IAM によるアクセス制御

デフォルトでは、すべての Google Cloud コンソール プロジェクトに単一のユーザー（元のプロジェクト作成者）が設定されています。その他のユーザーは、プロジェクト チームのメンバーとして追加されるまで、そのプロジェクトにアクセスできず、 Google Cloud リソースにもアクセスできません。このページでは、ユーザーをプロジェクトに追加するためのさまざまな方法について説明します。

また、Deployment Manager を通じて他のGoogle Cloud API の認証を行い、ユーザーに代わってリソースを作成できるようにする方法についても説明します。

始める前に

ユーザーのアクセス制御

プロジェクトに対するアクセス権をユーザーに付与して、各ユーザーが構成ファイルやデプロイを作成できるようにするには、ユーザーをプロジェクト チームメンバーに追加して、Identity and Access Management（IAM）の正しい役割を許可します。

チームメンバーを追加する方法については、チームメンバーを追加するをご覧ください。

Deployment Manager の役割

Role Permissions

(roles/deploymentmanager.admin)

Admin role for Deployment Manager.

deploymentmanager.*

  • deploymentmanager.compositeTypes.create
  • deploymentmanager.compositeTypes.delete
  • deploymentmanager.compositeTypes.get
  • deploymentmanager.compositeTypes.list
  • deploymentmanager.compositeTypes.update
  • deploymentmanager.deployments.cancelPreview
  • deploymentmanager.deployments.create
  • deploymentmanager.deployments.delete
  • deploymentmanager.deployments.get
  • deploymentmanager.deployments.getIamPolicy
  • deploymentmanager.deployments.list
  • deploymentmanager.deployments.setIamPolicy
  • deploymentmanager.deployments.stop
  • deploymentmanager.deployments.update
  • deploymentmanager.manifests.get
  • deploymentmanager.manifests.list
  • deploymentmanager.operations.get
  • deploymentmanager.operations.list
  • deploymentmanager.resources.get
  • deploymentmanager.resources.list
  • deploymentmanager.typeProviders.create
  • deploymentmanager.typeProviders.delete
  • deploymentmanager.typeProviders.get
  • deploymentmanager.typeProviders.getType
  • deploymentmanager.typeProviders.list
  • deploymentmanager.typeProviders.listTypes
  • deploymentmanager.typeProviders.update
  • deploymentmanager.types.create
  • deploymentmanager.types.delete
  • deploymentmanager.types.get
  • deploymentmanager.types.list
  • deploymentmanager.types.update

resourcemanager.projects.get

resourcemanager.projects.list

serviceusage.consumerpolicy.analyze

serviceusage.consumerpolicy.get

serviceusage.effectivepolicy.get

serviceusage.groups.*

  • serviceusage.groups.list
  • serviceusage.groups.listExpandedMembers
  • serviceusage.groups.listMembers

serviceusage.quotas.get

serviceusage.services.get

serviceusage.services.list

serviceusage.values.test

(roles/deploymentmanager.editor)

Provides the permissions necessary to create and manage deployments.

Lowest-level resources where you can grant this role:

  • Project

deploymentmanager.compositeTypes.*

  • deploymentmanager.compositeTypes.create
  • deploymentmanager.compositeTypes.delete
  • deploymentmanager.compositeTypes.get
  • deploymentmanager.compositeTypes.list
  • deploymentmanager.compositeTypes.update

deploymentmanager.deployments.cancelPreview

deploymentmanager.deployments.create

deploymentmanager.deployments.delete

deploymentmanager.deployments.get

deploymentmanager.deployments.list

deploymentmanager.deployments.stop

deploymentmanager.deployments.update

deploymentmanager.manifests.*

  • deploymentmanager.manifests.get
  • deploymentmanager.manifests.list

deploymentmanager.operations.*

  • deploymentmanager.operations.get
  • deploymentmanager.operations.list

deploymentmanager.resources.*

  • deploymentmanager.resources.get
  • deploymentmanager.resources.list

deploymentmanager.typeProviders.*

  • deploymentmanager.typeProviders.create
  • deploymentmanager.typeProviders.delete
  • deploymentmanager.typeProviders.get
  • deploymentmanager.typeProviders.getType
  • deploymentmanager.typeProviders.list
  • deploymentmanager.typeProviders.listTypes
  • deploymentmanager.typeProviders.update

deploymentmanager.types.*

  • deploymentmanager.types.create
  • deploymentmanager.types.delete
  • deploymentmanager.types.get
  • deploymentmanager.types.list
  • deploymentmanager.types.update

resourcemanager.projects.get

resourcemanager.projects.list

serviceusage.consumerpolicy.analyze

serviceusage.consumerpolicy.get

serviceusage.effectivepolicy.get

serviceusage.groups.*

  • serviceusage.groups.list
  • serviceusage.groups.listExpandedMembers
  • serviceusage.groups.listMembers

serviceusage.quotas.get

serviceusage.services.get

serviceusage.services.list

serviceusage.values.test

(roles/deploymentmanager.viewer)

Provides read-only access to all Deployment Manager-related resources.

