使用 IAM 进行访问权限控制

本页面介绍了 App Lifecycle Manager 角色和权限。

如需使用 App Lifecycle Manager，您需要确保拥有所需的服务账号。对于这些服务账号，您需要授予所需的权限。如需详细了解服务账号和 App Lifecycle Manager，请参阅 App Lifecycle Manager 服务账号。 如需详细了解服务账号，请参阅服务账号概览。

如需部署或查看 Terraform 配置中定义的 Google Cloud 资源，您需要向服务账号授予特定于这些资源的权限。除了使用 App Lifecycle Manager 所需的权限之外，您还需要拥有这些权限。如需查看所有角色及其所含权限的列表，请参阅 Identity and Access Management 基本角色和预定义角色参考文档。

无需服务账号即可查看 App Lifecycle Manager 部署、修订版本和 IAM 政策。

预定义的 App Lifecycle Manager 角色

IAM 提供预定义角色，可授予对特定 Google Cloud 资源的访问权限，并防止对其他资源进行未经授权的访问。

下表列出了 App Lifecycle Manager IAM 角色及其具备的权限：

角色 说明 权限
App Lifecycle Manager Admin (roles/saasservicemgmt.admin) 拥有对所有应用生命周期管理器的完整访问权限。 saasservicemgmt.rollouts.create
saasservicemgmt.rollouts.update
saasservicemgmt.rollouts.delete
saasservicemgmt.rolloutKinds.create
saasservicemgmt.rolloutKinds.update
saasservicemgmt.rolloutKinds.delete
saasservicemgmt.releases.create
saasservicemgmt.releases.update
saasservicemgmt.releases.delete
saasservicemgmt.units.create
saasservicemgmt.units.update
saasservicemgmt.units.delete
saasservicemgmt.unitKinds.create
saasservicemgmt.unitKinds.update
saasservicemgmt.unitKinds.delete
saasservicemgmt.unitOperations.create
saasservicemgmt.unitOperations.update
saasservicemgmt.unitOperations.delete
saasservicemgmt.tenants.create
saasservicemgmt.tenants.update
saasservicemgmt.tenants.delete
saasservicemgmt.saas.create
saasservicemgmt.saas.update
saasservicemgmt.saas.delete
resourcemanager.projects.get
resourcemanager.projects.list
saasservicemgmt.locations.list
saasservicemgmt.locations.get
saasservicemgmt.rollouts.list
saasservicemgmt.rollouts.get
saasservicemgmt.rolloutKinds.list
saasservicemgmt.rolloutKinds.get
saasservicemgmt.releases.list
saasservicemgmt.releases.get
saasservicemgmt.units.list
saasservicemgmt.units.get
saasservicemgmt.unitKinds.list
saasservicemgmt.unitKinds.get
saasservicemgmt.unitOperations.list
saasservicemgmt.unitOperations.get
saasservicemgmt.tenants.list
saasservicemgmt.tenants.get
saasservicemgmt.saas.list
saasservicemgmt.saas.get
App Lifecycle Manager Viewer (roles/saasservicemgmt.viewer) 读取 App Lifecycle Manager 资源：版本、发布、发布类型、单元、单元类型、单元操作、SaaS 和租户。 resourcemanager.projects.get
resourcemanager.projects.list
saasservicemgmt.locations.list
saasservicemgmt.locations.get
saasservicemgmt.rollouts.list
saasservicemgmt.rollouts.get
saasservicemgmt.rolloutKinds.list
saasservicemgmt.rolloutKinds.get
saasservicemgmt.releases.list
saasservicemgmt.releases.get
saasservicemgmt.units.list
saasservicemgmt.units.get
saasservicemgmt.unitKinds.list
saasservicemgmt.unitKinds.get
saasservicemgmt.unitOperations.list
saasservicemgmt.unitOperations.get
saasservicemgmt.tenants.list
saasservicemgmt.tenants.get
saasservicemgmt.saas.list
saasservicemgmt.saas.get

权限

调用方调用每种方法必须具备的权限列在 REST API 参考文档中。

后续步骤