Funções e permissões

Esta página descreve as funções e as autorizações da gestão de identidade e de acesso (IAM) necessárias para usar o Network Connectivity Center.

A um nível elevado, precisa do seguinte:

• Autorizações do Centro de conectividade de rede predefinidas, que são descritas em Funções predefinidas.
• Autorizações adicionais da seguinte forma:
  • Para criar raios, precisa de autorização para ler os tipos de recursos de raios relevantes, conforme descrito em Autorização para criar um raio.
  • Para trabalhar com o Network Connectivity Center na Google Cloud consola, precisa de autorização para ver determinados recursos de rede da nuvem virtual privada (VPC), conforme descrito no artigo Autorização para usar o Network Connectivity Center na Google Cloud consola.

Tenha em atenção que, se precisar de trabalhar com o Centro de conetividade de rede numa rede de VPC partilhada, tem de ter todas as autorizações necessárias no projeto anfitrião. Um hub, os respetivos raios e todos os recursos relacionados têm de estar no projeto anfitrião.

Para ver informações sobre como conceder autorizações, consulte a vista geral do IAM.

Funções predefinidas

A tabela seguinte descreve as funções predefinidas do Network Connectivity Center.

Role	Permissions
Service Automation Consumer Network Admin (roles/networkconnectivity.consumerNetworkAdmin) Service Automation Consumer Network Admin is responsible for setting up ServiceConnectionPolicies.	networkconnectivity.serviceConnectionPolicies.* networkconnectivity.serviceConnectionPolicies.create networkconnectivity.serviceConnectionPolicies.delete networkconnectivity.serviceConnectionPolicies.get networkconnectivity.serviceConnectionPolicies.list networkconnectivity.serviceConnectionPolicies.update resourcemanager.projects.get resourcemanager.projects.list
Group Admin (roles/networkconnectivity.groupAdmin) Enables full access to group resources and read-only access to hub and spoke resources	networkconnectivity.gatewayAdvertisedRoutes.get networkconnectivity.gatewayAdvertisedRoutes.list networkconnectivity.groups.* networkconnectivity.groups.acceptSpoke networkconnectivity.groups.acceptSpokeUpdate networkconnectivity.groups.get networkconnectivity.groups.getIamPolicy networkconnectivity.groups.list networkconnectivity.groups.rejectSpoke networkconnectivity.groups.rejectSpokeUpdate networkconnectivity.groups.setIamPolicy networkconnectivity.groups.use networkconnectivity.hubRouteTables.get networkconnectivity.hubRouteTables.getIamPolicy networkconnectivity.hubRouteTables.list networkconnectivity.hubRoutes.get networkconnectivity.hubRoutes.getIamPolicy networkconnectivity.hubRoutes.list networkconnectivity.hubs.get networkconnectivity.hubs.getIamPolicy networkconnectivity.hubs.list networkconnectivity.locations.* networkconnectivity.locations.get networkconnectivity.locations.list networkconnectivity.operations.get networkconnectivity.operations.list networkconnectivity.spokes.get networkconnectivity.spokes.getIamPolicy networkconnectivity.spokes.list resourcemanager.projects.get resourcemanager.projects.list
Group User (roles/networkconnectivity.groupUser) Enables use access on group resources	networkconnectivity.groups.use
Hub & Spoke Admin (roles/networkconnectivity.hubAdmin) Enables full access to hub and spoke resources. Lowest-level resources where you can grant this role: Project	networkconnectivity.gatewayAdvertisedRoutes.* networkconnectivity.gatewayAdvertisedRoutes.create networkconnectivity.gatewayAdvertisedRoutes.delete networkconnectivity.gatewayAdvertisedRoutes.get networkconnectivity.gatewayAdvertisedRoutes.list networkconnectivity.gatewayAdvertisedRoutes.update networkconnectivity.groups.* networkconnectivity.groups.acceptSpoke networkconnectivity.groups.acceptSpokeUpdate networkconnectivity.groups.get networkconnectivity.groups.getIamPolicy networkconnectivity.groups.list networkconnectivity.groups.rejectSpoke networkconnectivity.groups.rejectSpokeUpdate networkconnectivity.groups.setIamPolicy networkconnectivity.groups.use networkconnectivity.hubRouteTables.* networkconnectivity.hubRouteTables.get networkconnectivity.hubRouteTables.getIamPolicy networkconnectivity.hubRouteTables.list networkconnectivity.hubRouteTables.setIamPolicy networkconnectivity.hubRoutes.* networkconnectivity.hubRoutes.get networkconnectivity.hubRoutes.getIamPolicy networkconnectivity.hubRoutes.list networkconnectivity.hubRoutes.setIamPolicy networkconnectivity.hubs.* networkconnectivity.hubs.create networkconnectivity.hubs.delete networkconnectivity.hubs.get networkconnectivity.hubs.getIamPolicy networkconnectivity.hubs.list networkconnectivity.hubs.listSpokes networkconnectivity.hubs.queryStatus networkconnectivity.hubs.setIamPolicy networkconnectivity.hubs.update networkconnectivity.locations.* networkconnectivity.locations.get networkconnectivity.locations.list networkconnectivity.operations.* networkconnectivity.operations.cancel networkconnectivity.operations.delete networkconnectivity.operations.get networkconnectivity.operations.list networkconnectivity.spokes.* networkconnectivity.spokes.create networkconnectivity.spokes.delete networkconnectivity.spokes.get networkconnectivity.spokes.getIamPolicy networkconnectivity.spokes.list networkconnectivity.spokes.setIamPolicy networkconnectivity.spokes.update resourcemanager.projects.get resourcemanager.projects.list
