Dataplex Universal Catalog IAM 역할

Identity and Access Management(IAM)를 사용하면 Dataplex Universal Catalog 내에서 특정 작업을 수행할 수 있는 사용자를 제어할 수 있습니다. 최소 권한의 보안 원칙을 채택하여 비공개 데이터를 보호하거나 무단 액세스를 방지하거나 공격 표면을 줄이거나 규정 준수를 충족할 수 있습니다.

Dataplex Universal Catalog는 여러 가지 사전 정의된 IAM 역할을 제공하며 각 역할에는 사용자가 작업을 수행하도록 허용하는 특정 권한 집합이 있습니다. IAM 정책을 사용하여 이러한 역할을 부여할 수 있습니다.

더욱 세밀하게 제어하려면 특정 권한을 선택하고 새 역할을 사용자에게 할당하여 커스텀 IAM 역할을 만들면 됩니다. 커스텀 역할을 사용하면 조직 니즈에 맞는 액세스 모델을 빌드할 수 있습니다.

이 문서에서는 Dataplex Universal Catalog와 관련된 사전 정의된 IAM 역할과 커스텀 IAM 역할을 설명합니다.

IAM과 해당 기능에 대한 자세한 설명은 IAM 문서를 참조하세요.

Dataplex Universal Catalog 역할 정보

Dataplex Universal Catalog IAM 역할은 권한이 하나 이상 있는 번들입니다. 프로젝트에서 Dataplex Universal Catalog 리소스에 대한 작업을 수행하도록 허용하는 역할을 주 구성원에게 부여합니다. 예를 들어 Dataplex 뷰어 역할에는 사용자가 프로젝트에서 Dataplex Universal Catalog 리소스를 가져오고 나열하도록 허용하는 dataplex.*.get 및 dataplex.*.list 권한이 포함되어 있습니다. 자세한 내용은 Dataplex Universal Catalog 권한을 참조하세요.

프로젝트, 레이크, 데이터 영역을 포함한 서비스 계층 구조의 모든 리소스에 Dataplex Universal Catalog 역할을 적용할 수 있습니다.

기본 역할

IAM 프로젝트 역할을 사용하여 프로젝트 수준에서 기본 역할을 할당할 수 있습니다. 다음은 IAM 프로젝트 역할과 연결된 권한 목록입니다.

프로젝트 역할 권한
프로젝트 소유자 프로젝트에 대한 액세스 제어를 관리하고(IamPolicy 가져오기/설정) 프로젝트 결제를 설정할 수 있는 권한이 추가된 모든 프로젝트 편집자 권한
프로젝트 편집자 상태를 수정하는 작업에 대한 모든 프로젝트 권한(만들기, 삭제, 업데이트, 사용)이 추가된 모든 프로젝트 뷰어 권한
프로젝트 뷰어 상태를 보존하는 읽기 전용 작업에 대한 모든 프로젝트 권한(가져오기, 표시)

Dataplex Universal Catalog의 사전 정의된 역할

사전 정의된 역할에는 태스크 또는 관련 태스크 그룹을 수행하는 데 필요한 권한이 포함되어 있습니다.

다음에 유의하세요.

  • Data Catalog를 사용하는 경우 Data Catalog 항목 액세스 권한 부여는 Dataplex Universal Catalog 항목으로 자동 이전되지 않습니다. Dataplex Universal Catalog 항목을 사용하기 전에 이 항목에 대한 액세스 권한을 명시적으로 부여해야 합니다.
  • Dataplex 관리자, Dataplex 편집자, Dataplex 뷰어 역할은 항목 그룹, 항목 유형, 관점 유형, 항목과 같은 메타데이터 리소스에 대한 액세스 권한을 제공하지 않습니다.
  • @bigquery 및 @dataplex와 같은 시스템 정의 항목 그룹에 Dataplex Universal Catalog 항목을 추가하거나 삭제할 수 있는 권한을 부여하는 역할은 없습니다.
  • Dataplex 항목 및 EntryLink 소유자 역할에는 다음이 포함되어 있습니다.
    • 항목 관련 작업에 대한 전체 액세스 권한을 부여합니다.
    • Schema, Generic, Overview, Contacts와 같은 일부 시스템 관점 유형의 관점을 추가할 수 있는 권한을 부여합니다.
    • GenericEntry 유형의 항목을 만들 수 있는 권한을 부여합니다.
    • 이 역할을 사용하면 항목 유형과 관점 유형이 항목과 동일한 프로젝트에서 정의된 항목 유형과 관점 유형으로 항목을 만들 수 있습니다. 그 외의 경우에는 항목 유형과 관점 유형이 정의된 프로젝트에 대한 Dataplex 항목 유형 사용자 및 Dataplex 관점 유형 사용자 역할이 추가로 부여되어야 합니다.
    • LookupEntry 메서드나 SearchEntries 메서드를 사용하는 경우 이 역할은 BigQuery 항목과 같이 Dataplex Universal Catalog 외부에 있는Google Cloud 리소스에서 생성된 항목을 읽을 수 있는 권한을 부여하지 않습니다. 이러한 항목을 읽으려면 소스 시스템 리소스에 대한 권한을 부여받아야 합니다. 또는 GetEntry 메서드를 사용하면 Dataplex 항목 및 EntryLink 소유자 역할로만 항목을 읽을 수 있습니다.
  • 항목에 연결된 데이터 관점을 보려면 항목을 볼 수 있는 권한 외에도 항목이 나타내는 소스 애셋에서 데이터를 읽을 수 있는 권한이 필요합니다. 항목을 볼 수 있는 권한은 있지만 소스 애셋에 대한 데이터 읽기 권한이 없는 경우 항목의 다른 모든 메타데이터는 볼 수 있지만 Dataplex Universal Catalog는 연결된 데이터 관점의 콘텐츠를 표시하지 않습니다.

