角色与权限

本页面介绍了访问 Cloud Network Insights 所需的 Identity and Access Management (IAM) 角色和权限。如需了解有关 IAM 的详细说明，请参阅 Identity and Access Management 文档。

您可以授予用户或服务账号权限或预定义角色，也可以创建使用所指定权限的自定义角色。

您可能需要在 Google Cloud CLI 中运行 add-iam-policy 命令，以向用户授予 Cloud Network Insights 角色。

在 Google Cloud 中授予用户的角色会在 AppNeta 中复制。如果您 可以在控制台中修改 Cloud Network Insights 资源，则可以在 Google Cloud AppNeta 中 修改这些资源。

角色

本部分介绍了在授予 Cloud Network Insights 权限时如何使用预定义角色和自定义角色。

Cloud Network Insights 的预定义角色

Cloud Network Insights 具有以下预定义角色，可让您修改所有 Cloud Network Insights 资源或查看这些资源：

  • Cloud Network Insights Editor (roles/networkmanagement.CloudNetworkInsightsEditor)
  • Cloud Network Insights Viewer (roles/networkmanagement.CloudNetworkInsightsViewer)

如果您想授予用户在已启用 Cloud Network Insights 的项目中查看该服务的权限，可以向用户授予以下预定义角色之一：

  • Cloud Network Management Viewer (roles/networkmanagement.viewer)
  • Cloud Network Insights Viewer (roles/networkmanagement.CloudNetworkInsightsViewer)

如需详细了解如何授予角色，请参阅管理对项目、 文件夹和 组织的访问权限。

Cloud Network Insights 角色

下表介绍了 IAM 预定义角色及其与 Cloud Network Insights 关联的权限。

如需了解详情，请参阅 IAM 权限参考。

角色 权限

Cloud Network Insights Editor

( roles/networkmanagement.CloudNetworkInsightsEditor )

拥有对 Cloud Network Insights 资源的完整访问权限。
您可以授予此角色的最低级层资源：

  • 项目
  • networkmanagement.providers.get
  • networkmanagement.providers.list
  • networkmanagement.providers.generateProviderAccessToken
  • networkmanagement.providers.create
  • networkmanagement.providers.delete
  • networkmanagement.providers.downloadConfig
  • networkmanagement.monitoringPoints.get
  • networkmanagement.monitoringPoints.list
  • networkmanagement.networkPaths.get
  • networkmanagement.networkPaths.list
  • networkmanagement.webPaths.get
  • networkmanagement.webPaths.list
  • productrequirementsservice.requirements.record
  • productrequirementsservice.requirements.check

Cloud Network Insights Viewer

(roles/networkmanagement.CloudNetworkInsightsViewer)

拥有对 Cloud Network Insights 资源的只读权限。
您可以授予此角色的最低级层资源：
  • 项目
  • networkmanagement.providers.get
  • networkmanagement.providers.list
  • networkmanagement.providers.generateProviderAccessToken
  • networkmanagement.monitoringPoints.get
  • networkmanagement.monitoringPoints.list
  • networkmanagement.networkPaths.get
  • networkmanagement.networkPaths.list
  • networkmanagement.webPaths.get
  • networkmanagement.webPaths.list
  • productrequirementsservice.requirements.check

提醒和日志角色

下表介绍了 IAM 预定义角色及其关联的权限，用于查看或管理基于 Cloud Network Insights 数据的提醒和日志。用户还需要拥有 Cloud Network Insights Viewer 或 Editor 角色。

角色 权限

日志查看器

(roles/logging.viewer)
提供查看日志的权限。
您可以授予此角色的最低级层资源：
  • 查看
  • logging.buckets.get
  • logging.buckets.list
  • logging.exclusions.get
  • logging.exclusions.list
  • logging.links.get
  • logging.links.list
  • logging.locations.*
  • logging.logEntries.list
  • logging.logMetrics.get
  • logging.logMetrics.list
  • logging.logScopes.get
  • logging.logScopes.list
  • logging.logServiceIndexes.list
  • logging.logServices.list
  • logging.logs.list
  • logging.operations.get
  • logging.operations.list
  • logging.queries.getShared
  • logging.queries.listShared
  • logging.queries.usePrivate
  • logging.sinks.get
  • logging.sinks.list
  • logging.usage.get
  • logging.views.get
  • logging.views.list
  • observability.scopes.get
  • resourcemanager.projects.get

Logs Configuration Writer

(roles/logging.configWriter)
创建提醒政策。
您可以授予此角色的最低级层资源：
  • 查看
  • logging.buckets.create
  • logging.buckets.createTagBinding
  • logging.buckets.delete
  • logging.buckets.deleteTagBinding
  • logging.buckets.get
  • logging.buckets.list
  • logging.buckets.listEffectiveTags
  • logging.buckets.listTagBindings
  • logging.buckets.undelete
  • logging.buckets.update
  • logging.exclusions.*
  • logging.links.*
  • logging.locations.*
  • logging.logMetrics.*
  • logging.logScopes.*
  • logging.logServiceIndexes.list
  • logging.logServices.list
  • logging.logs.list
  • logging.notificationRules.*
  • logging.operations.*
  • logging.settings.*
  • logging.sinks.*
  • logging.sqlAlerts.*
  • logging.views.create
  • logging.views.delete
  • logging.views.get
  • logging.views.getIamPolicy
  • logging.views.list
  • logging.views.update
  • observability.scopes.get
  • resourcemanager.projects.get
  • resourcemanager.projects.list

Monitoring NotificationChannel Editor Beta 版

(roles/monitoring.notificationChannelEditor)
创建与通知关联的提醒政策。
  • monitoring.notificationChannelDescriptors.*
  • monitoring.notificationChannels.create
  • monitoring.notificationChannels.delete
  • monitoring.notificationChannels.get
  • monitoring.notificationChannels.list
  • monitoring.notificationChannels.sendVerificationCode
  • monitoring.notificationChannels.update
  • monitoring.notificationChannels.verify

Monitoring AlertPolicy Viewer

(roles/monitoring.alertPolicyViewer)

查看提醒政策。
  • monitoring.alertPolicies.get
  • monitoring.alertPolicies.list
  • monitoring.alertPolicies.listEffectiveTags
  • monitoring.alertPolicies.listTagBindings

Monitoring AlertPolicy Editor

(roles/monitoring.alertPolicyEditor)
修改提醒政策。
  • monitoring.alertPolicies.*