Hub & Spoke Viewer (roles/networkconnectivity.hubViewer) Enables read-only access to hub and spoke resources. Lowest-level resources where you can grant this role: Project	networkconnectivity.gatewayAdvertisedRoutes.get networkconnectivity.gatewayAdvertisedRoutes.list networkconnectivity.groups.get networkconnectivity.groups.getIamPolicy networkconnectivity.groups.list networkconnectivity.hubRouteTables.get networkconnectivity.hubRouteTables.getIamPolicy networkconnectivity.hubRouteTables.list networkconnectivity.hubRoutes.get networkconnectivity.hubRoutes.getIamPolicy networkconnectivity.hubRoutes.list networkconnectivity.hubs.get networkconnectivity.hubs.getIamPolicy networkconnectivity.hubs.list networkconnectivity.hubs.listSpokes networkconnectivity.hubs.queryStatus networkconnectivity.locations.* networkconnectivity.locations.get networkconnectivity.locations.list networkconnectivity.spokes.get networkconnectivity.spokes.getIamPolicy networkconnectivity.spokes.list resourcemanager.projects.get resourcemanager.projects.list
Multicloud Data Transfer Config Admin (roles/networkconnectivity.multicloudDataTransferConfigAdmin) Full access to all Multicloud Data Transfer Config resources.	networkconnectivity.multicloudDataTransferConfigs.* networkconnectivity.multicloudDataTransferConfigs.create networkconnectivity.multicloudDataTransferConfigs.delete networkconnectivity.multicloudDataTransferConfigs.get networkconnectivity.multicloudDataTransferConfigs.list networkconnectivity.multicloudDataTransferConfigs.update networkconnectivity.multicloudDataTransferDestinations.* networkconnectivity.multicloudDataTransferDestinations.create networkconnectivity.multicloudDataTransferDestinations.delete networkconnectivity.multicloudDataTransferDestinations.get networkconnectivity.multicloudDataTransferDestinations.list networkconnectivity.multicloudDataTransferDestinations.update networkconnectivity.multicloudDataTransferSupportedServices.* networkconnectivity.multicloudDataTransferSupportedServices.get networkconnectivity.multicloudDataTransferSupportedServices.list resourcemanager.projects.get resourcemanager.projects.list
Multicloud Data Transfer Config Viewer (roles/networkconnectivity.multicloudDataTransferConfigViewer) Read-only access to all Multicloud Data Transfer Config resources.	networkconnectivity.multicloudDataTransferConfigs.get networkconnectivity.multicloudDataTransferConfigs.list networkconnectivity.multicloudDataTransferDestinations.get networkconnectivity.multicloudDataTransferDestinations.list networkconnectivity.multicloudDataTransferSupportedServices.* networkconnectivity.multicloudDataTransferSupportedServices.get networkconnectivity.multicloudDataTransferSupportedServices.list resourcemanager.projects.get resourcemanager.projects.list
Destination Admin (roles/networkconnectivity.multicloudDataTransferDestinationAdmin) Access to all Destination resources.	networkconnectivity.multicloudDataTransferDestinations.* networkconnectivity.multicloudDataTransferDestinations.create networkconnectivity.multicloudDataTransferDestinations.delete networkconnectivity.multicloudDataTransferDestinations.get networkconnectivity.multicloudDataTransferDestinations.list networkconnectivity.multicloudDataTransferDestinations.update networkconnectivity.multicloudDataTransferSupportedServices.* networkconnectivity.multicloudDataTransferSupportedServices.get networkconnectivity.multicloudDataTransferSupportedServices.list resourcemanager.projects.get resourcemanager.projects.list
Destination Viewer (roles/networkconnectivity.multicloudDataTransferDestinationViewer) Read-only access to all Destination resources.	networkconnectivity.multicloudDataTransferDestinations.get networkconnectivity.multicloudDataTransferDestinations.list networkconnectivity.multicloudDataTransferSupportedServices.* networkconnectivity.multicloudDataTransferSupportedServices.get networkconnectivity.multicloudDataTransferSupportedServices.list resourcemanager.projects.get resourcemanager.projects.list
