.* dlp.googleapis.com/fileStoreProfiles.* dlp.googleapis.com/inspecttemplates.* dlp.googleapis.com/jobTriggers.* dlp.googleapis.com/jobs.* dlp.googleapis.com/projectDataProfiles.* dlp.googleapis.com/storedInfoTypes.* dlp.googleapis.com/subscriptions.* dlp.googleapis.com/tableDataProfiles.*	無
Secure Source Manager	securesourcemanager.googleapis.com/branchRules.* securesourcemanager.googleapis.com/hooks.* securesourcemanager.googleapis.com/instances.access securesourcemanager.googleapis.com/instances.create securesourcemanager.googleapis.com/instances.delete securesourcemanager.googleapis.com/instances.get securesourcemanager.googleapis.com/instances.getIamPolicy securesourcemanager.googleapis.com/instances.linkDeveloperConnect securesourcemanager.googleapis.com/instances.list securesourcemanager.googleapis.com/instances.setIamPolicy securesourcemanager.googleapis.com/issuecomments.* securesourcemanager.googleapis.com/issues.* securesourcemanager.googleapis.com/locations.* securesourcemanager.googleapis.com/operations.* securesourcemanager.googleapis.com/prcomments.* securesourcemanager.googleapis.com/pullRequests.* securesourcemanager.googleapis.com/repositories.create securesourcemanager.googleapis.com/repositories.delete securesourcemanager.googleapis.com/repositories.fetch securesourcemanager.googleapis.com/repositories.get securesourcemanager.googleapis.com/repositories.getIamPolicy securesourcemanager.googleapis.com/repositories.list securesourcemanager.googleapis.com/repositories.setIamPolicy securesourcemanager.googleapis.com/repositories.update	無
連接器	connectors.googleapis.com/*.*	connectors.googleapis.com/connections.executeSqlQuery connectors.googleapis.com/connections.generateOpenAPISpec connectors.googleapis.com/connections.listenEvent
Dataproc Metastore	metastore.googleapis.com/backups.* metastore.googleapis.com/databases.delete metastore.googleapis.com/databases.getIamPolicy metastore.googleapis.com/databases.setIamPolicy metastore.googleapis.com/databases.update metastore.googleapis.com/federations.* metastore.googleapis.com/imports.* metastore.googleapis.com/locations.* metastore.googleapis.com/operations.* metastore.googleapis.com/services.* metastore.googleapis.com/tables.delete metastore.googleapis.com/tables.getIamPolicy metastore.googleapis.com/tables.setIamPolicy metastore.googleapis.com/tables.update	metastore.googleapis.com/federations.use metastore.googleapis.com/services.use

