無邊界湖倉 IAM 角色

Borderless Lakehouse 定義了多個 Identity and Access Management (IAM) 角色，用於管理資源。預先定義的角色是透過 IAM 政策授予，包含可讓主體執行特定動作的權限。您也可以建立自訂 IAM 角色，根據需求調整存取控管。

這份參考資料列出 Lakehouse 執行階段目錄的 IAM 角色和權限。

事前準備

• 參閱 IAM 說明文件。

湖倉角色

IAM Lakehouse 角色是一或多項權限的組合。您可以將角色授予主體，讓他們對專案中的 Lakehouse 資源執行動作。舉例來說，BigLake 檢視者角色包含 biglake.*.get 和 biglake.*.list 權限，可讓使用者取得及列出專案中的 Lakehouse 資源。

下表列出所有 Lakehouse 角色，以及各角色相關聯的權限：

Role	Permissions
BigLake Admin (roles/biglake.admin) Provides full access to all BigLake resources.	biglake.* biglake.catalogs.create biglake.catalogs.delete biglake.catalogs.get biglake.catalogs.getIamPolicy biglake.catalogs.list biglake.catalogs.setIamPolicy biglake.catalogs.update biglake.databases.create biglake.databases.delete biglake.databases.get biglake.databases.list biglake.databases.update biglake.locks.check biglake.locks.create biglake.locks.delete biglake.locks.list biglake.namespaces.create biglake.namespaces.delete biglake.namespaces.get biglake.namespaces.getIamPolicy biglake.namespaces.list biglake.namespaces.setIamPolicy biglake.namespaces.update biglake.tables.create biglake.tables.createPartitions biglake.tables.delete biglake.tables.deletePartitions biglake.tables.get biglake.tables.getData biglake.tables.getIamPolicy biglake.tables.list biglake.tables.listPartitions biglake.tables.lock biglake.tables.register biglake.tables.setIamPolicy biglake.tables.update biglake.tables.updateData biglake.tables.updatePartitions resourcemanager.projects.get resourcemanager.projects.list
BigLake Editor ^Beta (roles/biglake.editor) Provides read and write access to all BigLake resources.	biglake.catalogs.create biglake.catalogs.delete biglake.catalogs.get biglake.catalogs.getIamPolicy biglake.catalogs.list biglake.catalogs.update biglake.databases.* biglake.databases.create biglake.databases.delete biglake.databases.get biglake.databases.list biglake.databases.update biglake.locks.* biglake.locks.check biglake.locks.create biglake.locks.delete biglake.locks.list biglake.namespaces.create biglake.namespaces.delete biglake.namespaces.get biglake.namespaces.getIamPolicy biglake.namespaces.list biglake.namespaces.update biglake.tables.create biglake.tables.createPartitions biglake.tables.delete biglake.tables.deletePartitions biglake.tables.get biglake.tables.getData biglake.tables.getIamPolicy biglake.tables.list biglake.tables.listPartitions biglake.tables.lock biglake.tables.update biglake.tables.updateData biglake.tables.updatePartitions resourcemanager.projects.get resourcemanager.projects.list
BigLake Viewer (roles/biglake.viewer) Provides read-only access to all BigLake resources.	biglake.catalogs.get biglake.catalogs.getIamPolicy biglake.catalogs.list biglake.databases.get biglake.databases.list biglake.locks.list biglake.namespaces.get biglake.namespaces.getIamPolicy biglake.namespaces.list biglake.tables.get biglake.tables.getData biglake.tables.getIamPolicy biglake.tables.list biglake.tables.listPartitions resourcemanager.projects.get resourcemanager.projects.list
BigLake Metadata Viewer ^Beta (roles/biglake.metadataViewer) Provides read-only metadata access to all BigLake resources.	biglake.catalogs.get biglake.catalogs.getIamPolicy biglake.catalogs.list biglake.namespaces.get biglake.namespaces.getIamPolicy biglake.namespaces.list biglake.tables.get biglake.tables.getIamPolicy biglake.tables.list biglake.tables.listPartitions resourcemanager.projects.get resourcemanager.projects.list

後續步驟

• 瞭解如何建立自訂 IAM 角色。
• 瞭解如何授予及管理角色。