Cloud Storage 的 IAM 角色

本文提供 Cloud Storage 的 Identity and Access Management (IAM) 角色和權限相關資訊。

預先定義的角色

下表說明與 Cloud Storage 相關聯的 Identity and Access Management (IAM) 角色，並列出各角色包含的權限。除非另有說明，否則這些角色可套用至專案、bucket 或代管資料夾。不過，您只能將舊版角色授予個別 bucket。

如要瞭解如何控管 bucket 存取權限，請參閱「使用 IAM 權限」。如要瞭解如何控管代管資料夾的存取權，請參閱「使用 IAM 控管代管資料夾」。

Role	Permissions
Storage Admin (roles/storage.admin) Grants full control of objects and buckets. When applied to an individual bucket, control applies only to the specified bucket and objects within the bucket. Lowest-level resources where you can grant this role: Bucket	cloudaicompanion.instances.completeTask cloudkms.keyHandles.* cloudkms.keyHandles.create cloudkms.keyHandles.get cloudkms.keyHandles.list cloudkms.operations.get cloudkms.projects.showEffectiveAutokeyConfig firebase.projects.get monitoring.dashboards.get monitoring.dashboards.list monitoring.groups.get monitoring.groups.list monitoring.metricDescriptors.list monitoring.monitoredResourceDescriptors.* monitoring.monitoredResourceDescriptors.get monitoring.monitoredResourceDescriptors.list monitoring.timeSeries.* monitoring.timeSeries.create monitoring.timeSeries.list orgpolicy.policy.get recommender.iamPolicyInsights.* recommender.iamPolicyInsights.get recommender.iamPolicyInsights.list recommender.iamPolicyInsights.update recommender.iamPolicyRecommendations.* recommender.iamPolicyRecommendations.get recommender.iamPolicyRecommendations.list recommender.iamPolicyRecommendations.update recommender.storageBucketSoftDeleteInsights.* recommender.storageBucketSoftDeleteInsights.get recommender.storageBucketSoftDeleteInsights.list recommender.storageBucketSoftDeleteInsights.update recommender.storageBucketSoftDeleteRecommendations.* recommender.storageBucketSoftDeleteRecommendations.get recommender.storageBucketSoftDeleteRecommendations.list recommender.storageBucketSoftDeleteRecommendations.update resourcemanager.hierarchyNodes.listEffectiveTags resourcemanager.projects.get resourcemanager.projects.list stackdriver.projects.get stackdriver.resourceMetadata.list storage.anywhereCaches.* storage.anywhereCaches.create storage.anywhereCaches.disable storage.anywhereCaches.get storage.anywhereCaches.list storage.anywhereCaches.pause storage.anywhereCaches.resume storage.anywhereCaches.update storage.bucketOperations.* storage.bucketOperations.cancel storage.bucketOperations.get storage.bucketOperations.list storage.buckets.* storage.buckets.create storage.buckets.createTagBinding storage.buckets.delete storage.buckets.deleteTagBinding storage.buckets.enableObjectRetention storage.buckets.get storage.buckets.getIamPolicy storage.buckets.getIpFilter storage.buckets.getObjectInsights storage.buckets.list storage.buckets.listEffectiveTags storage.buckets.listTagBindings storage.buckets.relocate storage.buckets.restore storage.buckets.setIamPolicy storage.buckets.setIpFilter storage.buckets.update storage.buckets.viewIntelligenceDetails storage.buckets.viewSecurityIntelligenceDetails storage.featureConfigs.* storage.featureConfigs.create storage.featureConfigs.delete storage.featureConfigs.get storage.featureConfigs.list storage.featureConfigs.update storage.folders.* storage.folders.create storage.folders.delete storage.folders.get storage.folders.list storage.folders.rename storage.intelligenceConfigs.* storage.intelligenceConfigs.get storage.intelligenceConfigs.update storage.managedFolders.* storage.managedFolders.create storage.managedFolders.delete storage.managedFolders.get storage.managedFolders.getIamPolicy storage.managedFolders.list storage.managedFolders.setIamPolicy storage.managedFolders.update storage.multipartUploads.* storage.multipartUploads.abort storage.multipartUploads.create storage.multipartUploads.list storage.multipartUploads.listParts storage.objects.* storage.objects.create storage.objects.createContext storage.objects.delete storage.objects.deleteContext storage.objects.get storage.objects.getIamPolicy storage.objects.list storage.objects.move storage.objects.overrideUnlockedRetention storage.objects.restore storage.objects.setIamPolicy storage.objects.setRetention storage.objects.update storage.objects.updateContext storagebatchoperations.* storagebatchoperations.bucketOperations.get storagebatchoperations.bucketOperations.list storagebatchoperations.jobs.cancel storagebatchoperations.jobs.create storagebatchoperations.jobs.delete storagebatchoperations.jobs.get storagebatchoperations.jobs.list storagebatchoperations.locations.get storagebatchoperations.locations.list storagebatchoperations.operations.cancel storagebatchoperations.operations.delete storagebatchoperations.operations.get storagebatchoperations.operations.list