強制規定版本 3

強制執行版本為 3 的政策可以封鎖下列強制執行版本中列出的所有權限：

• 強制規定版本 1
• 強制規定版本 2

此外，如果政策的強制執行版本為 3，也可能會封鎖下表列出的所有權限。

每個資料列都包含下列資訊：

• 主體存取邊界政策可封鎖的服務名稱。

• 主體存取邊界政策可封鎖的服務權限。

  在某些情況下，權限名稱的某個部分會替換為萬用字元 (*)。這種格式表示主體存取邊界政策可以封鎖符合該模式的所有權限。

服務	權限	例外狀況
重要聯絡人	essentialcontacts.googleapis.com/contacts.*	無
Identity and Access Management	iam.googleapis.com/denypolicies.* iam.googleapis.com/roles.* iam.googleapis.com/serviceAccountKeys.* iam.googleapis.com/serviceAccounts.*	iam.googleapis.com/serviceAccounts.createTagBinding iam.googleapis.com/serviceAccounts.deleteTagBinding iam.googleapis.com/serviceAccounts.getCertificateAs iam.googleapis.com/serviceAccounts.listEffectiveTags iam.googleapis.com/serviceAccounts.listTagBindings
Managed Service for Apache Spark	dataproc.googleapis.com/autoscalingPolicies.* dataproc.googleapis.com/batches.* dataproc.googleapis.com/clusters.* dataproc.googleapis.com/jobs.* dataproc.googleapis.com/operations.* dataproc.googleapis.com/sessionTemplates.* dataproc.googleapis.com/sessions.* dataproc.googleapis.com/workflowTemplates.*	無
服務管理	servicemanagement.googleapis.com/services.check servicemanagement.googleapis.com/services.report	無
Bigtable	bigtable.googleapis.com/*.*	無
Cloud Bigtable Admin API	bigtableadmin.googleapis.com/*.*	無
Cloud SQL	cloudsql.googleapis.com/*.*	無
網路服務	networkservices.googleapis.com/endpointPolicies.* networkservices.googleapis.com/gateways.* networkservices.googleapis.com/grpcRoutes.* networkservices.googleapis.com/httpRoutes.* networkservices.googleapis.com/httpfilters.* networkservices.googleapis.com/meshes.* networkservices.googleapis.com/route_views.* networkservices.googleapis.com/serviceBindings.* networkservices.googleapis.com/serviceLbPolicies.* networkservices.googleapis.com/tcpRoutes.* networkservices.googleapis.com/tlsRoutes.*	無
Cloud Service Mesh	trafficdirector.googleapis.com/*.*	無
Network Management API	networkmanagement.googleapis.com/*.*	無
Compute Engine	compute.googleapis.com/addresses.* compute.googleapis.com/backendBuckets.* compute.googleapis.com/backendServices.* compute.googleapis.com/externalVpnGateways.* compute.googleapis.com/firewallPolicies.* compute.googleapis.com/firewalls.* compute.googleapis.com/forwardingRules.* compute.googleapis.com/globalAddresses.* compute.googleapis.com/globalForwardingRules.* compute.googleapis.com/healthChecks.* compute.googleapis.com/httpHealthChecks.* compute.googleapis.com/httpsHealthChecks.* compute.googleapis.com/interconnectAttachments.* compute.googleapis.com/interconnectLocations.* compute.googleapis.com/interconnectRemoteLocations.* compute.googleapis.com/interconnects.* compute.googleapis.com/networks.* compute.googleapis.com/packetMirrorings.* compute.googleapis.com/publicAdvertisedPrefixes.* compute.googleapis.com/publicDelegatedPrefixes.* compute.googleapis.com/regionBackendServices.* compute.googleapis.com/regionFirewallPolicies.* compute.googleapis.com/regionHealthChecks.* compute.googleapis.com/regionSslPolicies.* compute.googleapis.com/regionTargetHttpProxies.* compute.googleapis.com/regionTargetTcpProxies.* compute.googleapis.com/regionUrlMaps.* compute.googleapis.com/routes.* compute.googleapis.com/sslPolicies.* compute.googleapis.com/subnetworks.* compute.googleapis.com/targetGrpcProxies.* compute.googleapis.com/targetHttpProxies.* compute.googleapis.com/targetHttpsProxies.* compute.googleapis.com/targetInstances.* compute.googleapis.com/targetPools.* compute.googleapis.com/targetSslProxies.* compute.googleapis.com/targetTcpProxies.* compute.googleapis.com/targetVpnGateways.* compute.googleapis.com/urlMaps.* compute.googleapis.com/vpnGateways.*	無
Artifact Registry	artifactregistry.googleapis.com/*.*	無
Pub/Sub	pubsub.googleapis.com/*.*	無
工作流程	workflows.googleapis.com/*.*	無
Google Distributed Cloud	gkeonprem.googleapis.com/*.*	無
API 金鑰	apikeys.googleapis.com/apikeys.* 注意：在 IAM v1 API 中，這些權限的名稱為 serviceusage.apiKeys.*。 apikeys.googleapis.com/keys.*	無
Cloud DNS	dns.googleapis.com/*.*	無
Firestore	datastore.googleapis.com/backupSchedules.* datastore.googleapis.com/backups.delete datastore.googleapis.com/backups.get datastore.googleapis.com/backups.list datastore.googleapis.com/databases.* datastore.googleapis.com/entities.* datastore.googleapis.com/indexes.* datastore.googleapis.com/locations.* datastore.googleapis.com/operations.* datastore.googleapis.com/userCreds.*	無
Cloud Key Management Service	cloudkms.googleapis.com/autokeyConfigs.* cloudkms.googleapis.com/cryptoKeyVersions.create cloudkms.googleapis.com/cryptoKeyVersions.destroy cloudkms.googleapis.com/cryptoKeyVersions.get cloudkms.googleapis.com/cryptoKeyVersions.list cloudkms.googleapis.com/cryptoKeyVersions.restore cloudkms.googleapis.com/cryptoKeyVersions.update cloudkms.googleapis.com/cryptoKeyVersions.useToDecrypt cloudkms.googleapis.com/cryptoKeyVersions.useToEncrypt cloudkms.googleapis.com/cryptoKeyVersions.useToSign cloudkms.googleapis.com/cryptoKeyVersions.useToVerify cloudkms.googleapis.com/cryptoKeyVersions.viewPublicKey cloudkms.googleapis.com/ekmConfigs.* cloudkms.googleapis.com/importJobs.* cloudkms.googleapis.com/keyHandles.* cloudkms.googleapis.com/keyRings.*	cloudkms.googleapis.com/importJobs.useToImport
組織政策服務	orgpolicy.googleapis.com/*.*	無
Knowledge Catalog	dataplex.googleapis.com/aspectTypes.* dataplex.googleapis.com/datascans.* dataplex.googleapis.com/entries.* dataplex.googleapis.com/entryGroups.create dataplex.googleapis.com/entryGroups.delete dataplex.googleapis.com/entryGroups.get dataplex.googleapis.com/entryGroups.getIamPolicy dataplex.googleapis.com/entryGroups.import dataplex.googleapis.com/entryGroups.list dataplex.googleapis.com/entryGroups.setIamPolicy dataplex.googleapis.com/entryGroups.update dataplex.googleapis.com/entryGroups.useContactsAspect dataplex.googleapis.com/entryGroups.useGenericAspect dataplex.googleapis.com/entryGroups.useGenericEntry dataplex.googleapis.com/entryGroups.useOverviewAspect dataplex.googleapis.com/entryGroups.useSchemaAspect dataplex.googleapis.com/entryTypes.* dataplex.googleapis.com/metadataJobs.*	無
Data Lineage API	datalineage.googleapis.com/events.* datalineage.googleapis.com/locations.* datalineage.googleapis.com/operations.* datalineage.googleapis.com/processes.* datalineage.googleapis.com/runs.*	無
GKE Hub	gkehub.googleapis.com/fleets.*	無
Cloud Run 函式	cloudfunctions.googleapis.com/*.*	無
Spanner	spanner.googleapis.com/*.*	無
Google Kubernetes Engine	container.googleapis.com/*.*	無

