Peran dan izin IAM

Halaman ini mencantumkan peran dan izin IAM untuk Workload Manager, termasuk izin yang diperlukan untuk membuat dan menjalankan evaluasi.

Peran Workload Manager

Tabel berikut mencantumkan semua peran IAM Workload Manager dan izin yang diberikan oleh peran tersebut:

Role	Permissions
Workload Manager Admin ^Beta (roles/workloadmanager.admin) Full access to Workload Manager all resources.	compute.acceleratorTypes.list compute.diskTypes.list compute.machineTypes.list compute.networks.list compute.projects.get compute.regions.list compute.subnetworks.list compute.zones.list dns.managedZones.list iam.serviceAccounts.list monitoring.timeSeries.list orgpolicy.policy.get resourcemanager.projects.get resourcemanager.projects.getIamPolicy resourcemanager.projects.list serviceusage.consumerpolicy.analyze serviceusage.consumerpolicy.get serviceusage.effectivepolicy.get serviceusage.groups.* serviceusage.groups.list serviceusage.groups.listExpandedMembers serviceusage.groups.listMembers serviceusage.quotas.get serviceusage.services.get serviceusage.values.test storage.buckets.list storage.objects.list workloadmanager.* workloadmanager.actuations.create workloadmanager.actuations.delete workloadmanager.actuations.get workloadmanager.actuations.list workloadmanager.deployments.create workloadmanager.deployments.delete workloadmanager.deployments.get workloadmanager.deployments.list workloadmanager.discoveredprofiles.get workloadmanager.discoveredprofiles.getHealth workloadmanager.discoveredprofiles.list workloadmanager.evaluations.create workloadmanager.evaluations.delete workloadmanager.evaluations.get workloadmanager.evaluations.list workloadmanager.evaluations.run workloadmanager.evaluations.update workloadmanager.executions.delete workloadmanager.executions.get workloadmanager.executions.list workloadmanager.findings.create workloadmanager.findings.list workloadmanager.insights.delete workloadmanager.insights.export workloadmanager.insights.listSapSystems workloadmanager.insights.write workloadmanager.locations.get workloadmanager.locations.list workloadmanager.operations.cancel workloadmanager.operations.delete workloadmanager.operations.get workloadmanager.operations.list workloadmanager.results.list workloadmanager.rules.list
Workload Manager Viewer ^Beta (roles/workloadmanager.viewer) Read-only access to Workload Manager all resources.	orgpolicy.policy.get resourcemanager.projects.get resourcemanager.projects.list workloadmanager.actuations.get workloadmanager.actuations.list workloadmanager.deployments.get workloadmanager.deployments.list workloadmanager.discoveredprofiles.* workloadmanager.discoveredprofiles.get workloadmanager.discoveredprofiles.getHealth workloadmanager.discoveredprofiles.list workloadmanager.evaluations.get workloadmanager.evaluations.list workloadmanager.executions.get workloadmanager.executions.list workloadmanager.findings.list workloadmanager.results.list workloadmanager.rules.list
Workload Manager Deployment Admin ^Beta (roles/workloadmanager.deploymentAdmin) Full access to Workload Manager deployment resources.	compute.acceleratorTypes.list compute.diskTypes.list compute.machineTypes.list compute.networks.list compute.projects.get compute.regions.list compute.subnetworks.list compute.zones.list dns.managedZones.list iam.serviceAccounts.list monitoring.timeSeries.list resourcemanager.projects.get resourcemanager.projects.getIamPolicy resourcemanager.projects.list serviceusage.consumerpolicy.analyze serviceusage.consumerpolicy.get serviceusage.effectivepolicy.get serviceusage.groups.* serviceusage.groups.list serviceusage.groups.listExpandedMembers serviceusage.groups.listMembers serviceusage.quotas.get serviceusage.services.get serviceusage.values.test storage.buckets.list storage.objects.list workloadmanager.actuations.* workloadmanager.actuations.create workloadmanager.actuations.delete workloadmanager.actuations.get workloadmanager.actuations.list workloadmanager.deployments.* workloadmanager.deployments.create workloadmanager.deployments.delete workloadmanager.deployments.get workloadmanager.deployments.list workloadmanager.locations.* workloadmanager.locations.get workloadmanager.locations.list workloadmanager.operations.* workloadmanager.operations.cancel workloadmanager.operations.delete workloadmanager.operations.get workloadmanager.operations.list
