角色与权限

本页面介绍了访问 Cloud Network Insights 所需的 Identity and Access Management (IAM) 角色和权限。如需了解有关 IAM 的详细说明，请参阅 Identity and Access Management 文档。

您可以授予用户或服务账号权限或预定义角色，也可以创建使用所指定权限的自定义角色。

您可能需要在 Google Cloud CLI 中运行 add-iam-policy 命令，以向用户授予 Cloud Network Insights 角色。

在 Google Cloud 中授予用户的角色会在 AppNeta 中复制。如果您可以在 Google Cloud 控制台中修改 Cloud Network Insights 资源，则可以在 AppNeta 中修改这些资源。

角色

本部分介绍了在授予 Cloud Network Insights 权限时如何使用预定义角色和自定义角色。

Cloud Network Insights 的预定义角色

Cloud Network Insights 具有以下预定义角色，可让您启用 Cloud Network Insights 并修改所有 Cloud Network Insights 资源（管理员）、修改所有 Cloud Network Insights 资源（编辑者）或查看资源（Viewer）：

  • Cloud Network Insights 管理员 (roles/networkmanagement.CloudNetworkInsightsAdmin)
  • Cloud Network Insights 编辑者 (roles/networkmanagement.CloudNetworkInsightsEditor)
  • Cloud Network Insights 查看者 (roles/networkmanagement.CloudNetworkInsightsViewer)

Cloud Network Insights 管理员 (roles/networkmanagement.CloudNetworkInsightsAdmin) 和 Cloud Network Insights 编辑者 (roles/networkmanagement.CloudNetworkInsightsEditor) 角色都可以修改所有 Cloud Network Insights 资源。但是，只有 Cloud Network Insights 管理员角色才能在首次在项目中启用 Cloud Network Insights 时接受 Broadcom 最终用户协议。启用 Cloud Network Insights 后，具有任一角色的用户都可以启用或停用 Cloud Network Insights。

如果您想授予用户在已启用 Cloud Network Insights 的项目中查看 Cloud Network Insights 的权限，可以向用户授予以下预定义角色之一：

  • Cloud Network Management 查看者 (roles/networkmanagement.viewer)
  • Cloud Network Insights 查看者 (roles/networkmanagement.CloudNetworkInsightsViewer)

如需详细了解如何授予角色，请参阅管理对项目、 文件夹和组织的访问权限。

Cloud Network Insights 角色

下表介绍了 IAM 预定义角色及其与 Cloud Network Insights 关联的权限。

如需了解详情，请参阅 IAM 权限参考。

角色 权限

Cloud Network Insights 管理员

(roles/networkmanagement.CloudNetworkInsightsAdmin)
拥有对 Cloud Network Insights 资源的完整访问权限。
在首次在项目中启用 Cloud Network Insights 时接受 Broadcom 最终用户协议。
您可以授予此角色的最低级层资源：
  • 项目
  • networkmanagement.locations.get
  • networkmanagement.locations.list
  • networkmanagement.monitoringpoints.downloadConfig
  • networkmanagement.monitoringpoints.get
  • networkmanagement.monitoringpoints.list
  • networkmanagement.networkpaths.get
  • networkmanagement.networkpaths.list
  • networkmanagement.operations.get
  • networkmanagement.operations.list
  • networkmanagement.providers.create
  • networkmanagement.providers.delete
  • networkmanagement.providers.generateProviderAccessToken
  • networkmanagement.providers.get
  • networkmanagement.providers.list
  • networkmanagement.webpaths.get
  • networkmanagement.webpaths.list
  • productrequirementsservice.requirements.check
  • productrequirementsservice.requirements.record
  • resourcemanager.organizations.get
  • resourcemanager.organizations.list
  • resourcemanager.projects.get
  • resourcemanager.projects.list

Cloud Network Insights 编辑者

(roles/networkmanagement.CloudNetworkInsightsEditor)
拥有对 Cloud Network Insights 资源的编辑权限。
您可以授予此角色的最低级层资源：
  • 项目
  • networkmanagement.locations.get
  • networkmanagement.locations.list
  • networkmanagement.monitoringpoints.downloadConfig
  • networkmanagement.monitoringpoints.get
  • networkmanagement.monitoringpoints.list
  • networkmanagement.networkpaths.get
  • networkmanagement.networkpaths.list
  • networkmanagement.operations.get
  • networkmanagement.operations.list
  • networkmanagement.providers.create
  • networkmanagement.providers.delete
  • networkmanagement.providers.generateProviderAccessToken
  • networkmanagement.providers.get
  • networkmanagement.providers.list
  • networkmanagement.webpaths.get
  • networkmanagement.webpaths.list
  • productrequirementsservice.requirements.check
  • resourcemanager.organizations.get
  • resourcemanager.organizations.list
  • resourcemanager.projects.get
  • resourcemanager.projects.list

