叢集權限和角色中的 Managed Service for Apache Spark

Identity and Access Management (IAM) 可讓您控管使用者和群組的專案資源存取權。本文著重說明與 Managed Service for Apache Spark 相關的 IAM「權限」，以及授予這些權限的 IAM「角色」。

叢集上的 Managed Service for Apache Spark 權限

2020 年 8 月 3 日起生效的安全規定： Managed Service for Apache Spark 使用者必須具備服務帳戶ActAs權限，才能部署 Managed Service for Apache Spark 資源，例如建立叢集和例項化工作流程。如要進一步瞭解服務帳戶權限，請參閱「服務帳戶驗證的角色」一文。

現有 Managed Service for Apache Spark 使用者可選擇啟用： 2020 年 8 月 3 日前已使用 Managed Service for Apache Spark 的使用者，可選擇啟用這項安全防護措施 (請參閱「保護 Managed Service for Apache Spark、Dataflow 和 Cloud Data Fusion 安全」)。

使用者 (包括服務帳戶) 可透過 Managed Service for Apache Spark 權限，對 Managed Service for Apache Spark 叢集、工作、作業和工作流程範本執行動作。舉例來說，dataproc.clusters.create 權限可讓使用者在專案中建立 Managed Service for Apache Spark 叢集。一般來說，您不會直接授予權限，而是授予包含一或多項權限的「角色」。

下表列出呼叫 Managed Service for Apache Spark API (方法) 必須具備的權限。這些表格是按照與各個 Managed Service for Apache Spark 資源 (叢集、工作、作業和工作流程範本) 有關的 API 進行編排。

權限範圍：下表列出的 Managed Service for Apache Spark 權限範圍是指其包含的 Google Cloud專案 (cloud-platform 範圍)。請參閱「服務帳戶權限」。

範例：

• dataproc.clusters.create 允許在包含專案中建立 Managed Service for Apache Spark 叢集
• dataproc.jobs.create 允許將 Managed Service for Apache Spark 工作提交至所含專案中的 Managed Service for Apache Spark 叢集
• dataproc.clusters.list 允許在包含專案中列出 Managed Service for Apache Spark 叢集的詳細資料。

叢集方法所需的權限

方法	所需權限
projects.regions.clusters.create ^1、2	dataproc.clusters.create
projects.regions.clusters.get	dataproc.clusters.get
projects.regions.clusters.list	dataproc.clusters.list
projects.regions.clusters.patch ^1、2、3	dataproc.clusters.update
projects.regions.clusters.delete ^1	dataproc.clusters.delete
projects.regions.clusters.start	dataproc.clusters.start
projects.regions.clusters.stop	dataproc.clusters.stop
projects.regions.clusters.getIamPolicy	dataproc.clusters.getIamPolicy
projects.regions.clusters.setIamPolicy	dataproc.clusters.setIamPolicy

注意：

1. 如要透過 Google Cloud CLI 取得狀態更新，還必須具備 dataproc.operations.get 權限。
2. 要從 Google Cloud CLI 取得作業結果，還必須具有 dataproc.clusters.get 權限。
3. 如要在叢集上啟用自動調度資源政策，也需要 dataproc.autoscalingPolicies.use 權限。

Jobs 方法所需的權限

方法	所需權限
projects.regions.jobs.submit ^1、2	dataproc.jobs.create dataproc.clusters.use
projects.regions.jobs.get	dataproc.jobs.get
projects.regions.jobs.list	dataproc.jobs.list
projects.regions.jobs.cancel ^1	dataproc.jobs.cancel
projects.regions.jobs.patch ^1	dataproc.jobs.update
projects.regions.jobs.delete ^1	dataproc.jobs.delete
projects.regions.jobs.getIamPolicy	dataproc.jobs.getIamPolicy
projects.regions.jobs.setIamPolicy	dataproc.jobs.setIamPolicy

注意：

1. Google Cloud CLI 也需要 dataproc.jobs.get、jobs submit、jobs wait、jobs update、jobs delete 和 jobs kill 指令的權限。

2. 如要提交工作，gcloud CLI 也必須具有 dataproc.clusters.get 權限。如要查看設定權限的範例，讓使用者使用 Managed Service for Apache Spark 精細 IAM 在叢集上執行 gcloud dataproc jobs submit，請參閱「使用精細 IAM 提交工作」。

作業方法所需權限

方法	所需權限
projects.regions.operations.get	dataproc.operations.get
projects.regions.operations.list	dataproc.operations.list
projects.regions.operations.cancel	dataproc.operations.cancel
projects.regions.operations.delete	dataproc.operations.delete
projects.regions.operations.getIamPolicy	dataproc.operations.getIamPolicy
projects.regions.operations.setIamPolicy	dataproc.operations.setIamPolicy

工作流程範本方法所需的權限

方法	所需權限
projects.regions.workflowTemplates.instantiate	dataproc.workflowTemplates.instantiate
projects.regions.workflowTemplates.instantiateInline	dataproc.workflowTemplates.instantiateInline
projects.regions.workflowTemplates.create	dataproc.workflowTemplates.create
projects.regions.workflowTemplates.get	dataproc.workflowTemplates.get
projects.regions.workflowTemplates.list	dataproc.workflowTemplates.list
projects.regions.workflowTemplates.update	dataproc.workflowTemplates.update
projects.regions.workflowTemplates.delete	dataproc.workflowTemplates.delete
projects.regions.workflowTemplates.getIamPolicy	dataproc.workflowTemplates.getIamPolicy
projects.regions.workflowTemplates.setIamPolicy	dataproc.workflowTemplates.setIamPolicy

注意：

1. 工作流程範本權限與叢集和工作權限是彼此獨立的。沒有 create cluster 或 submit job 權限的使用者也可以建立及執行個體化工作流程範本。

