使用 IAM 进行访问权限控制

本页面介绍您在 Cloud Marketplace 上购买和管理商业产品所需的 Identity and Access Management (IAM) 角色和权限。

借助 IAM，您可以通过定义谁（身份）对哪些资源具有哪种访问权限（角色）来管理访问权限控制。对于 Cloud Marketplace 上的商业应用，您的 Google Cloud 组织中的用户需要 IAM 角色，才能注册 Cloud Marketplace 方案和更改结算方案。

• 了解如何管理 Cloud Marketplace 产品的结算。
• 了解影响账单的因素。
• 了解 IAM 的基本概念。
• 了解 Google Cloud资源的层次结构。

准备工作

• 如需使用 gcloud 授予 Cloud Marketplace 角色和权限，请安装 gcloud CLI。否则，您可以使用 Google Cloud 控制台授予角色。

购买和管理角色

我们建议您为从 Cloud Marketplace 购买服务的用户分配 Billing Account Administrator IAM 角色。

用户如需访问这些服务，必须至少具有 Viewer 角色。

如需更精细地控制用户权限，您可以使用要授予的权限创建自定义角色。

具体产品的要求

如需在 Google Cloud 项目中使用以下服务，您必须拥有项目编辑者角色：

• Google Cloud Dataprep by Trifacta
• Neo4j Aura Professional
• Redis Enterprise Cloud

IAM 角色和权限列表

您可以为用户授予以下一个或多个 IAM 角色。根据您向用户授予的角色，您还必须将角色分配给 Google Cloud 结算账号、组织或项目。如需了解详情，请参阅向用户授予 IAM 角色部分。