Workload Manager Deployment Viewer ^Beta (roles/workloadmanager.deploymentViewer) Read-only access to Workload Manager deployment resources.	resourcemanager.projects.get resourcemanager.projects.list workloadmanager.actuations.get workloadmanager.actuations.list workloadmanager.deployments.get workloadmanager.deployments.list
Workload Manager Evaluation Admin ^Beta (roles/workloadmanager.evaluationAdmin) Full access to Workload Manager evaluation resources.	orgpolicy.policy.get resourcemanager.projects.get resourcemanager.projects.list workloadmanager.evaluations.* workloadmanager.evaluations.create workloadmanager.evaluations.delete workloadmanager.evaluations.get workloadmanager.evaluations.list workloadmanager.evaluations.run workloadmanager.evaluations.update workloadmanager.executions.* workloadmanager.executions.delete workloadmanager.executions.get workloadmanager.executions.list workloadmanager.findings.* workloadmanager.findings.create workloadmanager.findings.list workloadmanager.locations.* workloadmanager.locations.get workloadmanager.locations.list workloadmanager.operations.* workloadmanager.operations.cancel workloadmanager.operations.delete workloadmanager.operations.get workloadmanager.operations.list workloadmanager.results.list workloadmanager.rules.list
Workload Manager Evaluation Viewer ^Beta (roles/workloadmanager.evaluationViewer) Read-only access to Workload Manager evaluation resources.	orgpolicy.policy.get resourcemanager.projects.get resourcemanager.projects.list workloadmanager.evaluations.get workloadmanager.evaluations.list workloadmanager.executions.get workloadmanager.executions.list workloadmanager.results.list workloadmanager.rules.list
Workload Manager Insights Writer ^Beta (roles/workloadmanager.insightWriter) The role used to write data to WLM data warehouse.	workloadmanager.insights.delete workloadmanager.insights.write
Workload Manager Worker ^Beta (roles/workloadmanager.worker) The role used by Workload Manager application runners to read and update workloads.	orgpolicy.policy.get resourcemanager.projects.get resourcemanager.projects.list workloadmanager.actuations.* workloadmanager.actuations.create workloadmanager.actuations.delete workloadmanager.actuations.get workloadmanager.actuations.list workloadmanager.deployments.* workloadmanager.deployments.create workloadmanager.deployments.delete workloadmanager.deployments.get workloadmanager.deployments.list workloadmanager.discoveredprofiles.* workloadmanager.discoveredprofiles.get workloadmanager.discoveredprofiles.getHealth workloadmanager.discoveredprofiles.list workloadmanager.evaluations.* workloadmanager.evaluations.create workloadmanager.evaluations.delete workloadmanager.evaluations.get workloadmanager.evaluations.list workloadmanager.evaluations.run workloadmanager.evaluations.update workloadmanager.executions.* workloadmanager.executions.delete workloadmanager.executions.get workloadmanager.executions.list workloadmanager.findings.* workloadmanager.findings.create workloadmanager.findings.list workloadmanager.insights.write workloadmanager.results.list workloadmanager.rules.list
Workload Manager Workload Viewer ^Beta (roles/workloadmanager.workloadViewer) The role used to view the workload related data.	resourcemanager.projects.get resourcemanager.projects.list serviceusage.consumerpolicy.analyze serviceusage.consumerpolicy.get serviceusage.effectivepolicy.get serviceusage.groups.* serviceusage.groups.list serviceusage.groups.listExpandedMembers serviceusage.groups.listMembers serviceusage.services.get serviceusage.services.list serviceusage.values.test workloadmanager.discoveredprofiles.* workloadmanager.discoveredprofiles.get workloadmanager.discoveredprofiles.getHealth workloadmanager.discoveredprofiles.list

Service agent roles

Service agent roles should only be granted to service agents.

