使用 IAM 控管存取權

本頁說明在 Cloud Marketplace 購買及管理商業產品時，您需要具備的 Identity and Access Management (IAM) 角色和權限。

藉由 IAM，您可以定義「誰」(身分)「有權存取」(角色)「哪些資源」的方式，管理存取權的控管。如要使用 Cloud Marketplace 上的商用應用程式， Google Cloud 機構中的使用者必須具備 IAM 角色，才能註冊 Cloud Marketplace 方案及變更計費方案。

• 瞭解如何管理 Cloud Marketplace 產品的帳單。
• 瞭解影響帳單的因素。
• 瞭解 IAM 的基本概念。
• 瞭解資源階層 Google Cloud。

事前準備

• 如要使用 gcloud 授予 Cloud Marketplace 角色和權限，請安裝 gcloud CLI。否則，您可以使用 Google Cloud 控制台授予角色。

購買及管理角色

建議您將「帳單帳戶管理員」IAM 角色指派給從 Cloud Marketplace 購買服務的使用者。

如要存取服務，使用者至少須具備「檢視者」角色。

如要更精細地控管使用者權限，可以建立自訂角色，並授予所需權限。

產品相關規定

如要在 Google Cloud 專案中使用下列服務，您必須具備「專案編輯者」角色：

• Google Cloud Dataprep by Trifacta
• Neo4j Aura Professional
• Redis Enterprise Cloud

身分與存取權管理角色和權限清單

您可以授予使用者下列一或多個 IAM 角色。 視要授予使用者的角色而定，您也必須將角色指派給 Google Cloud 帳單帳戶、機構或專案。詳情請參閱「授予使用者 IAM 角色」一節。

