使用 IAM 控管存取權

本頁面說明 App Lifecycle Manager 的角色和權限。

如要使用 App Lifecycle Manager，請務必擁有必要的服務帳戶。您必須為這些服務帳戶授予必要權限。如要進一步瞭解服務帳戶和 App Lifecycle Manager，請參閱「App Lifecycle Manager 服務帳戶」。如要進一步瞭解服務帳戶，請參閱服務帳戶總覽。

如要部署或查看 Terraform 設定中定義的 Google Cloud 資源，您需要授予服務帳戶這些資源專屬的權限。除了使用 App Lifecycle Manager 必須具備的權限外，如需所有角色及其權限的清單，請參閱身分與存取權管理基本和預先定義角色參考資料。

查看 App Lifecycle Manager 部署作業、修訂版本和 IAM 政策時，不需要服務帳戶。

預先定義的 App Lifecycle Manager 角色

IAM 提供預先定義的角色，可授予特定 Google Cloud 資源的存取權，防止其他資源遭到未經授權的存取。

下表列出 App Lifecycle Manager IAM 角色及這些角色所具備的權限：

角色 說明 權限
App Lifecycle Manager 管理員 (roles/saasservicemgmt.admin) 具備所有 App Lifecycle Manager 資源的完整存取權。 saasservicemgmt.rollouts.create
saasservicemgmt.rollouts.update
saasservicemgmt.rollouts.delete
saasservicemgmt.rolloutKinds.create
saasservicemgmt.rolloutKinds.update
saasservicemgmt.rolloutKinds.delete
saasservicemgmt.releases.create
saasservicemgmt.releases.update
saasservicemgmt.releases.delete
saasservicemgmt.units.create
saasservicemgmt.units.update
saasservicemgmt.units.delete
saasservicemgmt.unitKinds.create
saasservicemgmt.unitKinds.update
saasservicemgmt.unitKinds.delete
saasservicemgmt.unitOperations.create
saasservicemgmt.unitOperations.update
saasservicemgmt.unitOperations.delete
saasservicemgmt.tenants.create
saasservicemgmt.tenants.update
saasservicemgmt.tenants.delete
saasservicemgmt.saas.create
saasservicemgmt.saas.update
saasservicemgmt.saas.delete
resourcemanager.projects.get
resourcemanager.projects.list
saasservicemgmt.locations.list
saasservicemgmt.locations.get
saasservicemgmt.rollouts.list
saasservicemgmt.rollouts.get
saasservicemgmt.rolloutKinds.list
saasservicemgmt.rolloutKinds.get
saasservicemgmt.releases.list
saasservicemgmt.releases.get
saasservicemgmt.units.list
saasservicemgmt.units.get
saasservicemgmt.unitKinds.list
saasservicemgmt.unitKinds.get
saasservicemgmt.unitOperations.list
saasservicemgmt.unitOperations.get
saasservicemgmt.tenants.list
saasservicemgmt.tenants.get
saasservicemgmt.saas.list
saasservicemgmt.saas.get
App Lifecycle Manager 檢視者 (roles/saasservicemgmt.viewer) 讀取 App Lifecycle Manager 資源：版本、推出作業、推出作業類型、單元、單元類型、單元作業、SaaS 和租戶。 resourcemanager.projects.get
resourcemanager.projects.list
saasservicemgmt.locations.list
saasservicemgmt.locations.get
saasservicemgmt.rollouts.list
saasservicemgmt.rollouts.get
saasservicemgmt.rolloutKinds.list
saasservicemgmt.rolloutKinds.get
saasservicemgmt.releases.list
saasservicemgmt.releases.get
saasservicemgmt.units.list
saasservicemgmt.units.get
saasservicemgmt.unitKinds.list
saasservicemgmt.unitKinds.get
saasservicemgmt.unitOperations.list
saasservicemgmt.unitOperations.get
saasservicemgmt.tenants.list
saasservicemgmt.tenants.get
saasservicemgmt.saas.list
saasservicemgmt.saas.get

權限

如要瞭解呼叫者在呼叫每個方法時必須具備的權限，請參閱 REST API 參考資料。

後續步驟