2. 要對工作流程完成狀態進行輪詢，Google Cloud CLI 還必須具有 dataproc.operations.get 權限。

3. 如要取消執行中的工作流程，必須具備 dataproc.operations.cancel 權限。

自動調度資源政策方法所需的權限

方法	所需權限
projects.regions.autoscalingPolicies.create	dataproc.autoscalingPolicies.create
projects.regions.autoscalingPolicies.get	dataproc.autoscalingPolicies.get
projects.regions.autoscalingPolicies.list	dataproc.autoscalingPolicies.list
projects.regions.autoscalingPolicies.update	dataproc.autoscalingPolicies.update
projects.regions.autoscalingPolicies.delete	dataproc.autoscalingPolicies.delete
projects.regions.autoscalingPolicies.getIamPolicy	dataproc.autoscalingPolicies.getIamPolicy
projects.regions.autoscalingPolicies.setIamPolicy	dataproc.autoscalingPolicies.setIamPolicy

注意：

1. 如要在叢集上啟用自動調度資源政策，必須具備 dataproc.autoscalingPolicies.use 權限，並使用 clusters.patch 方法要求。

節點群組方法所需的權限

方法	所需權限
projects.regions.nodeGroups.create	dataproc.nodeGroups.create
projects.regions.nodeGroups.get	dataproc.nodeGroups.get
projects.regions.nodeGroups.resize	dataproc.nodeGroups.update

Managed Service for Apache Spark 角色

Managed Service for Apache Spark IAM 角色是由一或多個權限組合而成。您為使用者或群組授予角色，讓他們能夠對專案中的 Managed Service for Apache Spark 資源執行動作。舉例來說，Managed Service for Apache Spark 檢視者角色包含 get 和 list 權限，可讓使用者在專案中取得及列出 Managed Service for Apache Spark 叢集、工作和作業。

下表列出包含建立及管理 Managed Service for Apache Spark 叢集所需權限的角色。

授予角色給	角色
使用者	授予使用者下列角色： Dataproc 編輯者角色，即可建立及管理 Managed Service for Apache Spark 叢集。 Managed Service for Apache Spark VM 服務帳戶的服務帳戶使用者角色。
服務帳戶	將 Dataproc 工作站角色授予 Managed Service for Apache Spark VM 服務帳戶。

注意事項：

• 您可能需要授予Managed Service for Apache Spark VM 服務帳戶其他預先定義或自訂角色，這些角色包含其他作業所需的權限，例如從 Cloud Storage、BigQuery、Cloud Logging 和其他 Google Cloud 資源讀取及寫入資料。

• 在某些專案中，系統可能已自動授予Managed Service for Apache Spark VM 服務帳戶專案編輯者角色，其中包含 Dataproc 工作站角色權限，以及 Managed Service for Apache Spark 資料平面作業不需要的其他權限。如要遵循最低權限的安全最佳做法原則，請將編輯者角色替換為 Dataproc 工作站角色 (請參閱「查看 VM 服務帳戶角色」)。