Dataplex 카탈로그 관리자 역할과 Dataplex 카탈로그 편집자 역할은 커스텀 항목을 보는 데 필요한 권한을 부여합니다.

  • SearchEntries 메서드를 사용하여 항목을 검색하려면 API 요청에 사용되는 프로젝트에 대한 Dataplex 카탈로그 관리자, Dataplex 카탈로그 편집자 또는 Dataplex 카탈로그 뷰어 IAM 역할 중 최소 하나 이상을 부여받아야 합니다. 검색 결과에 대한 권한은 선택한 프로젝트와는 별도로 확인됩니다.

다음 표에는 사전 정의된 Dataplex Universal Catalog 역할 및 각 역할과 연결된 권한이 나와 있습니다.

Role Permissions

(roles/dataplex.admin)

Full access to Dataplex Universal Catalog resources, except for catalog resources like entries and entry groups.

cloudasset.assets.analyzeIamPolicy

cloudasset.assets.searchAllIamPolicies

cloudasset.assets.searchAllResources

dataplex.assetActions.list

dataplex.assets.create

dataplex.assets.delete

dataplex.assets.get

dataplex.assets.getIamPolicy

dataplex.assets.list

dataplex.assets.setIamPolicy

dataplex.assets.update

dataplex.changeRequests.*

  • dataplex.changeRequests.adminDelete
  • dataplex.changeRequests.delete
  • dataplex.changeRequests.get
  • dataplex.changeRequests.getIamPolicy
  • dataplex.changeRequests.list
  • dataplex.changeRequests.setIamPolicy
  • dataplex.changeRequests.update
  • dataplex.changeRequests.use

dataplex.content.*

  • dataplex.content.create
  • dataplex.content.delete
  • dataplex.content.get
  • dataplex.content.getIamPolicy
  • dataplex.content.list
  • dataplex.content.setIamPolicy
  • dataplex.content.update

dataplex.dataAssets.*

  • dataplex.dataAssets.create
  • dataplex.dataAssets.delete
  • dataplex.dataAssets.get
  • dataplex.dataAssets.list
  • dataplex.dataAssets.update

dataplex.dataAttributeBindings.*

  • dataplex.dataAttributeBindings.create
  • dataplex.dataAttributeBindings.delete
  • dataplex.dataAttributeBindings.get
  • dataplex.dataAttributeBindings.getIamPolicy
  • dataplex.dataAttributeBindings.list
  • dataplex.dataAttributeBindings.setIamPolicy
  • dataplex.dataAttributeBindings.update

dataplex.dataAttributes.*

  • dataplex.dataAttributes.bind
  • dataplex.dataAttributes.create
  • dataplex.dataAttributes.delete
  • dataplex.dataAttributes.get
  • dataplex.dataAttributes.getIamPolicy
  • dataplex.dataAttributes.list
  • dataplex.dataAttributes.setIamPolicy
  • dataplex.dataAttributes.update

dataplex.dataDomainBindings.*

  • dataplex.dataDomainBindings.create
  • dataplex.dataDomainBindings.delete
  • dataplex.dataDomainBindings.get
  • dataplex.dataDomainBindings.list