Lowest-level resources where you can grant this role:

  • Project

deploymentmanager.compositeTypes.get

deploymentmanager.compositeTypes.list

deploymentmanager.deployments.get

deploymentmanager.deployments.list

deploymentmanager.manifests.*

  • deploymentmanager.manifests.get
  • deploymentmanager.manifests.list

deploymentmanager.operations.*

  • deploymentmanager.operations.get
  • deploymentmanager.operations.list

deploymentmanager.resources.*

  • deploymentmanager.resources.get
  • deploymentmanager.resources.list

deploymentmanager.typeProviders.get

deploymentmanager.typeProviders.getType

deploymentmanager.typeProviders.list

deploymentmanager.typeProviders.listTypes

deploymentmanager.types.get

deploymentmanager.types.list

resourcemanager.projects.get

resourcemanager.projects.list

serviceusage.consumerpolicy.analyze

serviceusage.consumerpolicy.get

serviceusage.effectivepolicy.get

serviceusage.groups.*

  • serviceusage.groups.list
  • serviceusage.groups.listExpandedMembers
  • serviceusage.groups.listMembers

serviceusage.quotas.get

serviceusage.services.get

serviceusage.services.list

serviceusage.values.test

(roles/deploymentmanager.typeEditor)

Provides read and write access to all Type Registry resources.

Lowest-level resources where you can grant this role:

  • Project

deploymentmanager.compositeTypes.*

  • deploymentmanager.compositeTypes.create
  • deploymentmanager.compositeTypes.delete
  • deploymentmanager.compositeTypes.get
  • deploymentmanager.compositeTypes.list
  • deploymentmanager.compositeTypes.update

deploymentmanager.operations.get

deploymentmanager.typeProviders.*

  • deploymentmanager.typeProviders.create
  • deploymentmanager.typeProviders.delete
  • deploymentmanager.typeProviders.get
  • deploymentmanager.typeProviders.getType
  • deploymentmanager.typeProviders.list
  • deploymentmanager.typeProviders.listTypes
  • deploymentmanager.typeProviders.update

deploymentmanager.types.*

  • deploymentmanager.types.create
  • deploymentmanager.types.delete
  • deploymentmanager.types.get
  • deploymentmanager.types.list
  • deploymentmanager.types.update

resourcemanager.projects.get

resourcemanager.projects.list

serviceusage.consumerpolicy.analyze

serviceusage.consumerpolicy.get

serviceusage.effectivepolicy.get

serviceusage.groups.*

  • serviceusage.groups.list
  • serviceusage.groups.listExpandedMembers
  • serviceusage.groups.listMembers

serviceusage.quotas.get

serviceusage.services.get

serviceusage.values.test

(roles/deploymentmanager.typeViewer)

Provides read-only access to all Type Registry resources.

Lowest-level resources where you can grant this role:

  • Project

deploymentmanager.compositeTypes.get

deploymentmanager.compositeTypes.list

deploymentmanager.typeProviders.get

deploymentmanager.typeProviders.getType

deploymentmanager.typeProviders.list

deploymentmanager.typeProviders.listTypes

deploymentmanager.types.get

deploymentmanager.types.list

resourcemanager.projects.get

resourcemanager.projects.list

serviceusage.consumerpolicy.analyze

serviceusage.consumerpolicy.get

serviceusage.effectivepolicy.get

serviceusage.groups.*

  • serviceusage.groups.list
  • serviceusage.groups.listExpandedMembers
  • serviceusage.groups.listMembers

serviceusage.quotas.get

serviceusage.services.get

serviceusage.values.test

Service agent roles

Service agent roles should only be granted to service agents.

Role Permissions

(roles/clouddeploymentmanager.serviceAgent)

Allows Deployment Manager service to actuate resources across DM projects and folders

