Integration Connectors의 IAM 역할 및 권한

사전 정의된 역할은 특정 Google Cloud 리소스에 대한 세부적인 액세스 권한을 부여합니다. 이러한 역할은 Google에서 만들고 유지관리합니다. Google은 Google Cloud가 새 기능이나 서비스를 추가하는 경우와 같이 필요에 따라 권한을 자동으로 업데이트합니다.

다음 표에는 Integration Connectors에 대한 사전 정의된 모든 IAM 역할이 나와 있습니다.

Role	Permissions
Connector Admin (roles/connectors.admin) Full access to all resources of Connectors Service.	connectors.actions.* connectors.actions.execute connectors.actions.list connectors.connections.create connectors.connections.delete connectors.connections.executeSqlQuery connectors.connections.generateOpenAPISpec connectors.connections.get connectors.connections.getConnectionSchemaMetadata connectors.connections.getIamPolicy connectors.connections.getRuntimeActionSchema connectors.connections.getRuntimeEntitySchema connectors.connections.list connectors.connections.setIamPolicy connectors.connections.update connectors.connectors.* connectors.connectors.get connectors.connectors.list connectors.customConnectorVersions.* connectors.customConnectorVersions.create connectors.customConnectorVersions.delete connectors.customConnectorVersions.get connectors.customConnectorVersions.getIamPolicy connectors.customConnectorVersions.list connectors.customConnectorVersions.setIamPolicy connectors.customConnectorVersions.update connectors.customConnectors.* connectors.customConnectors.create connectors.customConnectors.delete connectors.customConnectors.get connectors.customConnectors.getIamPolicy connectors.customConnectors.list connectors.customConnectors.setIamPolicy connectors.customConnectors.update connectors.endpointAttachments.* connectors.endpointAttachments.create connectors.endpointAttachments.delete connectors.endpointAttachments.get connectors.endpointAttachments.getIamPolicy connectors.endpointAttachments.list connectors.endpointAttachments.setIamPolicy connectors.endpointAttachments.update connectors.entities.* connectors.entities.create connectors.entities.delete connectors.entities.deleteEntitiesWithConditions connectors.entities.get connectors.entities.list connectors.entities.update connectors.entities.updateEntitiesWithConditions connectors.entityTypes.list connectors.eventSubscriptions.* connectors.eventSubscriptions.create connectors.eventSubscriptions.delete connectors.eventSubscriptions.get connectors.eventSubscriptions.list connectors.eventSubscriptions.update connectors.eventtypes.* connectors.eventtypes.get connectors.eventtypes.list connectors.locations.* connectors.locations.get connectors.locations.list connectors.managedZones.* connectors.managedZones.create connectors.managedZones.delete connectors.managedZones.get connectors.managedZones.getIamPolicy connectors.managedZones.list connectors.managedZones.setIamPolicy connectors.managedZones.update connectors.operations.* connectors.operations.cancel connectors.operations.delete connectors.operations.get connectors.operations.list connectors.providers.* connectors.providers.get connectors.providers.list connectors.regionalSettings.* connectors.regionalSettings.get connectors.regionalSettings.update connectors.runtimeconfig.get connectors.schemaMetadata.refresh connectors.settings.* connectors.settings.get connectors.settings.update connectors.versions.* connectors.versions.get connectors.versions.list resourcemanager.projects.get resourcemanager.projects.list secretmanager.secrets.getIamPolicy
Connectors Editor (roles/connectors.editor) Editor role for connectors	connectors.actions.* connectors.actions.execute connectors.actions.list connectors.connections.create connectors.connections.delete connectors.connections.executeSqlQuery connectors.connections.generateOpenAPISpec connectors.connections.get connectors.connections.getConnectionSchemaMetadata connectors.connections.getIamPolicy connectors.connections.getRuntimeActionSchema connectors.connections.getRuntimeEntitySchema connectors.connections.list connectors.connections.listenEvent connectors.connections.update connectors.connectors.* connectors.connectors.get connectors.connectors.list connectors.customConnectorVersions.create connectors.customConnectorVersions.delete connectors.customConnectorVersions.get connectors.customConnectorVersions.getIamPolicy connectors.customConnectorVersions.list connectors.customConnectorVersions.update connectors.customConnectors.create connectors.customConnectors.delete connectors.customConnectors.get connectors.customConnectors.getIamPolicy connectors.customConnectors.list connectors.customConnectors.update connectors.endpointAttachments.create connectors.endpointAttachments.delete connectors.endpointAttachments.get connectors.endpointAttachments.getIamPolicy connectors.endpointAttachments.list connectors.endpointAttachments.update connectors.entities.* connectors.entities.create connectors.entities.delete connectors.entities.deleteEntitiesWithConditions connectors.entities.get connectors.entities.list connectors.entities.update connectors.entities.updateEntitiesWithConditions connectors.entityTypes.list connectors.eventSubscriptions.* connectors.eventSubscriptions.create connectors.eventSubscriptions.delete connectors.eventSubscriptions.get connectors.eventSubscriptions.list connectors.eventSubscriptions.update connectors.eventtypes.* connectors.eventtypes.get connectors.eventtypes.list connectors.locations.* connectors.locations.get connectors.locations.list connectors.managedZones.create connectors.managedZones.delete connectors.managedZones.get connectors.managedZones.getIamPolicy connectors.managedZones.list connectors.managedZones.update connectors.operations.* connectors.operations.cancel connectors.operations.delete connectors.operations.get connectors.operations.list connectors.providers.* connectors.providers.get connectors.providers.list connectors.regionalSettings.* connectors.regionalSettings.get connectors.regionalSettings.update connectors.runtimeconfig.get connectors.schemaMetadata.refresh connectors.settings.* connectors.settings.get connectors.settings.update connectors.versions.* connectors.versions.get connectors.versions.list resourcemanager.projects.get resourcemanager.projects.list