dataplex.dataDomains.*

  • dataplex.dataDomains.create
  • dataplex.dataDomains.delete
  • dataplex.dataDomains.discover
  • dataplex.dataDomains.get
  • dataplex.dataDomains.getIamPolicy
  • dataplex.dataDomains.list
  • dataplex.dataDomains.lookupEntry
  • dataplex.dataDomains.modifyEntry
  • dataplex.dataDomains.setIamPolicy
  • dataplex.dataDomains.update

dataplex.dataProducts.*

  • dataplex.dataProducts.approve
  • dataplex.dataProducts.create
  • dataplex.dataProducts.delete
  • dataplex.dataProducts.get
  • dataplex.dataProducts.getIamPolicy
  • dataplex.dataProducts.list
  • dataplex.dataProducts.setIamPolicy
  • dataplex.dataProducts.update

dataplex.dataTaxonomies.*

  • dataplex.dataTaxonomies.configureDataAccess
  • dataplex.dataTaxonomies.configureResourceAccess
  • dataplex.dataTaxonomies.create
  • dataplex.dataTaxonomies.delete
  • dataplex.dataTaxonomies.get
  • dataplex.dataTaxonomies.getIamPolicy
  • dataplex.dataTaxonomies.list
  • dataplex.dataTaxonomies.setIamPolicy
  • dataplex.dataTaxonomies.update

dataplex.datascans.*

  • dataplex.datascans.cancel
  • dataplex.datascans.create
  • dataplex.datascans.delete
  • dataplex.datascans.get
  • dataplex.datascans.getData
  • dataplex.datascans.getIamPolicy
  • dataplex.datascans.list
  • dataplex.datascans.run
  • dataplex.datascans.setIamPolicy
  • dataplex.datascans.update

dataplex.entities.*

  • dataplex.entities.create
  • dataplex.entities.delete
  • dataplex.entities.get
  • dataplex.entities.list
  • dataplex.entities.update

dataplex.entries.link

dataplex.entryGroups.export

dataplex.entryGroups.import

dataplex.entryGroups.requestChanges

dataplex.entryGroups.useContextEntryLink

dataplex.entryGroups.useDefinitionEntryLink

dataplex.entryGroups.useRelatedEntryLink

dataplex.entryGroups.useSchemaJoinEntryLink

dataplex.entryGroups.useSynonymEntryLink

dataplex.entryLinks.*

  • dataplex.entryLinks.create
  • dataplex.entryLinks.delete
  • dataplex.entryLinks.get
  • dataplex.entryLinks.reference
  • dataplex.entryLinks.update

dataplex.environments.*

  • dataplex.environments.create
  • dataplex.environments.delete
  • dataplex.environments.execute
  • dataplex.environments.get
  • dataplex.environments.getIamPolicy
  • dataplex.environments.list
  • dataplex.environments.setIamPolicy
  • dataplex.environments.update

dataplex.glossaries.*

  • dataplex.glossaries.create
  • dataplex.glossaries.delete
  • dataplex.glossaries.get
  • dataplex.glossaries.getIamPolicy
  • dataplex.glossaries.import
  • dataplex.glossaries.list
  • dataplex.glossaries.requestChanges
  • dataplex.glossaries.setIamPolicy
  • dataplex.glossaries.update

dataplex.glossaryCategories.*

  • dataplex.glossaryCategories.create
  • dataplex.glossaryCategories.delete
  • dataplex.glossaryCategories.get
  • dataplex.glossaryCategories.list
  • dataplex.glossaryCategories.update

dataplex.glossaryTerms.*

  • dataplex.glossaryTerms.create
  • dataplex.glossaryTerms.delete
  • dataplex.glossaryTerms.get
  • dataplex.glossaryTerms.list
  • dataplex.glossaryTerms.update
  • dataplex.glossaryTerms.use

dataplex.lakeActions.list

dataplex.lakes.*

  • dataplex.lakes.create
  • dataplex.lakes.delete
  • dataplex.lakes.get
  • dataplex.lakes.getIamPolicy
  • dataplex.lakes.list
  • dataplex.lakes.setIamPolicy
  • dataplex.lakes.update

dataplex.locations.*

  • dataplex.locations.get
  • dataplex.locations.list

dataplex.metadataFeeds.*

  • dataplex.metadataFeeds.create
  • dataplex.metadataFeeds.delete
  • dataplex.metadataFeeds.get
  • dataplex.metadataFeeds.list
  • dataplex.metadataFeeds.update

dataplex.metadataJobs.*

  • dataplex.metadataJobs.cancel
  • dataplex.metadataJobs.create
  • dataplex.metadataJobs.get
  • dataplex.metadataJobs.list