是否需要授予角色？

視貴機構政策而定，系統可能已授予必要角色。

查看授予使用者的角色

如要查看使用者是否已獲授角色，請按照「管理專案、資料夾和機構的存取權 > 查看目前的存取權」一文中的操作說明進行。

檢查授予服務帳戶的角色

如要查看服務帳戶是否已獲授角色，請參閱「查看及管理 IAM 服務帳戶角色」。

檢查授予服務帳戶的角色

如要查看使用者是否已獲得服務帳戶的角色，請按照「管理服務帳戶的存取權 > 查看目前的存取權」一文中的操作說明進行。

查詢 Managed Service for Apache Spark 角色和權限

您可以使用下列章節，查詢 Managed Service for Apache Spark 角色和權限。

Role	Permissions
Dataproc Administrator (roles/dataproc.admin) Full control of Dataproc resources.	cloudkms.keyHandles.* cloudkms.keyHandles.create cloudkms.keyHandles.get cloudkms.keyHandles.list cloudkms.operations.get cloudkms.projects.showEffectiveAutokeyConfig compute.machineTypes.* compute.machineTypes.get compute.machineTypes.list compute.networks.get compute.networks.list compute.projects.get compute.regions.* compute.regions.get compute.regions.list compute.zones.* compute.zones.get compute.zones.list dataproc.autoscalingPolicies.* dataproc.autoscalingPolicies.create dataproc.autoscalingPolicies.delete dataproc.autoscalingPolicies.get dataproc.autoscalingPolicies.getIamPolicy dataproc.autoscalingPolicies.list dataproc.autoscalingPolicies.setIamPolicy dataproc.autoscalingPolicies.update dataproc.autoscalingPolicies.use dataproc.batches.* dataproc.batches.analyze dataproc.batches.cancel dataproc.batches.create dataproc.batches.delete dataproc.batches.get dataproc.batches.list dataproc.batches.sparkApplicationRead dataproc.batches.sparkApplicationWrite dataproc.clusters.* dataproc.clusters.create dataproc.clusters.delete dataproc.clusters.get dataproc.clusters.getIamPolicy dataproc.clusters.list dataproc.clusters.repair dataproc.clusters.setIamPolicy dataproc.clusters.start dataproc.clusters.stop dataproc.clusters.update dataproc.clusters.use dataproc.jobs.* dataproc.jobs.cancel dataproc.jobs.create dataproc.jobs.delete dataproc.jobs.get dataproc.jobs.getIamPolicy dataproc.jobs.list dataproc.jobs.setIamPolicy dataproc.jobs.update dataproc.nodeGroups.* dataproc.nodeGroups.create dataproc.nodeGroups.get dataproc.nodeGroups.update dataproc.operations.* dataproc.operations.cancel dataproc.operations.delete dataproc.operations.get dataproc.operations.getIamPolicy dataproc.operations.list dataproc.operations.setIamPolicy dataproc.sessionTemplates.* dataproc.sessionTemplates.create dataproc.sessionTemplates.delete dataproc.sessionTemplates.get dataproc.sessionTemplates.list dataproc.sessionTemplates.update dataproc.sessions.* dataproc.sessions.create dataproc.sessions.delete dataproc.sessions.get dataproc.sessions.list dataproc.sessions.sparkApplicationRead dataproc.sessions.sparkApplicationWrite dataproc.sessions.terminate dataproc.workflowTemplates.* dataproc.workflowTemplates.create dataproc.workflowTemplates.delete dataproc.workflowTemplates.get dataproc.workflowTemplates.getIamPolicy dataproc.workflowTemplates.instantiate dataproc.workflowTemplates.instantiateInline dataproc.workflowTemplates.list dataproc.workflowTemplates.setIamPolicy dataproc.workflowTemplates.update dataprocrm.nodePools.* dataprocrm.nodePools.create dataprocrm.nodePools.delete dataprocrm.nodePools.deleteNodes dataprocrm.nodePools.get dataprocrm.nodePools.list dataprocrm.nodePools.resize dataprocrm.nodes.get dataprocrm.nodes.heartbeat dataprocrm.nodes.list dataprocrm.nodes.update dataprocrm.operations.get dataprocrm.operations.list dataprocrm.workloads.* dataprocrm.workloads.cancel dataprocrm.workloads.create dataprocrm.workloads.delete dataprocrm.workloads.get dataprocrm.workloads.list resourcemanager.projects.get resourcemanager.projects.list
Dataproc Editor (roles/dataproc.editor) Provides the permissions necessary for viewing the resources required to manage Managed Service for Apache Spark, including machine types, networks, projects, and zones. Lowest-level resources where you can grant this role: Cluster	cloudkms.keyHandles.* cloudkms.keyHandles.create cloudkms.keyHandles.get cloudkms.keyHandles.list cloudkms.operations.get cloudkms.projects.showEffectiveAutokeyConfig compute.machineTypes.* compute.machineTypes.get compute.machineTypes.list compute.networks.get compute.networks.list compute.projects.get compute.regions.* compute.regions.get compute.regions.list compute.zones.* compute.zones.get compute.zones.list dataproc.autoscalingPolicies.create dataproc.autoscalingPolicies.delete dataproc.autoscalingPolicies.get dataproc.autoscalingPolicies.list dataproc.autoscalingPolicies.update dataproc.autoscalingPolicies.use dataproc.batches.* dataproc.batches.analyze dataproc.batches.cancel dataproc.batches.create dataproc.batches.delete dataproc.batches.get dataproc.batches.list dataproc.batches.sparkApplicationRead dataproc.batches.sparkApplicationWrite dataproc.clusters.create dataproc.clusters.delete dataproc.clusters.get dataproc.clusters.list dataproc.clusters.repair dataproc.clusters.start dataproc.clusters.stop dataproc.clusters.update dataproc.clusters.use dataproc.jobs.cancel dataproc.jobs.create dataproc.jobs.delete dataproc.jobs.get dataproc.jobs.list dataproc.jobs.update dataproc.nodeGroups.* dataproc.nodeGroups.create dataproc.nodeGroups.get dataproc.nodeGroups.update dataproc.operations.cancel dataproc.operations.delete dataproc.operations.get dataproc.operations.list dataproc.sessionTemplates.* dataproc.sessionTemplates.create dataproc.sessionTemplates.delete dataproc.sessionTemplates.get dataproc.sessionTemplates.list dataproc.sessionTemplates.update dataproc.sessions.* dataproc.sessions.create dataproc.sessions.delete dataproc.sessions.get dataproc.sessions.list dataproc.sessions.sparkApplicationRead dataproc.sessions.sparkApplicationWrite dataproc.sessions.terminate dataproc.workflowTemplates.create dataproc.workflowTemplates.delete dataproc.workflowTemplates.get dataproc.workflowTemplates.instantiate dataproc.workflowTemplates.instantiateInline dataproc.workflowTemplates.list dataproc.workflowTemplates.update dataprocrm.nodePools.* dataprocrm.nodePools.create dataprocrm.nodePools.delete dataprocrm.nodePools.deleteNodes dataprocrm.nodePools.get dataprocrm.nodePools.list dataprocrm.nodePools.resize dataprocrm.nodes.get dataprocrm.nodes.heartbeat dataprocrm.nodes.list dataprocrm.nodes.update dataprocrm.operations.get dataprocrm.operations.list dataprocrm.workloads.* dataprocrm.workloads.cancel dataprocrm.workloads.create dataprocrm.workloads.delete dataprocrm.workloads.get dataprocrm.workloads.list resourcemanager.projects.get resourcemanager.projects.list