Regional Endpoint Admin (roles/networkconnectivity.regionalEndpointAdmin) Full access to all Regional Endpoint resources.	networkconnectivity.regionalEndpoints.* networkconnectivity.regionalEndpoints.create networkconnectivity.regionalEndpoints.delete networkconnectivity.regionalEndpoints.get networkconnectivity.regionalEndpoints.list resourcemanager.projects.get resourcemanager.projects.list
Regional Endpoint Viewer (roles/networkconnectivity.regionalEndpointViewer) Read-only access to all Regional Endpoint resources.	networkconnectivity.regionalEndpoints.get networkconnectivity.regionalEndpoints.list resourcemanager.projects.get resourcemanager.projects.list
Network Connectivity Service Agent (roles/networkconnectivity.serviceAgent) Grants the Network Connectivity API authority to read some networking resources. It does not mutate these resources. Warning: Do not grant service agent roles to any principals except service agents.	compute.addresses.create compute.addresses.createInternal compute.addresses.delete compute.addresses.deleteInternal compute.addresses.get compute.addresses.setLabels compute.addresses.use compute.forwardingRules.create compute.forwardingRules.delete compute.forwardingRules.get compute.forwardingRules.pscCreate compute.forwardingRules.pscDelete compute.forwardingRules.pscSetLabels compute.forwardingRules.pscUpdate compute.forwardingRules.setLabels compute.instances.get compute.interconnectAttachments.get compute.networks.get compute.networks.use compute.projects.get compute.regionOperations.get compute.routers.get compute.subnetworks.create compute.subnetworks.delete compute.subnetworks.get compute.subnetworks.getIamPolicy compute.subnetworks.list compute.subnetworks.setIamPolicy compute.subnetworks.use compute.vpnTunnels.get dns.managedZones.create dns.networks.bindPrivateDNSZone networkconnectivity.hubRouteTables.get networkconnectivity.hubRouteTables.list networkconnectivity.hubRoutes.get networkconnectivity.hubRoutes.list networkconnectivity.internalRanges.create networkconnectivity.internalRanges.delete networkconnectivity.internalRanges.get networkconnectivity.internalRanges.list networkconnectivity.operations.get servicedirectory.namespaces.associatePrivateZone servicedirectory.namespaces.create servicedirectory.namespaces.delete servicedirectory.services.create servicedirectory.services.delete
Service Class User (roles/networkconnectivity.serviceClassUser) Service Class User uses a ServiceClass	networkconnectivity.serviceClasses.get networkconnectivity.serviceClasses.list networkconnectivity.serviceClasses.use resourcemanager.projects.get resourcemanager.projects.list
Service Automation Service Producer Admin (roles/networkconnectivity.serviceProducerAdmin) Service Automation Producer Admin uses information from a consumer request to manage ServiceClasses and ServiceConnectionMaps	networkconnectivity.operations.get networkconnectivity.operations.list networkconnectivity.serviceClasses.* networkconnectivity.serviceClasses.create networkconnectivity.serviceClasses.delete networkconnectivity.serviceClasses.get networkconnectivity.serviceClasses.list networkconnectivity.serviceClasses.update networkconnectivity.serviceClasses.use networkconnectivity.serviceConnectionMaps.* networkconnectivity.serviceConnectionMaps.create networkconnectivity.serviceConnectionMaps.delete networkconnectivity.serviceConnectionMaps.get networkconnectivity.serviceConnectionMaps.list networkconnectivity.serviceConnectionMaps.update resourcemanager.projects.get resourcemanager.projects.list
Spoke Admin (roles/networkconnectivity.spokeAdmin) Enables full access to spoke resources and read-only access to hub resources. Lowest-level resources where you can grant this role: Project	networkconnectivity.gatewayAdvertisedRoutes.* networkconnectivity.gatewayAdvertisedRoutes.create networkconnectivity.gatewayAdvertisedRoutes.delete networkconnectivity.gatewayAdvertisedRoutes.get networkconnectivity.gatewayAdvertisedRoutes.list networkconnectivity.gatewayAdvertisedRoutes.update networkconnectivity.hubRouteTables.get networkconnectivity.hubRouteTables.getIamPolicy networkconnectivity.hubRouteTables.list networkconnectivity.hubRoutes.get networkconnectivity.hubRoutes.getIamPolicy networkconnectivity.hubRoutes.list networkconnectivity.hubs.get networkconnectivity.hubs.getIamPolicy networkconnectivity.hubs.list networkconnectivity.locations.* networkconnectivity.locations.get networkconnectivity.locations.list networkconnectivity.operations.get networkconnectivity.operations.list networkconnectivity.spokes.* networkconnectivity.spokes.create networkconnectivity.spokes.delete networkconnectivity.spokes.get networkconnectivity.spokes.getIamPolicy networkconnectivity.spokes.list networkconnectivity.spokes.setIamPolicy networkconnectivity.spokes.update resourcemanager.projects.get resourcemanager.projects.list