dataplex.operations.*

  • dataplex.operations.cancel
  • dataplex.operations.delete
  • dataplex.operations.get
  • dataplex.operations.list

dataplex.partitions.*

  • dataplex.partitions.create
  • dataplex.partitions.delete
  • dataplex.partitions.get
  • dataplex.partitions.list
  • dataplex.partitions.update

dataplex.tasks.*

  • dataplex.tasks.cancel
  • dataplex.tasks.create
  • dataplex.tasks.delete
  • dataplex.tasks.get
  • dataplex.tasks.getIamPolicy
  • dataplex.tasks.list
  • dataplex.tasks.run
  • dataplex.tasks.setIamPolicy
  • dataplex.tasks.update

dataplex.zoneActions.list

dataplex.zones.*

  • dataplex.zones.create
  • dataplex.zones.delete
  • dataplex.zones.get
  • dataplex.zones.getIamPolicy
  • dataplex.zones.list
  • dataplex.zones.setIamPolicy
  • dataplex.zones.update

resourcemanager.projects.get

resourcemanager.projects.list

(roles/dataplex.dataScanAdmin)

Full access to DataScan resources.

dataplex.datascans.*

  • dataplex.datascans.cancel
  • dataplex.datascans.create
  • dataplex.datascans.delete
  • dataplex.datascans.get
  • dataplex.datascans.getData
  • dataplex.datascans.getIamPolicy
  • dataplex.datascans.list
  • dataplex.datascans.run
  • dataplex.datascans.setIamPolicy
  • dataplex.datascans.update

dataplex.operations.get

dataplex.operations.list

(roles/dataplex.editor)

Write access to Dataplex Universal Catalog resources, except for catalog resources like entries, entry groups, and glossaries.

cloudasset.assets.analyzeIamPolicy

dataplex.assetActions.list

dataplex.assets.create

dataplex.assets.delete

dataplex.assets.get

dataplex.assets.getIamPolicy

dataplex.assets.list

dataplex.assets.update

dataplex.content.delete

dataplex.content.get

dataplex.content.getIamPolicy

dataplex.content.list

dataplex.dataAssets.*

  • dataplex.dataAssets.create
  • dataplex.dataAssets.delete
  • dataplex.dataAssets.get
  • dataplex.dataAssets.list
  • dataplex.dataAssets.update

dataplex.dataAttributeBindings.create

dataplex.dataAttributeBindings.delete

dataplex.dataAttributeBindings.get

dataplex.dataAttributeBindings.getIamPolicy

dataplex.dataAttributeBindings.list

dataplex.dataAttributeBindings.update

dataplex.dataAttributes.bind

dataplex.dataAttributes.create

dataplex.dataAttributes.delete

dataplex.dataAttributes.get

dataplex.dataAttributes.getIamPolicy

dataplex.dataAttributes.list

dataplex.dataAttributes.update

dataplex.dataProducts.approve

dataplex.dataProducts.create

dataplex.dataProducts.delete

dataplex.dataProducts.get

dataplex.dataProducts.getIamPolicy

dataplex.dataProducts.list

dataplex.dataProducts.update

dataplex.dataTaxonomies.configureDataAccess

dataplex.dataTaxonomies.configureResourceAccess

dataplex.dataTaxonomies.create

dataplex.dataTaxonomies.delete

dataplex.dataTaxonomies.get

dataplex.dataTaxonomies.getIamPolicy

dataplex.dataTaxonomies.list

dataplex.dataTaxonomies.update

dataplex.datascans.cancel

dataplex.datascans.create

dataplex.datascans.delete

dataplex.datascans.get

dataplex.datascans.getIamPolicy

dataplex.datascans.list

dataplex.datascans.run

dataplex.datascans.update

dataplex.environments.create

dataplex.environments.delete

dataplex.environments.get

dataplex.environments.getIamPolicy

dataplex.environments.list

dataplex.environments.update

dataplex.lakeActions.list

dataplex.lakes.create

dataplex.lakes.delete

dataplex.lakes.get

dataplex.lakes.getIamPolicy

dataplex.lakes.list

dataplex.lakes.update

dataplex.operations.*

  • dataplex.operations.cancel
  • dataplex.operations.delete
  • dataplex.operations.get
  • dataplex.operations.list

dataplex.tasks.cancel

dataplex.tasks.create

dataplex.tasks.delete

dataplex.tasks.get

dataplex.tasks.getIamPolicy

dataplex.tasks.list

dataplex.tasks.run

dataplex.tasks.update

dataplex.zoneActions.list

dataplex.zones.create

dataplex.zones.delete

dataplex.zones.get

dataplex.zones.getIamPolicy

dataplex.zones.list

dataplex.zones.update

(roles/dataplex.viewer)