Role

Permissions

Workload Manager Service Agent (roles/workloadmanager.serviceAgent) Gives Workload Manager Service Agent access to CAI export functions and Cloud Monitoring. Warning: Do not grant service agent roles to any principals except service agents.

cloudasset.assets.exportAccessPolicy cloudasset.assets.exportIamPolicy cloudasset.assets.exportOSInventories cloudasset.assets.exportOrgPolicy cloudasset.assets.exportResource cloudasset.assets.listAccessPolicy cloudasset.assets.listIamPolicy cloudasset.assets.listOSInventories cloudasset.assets.listOrgPolicy cloudasset.assets.listResource cloudasset.assets.searchAllResources config.deployments.create config.deployments.delete config.deployments.get config.deployments.list config.deployments.update config.locations.* config.locations.get config.locations.list config.operations.* config.operations.cancel config.operations.delete config.operations.get config.operations.list config.resources.list config.revisions.get config.revisions.list monitoring.metricDescriptors.get monitoring.metricDescriptors.list monitoring.monitoredResourceDescriptors.* monitoring.monitoredResourceDescriptors.get monitoring.monitoredResourceDescriptors.list monitoring.timeSeries.list serviceusage.services.use workloadmanager.insights.export workloadmanager.insights.listSapSystems

Izin Workload Manager

Tabel berikut mencantumkan izin yang didukung oleh Workload Manager:

Izin	Disertakan dalam peran
workloadmanager.actuations.create	Pemilik (roles/owner) Editor (roles/editor) Workload Manager Admin (roles/workloadmanager.admin) Admin Deployment Workload Manager (roles/workloadmanager.deploymentAdmin) Workload Manager Worker (roles/workloadmanager.worker)
workloadmanager.actuations.delete	Pemilik (roles/owner) Editor (roles/editor) Workload Manager Admin (roles/workloadmanager.admin) Admin Deployment Workload Manager (roles/workloadmanager.deploymentAdmin) Workload Manager Worker (roles/workloadmanager.worker)
workloadmanager.actuations.get	Pemilik (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Workload Manager Admin (roles/workloadmanager.admin) Workload Manager Viewer (roles/workloadmanager.viewer) Support User (roles/iam.supportUser) Admin Deployment Workload Manager (roles/workloadmanager.deploymentAdmin) Workload Manager Deployment Viewer (roles/workloadmanager.deploymentViewer) Workload Manager Worker (roles/workloadmanager.worker)
workloadmanager.actuations.list	Pemilik (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Security Admin (roles/iam.securityAdmin) Security Reviewer (roles/iam.securityReviewer) Workload Manager Admin (roles/workloadmanager.admin) Workload Manager Viewer (roles/workloadmanager.viewer) Auditor Keamanan (roles/iam.securityAuditor) Support User (roles/iam.supportUser) Admin Deployment Workload Manager (roles/workloadmanager.deploymentAdmin) Workload Manager Deployment Viewer (roles/workloadmanager.deploymentViewer) Workload Manager Worker (roles/workloadmanager.worker)
workloadmanager.deployments.create	Pemilik (roles/owner) Editor (roles/editor) Workload Manager Admin (roles/workloadmanager.admin) Admin Deployment Workload Manager (roles/workloadmanager.deploymentAdmin) Workload Manager Worker (roles/workloadmanager.worker)
workloadmanager.deployments.delete	Pemilik (roles/owner) Editor (roles/editor) Workload Manager Admin (roles/workloadmanager.admin) Admin Deployment Workload Manager (roles/workloadmanager.deploymentAdmin) Workload Manager Worker (roles/workloadmanager.worker)
workloadmanager.deployments.get	Pemilik (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Workload Manager Admin (roles/workloadmanager.admin) Workload Manager Viewer (roles/workloadmanager.viewer) Support User (roles/iam.supportUser) Admin Deployment Workload Manager (roles/workloadmanager.deploymentAdmin) Workload Manager Deployment Viewer (roles/workloadmanager.deploymentViewer) Workload Manager Worker (roles/workloadmanager.worker)
workloadmanager.deployments.list	Pemilik (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Security Admin (roles/iam.securityAdmin) Security Reviewer (roles/iam.securityReviewer) Workload Manager Admin (roles/workloadmanager.admin) Workload Manager Viewer (roles/workloadmanager.viewer) Auditor Keamanan (roles/iam.securityAuditor) Support User (roles/iam.supportUser) Admin Deployment Workload Manager (roles/workloadmanager.deploymentAdmin) Workload Manager Deployment Viewer (roles/workloadmanager.deploymentViewer) Workload Manager Worker (roles/workloadmanager.worker)
workloadmanager.discoveredprofiles.get	Pemilik (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Workload Manager Admin (roles/workloadmanager.admin) Workload Manager Viewer (roles/workloadmanager.viewer) Support User (roles/iam.supportUser) Workload Manager Worker (roles/workloadmanager.worker) Workload Manager Workload Viewer (roles/workloadmanager.workloadViewer)
workloadmanager.discoveredprofiles.getHealth	Pemilik (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Workload Manager Admin (roles/workloadmanager.admin) Workload Manager Viewer (roles/workloadmanager.viewer) Support User (roles/iam.supportUser) Workload Manager Worker (roles/workloadmanager.worker) Workload Manager Workload Viewer (roles/workloadmanager.workloadViewer)
workloadmanager.discoveredprofiles.list	Pemilik (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Security Admin (roles/iam.securityAdmin) Security Reviewer (roles/iam.securityReviewer) Workload Manager Admin (roles/workloadmanager.admin) Workload Manager Viewer (roles/workloadmanager.viewer) Auditor Keamanan (roles/iam.securityAuditor) Support User (roles/iam.supportUser) Workload Manager Worker (roles/workloadmanager.worker) Workload Manager Workload Viewer (roles/workloadmanager.workloadViewer)