強制規定版本 2

如果政策的強制執行版本為 2，則可封鎖「強制執行版本 1」中列出的所有權限。此外，如果政策的強制執行版本為 2，也可能會封鎖下表列出的所有權限。

每個資料列都包含下列資訊：

• 主體存取邊界政策可封鎖的服務名稱。

• 主體存取邊界政策可封鎖的服務權限。

  在某些情況下，權限名稱的某個部分會替換為萬用字元 (*)。這種格式表示主體存取邊界政策可以封鎖符合該模式的所有權限。

服務	權限	例外狀況
Access Context Manager	accesscontextmanager.googleapis.com/*	無
Artifact Analysis	containeranalysis.googleapis.com/*	無
BigQuery	bigquery.googleapis.com/rowAccessPolicies.* bigquery.googleapis.com/datasets.* bigquery.googleapis.com/jobs.* bigquery.googleapis.com/models.* bigquery.googleapis.com/routines.* bigquery.googleapis.com/tables.*	無
BigQuery 資料政策	bigquerydatapolicy.googleapis.com/*	無
BigQuery 資料移轉服務	bigquerydatatransfer.googleapis.com/transfers.*	無
Chrome Enterprise Premium	beyondcorp.googleapis.com/*	無
Cloud Asset Inventory	cloudasset.googleapis.com/*	無
Cloud Billing	billing.googleapis.com/budgets.*	無
Cloud Build	cloudbuild.googleapis.com/*	無
Cloud Monitoring	monitoring.googleapis.com/*	monitoring.googleapis.com/metricsScopes.link monitoring.googleapis.com/timeSeries.list
Cloud Service Mesh	meshconfig.googleapis.com/*	無
Cloud Storage	storage.googleapis.com/bucketOperations.* storage.googleapis.com/buckets.* storage.googleapis.com/managedFolders.* storage.googleapis.com/multipartUploads.* storage.googleapis.com/folders.* storage.googleapis.com/hmacKeys.* storage.googleapis.com/objects.*	無
Cloud Trace	cloudtrace.googleapis.com/*	無
Compute Engine	compute.googleapis.com/networkAttachments.* compute.googleapis.com/networkEdgeSecurityServices.* compute.googleapis.com/regionSecurityPolicies.* compute.googleapis.com/securityPolicies.* compute.googleapis.com/serviceAttachments.* compute.googleapis.com/routers.*	無
Firebase 安全性規則	firebaserules.googleapis.com/*	無
GKE Multi-cloud	gkemulticloud.googleapis.com/*	無
Identity-Aware Proxy	iap.googleapis.com/*	無
Memorystore for Redis	redis.googleapis.com/*	無
Network Management API	networkmanagement.googleapis.com/*	無
網路服務	networkservices.googleapis.com/edgeCacheKeysets.* networkservices.googleapis.com/edgeCacheOrigins.* networkservices.googleapis.com/edgeCacheServices.*	無
reCAPTCHA	recaptchaenterprise.googleapis.com/*	無
Resource Manager	cloudresourcemanager.googleapis.com/*	cloudresourcemanager.googleapis.com/*.createPolicyBinding cloudresourcemanager.googleapis.com/*.deletePolicyBinding cloudresourcemanager.googleapis.com/*.searchPolicyBindings cloudresourcemanager.googleapis.com/*.updatePolicyBinding
Video Stitcher API	videostitcher.googleapis.com/*	無