Read access to Dataplex Universal Catalog resources, except for catalog resources like entries, entry groups, and glossaries.

cloudasset.assets.analyzeIamPolicy

dataplex.assetActions.list

dataplex.assets.get

dataplex.assets.getIamPolicy

dataplex.assets.list

dataplex.content.get

dataplex.content.getIamPolicy

dataplex.content.list

dataplex.dataAssets.get

dataplex.dataAssets.list

dataplex.dataAttributeBindings.get

dataplex.dataAttributeBindings.getIamPolicy

dataplex.dataAttributeBindings.list

dataplex.dataAttributes.get

dataplex.dataAttributes.getIamPolicy

dataplex.dataAttributes.list

dataplex.dataProducts.get

dataplex.dataProducts.getIamPolicy

dataplex.dataProducts.list

dataplex.dataTaxonomies.get

dataplex.dataTaxonomies.getIamPolicy

dataplex.dataTaxonomies.list

dataplex.datascans.get

dataplex.datascans.getIamPolicy

dataplex.datascans.list

dataplex.environments.get

dataplex.environments.getIamPolicy

dataplex.environments.list

dataplex.lakeActions.list

dataplex.lakes.get

dataplex.lakes.getIamPolicy

dataplex.lakes.list

dataplex.operations.get

dataplex.operations.list

dataplex.tasks.get

dataplex.tasks.getIamPolicy

dataplex.tasks.list

dataplex.zoneActions.list

dataplex.zones.get

dataplex.zones.getIamPolicy

dataplex.zones.list

(roles/dataplex.aspectTypeOwner)

Grants access to creating and managing Aspect Types. Does not give the right to create/modify Entries.

datacatalog.migrationConfig.get

dataplex.aspectTypes.*

  • dataplex.aspectTypes.create
  • dataplex.aspectTypes.delete
  • dataplex.aspectTypes.get
  • dataplex.aspectTypes.getIamPolicy
  • dataplex.aspectTypes.list
  • dataplex.aspectTypes.setIamPolicy
  • dataplex.aspectTypes.update
  • dataplex.aspectTypes.use

dataplex.dataDomains.discover

dataplex.operations.get

dataplex.projects.search

resourcemanager.projects.get

resourcemanager.projects.list

(roles/dataplex.aspectTypeUser)

Grants access to use Aspect Types to create/modify Entries with the corresponding aspects.

datacatalog.migrationConfig.get

dataplex.aspectTypes.get

dataplex.aspectTypes.list

dataplex.aspectTypes.use

dataplex.dataDomains.discover

dataplex.projects.search

resourcemanager.projects.get

resourcemanager.projects.list

(roles/dataplex.bindingAdmin)

Full access on DataAttribute Binding resources.

dataplex.dataAttributeBindings.*

  • dataplex.dataAttributeBindings.create
  • dataplex.dataAttributeBindings.delete
  • dataplex.dataAttributeBindings.get
  • dataplex.dataAttributeBindings.getIamPolicy
  • dataplex.dataAttributeBindings.list
  • dataplex.dataAttributeBindings.setIamPolicy
  • dataplex.dataAttributeBindings.update

(roles/dataplex.catalogAdmin)

Full access to catalog resources, including entries, entry groups, and glossaries.

datacatalog.migrationConfig.get

dataplex.aspectTypes.*

  • dataplex.aspectTypes.create
  • dataplex.aspectTypes.delete
  • dataplex.aspectTypes.get
  • dataplex.aspectTypes.getIamPolicy
  • dataplex.aspectTypes.list
  • dataplex.aspectTypes.setIamPolicy
  • dataplex.aspectTypes.update
  • dataplex.aspectTypes.use

dataplex.changeRequests.adminDelete

dataplex.changeRequests.delete

dataplex.changeRequests.get

dataplex.changeRequests.list

dataplex.changeRequests.use

dataplex.dataDomains.discover

dataplex.entries.*

  • dataplex.entries.create
  • dataplex.entries.delete
  • dataplex.entries.get
  • dataplex.entries.getData
  • dataplex.entries.link
  • dataplex.entries.list
  • dataplex.entries.update