Dataproc Viewer (roles/dataproc.viewer) Provides read-only access to Managed Service for Apache Spark resources. Lowest-level resources where you can grant this role: Cluster	compute.machineTypes.get compute.regions.* compute.regions.get compute.regions.list compute.zones.* compute.zones.get compute.zones.list dataproc.autoscalingPolicies.get dataproc.autoscalingPolicies.list dataproc.batches.analyze dataproc.batches.get dataproc.batches.list dataproc.batches.sparkApplicationRead dataproc.clusters.get dataproc.clusters.list dataproc.jobs.get dataproc.jobs.list dataproc.nodeGroups.get dataproc.operations.get dataproc.operations.list dataproc.sessionTemplates.get dataproc.sessionTemplates.list dataproc.sessions.get dataproc.sessions.list dataproc.sessions.sparkApplicationRead dataproc.workflowTemplates.get dataproc.workflowTemplates.list resourcemanager.projects.get resourcemanager.projects.list
Dataproc Hub Agent (roles/dataproc.hubAgent) Allows management of Dataproc resources. Intended for service accounts running Dataproc Hub instances.	compute.instances.get compute.instances.setMetadata compute.instances.setTags compute.zoneOperations.get compute.zones.list dataproc.autoscalingPolicies.get dataproc.autoscalingPolicies.list dataproc.autoscalingPolicies.use dataproc.clusters.create dataproc.clusters.delete dataproc.clusters.get dataproc.clusters.list dataproc.clusters.repair dataproc.clusters.update dataproc.operations.cancel dataproc.operations.delete dataproc.operations.get dataproc.operations.list iam.serviceAccounts.actAs iam.serviceAccounts.get iam.serviceAccounts.list logging.buckets.get logging.buckets.list logging.exclusions.get logging.exclusions.list logging.links.get logging.links.list logging.locations.* logging.locations.get logging.locations.list logging.logEntries.create logging.logEntries.list logging.logEntries.route logging.logMetrics.get logging.logMetrics.list logging.logScopes.get logging.logScopes.list logging.logServiceIndexes.list logging.logServices.list logging.logs.list logging.operations.get logging.operations.list logging.queries.getShared logging.queries.listShared logging.queries.usePrivate logging.sinks.get logging.sinks.list logging.usage.get logging.views.get logging.views.list observability.scopes.get resourcemanager.projects.get resourcemanager.projects.list storage.buckets.get storage.objects.get storage.objects.list
Dataproc Serverless Editor (roles/dataproc.serverlessEditor) Permissions needed to run serverless sessions and batches as a user	cloudkms.keyHandles.* cloudkms.keyHandles.create cloudkms.keyHandles.get cloudkms.keyHandles.list cloudkms.operations.get cloudkms.projects.showEffectiveAutokeyConfig compute.projects.get compute.regions.* compute.regions.get compute.regions.list compute.zones.* compute.zones.get compute.zones.list dataproc.batches.* dataproc.batches.analyze dataproc.batches.cancel dataproc.batches.create dataproc.batches.delete dataproc.batches.get dataproc.batches.list dataproc.batches.sparkApplicationRead dataproc.batches.sparkApplicationWrite dataproc.operations.cancel dataproc.operations.delete dataproc.operations.get dataproc.operations.list dataproc.sessionTemplates.* dataproc.sessionTemplates.create dataproc.sessionTemplates.delete dataproc.sessionTemplates.get dataproc.sessionTemplates.list dataproc.sessionTemplates.update dataproc.sessions.* dataproc.sessions.create dataproc.sessions.delete dataproc.sessions.get dataproc.sessions.list dataproc.sessions.sparkApplicationRead dataproc.sessions.sparkApplicationWrite dataproc.sessions.terminate dataprocrm.nodePools.* dataprocrm.nodePools.create dataprocrm.nodePools.delete dataprocrm.nodePools.deleteNodes dataprocrm.nodePools.get dataprocrm.nodePools.list dataprocrm.nodePools.resize dataprocrm.nodes.get dataprocrm.nodes.heartbeat dataprocrm.nodes.list dataprocrm.nodes.update dataprocrm.operations.get dataprocrm.operations.list dataprocrm.workloads.* dataprocrm.workloads.cancel dataprocrm.workloads.create dataprocrm.workloads.delete dataprocrm.workloads.get dataprocrm.workloads.list resourcemanager.projects.get resourcemanager.projects.list
Dataproc Serverless Node. (roles/dataproc.serverlessNode) Node access to Dataproc Serverless sessions and batches. Intended for service accounts.	dataproc.batches.sparkApplicationWrite dataproc.sessions.sparkApplicationRead dataproc.sessions.sparkApplicationWrite dataprocrm.nodePools.* dataprocrm.nodePools.create dataprocrm.nodePools.delete dataprocrm.nodePools.deleteNodes dataprocrm.nodePools.get dataprocrm.nodePools.list dataprocrm.nodePools.resize dataprocrm.nodes.list dataprocrm.operations.get
Dataproc Serverless Viewer (roles/dataproc.serverlessViewer) Permissions needed to view serverless sessions and batches	compute.projects.get compute.regions.* compute.regions.get compute.regions.list compute.zones.* compute.zones.get compute.zones.list dataproc.batches.get dataproc.batches.list dataproc.sessionTemplates.get dataproc.sessionTemplates.list dataproc.sessions.get dataproc.sessions.list resourcemanager.projects.get resourcemanager.projects.list
Dataproc Worker (roles/dataproc.worker) Provides worker access to Managed Service for Apache Spark resources. Intended for service accounts.	cloudprofiler.profiles.create cloudprofiler.profiles.update datalineage.locations.processOpenLineageMessage dataproc.agents.* dataproc.agents.create dataproc.agents.delete dataproc.agents.get dataproc.agents.list dataproc.agents.update dataproc.batches.sparkApplicationWrite dataproc.sessions.sparkApplicationWrite dataproc.tasks.* dataproc.tasks.lease dataproc.tasks.listInvalidatedLeases dataproc.tasks.reportStatus dataprocrm.nodePools.* dataprocrm.nodePools.create dataprocrm.nodePools.delete dataprocrm.nodePools.deleteNodes dataprocrm.nodePools.get dataprocrm.nodePools.list dataprocrm.nodePools.resize dataprocrm.nodes.get dataprocrm.nodes.heartbeat dataprocrm.nodes.list dataprocrm.nodes.mintOAuthToken dataprocrm.operations.get logging.logEntries.create logging.logEntries.route monitoring.metricDescriptors.create monitoring.metricDescriptors.get monitoring.metricDescriptors.list monitoring.monitoredResourceDescriptors.* monitoring.monitoredResourceDescriptors.get monitoring.monitoredResourceDescriptors.list monitoring.timeSeries.create storage.buckets.get storage.folders.* storage.folders.create storage.folders.delete storage.folders.get storage.folders.list storage.folders.rename storage.managedFolders.create storage.managedFolders.delete storage.managedFolders.get storage.managedFolders.list storage.multipartUploads.* storage.multipartUploads.abort storage.multipartUploads.create storage.multipartUploads.list storage.multipartUploads.listParts storage.objects.create storage.objects.createContext storage.objects.delete storage.objects.deleteContext storage.objects.get storage.objects.getIamPolicy storage.objects.list storage.objects.overrideUnlockedRetention storage.objects.restore storage.objects.setIamPolicy storage.objects.setRetention storage.objects.update storage.objects.updateContext