workloadmanager.evaluations.create	Pemilik (roles/owner) Editor (roles/editor) Workload Manager Admin (roles/workloadmanager.admin) Admin Evaluasi Workload Manager (roles/workloadmanager.evaluationAdmin) Workload Manager Worker (roles/workloadmanager.worker)
workloadmanager.evaluations.delete	Pemilik (roles/owner) Editor (roles/editor) Workload Manager Admin (roles/workloadmanager.admin) Admin Evaluasi Workload Manager (roles/workloadmanager.evaluationAdmin) Workload Manager Worker (roles/workloadmanager.worker)
workloadmanager.evaluations.get	Pemilik (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Workload Manager Admin (roles/workloadmanager.admin) Workload Manager Viewer (roles/workloadmanager.viewer) Support User (roles/iam.supportUser) Admin Evaluasi Workload Manager (roles/workloadmanager.evaluationAdmin) Workload Manager Evaluation Viewer (roles/workloadmanager.evaluationViewer) Workload Manager Worker (roles/workloadmanager.worker)
workloadmanager.evaluations.list	Pemilik (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Security Admin (roles/iam.securityAdmin) Security Reviewer (roles/iam.securityReviewer) Workload Manager Admin (roles/workloadmanager.admin) Workload Manager Viewer (roles/workloadmanager.viewer) Auditor Keamanan (roles/iam.securityAuditor) Support User (roles/iam.supportUser) Admin Evaluasi Workload Manager (roles/workloadmanager.evaluationAdmin) Workload Manager Evaluation Viewer (roles/workloadmanager.evaluationViewer) Workload Manager Worker (roles/workloadmanager.worker)
workloadmanager.evaluations.run	Pemilik (roles/owner) Editor (roles/editor) Workload Manager Admin (roles/workloadmanager.admin) Admin Evaluasi Workload Manager (roles/workloadmanager.evaluationAdmin) Workload Manager Worker (roles/workloadmanager.worker)
workloadmanager.evaluations.update	Pemilik (roles/owner) Editor (roles/editor) Workload Manager Admin (roles/workloadmanager.admin) Admin Evaluasi Workload Manager (roles/workloadmanager.evaluationAdmin) Workload Manager Worker (roles/workloadmanager.worker)
workloadmanager.executions.delete	Pemilik (roles/owner) Editor (roles/editor) Workload Manager Admin (roles/workloadmanager.admin) Admin Evaluasi Workload Manager (roles/workloadmanager.evaluationAdmin) Workload Manager Worker (roles/workloadmanager.worker)
workloadmanager.executions.get	Pemilik (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Workload Manager Admin (roles/workloadmanager.admin) Workload Manager Viewer (roles/workloadmanager.viewer) Support User (roles/iam.supportUser) Admin Evaluasi Workload Manager (roles/workloadmanager.evaluationAdmin) Workload Manager Evaluation Viewer (roles/workloadmanager.evaluationViewer) Workload Manager Worker (roles/workloadmanager.worker)
workloadmanager.executions.list	Pemilik (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Security Admin (roles/iam.securityAdmin) Security Reviewer (roles/iam.securityReviewer) Workload Manager Admin (roles/workloadmanager.admin) Workload Manager Viewer (roles/workloadmanager.viewer) Auditor Keamanan (roles/iam.securityAuditor) Support User (roles/iam.supportUser) Admin Evaluasi Workload Manager (roles/workloadmanager.evaluationAdmin) Workload Manager Evaluation Viewer (roles/workloadmanager.evaluationViewer) Workload Manager Worker (roles/workloadmanager.worker)
workloadmanager.findings.create	Pemilik (roles/owner) Editor (roles/editor) Workload Manager Admin (roles/workloadmanager.admin) Admin Evaluasi Workload Manager (roles/workloadmanager.evaluationAdmin) Workload Manager Worker (roles/workloadmanager.worker)
workloadmanager.findings.list	Pemilik (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Security Admin (roles/iam.securityAdmin) Security Reviewer (roles/iam.securityReviewer) Workload Manager Admin (roles/workloadmanager.admin) Workload Manager Viewer (roles/workloadmanager.viewer) Auditor Keamanan (roles/iam.securityAuditor) Support User (roles/iam.supportUser) Admin Evaluasi Workload Manager (roles/workloadmanager.evaluationAdmin) Workload Manager Worker (roles/workloadmanager.worker)
workloadmanager.insights.delete	Pemilik (roles/owner) Editor (roles/editor) Workload Manager Admin (roles/workloadmanager.admin) Workload Manager Insights Writer (roles/workloadmanager.insightWriter)
workloadmanager.insights.export	Pemilik (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Workload Manager Admin (roles/workloadmanager.admin) Support User (roles/iam.supportUser) Peran agen layanan Peringatan: Jangan berikan peran agen layanan kepada akun utama mana pun kecuali agen layanan. Workload Manager Service Agent (roles/workloadmanager.serviceAgent)