Role	Permissions
Consumer Procurement Entitlement Manager (roles/consumerprocurement.entitlementManager) Allows managing entitlements and enabling, disabling, and inspecting service states for a consumer project.	commerceoffercatalog.offers.get consumerprocurement.consents.check consumerprocurement.consents.grant consumerprocurement.consents.list consumerprocurement.consents.revoke consumerprocurement.entitlements.* consumerprocurement.entitlements.get consumerprocurement.entitlements.list consumerprocurement.freeTrials.* consumerprocurement.freeTrials.create consumerprocurement.freeTrials.get consumerprocurement.freeTrials.list orgpolicy.policy.get resourcemanager.projects.get resourcemanager.projects.list serviceusage.consumerpolicy.* serviceusage.consumerpolicy.analyze serviceusage.consumerpolicy.get serviceusage.consumerpolicy.update serviceusage.effectivepolicy.get serviceusage.groups.* serviceusage.groups.list serviceusage.groups.listExpandedMembers serviceusage.groups.listMembers serviceusage.operations.get serviceusage.services.disable serviceusage.services.enable serviceusage.services.get serviceusage.services.list serviceusage.values.test
Consumer Procurement Entitlement Viewer (roles/consumerprocurement.entitlementViewer) Allows inspecting entitlements and service states for a consumer project.	commerceoffercatalog.offers.get consumerprocurement.consents.check consumerprocurement.consents.list consumerprocurement.entitlements.* consumerprocurement.entitlements.get consumerprocurement.entitlements.list consumerprocurement.freeTrials.get consumerprocurement.freeTrials.list orgpolicy.policy.get resourcemanager.projects.get resourcemanager.projects.list serviceusage.consumerpolicy.analyze serviceusage.consumerpolicy.get serviceusage.effectivepolicy.get serviceusage.groups.* serviceusage.groups.list serviceusage.groups.listExpandedMembers serviceusage.groups.listMembers serviceusage.services.get serviceusage.services.list serviceusage.values.test
Consumer Procurement Events Viewer (roles/consumerprocurement.eventsViewer) Allows viewing key events for an offer	consumerprocurement.events.* consumerprocurement.events.get consumerprocurement.events.list
Consumer Procurement License Pool Editor (roles/consumerprocurement.licensePoolEditor) Allows managing license pools and license assignments.	consumerprocurement.licensePools.* consumerprocurement.licensePools.assign consumerprocurement.licensePools.enumerateLicensedUsers consumerprocurement.licensePools.get consumerprocurement.licensePools.unassign consumerprocurement.licensePools.update
Consumer Procurement License Pool Viewer (roles/consumerprocurement.licensePoolViewer) Allows viewing license pools and license assignments.	consumerprocurement.licensePools.enumerateLicensedUsers consumerprocurement.licensePools.get
Consumer Procurement Order Administrator (roles/consumerprocurement.orderAdmin) Allows managing purchases.	billing.accounts.get billing.accounts.getIamPolicy billing.accounts.list billing.accounts.redeemPromotion billing.credits.list billing.resourceAssociations.create commerceoffercatalog.* commerceoffercatalog.agreements.get commerceoffercatalog.agreements.list commerceoffercatalog.documents.get commerceoffercatalog.documents.list commerceoffercatalog.offers.get consumerprocurement.accounts.* consumerprocurement.accounts.create consumerprocurement.accounts.delete consumerprocurement.accounts.get consumerprocurement.accounts.list consumerprocurement.consents.check consumerprocurement.consents.grant consumerprocurement.consents.list consumerprocurement.consents.revoke consumerprocurement.events.* consumerprocurement.events.get consumerprocurement.events.list consumerprocurement.licensePools.* consumerprocurement.licensePools.assign consumerprocurement.licensePools.enumerateLicensedUsers consumerprocurement.licensePools.get consumerprocurement.licensePools.unassign consumerprocurement.licensePools.update consumerprocurement.orderAttributions.* consumerprocurement.orderAttributions.get consumerprocurement.orderAttributions.list consumerprocurement.orderAttributions.update consumerprocurement.orders.* consumerprocurement.orders.cancel consumerprocurement.orders.get consumerprocurement.orders.list consumerprocurement.orders.modify consumerprocurement.orders.place discoveryengine.billingAccountLicenseConfigs.* discoveryengine.billingAccountLicenseConfigs.distribute discoveryengine.billingAccountLicenseConfigs.get discoveryengine.billingAccountLicenseConfigs.list discoveryengine.billingAccountLicenseConfigs.retract
Consumer Procurement Order Viewer (roles/consumerprocurement.orderViewer) Allows inspecting purchases.	billing.accounts.get billing.accounts.getIamPolicy billing.accounts.list billing.credits.list commerceoffercatalog.* commerceoffercatalog.agreements.get commerceoffercatalog.agreements.list commerceoffercatalog.documents.get commerceoffercatalog.documents.list commerceoffercatalog.offers.get consumerprocurement.accounts.get consumerprocurement.accounts.list consumerprocurement.consents.check consumerprocurement.consents.list consumerprocurement.licensePools.enumerateLicensedUsers consumerprocurement.licensePools.get consumerprocurement.orderAttributions.get consumerprocurement.orderAttributions.list consumerprocurement.orders.get consumerprocurement.orders.list discoveryengine.billingAccountLicenseConfigs.get discoveryengine.billingAccountLicenseConfigs.list
Consumer Procurement Administrator (roles/consumerprocurement.procurementAdmin) Allows managing purchases, consents at both billing account and project level.	billing.accounts.get billing.accounts.getIamPolicy billing.accounts.list billing.accounts.redeemPromotion billing.credits.list billing.resourceAssociations.create commerceoffercatalog.* commerceoffercatalog.agreements.get commerceoffercatalog.agreements.list commerceoffercatalog.documents.get commerceoffercatalog.documents.list commerceoffercatalog.offers.get consumerprocurement.* consumerprocurement.accounts.create consumerprocurement.accounts.delete consumerprocurement.accounts.get consumerprocurement.accounts.list consumerprocurement.consents.allowProjectGrant consumerprocurement.consents.check consumerprocurement.consents.grant consumerprocurement.consents.list consumerprocurement.consents.revoke consumerprocurement.entitlements.get consumerprocurement.entitlements.list consumerprocurement.events.get consumerprocurement.events.list consumerprocurement.freeTrials.create consumerprocurement.freeTrials.get consumerprocurement.freeTrials.list consumerprocurement.licensePools.assign consumerprocurement.licensePools.enumerateLicensedUsers consumerprocurement.licensePools.get consumerprocurement.licensePools.unassign consumerprocurement.licensePools.update consumerprocurement.orderAttributions.get consumerprocurement.orderAttributions.list consumerprocurement.orderAttributions.update consumerprocurement.orders.cancel consumerprocurement.orders.get consumerprocurement.orders.list consumerprocurement.orders.modify consumerprocurement.orders.place discoveryengine.billingAccountLicenseConfigs.* discoveryengine.billingAccountLicenseConfigs.distribute discoveryengine.billingAccountLicenseConfigs.get discoveryengine.billingAccountLicenseConfigs.list discoveryengine.billingAccountLicenseConfigs.retract orgpolicy.policy.get resourcemanager.projects.get resourcemanager.projects.list serviceusage.consumerpolicy.* serviceusage.consumerpolicy.analyze serviceusage.consumerpolicy.get serviceusage.consumerpolicy.update serviceusage.effectivepolicy.get serviceusage.groups.* serviceusage.groups.list serviceusage.groups.listExpandedMembers serviceusage.groups.listMembers serviceusage.operations.get serviceusage.services.disable serviceusage.services.enable serviceusage.services.get serviceusage.services.list serviceusage.values.test
Consumer Procurement Viewer (roles/consumerprocurement.procurementViewer) Allows inspecting purchases, consents and entitlements and service states for a consumer project.	billing.accounts.get billing.accounts.getIamPolicy billing.accounts.list billing.credits.list commerceoffercatalog.* commerceoffercatalog.agreements.get commerceoffercatalog.agreements.list commerceoffercatalog.documents.get commerceoffercatalog.documents.list commerceoffercatalog.offers.get consumerprocurement.accounts.get consumerprocurement.accounts.list consumerprocurement.consents.check consumerprocurement.consents.list consumerprocurement.entitlements.* consumerprocurement.entitlements.get consumerprocurement.entitlements.list consumerprocurement.freeTrials.get consumerprocurement.freeTrials.list consumerprocurement.licensePools.enumerateLicensedUsers consumerprocurement.licensePools.get consumerprocurement.orderAttributions.get consumerprocurement.orderAttributions.list consumerprocurement.orders.get consumerprocurement.orders.list discoveryengine.billingAccountLicenseConfigs.get discoveryengine.billingAccountLicenseConfigs.list orgpolicy.policy.get resourcemanager.projects.get resourcemanager.projects.list serviceusage.consumerpolicy.analyze serviceusage.consumerpolicy.get serviceusage.effectivepolicy.get serviceusage.groups.* serviceusage.groups.list serviceusage.groups.listExpandedMembers serviceusage.groups.listMembers serviceusage.services.get serviceusage.services.list serviceusage.values.test