dataplex.entryGroups.*

  • dataplex.entryGroups.create
  • dataplex.entryGroups.delete
  • dataplex.entryGroups.export
  • dataplex.entryGroups.get
  • dataplex.entryGroups.getIamPolicy
  • dataplex.entryGroups.import
  • dataplex.entryGroups.list
  • dataplex.entryGroups.requestChanges
  • dataplex.entryGroups.setIamPolicy
  • dataplex.entryGroups.update
  • dataplex.entryGroups.useContactsAspect
  • dataplex.entryGroups.useContextAspect
  • dataplex.entryGroups.useContextEntry
  • dataplex.entryGroups.useContextEntryLink
  • dataplex.entryGroups.useDataProfileAspect
  • dataplex.entryGroups.useDataQualityRuleTemplateAspect
  • dataplex.entryGroups.useDataQualityRuleTemplateEntry
  • dataplex.entryGroups.useDataQualityScorecardAspect
  • dataplex.entryGroups.useDataRulesAspect
  • dataplex.entryGroups.useDatabaseDataPolicyAspect
  • dataplex.entryGroups.useDefinitionEntryLink
  • dataplex.entryGroups.useDescriptionsAspect
  • dataplex.entryGroups.useGenericAspect
  • dataplex.entryGroups.useGenericEntry
  • dataplex.entryGroups.useGraphProfileAspect
  • dataplex.entryGroups.useMySQLConnectorTypes
  • dataplex.entryGroups.useOracleConnectorTypes
  • dataplex.entryGroups.useOverviewAspect
  • dataplex.entryGroups.usePostgreSQLConnectorTypes
  • dataplex.entryGroups.useQueriesAspect
  • dataplex.entryGroups.useRefreshCadenceAspect
  • dataplex.entryGroups.useRelatedEntryLink
  • dataplex.entryGroups.useSQLAccessAspect
  • dataplex.entryGroups.useSQLServerConnectorTypes
  • dataplex.entryGroups.useSQLTriggersAspect
  • dataplex.entryGroups.useSchemaAspect
  • dataplex.entryGroups.useSchemaJoinAspect
  • dataplex.entryGroups.useSchemaJoinEntryLink
  • dataplex.entryGroups.useSecondaryIndexesAspect
  • dataplex.entryGroups.useStorageAspect
  • dataplex.entryGroups.useSynonymEntryLink

dataplex.entryLinks.*

  • dataplex.entryLinks.create
  • dataplex.entryLinks.delete
  • dataplex.entryLinks.get
  • dataplex.entryLinks.reference
  • dataplex.entryLinks.update

dataplex.entryTypes.*

  • dataplex.entryTypes.create
  • dataplex.entryTypes.delete
  • dataplex.entryTypes.get
  • dataplex.entryTypes.getIamPolicy
  • dataplex.entryTypes.list
  • dataplex.entryTypes.setIamPolicy
  • dataplex.entryTypes.update
  • dataplex.entryTypes.use

dataplex.glossaries.*

  • dataplex.glossaries.create
  • dataplex.glossaries.delete
  • dataplex.glossaries.get
  • dataplex.glossaries.getIamPolicy
  • dataplex.glossaries.import
  • dataplex.glossaries.list
  • dataplex.glossaries.requestChanges
  • dataplex.glossaries.setIamPolicy
  • dataplex.glossaries.update

dataplex.glossaryCategories.*

  • dataplex.glossaryCategories.create
  • dataplex.glossaryCategories.delete
  • dataplex.glossaryCategories.get
  • dataplex.glossaryCategories.list
  • dataplex.glossaryCategories.update

dataplex.glossaryTerms.*

  • dataplex.glossaryTerms.create
  • dataplex.glossaryTerms.delete
  • dataplex.glossaryTerms.get
  • dataplex.glossaryTerms.list
  • dataplex.glossaryTerms.update
  • dataplex.glossaryTerms.use

dataplex.locations.*

  • dataplex.locations.get
  • dataplex.locations.list

dataplex.operations.get

dataplex.projects.search

resourcemanager.projects.get

resourcemanager.projects.list

(roles/dataplex.catalogEditor)

Write access to catalog resources, including entries, entry groups, and glossaries. Cannot set IAM policies on resources.