Role	Permissions
Consumer Procurement Entitlement Manager (roles/consumerprocurement.entitlementManager) Allows managing entitlements and enabling, disabling, and inspecting service states for a consumer project.	commerceoffercatalog.offers.get consumerprocurement.consents.check consumerprocurement.consents.grant consumerprocurement.consents.list consumerprocurement.consents.revoke consumerprocurement.entitlements.* consumerprocurement.entitlements.get consumerprocurement.entitlements.list consumerprocurement.freeTrials.* consumerprocurement.freeTrials.create consumerprocurement.freeTrials.get consumerprocurement.freeTrials.list orgpolicy.policy.get resourcemanager.projects.get resourcemanager.projects.list serviceusage.consumerpolicy.* serviceusage.consumerpolicy.analyze serviceusage.consumerpolicy.get serviceusage.consumerpolicy.update serviceusage.effectivepolicy.get serviceusage.groups.* serviceusage.groups.list serviceusage.groups.listExpandedMembers serviceusage.groups.listMembers serviceusage.operations.get serviceusage.services.disable serviceusage.services.enable serviceusage.services.get serviceusage.services.list serviceusage.values.test
Consumer Procurement Entitlement Viewer (roles/consumerprocurement.entitlementViewer) Allows inspecting entitlements and service states for a consumer project.	commerceoffercatalog.offers.get consumerprocurement.consents.check consumerprocurement.consents.list consumerprocurement.entitlements.* consumerprocurement.entitlements.get consumerprocurement.entitlements.list consumerprocurement.freeTrials.get consumerprocurement.freeTrials.list orgpolicy.policy.get resourcemanager.projects.get resourcemanager.projects.list serviceusage.consumerpolicy.analyze serviceusage.consumerpolicy.get serviceusage.effectivepolicy.get serviceusage.groups.* serviceusage.groups.list serviceusage.groups.listExpandedMembers serviceusage.groups.listMembers serviceusage.services.get serviceusage.services.list serviceusage.values.test
Consumer Procurement Events Viewer (roles/consumerprocurement.eventsViewer) Allows viewing key events for an offer	consumerprocurement.events.* consumerprocurement.events.get consumerprocurement.events.list
Consumer Procurement License Pool Editor (roles/consumerprocurement.licensePoolEditor) Allows managing license pools and license assignments.	consumerprocurement.licensePools.* consumerprocurement.licensePools.assign consumerprocurement.licensePools.enumerateLicensedUsers consumerprocurement.licensePools.get consumerprocurement.licensePools.unassign consumerprocurement.licensePools.update
Consumer Procurement License Pool Viewer (roles/consumerprocurement.licensePoolViewer) Allows viewing license pools and license assignments.	consumerprocurement.licensePools.enumerateLicensedUsers consumerprocurement.licensePools.get
Consumer Procurement Order Administrator (roles/consumerprocurement.orderAdmin) Allows managing purchases.	billing.accounts.get billing.accounts.getIamPolicy billing.accounts.list billing.accounts.redeemPromotion billing.credits.list billing.resourceAssociations.create commerceoffercatalog.* commerceoffercatalog.agreements.get commerceoffercatalog.agreements.list commerceoffercatalog.documents.get commerceoffercatalog.documents.list commerceoffercatalog.offers.get consumerprocurement.accounts.* consumerprocurement.accounts.create consumerprocurement.accounts.delete consumerprocurement.accounts.get consumerprocurement.accounts.list consumerprocurement.consents.check consumerprocurement.consents.grant consumerprocurement.consents.list consumerprocurement.consents.revoke consumerprocurement.events.* consumerprocurement.events.get consumerprocurement.events.list consumerprocurement.licensePools.* consumerprocurement.licensePools.assign consumerprocurement.licensePools.enumerateLicensedUsers consumerprocurement.licensePools.get consumerprocurement.licensePools.unassign consumerprocurement.licensePools.update consumerprocurement.orderAttributions.* consumerprocurement.orderAttributions.get consumerprocurement.orderAttributions.list consumerprocurement.orderAttributions.update consumerprocurement.orders.* consumerprocurement.orders.cancel consumerprocurement.orders.get consumerprocurement.orders.list consumerprocurement.orders.modify consumerprocurement.orders.place discoveryengine.billingAccountLicenseConfigs.* discoveryengine.billingAccountLicenseConfigs.distribute discoveryengine.billingAccountLicenseConfigs.get discoveryengine.billingAccountLicenseConfigs.list discoveryengine.billingAccountLicenseConfigs.retract
Consumer Procurement Order Viewer (roles/consumerprocurement.orderViewer) Allows inspecting purchases.	billing.accounts.get billing.accounts.getIamPolicy billing.accounts.list billing.credits.list commerceoffercatalog.* commerceoffercatalog.agreements.get commerceoffercatalog.agreements.list commerceoffercatalog.documents.get commerceoffercatalog.documents.list commerceoffercatalog.offers.get consumerprocurement.accounts.get consumerprocurement.accounts.list consumerprocurement.consents.check consumerprocurement.consents.list consumerprocurement.licensePools.enumerateLicensedUsers consumerprocurement.licensePools.get consumerprocurement.orderAttributions.get consumerprocurement.orderAttributions.list consumerprocurement.orders.get consumerprocurement.orders.list discoveryengine.billingAccountLicenseConfigs.get discoveryengine.billingAccountLicenseConfigs.list
Consumer Procurement Administrator (roles/consumerprocurement.procurementAdmin) Allows managing purchases, consents at both billing account and project level.	billing.accounts.get billing.accounts.getIamPolicy billing.accounts.list billing.accounts.redeemPromotion billing.credits.list billing.resourceAssociations.create commerceoffercatalog.* commerceoffercatalog.agreements.get commerceoffercatalog.agreements.list commerceoffercatalog.documents.get commerceoffercatalog.documents.list commerceoffercatalog.offers.get consumerprocurement.* consumerprocurement.accounts.create consumerprocurement.accounts.delete consumerprocurement.accounts.get consumerprocurement.accounts.list consumerprocurement.consents.allowProjectGrant consumerprocurement.consents.check consumerprocurement.consents.grant consumerprocurement.consents.list consumerprocurement.consents.revoke consumerprocurement.entitlements.get consumerprocurement.entitlements.list consumerprocurement.events.get consumerprocurement.events.list consumerprocurement.freeTrials.create consumerprocurement.freeTrials.get consumerprocurement.freeTrials.list consumerprocurement.licensePools.assign consumerprocurement.licensePools.enumerateLicensedUsers consumerprocurement.licensePools.get consumerprocurement.licensePools.unassign consumerprocurement.licensePools.update consumerprocurement.orderAttributions.get consumerprocurement.orderAttributions.list consumerprocurement.orderAttributions.update consumerprocurement.orders.cancel consumerprocurement.orders.get consumerprocurement.orders.list consumerprocurement.orders.modify consumerprocurement.orders.place discoveryengine.billingAccountLicenseConfigs.* discoveryengine.billingAccountLicenseConfigs.distribute discoveryengine.billingAccountLicenseConfigs.get discoveryengine.billingAccountLicenseConfigs.list discoveryengine.billingAccountLicenseConfigs.retract orgpolicy.policy.get resourcemanager.projects.get resourcemanager.projects.list serviceusage.consumerpolicy.* serviceusage.consumerpolicy.analyze serviceusage.consumerpolicy.get serviceusage.consumerpolicy.update serviceusage.effectivepolicy.get serviceusage.groups.* serviceusage.groups.list serviceusage.groups.listExpandedMembers serviceusage.groups.listMembers serviceusage.operations.get serviceusage.services.disable serviceusage.services.enable serviceusage.services.get serviceusage.services.list serviceusage.values.test
Consumer Procurement Viewer (roles/consumerprocurement.procurementViewer) Allows inspecting purchases, consents and entitlements and service states for a consumer project.	billing.accounts.get billing.accounts.getIamPolicy billing.accounts.list billing.credits.list commerceoffercatalog.* commerceoffercatalog.agreements.get commerceoffercatalog.agreements.list commerceoffercatalog.documents.get commerceoffercatalog.documents.list commerceoffercatalog.offers.get consumerprocurement.accounts.get consumerprocurement.accounts.list consumerprocurement.consents.check consumerprocurement.consents.list consumerprocurement.entitlements.* consumerprocurement.entitlements.get consumerprocurement.entitlements.list consumerprocurement.freeTrials.get consumerprocurement.freeTrials.list consumerprocurement.licensePools.enumerateLicensedUsers consumerprocurement.licensePools.get consumerprocurement.orderAttributions.get consumerprocurement.orderAttributions.list consumerprocurement.orders.get consumerprocurement.orders.list discoveryengine.billingAccountLicenseConfigs.get discoveryengine.billingAccountLicenseConfigs.list orgpolicy.policy.get resourcemanager.projects.get resourcemanager.projects.list serviceusage.consumerpolicy.analyze serviceusage.consumerpolicy.get serviceusage.effectivepolicy.get serviceusage.groups.* serviceusage.groups.list serviceusage.groups.listExpandedMembers serviceusage.groups.listMembers serviceusage.services.get serviceusage.services.list serviceusage.values.test