將 IAM 角色授予使用者

根據上述表格中的角色，consumerprocurement.orderAdmin 和 consumerprocurement.orderViewer 角色必須在帳單帳戶或機構層級指派，consumerprocurement.entitlementManager 和 consumerprocurement.entitlementViewer 角色則必須在專案或機構層級指派。

如要使用 gcloud 授予使用者角色，請執行下列任一指令：

機構

您必須具備resourcemanager.organizationAdmin角色，才能在機構層級指派角色。

gcloud organizations add-iam-policy-binding organization-id \
--member=member --role=role-id

預留位置值如下：

• organization-id：您要授予角色的機構的數字 ID。
• member：您要授予存取權的使用者。
• role-id：角色 ID (來自上表)。

帳單帳戶

您必須具備billing.admin角色，才能在帳單帳戶層級指派角色。

gcloud beta billing accounts set-iam-policy account-id \
policy-file

預留位置值如下：

• account-id：您的帳單帳戶 ID，可從「管理帳單帳戶」頁面取得。
• policy-file：IAM 政策檔案，格式為 JSON 或 YAML。政策檔案必須包含上表中的角色 ID，以及您要指派角色的使用者。

專案

您必須具備resourcemanager.folderAdmin角色，才能在專案層級指派角色。

gcloud projects add-iam-policy-binding project-id \
--member=member --role=role-id

預留位置值如下：

• project-id：您要授予角色的專案。
• member：您要授予存取權的使用者。
• role-id：角色 ID (來自上表)。

如要使用 Google Cloud 控制台授予使用者角色，請參閱 IAM 說明文件中的「授予、變更及撤銷使用者的存取權」。

搭配 Cloud Marketplace 使用自訂角色

如要精細控管授予使用者的權限，可以建立自訂角色，並授予所需權限。

如要為從 Cloud Marketplace 購買服務的使用者建立自訂角色，該角色必須包含下列權限，才能存取使用者用來購買服務的帳單帳戶：

• billing.accounts.get，通常會透過「roles/consumerprocurement.orderAdmin」角色授予。
• consumerprocurement.orders.get，通常會透過「roles/consumerprocurement.orderAdmin」角色授予。
• consumerprocurement.orders.list，通常會透過「roles/consumerprocurement.orderAdmin」角色授予。
• consumerprocurement.orders.place，通常會透過「roles/consumerprocurement.orderAdmin」角色授予。
• consumerprocurement.accounts.get，通常會透過「roles/consumerprocurement.orderAdmin」角色授予。
• consumerprocurement.accounts.list，通常會透過「roles/consumerprocurement.orderAdmin」角色授予。
• consumerprocurement.accounts.create，通常會透過「roles/consumerprocurement.orderAdmin」角色授予。
• consumerprocurement.consents.grant，通常會透過「roles/consumerprocurement.orderAdmin」角色授予。

透過單一登入 (SSO) 存取合作夥伴網站

部分 Cloud Marketplace API 產品支援單一登入 (SSO) 合作夥伴外部網站。機構組織內的授權使用者可以在產品詳細資料頁面存取「在供應商上管理」按鈕。這個按鈕會將使用者導向合作夥伴的網站。在某些情況下，系統會提示使用者「使用 Google 帳戶登入」。在其他情況下，使用者會登入共用帳戶環境。

如要存取單一登入功能，使用者請前往產品詳細資料頁面，然後選取適當的專案。專案必須連結至已購買方案的帳單帳戶。如要進一步瞭解如何管理 Cloud Marketplace API 方案，請參閱「管理計費方案」。

此外，使用者在所選專案中必須具備足夠的 IAM 權限。大多數產品都需要roles/consumerprocurement.entitlementManager (或roles/editor 基本角色)。

特定產品的最低權限

下列產品可使用不同的權限組合，存取單一登入功能：

• Confluent Cloud 上的 Apache Kafka
• 適用於 Apache Cassandra 的 DataStax Astra
• Elastic Cloud
• Neo4j Aura Professional
• Redis Enterprise Cloud

對於這些產品，您可以使用下列最低權限：

• consumerprocurement.entitlements.get
• consumerprocurement.entitlements.list
• serviceusage.services.get
• serviceusage.services.list
• resourcemanager.projects.get

這些權限通常透過 roles/consumerprocurement.entitlementManager 或 roles/consumerprocurement.entitlementViewer 角色授予。