Service agent roles

Service agent roles should only be granted to service agents.

Role

Permissions

Dataproc Service Agent (roles/dataproc.serviceAgent) Gives Dataproc Service Account access to service accounts, compute resources, storage resources, and kubernetes resources. Includes access to service accounts. Warning: Do not grant service agent roles to any principals except service agents.

backupdr.backupPlanAssociations.createForComputeDisk backupdr.backupPlanAssociations.createForComputeInstance backupdr.backupPlanAssociations.deleteForComputeDisk backupdr.backupPlanAssociations.deleteForComputeInstance backupdr.backupPlanAssociations.fetchForComputeDisk backupdr.backupPlanAssociations.getForComputeDisk backupdr.backupPlanAssociations.list backupdr.backupPlanAssociations.triggerBackupForComputeDisk backupdr.backupPlanAssociations.triggerBackupForComputeInstance backupdr.backupPlanAssociations.updateForComputeDisk backupdr.backupPlanAssociations.updateForComputeInstance backupdr.backupPlans.get backupdr.backupPlans.list backupdr.backupPlans.useForComputeDisk backupdr.backupPlans.useForComputeInstance backupdr.backupVaults.get backupdr.backupVaults.list backupdr.locations.list backupdr.operations.get backupdr.operations.list backupdr.serviceConfig.initialize biglake.catalogs.get cloudaicompanion.instances.completeTask compute.acceleratorTypes.* compute.acceleratorTypes.get compute.acceleratorTypes.list compute.addresses.createInternal compute.addresses.deleteInternal compute.addresses.get compute.addresses.list compute.addresses.listEffectiveTags compute.addresses.listTagBindings compute.addresses.use compute.addresses.useInternal compute.autoscalers.* compute.autoscalers.create compute.autoscalers.delete compute.autoscalers.get compute.autoscalers.list compute.autoscalers.update compute.diskSettings.get compute.diskTypes.* compute.diskTypes.get compute.diskTypes.list compute.disks.create compute.disks.createSnapshot compute.disks.createTagBinding compute.disks.delete compute.disks.get compute.disks.list compute.disks.resize compute.disks.setLabels compute.disks.startAsyncReplication compute.disks.stopAsyncReplication compute.disks.stopGroupAsyncReplication compute.disks.update compute.disks.updateKmsKey compute.disks.use compute.disks.useReadOnly compute.firewalls.get compute.firewalls.list compute.globalAddresses.get compute.globalAddresses.list compute.globalAddresses.listEffectiveTags compute.globalAddresses.listTagBindings compute.globalAddresses.use compute.globalNetworkEndpointGroups.* compute.globalNetworkEndpointGroups.attachNetworkEndpoints compute.globalNetworkEndpointGroups.create compute.globalNetworkEndpointGroups.createTagBinding compute.globalNetworkEndpointGroups.delete compute.globalNetworkEndpointGroups.deleteTagBinding compute.globalNetworkEndpointGroups.detachNetworkEndpoints compute.globalNetworkEndpointGroups.get compute.globalNetworkEndpointGroups.list compute.globalNetworkEndpointGroups.listEffectiveTags compute.globalNetworkEndpointGroups.listTagBindings compute.globalNetworkEndpointGroups.use compute.globalOperations.get compute.globalOperations.list compute.hosts.* compute.hosts.get compute.hosts.getVersion compute.hosts.list compute.images.get compute.images.getFromFamily compute.images.list compute.images.useReadOnly compute.instanceGroupManagers.* compute.instanceGroupManagers.create compute.instanceGroupManagers.createTagBinding compute.instanceGroupManagers.delete compute.instanceGroupManagers.deleteTagBinding compute.instanceGroupManagers.get compute.instanceGroupManagers.list compute.instanceGroupManagers.listEffectiveTags compute.instanceGroupManagers.listTagBindings compute.instanceGroupManagers.update compute.instanceGroupManagers.use compute.instanceGroups.* compute.instanceGroups.create compute.instanceGroups.createTagBinding compute.instanceGroups.delete compute.instanceGroups.deleteTagBinding compute.instanceGroups.get compute.instanceGroups.list compute.instanceGroups.listEffectiveTags compute.instanceGroups.listTagBindings compute.instanceGroups.update compute.instanceGroups.use compute.instanceSettings.get compute.instanceTemplates.* compute.instanceTemplates.create compute.instanceTemplates.delete compute.instanceTemplates.get compute.instanceTemplates.getIamPolicy compute.instanceTemplates.list compute.instanceTemplates.setIamPolicy compute.instanceTemplates.useReadOnly compute.instances.* compute.instances.addAccessConfig compute.instances.addNetworkInterface compute.instances.addResourcePolicies compute.instances.attachDisk compute.instances.create compute.instances.createTagBinding compute.instances.delete compute.instances.deleteAccessConfig compute.instances.deleteNetworkInterface compute.instances.deleteTagBinding compute.instances.detachDisk compute.instances.get compute.instances.getEffectiveFirewalls compute.instances.getGuestAttributes compute.instances.getIamPolicy compute.instances.getScreenshot compute.instances.getSerialPortOutput compute.instances.getShieldedInstanceIdentity compute.instances.getShieldedVmIdentity compute.instances.list compute.instances.listEffectiveTags compute.instances.listReferrers compute.instances.listTagBindings compute.instances.osAdminLogin compute.instances.osLogin compute.instances.pscInterfaceCreate compute.instances.removeResourcePolicies compute.instances.reset compute.instances.resume compute.instances.sendDiagnosticInterrupt compute.instances.setDeletionProtection compute.instances.setDiskAutoDelete compute.instances.setIamPolicy compute.instances.setLabels compute.instances.setMachineResources compute.instances.setMachineType compute.instances.setMetadata compute.instances.setMinCpuPlatform compute.instances.setName compute.instances.setScheduling compute.instances.setSecurityPolicy compute.instances.setServiceAccount compute.instances.setShieldedInstanceIntegrityPolicy compute.instances.setShieldedVmIntegrityPolicy compute.instances.setTags compute.instances.simulateMaintenanceEvent compute.instances.start compute.instances.startWithEncryptionKey compute.instances.stop compute.instances.suspend compute.instances.update compute.instances.updateAccessConfig compute.instances.updateDisplayDevice compute.instances.updateNetworkInterface compute.instances.updateSecurity compute.instances.updateShieldedInstanceConfig compute.instances.updateShieldedVmConfig compute.instances.use compute.instances.useReadOnly compute.licenses.get compute.licenses.list compute.licenses.listEffectiveTags compute.licenses.listTagBindings compute.machineImages.* compute.machineImages.create compute.machineImages.createTagBinding compute.machineImages.delete compute.machineImages.deleteTagBinding compute.machineImages.get compute.machineImages.getIamPolicy compute.machineImages.list compute.machineImages.listEffectiveTags compute.machineImages.listTagBindings compute.machineImages.setIamPolicy compute.machineImages.setLabels compute.machineImages.useReadOnly compute.machineTypes.* compute.machineTypes.get compute.machineTypes.list compute.multiMig.* compute.multiMig.create compute.multiMig.delete compute.multiMig.get compute.multiMig.list compute.multiMigMembers.* compute.multiMigMembers.get compute.multiMigMembers.list compute.networkEndpointGroups.* compute.networkEndpointGroups.attachNetworkEndpoints compute.networkEndpointGroups.create compute.networkEndpointGroups.createTagBinding compute.networkEndpointGroups.delete compute.networkEndpointGroups.deleteTagBinding compute.networkEndpointGroups.detachNetworkEndpoints compute.networkEndpointGroups.get compute.networkEndpointGroups.list compute.networkEndpointGroups.listEffectiveTags compute.networkEndpointGroups.listTagBindings compute.networkEndpointGroups.use compute.networks.get compute.networks.getEffectiveFirewalls compute.networks.list compute.networks.listEffectiveTags compute.networks.listTagBindings compute.networks.setFirewallPolicy compute.networks.use compute.networks.useExternalIp compute.nodeGroups.get compute.nodeTypes.get compute.projects.get compute.regionFirewallPolicies.create compute.regionFirewallPolicies.createTagBinding compute.regionFirewallPolicies.delete compute.regionFirewallPolicies.deleteTagBinding compute.regionFirewallPolicies.get compute.regionFirewallPolicies.update compute.regionFirewallPolicies.use compute.regionNetworkEndpointGroups.