Storage Bucket Viewer ^Beta (roles/storage.bucketViewer) Grants permission to view buckets and their metadata, excluding IAM policies. Lowest-level resources where you can grant this role: Bucket	storage.buckets.get storage.buckets.list
Storage Editor (roles/storage.editor) Editor role for storage Lowest-level resources where you can grant this role: Managed folder	resourcemanager.projects.get resourcemanager.projects.list storage.buckets.create storage.buckets.delete storage.buckets.list storage.buckets.listEffectiveTags storage.buckets.listTagBindings storage.buckets.viewIntelligenceDetails storage.buckets.viewSecurityIntelligenceDetails storage.featureConfigs.* storage.featureConfigs.create storage.featureConfigs.delete storage.featureConfigs.get storage.featureConfigs.list storage.featureConfigs.update storage.folders.* storage.folders.create storage.folders.delete storage.folders.get storage.folders.list storage.folders.rename storage.hmacKeys.* storage.hmacKeys.create storage.hmacKeys.delete storage.hmacKeys.get storage.hmacKeys.list storage.hmacKeys.update storage.intelligenceConfigs.get
Storage Folder Admin (roles/storage.folderAdmin) Grants full control over folders and objects, including listing, creating, viewing, and deleting objects. Lowest-level resources where you can grant this role: Managed folder	orgpolicy.policy.get resourcemanager.projects.get resourcemanager.projects.list storage.folders.* storage.folders.create storage.folders.delete storage.folders.get storage.folders.list storage.folders.rename storage.managedFolders.* storage.managedFolders.create storage.managedFolders.delete storage.managedFolders.get storage.managedFolders.getIamPolicy storage.managedFolders.list storage.managedFolders.setIamPolicy storage.managedFolders.update storage.multipartUploads.* storage.multipartUploads.abort storage.multipartUploads.create storage.multipartUploads.list storage.multipartUploads.listParts storage.objects.* storage.objects.create storage.objects.createContext storage.objects.delete storage.objects.deleteContext storage.objects.get storage.objects.getIamPolicy storage.objects.list storage.objects.move storage.objects.overrideUnlockedRetention storage.objects.restore storage.objects.setIamPolicy storage.objects.setRetention storage.objects.update storage.objects.updateContext
Storage Legacy Bucket Owner (roles/storage.legacyBucketOwner) Grants permission to create, overwrite, and delete objects; list objects in a bucket and read object metadata, excluding allow policies, when listing; and read and edit bucket metadata, including allow policies. Use of this role is also reflected in the bucket's ACLs. For more information, see IAM relation to ACLs. Lowest-level resources where you can grant this role: Bucket	storage.anywhereCaches.* storage.anywhereCaches.create storage.anywhereCaches.disable storage.anywhereCaches.get storage.anywhereCaches.list storage.anywhereCaches.pause storage.anywhereCaches.resume storage.anywhereCaches.update storage.bucketOperations.* storage.bucketOperations.cancel storage.bucketOperations.get storage.bucketOperations.list storage.buckets.createTagBinding storage.buckets.deleteTagBinding storage.buckets.enableObjectRetention storage.buckets.get storage.buckets.getIamPolicy storage.buckets.getIpFilter storage.buckets.listEffectiveTags storage.buckets.listTagBindings storage.buckets.relocate storage.buckets.restore storage.buckets.setIamPolicy storage.buckets.setIpFilter storage.buckets.update storage.folders.* storage.folders.create storage.folders.delete storage.folders.get storage.folders.list storage.folders.rename storage.managedFolders.* storage.managedFolders.create storage.managedFolders.delete storage.managedFolders.get storage.managedFolders.getIamPolicy storage.managedFolders.list storage.managedFolders.setIamPolicy storage.managedFolders.update storage.multipartUploads.* storage.multipartUploads.abort storage.multipartUploads.create storage.multipartUploads.list storage.multipartUploads.listParts storage.objects.create storage.objects.createContext storage.objects.delete storage.objects.deleteContext storage.objects.list storage.objects.restore storage.objects.setRetention storage.objects.updateContext