workloadmanager.insights.listSapSystems	Pemilik (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Workload Manager Admin (roles/workloadmanager.admin) Support User (roles/iam.supportUser) Peran agen layanan Peringatan: Jangan berikan peran agen layanan kepada akun utama mana pun kecuali agen layanan. Workload Manager Service Agent (roles/workloadmanager.serviceAgent)
workloadmanager.insights.write	Pemilik (roles/owner) Editor (roles/editor) Workload Manager Admin (roles/workloadmanager.admin) Workload Manager Insights Writer (roles/workloadmanager.insightWriter) Workload Manager Worker (roles/workloadmanager.worker)
workloadmanager.locations.get	Pemilik (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Workload Manager Admin (roles/workloadmanager.admin) Support User (roles/iam.supportUser) Admin Deployment Workload Manager (roles/workloadmanager.deploymentAdmin) Admin Evaluasi Workload Manager (roles/workloadmanager.evaluationAdmin)
workloadmanager.locations.list	Pemilik (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Security Admin (roles/iam.securityAdmin) Security Reviewer (roles/iam.securityReviewer) Workload Manager Admin (roles/workloadmanager.admin) Auditor Keamanan (roles/iam.securityAuditor) Support User (roles/iam.supportUser) Admin Deployment Workload Manager (roles/workloadmanager.deploymentAdmin) Admin Evaluasi Workload Manager (roles/workloadmanager.evaluationAdmin)
workloadmanager.operations.cancel	Pemilik (roles/owner) Editor (roles/editor) Workload Manager Admin (roles/workloadmanager.admin) Admin Deployment Workload Manager (roles/workloadmanager.deploymentAdmin) Admin Evaluasi Workload Manager (roles/workloadmanager.evaluationAdmin)
workloadmanager.operations.delete	Pemilik (roles/owner) Editor (roles/editor) Workload Manager Admin (roles/workloadmanager.admin) Admin Deployment Workload Manager (roles/workloadmanager.deploymentAdmin) Admin Evaluasi Workload Manager (roles/workloadmanager.evaluationAdmin)
workloadmanager.operations.get	Pemilik (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Workload Manager Admin (roles/workloadmanager.admin) Support User (roles/iam.supportUser) Admin Deployment Workload Manager (roles/workloadmanager.deploymentAdmin) Admin Evaluasi Workload Manager (roles/workloadmanager.evaluationAdmin)
workloadmanager.operations.list	Pemilik (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Security Admin (roles/iam.securityAdmin) Security Reviewer (roles/iam.securityReviewer) Workload Manager Admin (roles/workloadmanager.admin) Auditor Keamanan (roles/iam.securityAuditor) Support User (roles/iam.supportUser) Admin Deployment Workload Manager (roles/workloadmanager.deploymentAdmin) Admin Evaluasi Workload Manager (roles/workloadmanager.evaluationAdmin)
workloadmanager.results.list	Pemilik (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Security Admin (roles/iam.securityAdmin) Security Reviewer (roles/iam.securityReviewer) Workload Manager Admin (roles/workloadmanager.admin) Workload Manager Viewer (roles/workloadmanager.viewer) Auditor Keamanan (roles/iam.securityAuditor) Support User (roles/iam.supportUser) Admin Evaluasi Workload Manager (roles/workloadmanager.evaluationAdmin) Workload Manager Evaluation Viewer (roles/workloadmanager.evaluationViewer) Workload Manager Worker (roles/workloadmanager.worker)
workloadmanager.rules.list	Pemilik (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Security Admin (roles/iam.securityAdmin) Security Reviewer (roles/iam.securityReviewer) Workload Manager Admin (roles/workloadmanager.admin) Workload Manager Viewer (roles/workloadmanager.viewer) Auditor Keamanan (roles/iam.securityAuditor) Support User (roles/iam.supportUser) Admin Evaluasi Workload Manager (roles/workloadmanager.evaluationAdmin) Workload Manager Evaluation Viewer (roles/workloadmanager.evaluationViewer) Workload Manager Worker (roles/workloadmanager.worker)

Peran IAM di project konsumen dan target untuk evaluasi

Untuk mengevaluasi workload menggunakan Workload Manager, Anda menjalankan evaluasi dari project konsumen terhadap project target.

Untuk mempelajari project konsumen dan target serta melihat tabel ringkasan izin yang diperlukan untuk membuat, menjalankan, dan melihat evaluasi, lihat Peran IAM di project konsumen dan target untuk evaluasi.

Langkah berikutnya

• Pelajari agen layanan Workload Manager
• Membuat dan menjalankan evaluasi