Connectors Viewer (roles/connectors.viewer) Read-only access to Connectors all resources.	connectors.actions.list connectors.connections.generateOpenAPISpec connectors.connections.get connectors.connections.getConnectionSchemaMetadata connectors.connections.getIamPolicy connectors.connections.getRuntimeActionSchema connectors.connections.getRuntimeEntitySchema connectors.connections.list connectors.connectors.* connectors.connectors.get connectors.connectors.list connectors.customConnectorVersions.get connectors.customConnectorVersions.getIamPolicy connectors.customConnectorVersions.list connectors.customConnectors.get connectors.customConnectors.getIamPolicy connectors.customConnectors.list connectors.endpointAttachments.get connectors.endpointAttachments.getIamPolicy connectors.endpointAttachments.list connectors.entities.get connectors.entities.list connectors.entityTypes.list connectors.eventSubscriptions.get connectors.eventSubscriptions.list connectors.eventtypes.* connectors.eventtypes.get connectors.eventtypes.list connectors.locations.* connectors.locations.get connectors.locations.list connectors.managedZones.get connectors.managedZones.getIamPolicy connectors.managedZones.list connectors.operations.get connectors.operations.list connectors.providers.* connectors.providers.get connectors.providers.list connectors.regionalSettings.get connectors.runtimeconfig.get connectors.settings.get connectors.versions.* connectors.versions.get connectors.versions.list resourcemanager.projects.get resourcemanager.projects.list
Custom Connectors Admin (roles/connectors.customConnectorAdmin) Custom Connector is a global resource which creates custom connector within the given target project. This role grants Admin access to Custom Connector resources	connectors.customConnectorVersions.* connectors.customConnectorVersions.create connectors.customConnectorVersions.delete connectors.customConnectorVersions.get connectors.customConnectorVersions.getIamPolicy connectors.customConnectorVersions.list connectors.customConnectorVersions.setIamPolicy connectors.customConnectorVersions.update connectors.customConnectors.* connectors.customConnectors.create connectors.customConnectors.delete connectors.customConnectors.get connectors.customConnectors.getIamPolicy connectors.customConnectors.list connectors.customConnectors.setIamPolicy connectors.customConnectors.update connectors.locations.* connectors.locations.get connectors.locations.list
Custom Connector Viewer (roles/connectors.customConnectorViewer) Custom Connector is a global resource which creates custom connector within the given target project. This role grants Read-only access to Custom Connector & Custom Connector Version resources.	connectors.customConnectorVersions.get connectors.customConnectorVersions.getIamPolicy connectors.customConnectorVersions.list connectors.customConnectors.get connectors.customConnectors.getIamPolicy connectors.customConnectors.list connectors.locations.* connectors.locations.get connectors.locations.list
Connectors Endpoint Attachment Admin (roles/connectors.endpointAttachmentAdmin) Endpoint Attachment is a regional resource which creates PSC connection endpoint for the given PSC Service Attachment. This role grants Admin access to Connectors Endpoint Attachment resources.	connectors.endpointAttachments.* connectors.endpointAttachments.create connectors.endpointAttachments.delete connectors.endpointAttachments.get connectors.endpointAttachments.getIamPolicy connectors.endpointAttachments.list connectors.endpointAttachments.setIamPolicy connectors.endpointAttachments.update connectors.locations.* connectors.locations.get connectors.locations.list
Connectors Endpoint Attachment Viewer (roles/connectors.endpointAttachmentViewer) Endpoint Attachment is a regional resource which creates PSC connection endpoint for the given PSC Service Attachment. This role grants Read-only access to Connectors Endpoint Attachment resources	connectors.endpointAttachments.get connectors.endpointAttachments.getIamPolicy connectors.endpointAttachments.list connectors.locations.* connectors.locations.get connectors.locations.list
Connectors Event Subscriptions Admin (roles/connectors.eventSubscriptionAdmin) Event Subscription is a regional resource which creates subscriptions on events for a given connection within the given target project. This role grants Admin access to Connectors Subscription resources	connectors.eventSubscriptions.* connectors.eventSubscriptions.create connectors.eventSubscriptions.delete connectors.eventSubscriptions.get connectors.eventSubscriptions.list connectors.eventSubscriptions.update
Connectors Event Subscriptions Viewer (roles/connectors.eventSubscriptionViewer) Event Subscription is a regional resource which creates subscriptions on events for a given connection within the given target project. This role grants Read-only access to Event Subscription resources.	connectors.eventSubscriptions.get connectors.eventSubscriptions.list
Connector Invoker (roles/connectors.invoker) Full Access to invoke all operations on Connections.	connectors.actions.* connectors.actions.execute connectors.actions.list connectors.connections.executeSqlQuery connectors.entities.* connectors.entities.create connectors.entities.delete connectors.entities.deleteEntitiesWithConditions connectors.entities.get connectors.entities.list connectors.entities.update connectors.entities.updateEntitiesWithConditions connectors.entityTypes.list
Connector Event Listener (roles/connectors.listener) Full Access to listen events by connections.	connectors.connections.listenEvent
Connectors Managed Zone Admin (roles/connectors.managedZoneAdmin) Managed Zone is a global resource which creates Cloud DNS Peering Zone with the given target project. This role grants Admin access to Connectors Managed Zone resources	connectors.locations.* connectors.locations.get connectors.locations.list connectors.managedZones.* connectors.managedZones.create connectors.managedZones.delete connectors.managedZones.get connectors.managedZones.getIamPolicy connectors.managedZones.list connectors.managedZones.setIamPolicy connectors.managedZones.update
Connectors Managed Zone Viewer (roles/connectors.managedZoneViewer) Managed Zone is a global resource which creates Cloud DNS Peering Zone with the given target project. This role grants Read-only access to Connectors Managed Zone resources.	connectors.locations.* connectors.locations.get connectors.locations.list connectors.managedZones.get connectors.managedZones.getIamPolicy connectors.managedZones.list