Storage Legacy Bucket Reader (roles/storage.legacyBucketReader) Grants permission to list a bucket's contents and read bucket metadata, excluding allow policies. Also grants permission to read object metadata, excluding allow policies, when listing objects. Use of this role is also reflected in the bucket's ACLs. For more information, see IAM relation to ACLs. Lowest-level resources where you can grant this role: Bucket	storage.buckets.get storage.folders.get storage.folders.list storage.managedFolders.get storage.managedFolders.list storage.multipartUploads.list storage.objects.list
Storage Legacy Bucket Writer (roles/storage.legacyBucketWriter) Grants permission to create, overwrite, and delete objects; list objects in a bucket and read object metadata, excluding allow policies, when listing; and read bucket metadata, excluding allow policies. Use of this role is also reflected in the bucket's ACLs. For more information, see IAM relation to ACLs. Lowest-level resources where you can grant this role: Bucket	storage.buckets.get storage.folders.* storage.folders.create storage.folders.delete storage.folders.get storage.folders.list storage.folders.rename storage.managedFolders.create storage.managedFolders.delete storage.managedFolders.get storage.managedFolders.list storage.managedFolders.update storage.multipartUploads.* storage.multipartUploads.abort storage.multipartUploads.create storage.multipartUploads.list storage.multipartUploads.listParts storage.objects.create storage.objects.createContext storage.objects.delete storage.objects.list storage.objects.restore storage.objects.setRetention
Storage Legacy Object Owner (roles/storage.legacyObjectOwner) Grants permission to view and edit objects and their metadata, including ACLs. Lowest-level resources where you can grant this role: Managed folder	storage.objects.createContext storage.objects.deleteContext storage.objects.get storage.objects.getIamPolicy storage.objects.overrideUnlockedRetention storage.objects.setIamPolicy storage.objects.setRetention storage.objects.update storage.objects.updateContext
Storage Legacy Object Reader (roles/storage.legacyObjectReader) Grants permission to view objects and their metadata, excluding ACLs. Lowest-level resources where you can grant this role: Managed folder	storage.objects.get
Storage Object Admin (roles/storage.objectAdmin) Grants full control of objects, including listing, creating, viewing, and deleting objects. Lowest-level resources where you can grant this role: Managed folder	monitoring.timeSeries.create orgpolicy.policy.get resourcemanager.projects.get resourcemanager.projects.list storage.folders.* storage.folders.create storage.folders.delete storage.folders.get storage.folders.list storage.folders.rename storage.managedFolders.create storage.managedFolders.delete storage.managedFolders.get storage.managedFolders.list storage.managedFolders.update storage.multipartUploads.* storage.multipartUploads.abort storage.multipartUploads.create storage.multipartUploads.list storage.multipartUploads.listParts storage.objects.* storage.objects.create storage.objects.createContext storage.objects.delete storage.objects.deleteContext storage.objects.get storage.objects.getIamPolicy storage.objects.list storage.objects.move storage.objects.overrideUnlockedRetention storage.objects.restore storage.objects.setIamPolicy storage.objects.setRetention storage.objects.update storage.objects.updateContext
Storage Object Creator (roles/storage.objectCreator) Allows users to create objects. Does not give permission to view, delete, or overwrite objects. Lowest-level resources where you can grant this role: Managed folder	orgpolicy.policy.get resourcemanager.projects.get resourcemanager.projects.list storage.folders.create storage.managedFolders.create storage.multipartUploads.abort storage.multipartUploads.create storage.multipartUploads.listParts storage.objects.create storage.objects.createContext