* compute.regionNetworkEndpointGroups.attachNetworkEndpoints compute.regionNetworkEndpointGroups.create compute.regionNetworkEndpointGroups.createTagBinding compute.regionNetworkEndpointGroups.delete compute.regionNetworkEndpointGroups.deleteTagBinding compute.regionNetworkEndpointGroups.detachNetworkEndpoints compute.regionNetworkEndpointGroups.get compute.regionNetworkEndpointGroups.list compute.regionNetworkEndpointGroups.listEffectiveTags compute.regionNetworkEndpointGroups.listTagBindings compute.regionNetworkEndpointGroups.use compute.regionOperations.get compute.regionOperations.list compute.regions.* compute.regions.get compute.regions.list compute.reservationBlocks.get compute.reservationBlocks.list compute.reservationSubBlocks.* compute.reservationSubBlocks.get compute.reservationSubBlocks.list compute.reservationSubBlocks.performMaintenance compute.reservationSubBlocks.reportFaulty compute.reservations.get compute.reservations.list compute.reservations.listEffectiveTags compute.reservations.listTagBindings compute.resourcePolicies.list compute.resourcePolicies.useReadOnly compute.storagePools.get compute.storagePools.list compute.storagePools.listEffectiveTags compute.storagePools.listTagBindings compute.storagePools.use compute.subnetworks.get compute.subnetworks.list compute.subnetworks.listEffectiveTags compute.subnetworks.listTagBindings compute.subnetworks.setPrivateIpGoogleAccess compute.subnetworks.use compute.subnetworks.useExternalIp compute.targetPools.get compute.targetPools.list compute.targetPools.listEffectiveTags compute.targetPools.listTagBindings compute.zoneOperations.get compute.zoneOperations.list compute.zones.* compute.zones.get compute.zones.list container.clusterRoleBindings.* container.clusterRoleBindings.create container.clusterRoleBindings.delete container.clusterRoleBindings.get container.clusterRoleBindings.list container.clusterRoleBindings.update container.clusterRoles.* container.clusterRoles.bind container.clusterRoles.create container.clusterRoles.delete container.clusterRoles.escalate container.clusterRoles.get container.clusterRoles.list container.clusterRoles.update container.clusters.connect container.clusters.get container.clusters.update container.customResourceDefinitions.create container.customResourceDefinitions.delete container.customResourceDefinitions.get container.customResourceDefinitions.list container.customResourceDefinitions.update container.namespaces.create container.namespaces.delete container.namespaces.get container.namespaces.list container.namespaces.update container.operations.get container.roleBindings.* container.roleBindings.create container.roleBindings.delete container.roleBindings.get container.roleBindings.list container.roleBindings.update container.roles.bind container.roles.escalate dataproc.autoscalingPolicies.create dataproc.autoscalingPolicies.delete dataproc.autoscalingPolicies.get dataproc.autoscalingPolicies.getIamPolicy dataproc.autoscalingPolicies.list dataproc.autoscalingPolicies.update dataproc.autoscalingPolicies.use dataproc.clusters.* dataproc.clusters.create dataproc.clusters.delete dataproc.clusters.get dataproc.clusters.getIamPolicy dataproc.clusters.list dataproc.clusters.repair dataproc.clusters.setIamPolicy dataproc.clusters.start dataproc.clusters.stop dataproc.clusters.update dataproc.clusters.use dataproc.jobs.* dataproc.jobs.cancel dataproc.jobs.create dataproc.jobs.delete dataproc.jobs.get dataproc.jobs.getIamPolicy dataproc.jobs.list dataproc.jobs.setIamPolicy dataproc.jobs.update dataproc.nodeGroups.* dataproc.nodeGroups.create dataproc.nodeGroups.get dataproc.nodeGroups.update dataproc.operations.cancel dataproc.sessionTemplates.get dataproc.sessions.* dataproc.sessions.create dataproc.sessions.delete dataproc.sessions.get dataproc.sessions.list dataproc.sessions.sparkApplicationRead dataproc.sessions.sparkApplicationWrite dataproc.sessions.terminate dataprocrm.nodePools.* dataprocrm.nodePools.create dataprocrm.nodePools.delete dataprocrm.nodePools.deleteNodes dataprocrm.nodePools.get dataprocrm.nodePools.list dataprocrm.nodePools.resize dataprocrm.nodes.* dataprocrm.nodes.get dataprocrm.nodes.heartbeat dataprocrm.nodes.list dataprocrm.nodes.mintOAuthToken dataprocrm.nodes.update dataprocrm.operations.cancel dataprocrm.operations.get dataprocrm.operations.list dataprocrm.workloads.* dataprocrm.workloads.cancel dataprocrm.workloads.create dataprocrm.workloads.delete dataprocrm.workloads.get dataprocrm.workloads.list firebase.projects.get iam.serviceAccounts.actAs iam.serviceAccounts.getAccessToken metastore.services.get monitoring.metricDescriptors.list monitoring.monitoredResourceDescriptors.list monitoring.timeSeries.* monitoring.timeSeries.create monitoring.timeSeries.list orgpolicy.policy.get recommender.iamPolicyInsights.* recommender.iamPolicyInsights.get recommender.iamPolicyInsights.list recommender.iamPolicyInsights.update recommender.iamPolicyRecommendations.* recommender.iamPolicyRecommendations.get recommender.iamPolicyRecommendations.list recommender.iamPolicyRecommendations.update recommender.storageBucketSoftDeleteInsights.* recommender.storageBucketSoftDeleteInsights.get recommender.storageBucketSoftDeleteInsights.list recommender.storageBucketSoftDeleteInsights.update recommender.storageBucketSoftDeleteRecommendations.* recommender.storageBucketSoftDeleteRecommendations.get recommender.storageBucketSoftDeleteRecommendations.list recommender.storageBucketSoftDeleteRecommendations.update resourcemanager.hierarchyNodes.listEffectiveTags resourcemanager.projects.get resourcemanager.projects.list resourcemanager.tagKeys.create resourcemanager.tagKeys.get resourcemanager.tagKeys.getIamPolicy resourcemanager.tagKeys.setIamPolicy resourcemanager.tagValueBindings.* resourcemanager.tagValueBindings.create resourcemanager.tagValueBindings.delete resourcemanager.tagValues.create resourcemanager.tagValues.get serviceusage.consumerpolicy.analyze serviceusage.consumerpolicy.get serviceusage.effectivepolicy.get serviceusage.groups.* serviceusage.groups.list serviceusage.groups.listExpandedMembers serviceusage.groups.listMembers serviceusage.quotas.get serviceusage.services.get serviceusage.services.list serviceusage.services.use serviceusage.values.test storage.anywhereCaches.* storage.anywhereCaches.create storage.anywhereCaches.disable storage.anywhereCaches.get storage.anywhereCaches.list storage.anywhereCaches.pause storage.anywhereCaches.resume storage.anywhereCaches.update storage.bucketOperations.* storage.bucketOperations.cancel storage.bucketOperations.get storage.bucketOperations.list storage.buckets.* storage.buckets.create storage.buckets.createTagBinding storage.buckets.delete storage.buckets.deleteTagBinding storage.buckets.enableObjectRetention storage.buckets.get storage.buckets.getIamPolicy storage.buckets.getIpFilter storage.buckets.getObjectInsights storage.buckets.list storage.buckets.listEffectiveTags storage.buckets.listTagBindings storage.buckets.relocate storage.buckets.restore storage.buckets.setIamPolicy storage.buckets.setIpFilter storage.buckets.update storage.buckets.viewIntelligenceDetails storage.featureConfigs.* storage.featureConfigs.create storage.featureConfigs.delete storage.featureConfigs.get storage.featureConfigs.list storage.featureConfigs.update storage.folders.* storage.folders.create storage.folders.delete storage.folders.get storage.folders.list storage.folders.rename storage.intelligenceConfigs.* storage.intelligenceConfigs.get storage.intelligenceConfigs.update storage.managedFolders.* storage.managedFolders.create storage.managedFolders.delete storage.managedFolders.get storage.managedFolders.getIamPolicy storage.managedFolders.list storage.managedFolders.setIamPolicy storage.multipartUploads.* storage.multipartUploads.abort storage.multipartUploads.create storage.multipartUploads.list storage.multipartUploads.listParts storage.objects.* storage.objects.create storage.objects.createContext storage.objects.delete storage.objects.deleteContext storage.objects.get storage.objects.getIamPolicy storage.objects.list storage.objects.move storage.objects.overrideUnlockedRetention storage.objects.restore storage.objects.setIamPolicy storage.objects.setRetention storage.objects.update storage.objects.updateContext storagebatchoperations.* storagebatchoperations.bucketOperations.get storagebatchoperations.bucketOperations.list storagebatchoperations.jobs.cancel storagebatchoperations.jobs.create storagebatchoperations.jobs.delete storagebatchoperations.jobs.get storagebatchoperations.jobs.list storagebatchoperations.locations.get storagebatchoperations.locations.list storagebatchoperations.operations.cancel storagebatchoperations.operations.delete storagebatchoperations.operations.get storagebatchoperations.operations.list