datacatalog.migrationConfig.get

dataplex.aspectTypes.create

dataplex.aspectTypes.delete

dataplex.aspectTypes.get

dataplex.aspectTypes.getIamPolicy

dataplex.aspectTypes.list

dataplex.aspectTypes.update

dataplex.aspectTypes.use

dataplex.changeRequests.get

dataplex.changeRequests.list

dataplex.dataDomains.discover

dataplex.entries.*

  • dataplex.entries.create
  • dataplex.entries.delete
  • dataplex.entries.get
  • dataplex.entries.getData
  • dataplex.entries.link
  • dataplex.entries.list
  • dataplex.entries.update

dataplex.entryGroups.create

dataplex.entryGroups.delete

dataplex.entryGroups.get

dataplex.entryGroups.getIamPolicy

dataplex.entryGroups.list

dataplex.entryGroups.update

dataplex.entryGroups.useContactsAspect

dataplex.entryGroups.useContextAspect

dataplex.entryGroups.useContextEntry

dataplex.entryGroups.useContextEntryLink

dataplex.entryGroups.useDataProfileAspect

dataplex.entryGroups.useDataQualityRuleTemplateAspect

dataplex.entryGroups.useDataQualityRuleTemplateEntry

dataplex.entryGroups.useDataQualityScorecardAspect

dataplex.entryGroups.useDataRulesAspect

dataplex.entryGroups.useDatabaseDataPolicyAspect

dataplex.entryGroups.useDefinitionEntryLink

dataplex.entryGroups.useDescriptionsAspect

dataplex.entryGroups.useGenericAspect

dataplex.entryGroups.useGenericEntry

dataplex.entryGroups.useGraphProfileAspect

dataplex.entryGroups.useMySQLConnectorTypes

dataplex.entryGroups.useOracleConnectorTypes

dataplex.entryGroups.useOverviewAspect

dataplex.entryGroups.usePostgreSQLConnectorTypes

dataplex.entryGroups.useQueriesAspect

dataplex.entryGroups.useRefreshCadenceAspect

dataplex.entryGroups.useRelatedEntryLink

dataplex.entryGroups.useSQLAccessAspect

dataplex.entryGroups.useSQLServerConnectorTypes

dataplex.entryGroups.useSQLTriggersAspect

dataplex.entryGroups.useSchemaAspect

dataplex.entryGroups.useSchemaJoinAspect

dataplex.entryGroups.useSchemaJoinEntryLink

dataplex.entryGroups.useSecondaryIndexesAspect

dataplex.entryGroups.useStorageAspect

dataplex.entryGroups.useSynonymEntryLink

dataplex.entryLinks.create

dataplex.entryLinks.delete

dataplex.entryLinks.get

dataplex.entryLinks.update

dataplex.entryTypes.create

dataplex.entryTypes.delete

dataplex.entryTypes.get

dataplex.entryTypes.getIamPolicy

dataplex.entryTypes.list

dataplex.entryTypes.update

dataplex.entryTypes.use

dataplex.glossaries.create

dataplex.glossaries.delete

dataplex.glossaries.get

dataplex.glossaries.getIamPolicy

dataplex.glossaries.list

dataplex.glossaries.update

dataplex.glossaryCategories.*

  • dataplex.glossaryCategories.create
  • dataplex.glossaryCategories.delete
  • dataplex.glossaryCategories.get
  • dataplex.glossaryCategories.list
  • dataplex.glossaryCategories.update

dataplex.glossaryTerms.*

  • dataplex.glossaryTerms.create
  • dataplex.glossaryTerms.delete
  • dataplex.glossaryTerms.get
  • dataplex.glossaryTerms.list
  • dataplex.glossaryTerms.update
  • dataplex.glossaryTerms.use

dataplex.locations.*

  • dataplex.locations.get
  • dataplex.locations.list

dataplex.operations.get

dataplex.projects.search

resourcemanager.projects.get

resourcemanager.projects.list

(roles/dataplex.catalogViewer)

Read access to catalog resources, including entries, entry groups, and glossaries. Can view IAM policies on catalog resources.

datacatalog.migrationConfig.get

dataplex.aspectTypes.get

dataplex.aspectTypes.getIamPolicy

dataplex.aspectTypes.list

dataplex.changeRequests.get

dataplex.changeRequests.list

dataplex.dataDomains.discover

dataplex.entries.get

dataplex.entries.list

dataplex.entryGroups.get

dataplex.entryGroups.getIamPolicy

dataplex.entryGroups.list

dataplex.entryGroups.requestChanges

dataplex.entryLinks.get

dataplex.entryTypes.get

dataplex.entryTypes.getIamPolicy

dataplex.entryTypes.list

dataplex.glossaries.get

dataplex.glossaries.getIamPolicy

dataplex.glossaries.list

dataplex.glossaries.requestChanges

dataplex.glossaryCategories.get

dataplex.glossaryCategories.list

dataplex.glossaryTerms.get

dataplex.glossaryTerms.list

dataplex.locations.*

  • dataplex.locations.get
  • dataplex.locations.list

dataplex.projects.search

resourcemanager.projects.get

resourcemanager.projects.list

(roles/dataplex.changeRequestOwner)