強制規定版本 1

下表列出主體存取邊界政策 (強制執行版本 1) 可封鎖的權限。

每個資料列都包含下列資訊：

• 主體存取邊界政策可封鎖的服務名稱。

• 主體存取邊界政策可封鎖的服務權限。

  在某些情況下，權限名稱的某個部分會替換為萬用字元 (*)。這種格式表示主體存取邊界政策可以封鎖符合該模式的所有權限。

• 即使這些權限符合其中一個支援的權限模式，主體存取邊界也無法封鎖服務的權限。

服務	權限	例外狀況
存取權核准	accessapproval.googleapis.com/requests.list accessapproval.googleapis.com/serviceaccounts.get accessapproval.googleapis.com/settings.*	無
Access Context Manager	accesscontextmanager.googleapis.com/*	accesscontextmanager.googleapis.com/gcpUserAccessBindings.*
BigQuery	bigquery.googleapis.com/datasets.create bigquery.googleapis.com/datasets.delete bigquery.googleapis.com/datasets.get bigquery.googleapis.com/datasets.setIamPolicy bigquery.googleapis.com/datasets.update bigquery.googleapis.com/jobs.create bigquery.googleapis.com/jobs.delete bigquery.googleapis.com/jobs.list bigquery.googleapis.com/jobs.get bigquery.googleapis.com/models.create bigquery.googleapis.com/models.delete bigquery.googleapis.com/models.list bigquery.googleapis.com/models.updateMetadata bigquery.googleapis.com/routines.create bigquery.googleapis.com/routines.delete bigquery.googleapis.com/routines.list bigquery.googleapis.com/routines.update	無
二進位授權	binaryauthorization.googleapis.com/*	無
Cloud Logging	logging.googleapis.com/logEntries.create logging.googleapis.com/logMetrics.*	無
Cloud Run	run.googleapis.com/authorizeddomains.* run.googleapis.com/configurations.get run.googleapis.com/configurations.list run.googleapis.com/domainmappings.* run.googleapis.com/services.create run.googleapis.com/services.delete run.googleapis.com/services.get run.googleapis.com/services.list run.googleapis.com/services.update run.googleapis.com/executions.* run.googleapis.com/jobs.create run.googleapis.com/jobs.delete run.googleapis.com/jobs.get run.googleapis.com/jobs.list run.googleapis.com/jobs.run run.googleapis.com/revisions.* run.googleapis.com/routes.get run.googleapis.com/routes.list run.googleapis.com/tasks.*	無
Cloud Storage	storage.googleapis.com/buckets.get storage.googleapis.com/buckets.getIamPolicy storage.googleapis.com/buckets.list storage.googleapis.com/buckets.setIamPolicy storage.googleapis.com/buckets.update storage.googleapis.com/hmacKeys.update storage.googleapis.com/objects.delete storage.googleapis.com/objects.get storage.googleapis.com/objects.setRetention	無
Dataflow	dataflow.googleapis.com/messages.list dataflow.googleapis.com/metrics.get dataflow.googleapis.com/snapshots.list dataflow.googleapis.com/workItems.* dataflow.googleapis.com/jobs.*	dataflow.googleapis.com/jobs.snapshot
Firestore	datastore.googleapis.com/databases.create datastore.googleapis.com/databases.delete datastore.googleapis.com/databases.get datastore.googleapis.com/databases.getMetadata datastore.googleapis.com/databases.list	無
Firebase 安全性規則	firebaserules.googleapis.com/*	無
GKE Hub	gkehub.googleapis.com/membershipbindings.* gkehub.googleapis.com/rbacrolebindings.* gkehub.googleapis.com/features.* gkehub.googleapis.com/fleet.create gkehub.googleapis.com/fleet.get gkehub.googleapis.com/fleet.patch gkehub.googleapis.com/locations.* gkehub.googleapis.com/memberships.* gkehub.googleapis.com/scopes.*	gkehub.googleapis.com/*.createTagBinding gkehub.googleapis.com/*.deleteTagBinding gkehub.googleapis.com/*.listEffectiveTags gkehub.googleapis.com/*.listTagBindings
Pub/Sub	pubsub.googleapis.com/*	pubsub.googleapis.com/*.getIamPolicy pubsub.googleapis.com/*.setIamPolicy pubsub.googleapis.com/schemas.delete pubsub.googleapis.com/schemas.validate pubsub.googleapis.com/subscriptions.consume
Memorystore for Redis	redis.googleapis.com/instances.create redis.googleapis.com/instances.delete redis.googleapis.com/instances.failover redis.googleapis.com/instances.get redis.googleapis.com/instances.getAuthString redis.googleapis.com/instances.list redis.googleapis.com/instances.update redis.googleapis.com/instances.upgrade	無
Gemini Enterprise Agent Platform	aiplatform.googleapis.com/*	aiplatform.googleapis.com/operations.*