注意：

• 使用 Google Cloud 控制台或 gcloud CLI Google Cloud CLI 建立及檢視 Managed Service for Apache Spark 叢集時，需要或建議使用 compute 權限。
• 如要允許使用者上傳檔案，請授予 Storage Object Creator 角色。 如要允許使用者查看工作輸出內容，請授予 Storage Object Viewer 角色。
• 使用者必須具有 monitoring.timeSeries.list 權限，才能檢視 Google Cloud 控制台→「Managed Service for Apache Spark」→「Cluster details」(叢集詳細資料) 的「Overview」(總覽) 分頁中的圖表。
• 使用者必須具有 compute.instances.list 權限，才能檢視Google Cloud 控制台→「Managed Service for Apache Spark」→「Cluster details」(叢集詳細資料) 的「VM Instances」(VM 執行個體) 分頁上的執行個體狀態和主要執行個體 SSH 選單。如要瞭解 Compute Engine 角色，請參閱「Compute Engine→可用的 IAM 角色」。
• 如要透過使用者指定的服務帳戶建立叢集，指定的服務帳戶必須具有 Dataproc Worker 角色授予的所有權限，包括存取 Managed Service for Apache Spark 暫存和臨時值區。視設定的功能而定，可能需要其他角色。詳情請參閱「建立採用自訂 VM 服務帳戶的叢集」。