Storage Object User (roles/storage.objectUser) Access to create, read, update and delete objects and multipart uploads. Lowest-level resources where you can grant this role: Managed folder	monitoring.timeSeries.create orgpolicy.policy.get resourcemanager.projects.get resourcemanager.projects.list storage.folders.* storage.folders.create storage.folders.delete storage.folders.get storage.folders.list storage.folders.rename storage.managedFolders.create storage.managedFolders.delete storage.managedFolders.get storage.managedFolders.list storage.managedFolders.update storage.multipartUploads.* storage.multipartUploads.abort storage.multipartUploads.create storage.multipartUploads.list storage.multipartUploads.listParts storage.objects.create storage.objects.createContext storage.objects.delete storage.objects.deleteContext storage.objects.get storage.objects.list storage.objects.move storage.objects.restore storage.objects.update storage.objects.updateContext
Storage Object Viewer (roles/storage.objectViewer) Grants access to view objects and their metadata, excluding ACLs. Can also list the objects in a bucket. Lowest-level resources where you can grant this role: Managed folder	resourcemanager.projects.get resourcemanager.projects.list storage.folders.get storage.folders.list storage.managedFolders.get storage.managedFolders.list storage.objects.get storage.objects.list
Storage Viewer (roles/storage.viewer) Viewer role for storage Lowest-level resources where you can grant this role: Managed folder	resourcemanager.projects.get resourcemanager.projects.list storage.buckets.list storage.buckets.listEffectiveTags storage.buckets.listTagBindings storage.buckets.viewIntelligenceDetails storage.buckets.viewSecurityIntelligenceDetails storage.featureConfigs.get storage.featureConfigs.list storage.folders.get storage.folders.list storage.hmacKeys.get storage.hmacKeys.list storage.intelligenceConfigs.get
Storage Annotation Generator Service ^Beta (roles/storage.annotationGeneratorService) Grants all permissions needed to generate annotations for objects in a bucket. Lowest-level resources where you can grant this role: Managed folder	storage.objects.createContext storage.objects.deleteContext storage.objects.get storage.objects.list storage.objects.update storage.objects.updateContext
Storage Express Mode Service Input ^Beta (roles/storage.expressModeServiceInput) Grants permission to Express Mode service accounts at a managed folder so they can create objects but not read them on input folders. Lowest-level resources where you can grant this role: Managed folder	storage.objects.create storage.objects.delete storage.objects.list storage.objects.update
Storage Express Mode Service Output ^Beta (roles/storage.expressModeServiceOutput) Grants permission to Express Mode service accounts at a managed folder so they can read objects but not write them on output folders. Lowest-level resources where you can grant this role: Managed folder	storage.objects.delete storage.objects.get storage.objects.list
Storage Express Mode User Access ^Beta (roles/storage.expressModeUserAccess) Grants permission to Express Mode accounts at the project level so they can read, list, create and delete any object in any of their buckets in Express Mode. Lowest-level resources where you can grant this role: Project	orgpolicy.policy.get storage.buckets.get storage.buckets.list storage.multipartUploads.* storage.multipartUploads.abort storage.multipartUploads.create storage.multipartUploads.list storage.multipartUploads.listParts storage.objects.create storage.objects.delete storage.objects.get storage.objects.list storage.objects.restore storage.objects.update
Storage HMAC Key Admin (roles/storage.hmacKeyAdmin) Full control of Cloud Storage HMAC keys. Lowest-level resources where you can grant this role: Project	firebase.projects.get orgpolicy.policy.get resourcemanager.projects.get resourcemanager.projects.list storage.hmacKeys.* storage.hmacKeys.create storage.hmacKeys.delete storage.hmacKeys.get storage.hmacKeys.list storage.hmacKeys.update
Storage Insights Collector Service (roles/storage.insightsCollectorService) Read-only access to Cloud Storage Inventory metadata for Storage Insights. Lowest-level resources where you can grant this role: Bucket	resourcemanager.projects.get resourcemanager.projects.list storage.buckets.get storage.buckets.getObjectInsights