Cloud Network Insights 查看者

(roles/networkmanagement.CloudNetworkInsightsViewer)
拥有对 Cloud Network Insights 资源的只读权限。
您可以授予此角色的最低级层资源：
  • 项目
  • networkmanagement.monitoringpoints.get
  • networkmanagement.monitoringpoints.list
  • networkmanagement.networkpaths.get
  • networkmanagement.networkpaths.list
  • networkmanagement.providers.generateProviderAccessToken
  • networkmanagement.providers.get
  • networkmanagement.providers.list
  • networkmanagement.webpaths.get
  • networkmanagement.webpaths.list
  • productrequirementsservice.requirements.check
  • resourcemanager.organizations.get
  • resourcemanager.organizations.list
  • resourcemanager.projects.get
  • resourcemanager.projects.list

提醒和日志角色

下表介绍了 IAM 预定义角色及其关联的权限，用于根据 Cloud Network Insights 数据查看或管理提醒和日志。用户还需要 Cloud Network Insights 角色。

角色 权限

日志查看器

(roles/logging.viewer)
提供查看日志的权限。
您可以授予此角色的最低级层资源：
  • 查看
  • logging.buckets.get
  • logging.buckets.list
  • logging.exclusions.get
  • logging.exclusions.list
  • logging.links.get
  • logging.links.list
  • logging.locations.*
  • logging.logEntries.list
  • logging.logMetrics.get
  • logging.logMetrics.list
  • logging.logScopes.get
  • logging.logScopes.list
  • logging.logServiceIndexes.list
  • logging.logServices.list
  • logging.logs.list
  • logging.operations.get
  • logging.operations.list
  • logging.queries.getShared
  • logging.queries.listShared
  • logging.queries.usePrivate
  • logging.sinks.get
  • logging.sinks.list
  • logging.usage.get
  • logging.views.get
  • logging.views.list
  • observability.scopes.get
  • resourcemanager.projects.get

Logs Configuration Writer

(roles/logging.configWriter)
创建提醒政策。
您可以授予此角色的最低级层资源：
  • 查看
  • logging.buckets.create
  • logging.buckets.createTagBinding
  • logging.buckets.delete
  • logging.buckets.deleteTagBinding
  • logging.buckets.get
  • logging.buckets.list
  • logging.buckets.listEffectiveTags
  • logging.buckets.listTagBindings
  • logging.buckets.undelete
  • logging.buckets.update
  • logging.exclusions.*
  • logging.links.*
  • logging.locations.*
  • logging.logMetrics.*
  • logging.logScopes.*
  • logging.logServiceIndexes.list
  • logging.logServices.list
  • logging.logs.list
  • logging.notificationRules.*
  • logging.operations.*
  • logging.settings.*
  • logging.sinks.*
  • logging.sqlAlerts.*
  • logging.views.create
  • logging.views.delete
  • logging.views.get
  • logging.views.getIamPolicy
  • logging.views.list
  • logging.views.update
  • observability.scopes.get
  • resourcemanager.projects.get
  • resourcemanager.projects.list

Monitoring NotificationChannel Editor Beta 版

(roles/monitoring.notificationChannelEditor)
创建与通知关联的提醒政策。
  • monitoring.notificationChannelDescriptors.*
  • monitoring.notificationChannels.create
  • monitoring.notificationChannels.delete
  • monitoring.notificationChannels.get
  • monitoring.notificationChannels.list
  • monitoring.notificationChannels.sendVerificationCode
  • monitoring.notificationChannels.update
  • monitoring.notificationChannels.verify

Monitoring AlertPolicy Viewer

(roles/monitoring.alertPolicyViewer)
查看提醒政策。
  • monitoring.alertPolicies.get
  • monitoring.alertPolicies.list
  • monitoring.alertPolicies.listEffectiveTags
  • monitoring.alertPolicies.listTagBindings

Monitoring AlertPolicy Editor

(roles/monitoring.alertPolicyEditor)
修改提醒政策。
  • monitoring.alertPolicies.*