Grants Change Request creator necessary permissions on a created ChangeRequest instance.

dataplex.changeRequests.delete

dataplex.changeRequests.get

dataplex.changeRequests.update

(roles/dataplex.dataDomainAdmin)

Allows full management of the Data Domain and its bindings.

dataplex.dataDomainBindings.*

  • dataplex.dataDomainBindings.create
  • dataplex.dataDomainBindings.delete
  • dataplex.dataDomainBindings.get
  • dataplex.dataDomainBindings.list

dataplex.dataDomains.create

dataplex.dataDomains.delete

dataplex.dataDomains.discover

dataplex.dataDomains.get

dataplex.dataDomains.getIamPolicy

dataplex.dataDomains.list

dataplex.dataDomains.lookupEntry

dataplex.dataDomains.setIamPolicy

dataplex.dataDomains.update

dataplex.operations.get

resourcemanager.projects.get

resourcemanager.projects.list

(roles/dataplex.dataDomainEditor)

Allows updating the Data Domain as well as full management of its bindings.

dataplex.dataDomainBindings.*

  • dataplex.dataDomainBindings.create
  • dataplex.dataDomainBindings.delete
  • dataplex.dataDomainBindings.get
  • dataplex.dataDomainBindings.list

dataplex.dataDomains.discover

dataplex.dataDomains.get

dataplex.dataDomains.getIamPolicy

dataplex.dataDomains.list

dataplex.dataDomains.lookupEntry

dataplex.dataDomains.update

dataplex.operations.get

resourcemanager.projects.get

resourcemanager.projects.list

(roles/dataplex.dataDomainEntryReader)

Allows discovering and viewing the Data Domain, its subdomains, and metadata of all its resources.

dataplex.dataDomains.discover

dataplex.dataDomains.get

dataplex.dataDomains.list

dataplex.dataDomains.lookupEntry

(roles/dataplex.dataDomainViewer)

Allows viewing the configuration of the Data Domain and its bindings.

dataplex.dataDomainBindings.get

dataplex.dataDomainBindings.list

dataplex.dataDomains.discover

dataplex.dataDomains.get

dataplex.dataDomains.getIamPolicy

dataplex.dataDomains.list

dataplex.dataDomains.lookupEntry

resourcemanager.projects.get

resourcemanager.projects.list

(roles/dataplex.dataOwner)

Owner access to data. To be granted to Dataplex Universal Catalog resources Lake, Zone or Asset only.

dataplex.assets.ownData

dataplex.assets.readData

dataplex.assets.writeData

(roles/dataplex.dataProductsAdmin)

Full access to Data Products.

dataplex.dataAssets.*

  • dataplex.dataAssets.create
  • dataplex.dataAssets.delete
  • dataplex.dataAssets.get
  • dataplex.dataAssets.list
  • dataplex.dataAssets.update

dataplex.dataProducts.*

  • dataplex.dataProducts.approve
  • dataplex.dataProducts.create
  • dataplex.dataProducts.delete
  • dataplex.dataProducts.get
  • dataplex.dataProducts.getIamPolicy
  • dataplex.dataProducts.list
  • dataplex.dataProducts.setIamPolicy
  • dataplex.dataProducts.update

dataplex.operations.get

resourcemanager.projects.get

resourcemanager.projects.list

(roles/dataplex.dataProductsConsumer)

Restricted read access, intended for consumers of Data Products.

dataplex.dataAssets.get

dataplex.dataAssets.list

dataplex.dataProducts.get

resourcemanager.projects.get

resourcemanager.projects.list

(roles/dataplex.dataProductsEditor)

Write access to Data Products.

dataplex.dataAssets.*

  • dataplex.dataAssets.create
  • dataplex.dataAssets.delete
  • dataplex.dataAssets.get
  • dataplex.dataAssets.list
  • dataplex.dataAssets.update

dataplex.dataProducts.approve

dataplex.dataProducts.create

dataplex.dataProducts.delete

dataplex.dataProducts.get

dataplex.dataProducts.getIamPolicy

dataplex.dataProducts.list

dataplex.dataProducts.update

dataplex.operations.get

resourcemanager.projects.get

resourcemanager.projects.list

(roles/dataplex.dataProductsViewer)

Read access to Data Products.

dataplex.dataAssets.get

dataplex.dataAssets.list

dataplex.dataProducts.get

dataplex.dataProducts.getIamPolicy

dataplex.dataProducts.list