注意：請考量以下權限相關事項：

• orgpolicy.policy.get 權限可讓主體瞭解專案受到的組織政策限制。只有在專案層級或以上授予角色時，這項權限才會生效。
• 如要進一步瞭解 resourcemanager.projects.* 權限，請參閱「使用 IAM 控管專案的存取權」。
• storagebatchoperations.jobs.* 和 storagebatchoperations.operations.* 權限可讓您建立及管理儲存空間批次作業。只有在專案層級授予角色時，這些權限才會生效。

預先定義的儲存空間分析角色

下表說明與儲存空間分析相關的 IAM 角色，並列出各角色包含的權限。

Role	Permissions
Storage Insights Admin (roles/storageinsights.admin) Full access to Storage Insights resources.	resourcemanager.projects.get resourcemanager.projects.list storageinsights.* storageinsights.datasetConfigs.create storageinsights.datasetConfigs.delete storageinsights.datasetConfigs.get storageinsights.datasetConfigs.linkDataset storageinsights.datasetConfigs.list storageinsights.datasetConfigs.unlinkDataset storageinsights.datasetConfigs.update storageinsights.locations.get storageinsights.locations.list storageinsights.operations.cancel storageinsights.operations.delete storageinsights.operations.get storageinsights.operations.list storageinsights.reportConfigs.create storageinsights.reportConfigs.delete storageinsights.reportConfigs.get storageinsights.reportConfigs.list storageinsights.reportConfigs.update storageinsights.reportDetails.get storageinsights.reportDetails.list
Storage Insights Viewer (roles/storageinsights.viewer) Read-only access to Storage Insights resources.	resourcemanager.projects.get resourcemanager.projects.list storageinsights.datasetConfigs.get storageinsights.datasetConfigs.list storageinsights.locations.* storageinsights.locations.get storageinsights.locations.list storageinsights.operations.get storageinsights.operations.list storageinsights.reportConfigs.get storageinsights.reportConfigs.list storageinsights.reportDetails.* storageinsights.reportDetails.get storageinsights.reportDetails.list
Storage Insights Analyst (roles/storageinsights.analyst) Data access to Storage Insights.	resourcemanager.projects.get resourcemanager.projects.list storageinsights.datasetConfigs.get storageinsights.datasetConfigs.linkDataset storageinsights.datasetConfigs.list storageinsights.datasetConfigs.unlinkDataset storageinsights.locations.* storageinsights.locations.get storageinsights.locations.list storageinsights.operations.get storageinsights.operations.list storageinsights.reportConfigs.get storageinsights.reportConfigs.list storageinsights.reportDetails.* storageinsights.reportDetails.get storageinsights.reportDetails.list

Service agent roles

Service agent roles should only be granted to service agents.

Role	Permissions
StorageInsights Service Agent (roles/storageinsights.serviceAgent) Permissions for Insights to write reports into customer project Warning: Do not grant service agent roles to any principals except service agents.	bigquery.datasets.create serviceusage.services.use storageinsights.reportDetails.list

基本角色

注意： 請盡可能減少使用基本角色，在正式環境中，除非沒有其他替代方案，否則請勿授予基本角色。基本角色包含所有 Google Cloud 服務的廣泛權限，且在 Cloud Storage 中可能會出現令人意外的行為，如本節所述。

基本角色是 IAM 推出前就存在的角色，這些角色具有獨特特性：

• 基本角色只能指派給整個專案，無法指派給專案中的個別值區。與您為專案授予的其他角色一樣，基本角色適用於專案中的所有 bucket 和物件。

• 基本角色包含其他服務的額外權限， Google Cloud本節未涵蓋這些服務。如要瞭解基本角色授予的權限，請參閱「基本角色」。

• 每個基本角色都有便利值，可讓您將基本角色當做群組使用。如果以這種方式使用，則任何具有基本角色的主體都會視為群組的一部分。群組中的所有成員都會根據便利值擁有的存取權，取得資源的額外存取權。