向用户授予 IAM 角色

对于上表中的角色，您必须在结算账号或组织级层分配 consumerprocurement.orderAdmin 和 consumerprocurement.orderViewer 角色，必须在项目或组织级层分配 consumerprocurement.entitlementManager 和 consumerprocurement.entitlementViewer 角色。

如需使用 gcloud 为用户授予角色，请运行以下命令之一：

组织

您必须具有 resourcemanager.organizationAdmin 角色才能在组织级层分配角色。

gcloud organizations add-iam-policy-binding organization-id \
--member=member --role=role-id

占位符值如下：

• organization-id：您要向其授予角色的组织的数字 ID。
• member：要向其授予访问权限的用户。
• role-id：上表中的角色 ID。

结算账号

您必须具有 billing.admin 角色才能在结算账号级层分配角色。

gcloud beta billing accounts set-iam-policy account-id \
policy-file

占位符值如下：

• account-id：您的结算账号 ID，您可以从“管理结算账号”页面获得。
• policy-file：IAM 政策文件，采用 JSON 或 YAML 格式。 政策文件必须包含上表中的角色 ID，以及要为其分配这些角色的用户。

项目

您必须具有 resourcemanager.folderAdmin 角色才能在项目级层分配角色。

gcloud projects add-iam-policy-binding project-id \
--member=member --role=role-id

占位值如下：

• project-id：要为其授予角色的项目。
• member：要向其授予访问权限的用户。
• role-id：上表中的角色 ID。

如需使用 Google Cloud 控制台向用户授予角色，请参阅关于授予、更改和撤消用户的访问权限的 IAM 文档。

将自定义角色与 Cloud Marketplace 搭配使用

如果您想精细控制您授予用户的权限，您可以使用授予的权限创建自定义角色。

如果您要为从 Cloud Marketplace 购买服务的用户创建自定义角色，该角色必须包含以下权限，以便用户使用其购买服务的结算账号：

• billing.accounts.get，通常使用 roles/consumerprocurement.orderAdmin 角色授予。
• consumerprocurement.orders.get，通常使用 roles/consumerprocurement.orderAdmin 角色授予。
• consumerprocurement.orders.list，通常使用 roles/consumerprocurement.orderAdmin 角色授予。
• consumerprocurement.orders.place，通常使用 roles/consumerprocurement.orderAdmin 角色授予。
• consumerprocurement.accounts.get，通常使用 roles/consumerprocurement.orderAdmin 角色授予。
• consumerprocurement.accounts.list，通常使用 roles/consumerprocurement.orderAdmin 角色授予。
• consumerprocurement.accounts.create，通常使用 roles/consumerprocurement.orderAdmin 角色授予。
• consumerprocurement.consents.grant，通常使用 roles/consumerprocurement.orderAdmin 角色授予。

通过单点登录 (SSO) 访问合作伙伴网站

某些 Cloud Marketplace API 产品支持通过单点登录 (SSO) 访问合作伙伴的外部网站。组织内的授权用户可以使用产品详情页面上的“在提供商网站上管理”按钮。点击此按钮后，系统会将用户转到合作伙伴的网站。在某些情况下，系统会提示用户“使用 Google 账号登录”。在其他情况下，用户会通过共享账号上下文登录。

如需使用 SSO 功能，用户需要导航到产品详情页面，然后选择适当的项目。该项目必须与购买该方案的结算账号关联。如需详细了解 Cloud Marketplace API 方案管理，请参阅管理结算方案。

此外，用户必须在所选项目中拥有足够的 IAM 权限。对于大多数产品，需要 roles/consumerprocurement.entitlementManager（或 roles/editor 基本角色）。

特定产品的最小权限

以下产品可以基于一组不同的权限运行，以便使用单点登录功能：

• Confluent Cloud 上的 Apache Kafka
• DataStax Astra for Apache Cassandra
• Elastic Cloud
• Neo4j Aura Professional
• Redis Enterprise Cloud

对于这些产品，您可以使用以下最小权限：

• consumerprocurement.entitlements.get
• consumerprocurement.entitlements.list
• serviceusage.services.get
• serviceusage.services.list
• resourcemanager.projects.get

这些权限通常通过 roles/consumerprocurement.entitlementManager 或 roles/consumerprocurement.entitlementViewer 角色授予。