使用 IAM 控管存取權

Google Cloud Fraud Defense 提供角色式存取控管 (RBAC)，並搭配 Identity and Access Management (IAM)，以及使用 VPC Service Controls 控管 reCAPTCHA Enterprise API 的存取權。

使用 IAM 進行角色型存取權控管

IAM 可讓您詳細劃分特定Google Cloud 資源的存取權限，同時避免其他資源 (例如記錄檔和資料分析) 遭到未經授權者擅自存取。

本節說明 Fraud Defense 的 IAM 角色。

如要瞭解如何將 IAM 角色指派給使用者或服務帳戶，請參閱 IAM 說明文件中的「授予、變更及撤銷資源的存取權」一文。

角色和權限

下表列出 Fraud Defense 的必要 IAM 角色和權限：

Role	Permissions
reCAPTCHA Enterprise Admin (roles/recaptchaenterprise.admin) Access to view and modify reCAPTCHA Enterprise keys	monitoring.timeSeries.list recaptchaenterprise.firewallpolicies.* recaptchaenterprise.firewallpolicies.create recaptchaenterprise.firewallpolicies.delete recaptchaenterprise.firewallpolicies.get recaptchaenterprise.firewallpolicies.list recaptchaenterprise.firewallpolicies.update recaptchaenterprise.keys.* recaptchaenterprise.keys.create recaptchaenterprise.keys.createTagBinding recaptchaenterprise.keys.delete recaptchaenterprise.keys.deleteTagBinding recaptchaenterprise.keys.get recaptchaenterprise.keys.list recaptchaenterprise.keys.listEffectiveTags recaptchaenterprise.keys.listTagBindings recaptchaenterprise.keys.retrievelegacysecretkey recaptchaenterprise.keys.update recaptchaenterprise.metrics.get recaptchaenterprise.projectmetadata.* recaptchaenterprise.projectmetadata.get recaptchaenterprise.projectmetadata.update resourcemanager.projects.get resourcemanager.projects.list
Recaptchaenterprise Editor (roles/recaptchaenterprise.editor) Editor role for recaptchaenterprise	monitoring.timeSeries.list recaptchaenterprise.assessments.* recaptchaenterprise.assessments.annotate recaptchaenterprise.assessments.create recaptchaenterprise.firewallpolicies.* recaptchaenterprise.firewallpolicies.create recaptchaenterprise.firewallpolicies.delete recaptchaenterprise.firewallpolicies.get recaptchaenterprise.firewallpolicies.list recaptchaenterprise.firewallpolicies.update recaptchaenterprise.keys.create recaptchaenterprise.keys.delete recaptchaenterprise.keys.get recaptchaenterprise.keys.list recaptchaenterprise.keys.listEffectiveTags recaptchaenterprise.keys.listTagBindings recaptchaenterprise.keys.retrievelegacysecretkey recaptchaenterprise.keys.update recaptchaenterprise.metrics.get recaptchaenterprise.projectmetadata.* recaptchaenterprise.projectmetadata.get recaptchaenterprise.projectmetadata.update recaptchaenterprise.relatedaccountgroupmemberships.list recaptchaenterprise.relatedaccountgroups.list resourcemanager.projects.get resourcemanager.projects.list
reCAPTCHA Enterprise Viewer (roles/recaptchaenterprise.viewer) Access to view reCAPTCHA Enterprise keys and metrics	monitoring.timeSeries.list recaptchaenterprise.firewallpolicies.get recaptchaenterprise.firewallpolicies.list recaptchaenterprise.keys.get recaptchaenterprise.keys.list recaptchaenterprise.keys.listEffectiveTags recaptchaenterprise.keys.listTagBindings recaptchaenterprise.metrics.get recaptchaenterprise.projectmetadata.get resourcemanager.projects.get resourcemanager.projects.list
reCAPTCHA Enterprise Agent (roles/recaptchaenterprise.agent) Access to create and annotate reCAPTCHA Enterprise assessments	recaptchaenterprise.assessments.* recaptchaenterprise.assessments.annotate recaptchaenterprise.assessments.create recaptchaenterprise.firewallpolicies.list recaptchaenterprise.relatedaccountgroupmemberships.list recaptchaenterprise.relatedaccountgroups.list resourcemanager.projects.get resourcemanager.projects.list

自訂角色

您可能需要自訂角色，以因應法規要求等用途。如要建立包含 Fraud Defense 權限的自訂角色，請按照下表所示執行適當動作：

角色說明	動作
僅授予 reCAPTCHA Enterprise API 權限的角色	在「API 權限」部分選擇權限。
授予 reCAPTCHA Enterprise API 和主控台權限的角色	在「角色和權限」部分選擇權限群組。
可建立及註解評量的角色	在「角色和權限」部分中，將權限加入角色 roles/recaptchaenterprise.agent。

如要進一步瞭解自訂角色，請前往建立及管理自訂角色頁面。

API 權限

下表列出了呼叫 reCAPTCHA Enterprise API (recaptchaenterprise.googleapis.com/v1) 中各方法時必須具備的權限：

方法 (REST/RPC)	所需權限	適用的資源類型
recaptchaenterprise.assessments.annotate/AnnotateAssessmentRequest	recaptchaenterprise.assessments.annotate	專案
recaptchaenterprise.assessments.create/CreateAssessmentRequest	recaptchaenterprise.assessments.create	專案
recaptchaenterprise.keys.create/CreateKeyRequest	recaptchaenterprise.keys.create	專案
recaptchaenterprise.keys.delete/DeleteKeyRequest	recaptchaenterprise.keys.delete	專案
recaptchaenterprise.keys.get/GetKeyRequest	recaptchaenterprise.keys.get	專案
recaptchaenterprise.keys.list/ListKeysRequest	recaptchaenterprise.keys.list	專案
recaptchaenterprise.keys.update/UpdateKeyRequest	recaptchaenterprise.keys.update	專案

VPC Service Controls

VPC Service Controls 支援 Fraud Defense，可為 reCAPTCHA API 提供額外的存取權控管。詳情請參閱「支援的產品和限制  > Fraud Defense」。