無邊界湖倉 IAM 角色

Borderless Lakehouse 定義了多個 Identity and Access Management (IAM) 角色，用於管理資源。每個預先定義的角色都包含一組 IAM 權限，可讓主體執行特定動作。您可以使用 IAM 政策，將一或多個 IAM 角色授予主體。

IAM 也能建立自訂 IAM 角色。您可以建立自訂身分與存取權管理角色，並為角色指派一或多個權限。然後，您就可以將新角色授予主體。除了可用的預先定義角色外，您也可以使用自訂角色，建立直接對應至需求的存取控管模型。

本頁面著重說明與 Lakehouse 執行階段目錄相關的 IAM 角色。

事前準備

• 參閱 IAM 說明文件。

Lakehouse 角色

IAM Lakehouse 角色是一或多個權限的組合。您可以將角色授予主體，允許主體對專案中的 Lakehouse 資源執行動作。舉例來說，BigLake 檢視者角色包含 biglake.*.get 和 biglake.*.list 權限，可讓使用者在專案中取得及列出 Lakehouse 資源。

下表列出所有 Lakehouse 角色，以及各角色相關聯的權限：

Role	Permissions
BigLake Admin (roles/biglake.admin) Provides full access to all BigLake resources.	biglake.* biglake.catalogs.create biglake.catalogs.delete biglake.catalogs.get biglake.catalogs.getIamPolicy biglake.catalogs.list biglake.catalogs.setIamPolicy biglake.catalogs.update biglake.databases.create biglake.databases.delete biglake.databases.get biglake.databases.list biglake.databases.update biglake.locks.check biglake.locks.create biglake.locks.delete biglake.locks.list biglake.namespaces.create biglake.namespaces.delete biglake.namespaces.get biglake.namespaces.getIamPolicy biglake.namespaces.list biglake.namespaces.setIamPolicy biglake.namespaces.update biglake.tables.create biglake.tables.createPartitions biglake.tables.delete biglake.tables.deletePartitions biglake.tables.get biglake.tables.getData biglake.tables.getIamPolicy biglake.tables.list biglake.tables.listPartitions biglake.tables.lock biglake.tables.register biglake.tables.setIamPolicy biglake.tables.update biglake.tables.updateData biglake.tables.updatePartitions resourcemanager.projects.get resourcemanager.projects.list
BigLake Editor ^Beta (roles/biglake.editor) Provides read and write access to all BigLake resources.	biglake.catalogs.create biglake.catalogs.delete biglake.catalogs.get biglake.catalogs.getIamPolicy biglake.catalogs.list biglake.catalogs.update biglake.databases.* biglake.databases.create biglake.databases.delete biglake.databases.get biglake.databases.list biglake.databases.update biglake.locks.* biglake.locks.check biglake.locks.create biglake.locks.delete biglake.locks.list biglake.namespaces.create biglake.namespaces.delete biglake.namespaces.get biglake.namespaces.getIamPolicy biglake.namespaces.list biglake.namespaces.update biglake.tables.create biglake.tables.createPartitions biglake.tables.delete biglake.tables.deletePartitions biglake.tables.get biglake.tables.getData biglake.tables.getIamPolicy biglake.tables.list biglake.tables.listPartitions biglake.tables.lock biglake.tables.update biglake.tables.updateData biglake.tables.updatePartitions resourcemanager.projects.get resourcemanager.projects.list
BigLake Viewer (roles/biglake.viewer) Provides read-only access to all BigLake resources.	biglake.catalogs.get biglake.catalogs.getIamPolicy biglake.catalogs.list biglake.databases.get biglake.databases.list biglake.locks.list biglake.namespaces.get biglake.namespaces.getIamPolicy biglake.namespaces.list biglake.tables.get biglake.tables.getData biglake.tables.getIamPolicy biglake.tables.list biglake.tables.listPartitions resourcemanager.projects.get resourcemanager.projects.list
BigLake Metadata Viewer ^Beta (roles/biglake.metadataViewer) Provides read-only metadata access to all BigLake resources.	biglake.catalogs.get biglake.catalogs.getIamPolicy biglake.catalogs.list biglake.namespaces.get biglake.namespaces.getIamPolicy biglake.namespaces.list biglake.tables.get biglake.tables.getIamPolicy biglake.tables.list biglake.tables.listPartitions resourcemanager.projects.get resourcemanager.projects.list

後續步驟

• 瞭解如何建立自訂 IAM 角色。
• 瞭解如何授予及管理角色。