Service agent roles

Service agent roles should only be granted to service agents.

Role

Permissions

Connectors Platform Service Agent (roles/connectors.serviceAgent) Grants Connectors Platform service account to manage customer resources Warning: Do not grant service agent roles to any principals except service agents.

connectors.actions.* connectors.actions.execute connectors.actions.list connectors.connections.get connectors.connections.getConnectionSchemaMetadata connectors.connections.list connectors.connectors.* connectors.connectors.get connectors.connectors.list connectors.customConnectorVersions.get connectors.customConnectorVersions.list connectors.customConnectors.get connectors.customConnectors.list connectors.endpointAttachments.get connectors.endpointAttachments.list connectors.entities.get connectors.entityTypes.list connectors.eventSubscriptions.get connectors.eventSubscriptions.list connectors.eventtypes.* connectors.eventtypes.get connectors.eventtypes.list connectors.locations.* connectors.locations.get connectors.locations.list connectors.managedZones.get connectors.managedZones.list connectors.providers.* connectors.providers.get connectors.providers.list connectors.runtimeconfig.get iam.serviceAccounts.getAccessToken iam.serviceAccounts.getOpenIdToken iam.serviceAccounts.implicitDelegation monitoring.metricDescriptors.create monitoring.metricDescriptors.get monitoring.metricDescriptors.list monitoring.monitoredResourceDescriptors.* monitoring.monitoredResourceDescriptors.get monitoring.monitoredResourceDescriptors.list monitoring.timeSeries.create

사전 정의된 역할에 대한 자세한 내용은 역할 및 권한을 참조하세요. 가장 적절한 사전 정의된 역할을 선택하는 데 도움이 필요하면 사전 정의된 역할 선택을 참조하세요.

연결 서비스 계정 권한

연결은 연결을 만들 때 지정한 서비스 계정으로 실행됩니다. 연결을 만들거나 업데이트하려면 요청을 수행하는 주 구성원에게 연결의 서비스 계정에 대한 iam.serviceAccounts.actAs 권한이 있어야 합니다. 주 구성원은 Integration Connectors를 호출하는 사용자 또는 서비스 계정입니다 (예: Google Cloud 콘솔, Terraform 또는 API). 이 요구사항은 인증 유형과 관계없이 모든 연결에 적용됩니다.

이 권한을 부여하려면 주 구성원에게 연결의 서비스 계정에 대한 서비스 계정 사용자 역할(roles/iam.serviceAccountUser)을 할당합니다. 자세한 내용은 서비스 계정에 대한 액세스 관리 및 서비스 계정 인증 역할을 참조하세요.

주 구성원에게 권한이 없으면 요청이 실패하고 전제조건 위반 유형이 SERVICE_ACCOUNT_PERMISSION_DENIED인 FAILED_PRECONDITION 오류가 발생하며 연결이 생성되거나 업데이트되지 않습니다. 기존 연결은 계속 실행됩니다.