專案角色

您還可以使用 IAM 專案角色設定專案層級的權限。下表列出與 IAM 專案角色相關的權限：

專案角色	權限
專案檢視者	保留狀態的唯讀動作的所有專案權限 (取得、表列)
專案編輯者	所有專案檢視者權限，加上修改狀態動作的所有專案權限 (建立、刪除、更新、使用、取消、停止、啟動)
專案擁有者	所有專案編輯者權限，加上管理專案存取權 (取得/設定 IAM 政策) 及設定專案帳單的權限

IAM 角色和 Managed Service for Apache Spark 作業摘要

下表列出與專案和 Managed Service for Apache Spark 角色相關聯的 Managed Service for Apache Spark 作業。

作業	專案編輯者	專案檢視者	Managed Service for Apache Spark 管理員	Managed Service for Apache Spark 編輯器	Managed Service for Apache Spark 檢視者
取得/設定 Managed Service for Apache Spark IAM 權限	否	否	是	否	否
建立叢集	可以	否	是	是	不可以
列出叢集	可以	是	是	是	可以
取得叢集詳細資料	可以	可以	可以 ^1、2	可以 ^1、2	可以 ^1、2
更新叢集	可以	否	是	是	不可以
刪除叢集	可以	否	是	是	否
啟動/停止叢集	是	否	是	是	不可以
提交工作	可以	不可以	是 ^3	是 ^3	不可以
列出工作	可以	是	是	是	可以
取得工作詳細資料	可以	可以	是 ^4	是 ^4	是 ^4
取消工作	可以	否	是	是	不可以
刪除工作	可以	否	是	是	不可以
列出作業	可以	是	是	是	可以
取得作業詳細資料	可以	是	是	是	可以
刪除作業	可以	否	是	是	不可以

注意：

1. 除非使用者另外具有包含 monitoring.timeSeries.list 權限的角色，否則不提供效能圖。
2. 除非使用者另外具有包含 compute.instances.list 權限的角色，否則叢集中的 VM 清單將不包含主要執行個體的狀態資訊或 SSH 連結。
3. 如要上傳檔案，使用者必須具備 Storage Object Creator 角色，或擁有 Managed Service for Apache Spark 暫存 bucket 的寫入存取權。
4. 除非使用者另外具有「Storage 物件檢視者」角色，或已獲得專案暫存值區的讀取存取權，否則無法提供工作輸出。

Managed Service for Apache Spark VM 存取範圍

VM 存取範圍和 IAM 角色會搭配運作，限制 VM 對 API 的存取權。 Google Cloud舉例來說，如果叢集 VM 只獲得 https://www.googleapis.com/auth/storage-full 範圍的存取權，在叢集 VM 上執行的應用程式就能呼叫 Cloud Storage API，但即使這些應用程式是以已獲授權的 VM 服務帳戶身分執行，且該帳戶已獲授權具有廣泛權限的 BigQuery 角色，應用程式也無法向 BigQuery 提出要求。

最佳做法是將廣泛的 cloud-platform 範圍 (https://www.googleapis.com/auth/cloud-platform) 授予 VM，然後將特定 IAM 角色授予 VM 服務帳戶，藉此限制 VM 存取權 (請參閱範圍最佳做法)。

注意： 使用 Managed Service for Apache Spark 映像檔 2.1 以上版本建立的 Managed Service for Apache Spark 叢集 VM，預設會套用 cloud-platform 範圍。

Managed Service for Apache Spark VM 的預設範圍。如果建立叢集時未指定範圍 (請參閱 gcloud dataproc cluster create --scopes)，Managed Service for Apache Spark VM 會採用下列預設範圍：

https://www.googleapis.com/auth/cloud-platform (clusters created with image version 2.1+).
https://www.googleapis.com/auth/bigquery
https://www.googleapis.com/auth/bigtable.admin.table
https://www.googleapis.com/auth/bigtable.data
https://www.googleapis.com/auth/cloud.useraccounts.readonly
https://www.googleapis.com/auth/devstorage.full_control
https://www.googleapis.com/auth/devstorage.read_write
https://www.googleapis.com/auth/logging.write

如果您在建立叢集時指定範圍，叢集 VM 會具有您指定的範圍和下列最低必要範圍集 (即使您未指定這些範圍)：

https://www.googleapis.com/auth/cloud-platform (clusters created with image version 2.1+).
https://www.googleapis.com/auth/cloud.useraccounts.readonly
https://www.googleapis.com/auth/devstorage.read_write
https://www.googleapis.com/auth/logging.write

管理 IAM 允許政策

您可以使用允許政策，將 IAM 角色授予主體。您可以使用 Google Cloud 控制台、IAM API 或 Google Cloud CLI 取得及設定允許政策。

• 如要使用 Google Cloud 控制台，請參閱「使用 Google Cloud 控制台控管存取權」一文。
• 如要使用 API，請參閱透過 API 控管存取權。
• 如要使用 Google Cloud CLI，請參閱透過 Google Cloud CLI 控管存取權。

後續步驟

• 瞭解 Managed Service for Apache Spark 主體和角色
• 瞭解 Managed Service for Apache Spark 細部 IAM
• 進一步瞭解 IAM。
• 瞭解 Managed Service for Apache Spark 中的服務帳戶