Nota: para criar hubs, também precisa de autorização para ler o tipo de recurso do hub, conforme descrito em Autorização para criar um hub. Se planeia trabalhar na Google Cloud consola, também precisa das autorizações descritas em Autorização para usar o Centro de conectividade de rede na Google Cloud consola.

Autorizações adicionais necessárias

Consoante as ações que tem de realizar no Network Connectivity Center, pode precisar das autorizações descritas nas secções seguintes.

Autorização para criar um spoke

Para criar um spoke, tem de ter autorização para ler o tipo de recurso do spoke. Por exemplo:

• Para raios de túnel VPN, raios de associação VLAN e raios de dispositivo de router, precisa de compute.routers.get.
• Para criar raios de dispositivos de encaminhamento, precisa de compute.instances.get. Além disso, antes de poder usar um spoke de dispositivo de router, tem de configurar a interligação entre o Cloud Router e a instância do dispositivo de router. Para estabelecer uma relação de peering, precisa das seguintes autorizações:
  • compute.instances.use
  • compute.routers.update
• Para criar raios de associação VLAN, precisa de compute.interconnectAttachments.get.
• Para criar raios de túnel de VPN, precisa de compute.vpnTunnels.get.

• Para criar raios de VPC, precisa das seguintes autorizações:

  • compute.networks.use
  • compute.networks.get

• Para criar nós de VPC num projeto diferente do centro ao qual está associado, precisa de networkconnectivity.groups.use.

Autorização para usar o Network Connectivity Center na consola Google Cloud

Para usar o Network Connectivity Center na Google Cloud consola, precisa de uma função, como Visualizador de rede de computação (roles/compute.networkViewer), que inclua as autorizações descritas na tabela seguinte. Para usar estas autorizações, primeiro tem de criar uma função personalizada.

Tarefa	Autorizações necessárias
Aceda à página Network Connectivity Center	compute.projects.get compute.networks.get
Aceda e use a página Adicionar raios	compute.networks.list compute.regions.list compute.routers.list compute.zones.list compute.networks.get
Adicione um spoke de associação VLAN	compute.interconnectAttachments.list compute.interconnectAttachments.get compute.networks.get compute.routers.list compute.routers.get
Adicione um spoke de túnel de VPN	compute.forwardingRules.list compute.networks.get compute.routers.get compute.routers.list compute.targetVpnGateways.list compute.vpnGateways.list compute.vpnTunnels.get compute.vpnTunnels.list
Adicione um spoke de dispositivo de router	compute.instances.list compute.instances.get compute.networks.get
Adicione um spoke de VPC	compute.networks.use compute.networks.get compute.subnetworks.list

Nota: para criar hubs, também precisa de autorização para ler os tipos de recursos usados pelos seus hubs, conforme descrito em Autorização para criar um hub.

Proteger recursos com os VPC Service Controls

Para proteger ainda mais os recursos do Network Connectivity Center, use os VPC Service Controls.

O VPC Service Controls oferece aos seus recursos segurança adicional para ajudar a mitigar o risco de exfiltração de dados. Ao usar os VPC Service Controls, pode colocar recursos do Network Connectivity Center dentro de perímetros de serviço. Em seguida, o VPC Service Controls protege estes recursos contra pedidos originados fora do perímetro.

Para saber mais acerca dos perímetros de serviço, consulte a página Configuração do perímetro de serviço da documentação do VPC Service Controls.

O que se segue?

Para mais informações sobre as funções e os Google Cloud recursos do projeto, consulte a seguinte documentação:

• Para compreender as funções e as autorizações de IAM, consulte o artigo Controlo de acesso para projetos através da IAM.
• Para compreender os tipos de funções, consulte a referência de funções básicas e predefinidas do Identity and Access Management.
• Para saber mais sobre as funções predefinidas, consulte o artigo Funções e autorizações de IAM do Compute Engine.
• Para saber mais sobre o Network Connectivity Center, consulte o artigo Vista geral do Network Connectivity Center.
• Para saber como gerir hubs e raios, consulte o artigo Trabalhe com hubs e raios.