  • 授予 bucket 角色時，可以使用便利值。

  • 設定物件的 ACL 時，可以使用便利值。

• 基本角色不一定會授予名稱所暗示的所有 Cloud Storage 資源存取權。而是透過內建方式提供部分預期存取權，並透過便利值提供其餘預期存取權。由於便利值可像任何其他 IAM 主體一樣手動新增或移除，因此可能會撤銷主體原本預期擁有的存取權。

  如要瞭解具備基本角色的主體通常會因便利值而獲得哪些額外存取權，請參閱「可修改的行為」。

內建權限

下表說明與各基本角色一併授予的 Cloud Storage 權限。

角色	說明	Cloud Storage 權限
檢視者 (roles/viewer)	具備下列權限：列出專案中的值區；在列出作業期間查看值區中繼資料 (不含 ACL)；以及列出和取得專案中的 HMAC 金鑰。	storage.buckets.getIpFilter storage.buckets.list storage.hmacKeys.get storage.hmacKeys.list
編輯者 (roles/editor)	具備下列權限：建立、列出及刪除專案中的值區；在列出作業期間查看值區中繼資料 (不含 ACL)；以及控管專案中的 HMAC 金鑰。	storage.buckets.create storage.buckets.delete storage.buckets.getIpFilter storage.buckets.list storage.hmacKeys.*
擁有者 (roles/owner)	具備下列權限：在專案中建立、列出及刪除值區；在列出作業期間查看值區中繼資料 (不含 ACL)；建立、刪除及列出標記繫結；控制專案中的 HMAC 金鑰；在專案、資料夾或機構中啟用、停用、更新及取得 Storage Intelligence 設定。 在 Google Cloud 中，具有這個角色的主體通常可以執行管理工作，例如變更專案主體的角色或變更帳單。	storage.buckets.create storage.buckets.delete storage.buckets.list storage.buckets.createTagBinding storage.buckets.deleteTagBinding storage.buckets.getIpFilter storage.buckets.listEffectiveTags storage.buckets.listTagBindings storage.buckets.setIpFilter storage.hmacKeys.* storage.intelligenceConfigs.get storage.intelligenceConfigs.update

可修改的行為

由於便利值，獲派基本角色的主體通常會擁有專案值區和物件的其他存取權。建立 bucket 時，便利值會獲得特定 bucket 層級存取權，但您之後可以編輯 bucket IAM 政策和物件 ACL，移除或變更存取權。

建立啟用統一值區層級存取權的值區時，系統會透過便利值授予下列存取權：

• 獲派 roles/viewer 的主體會取得 bucket 的 roles/storage.legacyBucketReader 和 roles/storage.legacyObjectReader 角色。

• 獲得 roles/editor 的主體會取得該 bucket 的 roles/storage.legacyBucketOwner 和 roles/storage.legacyObjectOwner 角色。

• 獲派 roles/owner 的主體會取得 bucket 的 roles/storage.legacyBucketOwner 和 roles/storage.legacyObjectOwner 角色。

建立未啟用統一值區層級存取權的值區時，系統會使用便利值授予下列存取權：

• 授予 roles/viewer 的主體會取得 bucket 的 roles/storage.legacyBucketReader 角色。

• 獲得 roles/editor 的主體會取得該 bucket 的 roles/storage.legacyBucketOwner 角色。

• 授予 roles/owner 的主體會取得 bucket 的 roles/storage.legacyBucketOwner 角色。

• 此外，值區還具有預設物件存取控管清單 (ACL)。 這個預設 ACL 通常會套用至 bucket 中的新物件，且通常會授予便利值的額外存取權。

自訂角色

您可能需要定義自己的角色，其中包含您指定的一組權限。為了支援這方面的需求，身分與存取權管理提供了自訂角色。

後續步驟

• 使用 IAM 權限控管 bucket 和物件的存取權。

• 瞭解各項 Cloud Storage 的身分與存取權管理權限。

• 查看可用的 Cloud Storage IAM 參考資料，例如哪些 IAM 權限允許使用者透過各種工具和 API 執行動作。

• 如需其他 Google Cloud 角色的參考資料，請參閱「瞭解角色」。