accesscontextmanager.accessLevels.create

accesscontextmanager.accessLevels.delete

accesscontextmanager.accessLevels.get

accesscontextmanager.accessLevels.update

accesscontextmanager.policies.list

accesscontextmanager.servicePerimeters.create

accesscontextmanager.servicePerimeters.delete

accesscontextmanager.servicePerimeters.get

accesscontextmanager.servicePerimeters.update

appengine.applications.get

appengine.operations.get

appengine.services.update

appengine.versions.create

appengine.versions.delete

appengine.versions.get

appengine.versions.list

artifactregistry.repositories.create

artifactregistry.repositories.delete

artifactregistry.repositories.get

artifactregistry.repositories.update

bigquery.connections.get

bigquery.datasets.create

bigquery.datasets.delete

bigquery.datasets.get

bigquery.datasets.getIamPolicy

bigquery.datasets.update

bigquery.jobs.create

bigquery.routines.create

bigquery.routines.get

bigquery.routines.update

bigquery.tables.create

bigquery.tables.delete

bigquery.tables.get

bigquery.tables.getData

bigquery.tables.setCategory

bigquery.tables.update

bigquery.tables.updateData

bigtable.instances.create

bigtable.instances.delete

bigtable.instances.get

bigtable.instances.update

bigtable.tables.create

bigtable.tables.delete

bigtable.tables.get

bigtable.tables.update

billing.resourceAssociations.create

billing.resourcebudgets.write

cloudbuild.builds.create

cloudbuild.builds.get

cloudfunctions.functions.call

cloudfunctions.functions.create

cloudfunctions.functions.delete

cloudfunctions.functions.get

cloudfunctions.functions.getIamPolicy

cloudfunctions.functions.list

cloudfunctions.functions.update

cloudfunctions.operations.get

cloudprivatecatalog.targets.get

cloudscheduler.jobs.create

cloudscheduler.jobs.delete

cloudscheduler.jobs.get

cloudscheduler.jobs.update

cloudsql.backupRuns.create

cloudsql.databases.*

  • cloudsql.databases.create
  • cloudsql.databases.delete
  • cloudsql.databases.get
  • cloudsql.databases.list
  • cloudsql.databases.update

cloudsql.instances.create

cloudsql.instances.delete

cloudsql.instances.get

cloudsql.instances.import

cloudsql.instances.restart

cloudsql.instances.update

cloudsql.sslCerts.create

cloudsql.sslCerts.delete

cloudsql.sslCerts.get

cloudsql.users.create

cloudsql.users.delete

cloudtasks.queues.create

cloudtasks.queues.delete

cloudtasks.queues.get

compute.addresses.create

compute.addresses.createInternal

compute.addresses.delete

compute.addresses.deleteInternal

compute.addresses.get

compute.addresses.list

compute.addresses.setLabels

compute.addresses.use

compute.addresses.useInternal

compute.autoscalers.create

compute.autoscalers.delete

compute.autoscalers.get

compute.autoscalers.update

compute.backendBuckets.create

compute.backendBuckets.delete

compute.backendBuckets.get

compute.backendBuckets.update

compute.backendBuckets.use

compute.backendServices.create

compute.backendServices.delete

compute.backendServices.get

compute.backendServices.setSecurityPolicy

compute.backendServices.update

compute.backendServices.use

compute.disks.addResourcePolicies

compute.disks.create

compute.disks.delete

compute.disks.get

compute.disks.removeResourcePolicies

compute.disks.resize

compute.disks.setLabels

compute.disks.update

compute.disks.use

compute.disks.useReadOnly

compute.externalVpnGateways.create

compute.externalVpnGateways.delete

compute.externalVpnGateways.get

compute.externalVpnGateways.setLabels

compute.externalVpnGateways.use

compute.firewallPolicies.create

compute.firewallPolicies.delete

compute.firewallPolicies.get

compute.firewalls.create

compute.firewalls.delete

compute.firewalls.get

compute.firewalls.list

compute.firewalls.update

compute.forwardingRules.create

compute.forwardingRules.delete

compute.forwardingRules.get

compute.forwardingRules.pscCreate

compute.forwardingRules.pscSetLabels

compute.forwardingRules.setLabels

compute.forwardingRules.setTarget

compute.forwardingRules.update

compute.forwardingRules.use

compute.globalAddresses.create

compute.globalAddresses.createInternal

compute.globalAddresses.delete

compute.globalAddresses.deleteInternal

compute.globalAddresses.get

compute.globalAddresses.setLabels

compute.globalAddresses.use

compute.globalForwardingRules.create

compute.globalForwardingRules.delete

compute.globalForwardingRules.get

compute.globalForwardingRules.pscCreate

compute.globalForwardingRules.pscDelete

compute.globalForwardingRules.pscSetLabels

compute.globalForwardingRules.setLabels

compute.globalNetworkEndpointGroups.attachNetworkEndpoints

compute.globalNetworkEndpointGroups.create

compute.globalNetworkEndpointGroups.delete

compute.globalNetworkEndpointGroups.get

compute.globalNetworkEndpointGroups.use

compute.globalOperations.get

compute.healthChecks.create

compute.healthChecks.delete

compute.healthChecks.get

compute.healthChecks.update

compute.healthChecks.use

compute.healthChecks.useReadOnly

compute.httpHealthChecks.create

compute.httpHealthChecks.delete

compute.httpHealthChecks.get

compute.httpHealthChecks.update

compute.httpHealthChecks.use

compute.httpHealthChecks.useReadOnly

compute.httpsHealthChecks.create

compute.httpsHealthChecks.delete

compute.httpsHealthChecks.get

compute.httpsHealthChecks.update

compute.httpsHealthChecks.use

compute.httpsHealthChecks.useReadOnly

compute.images.create

compute.images.delete

compute.images.deprecate

compute.images.get

compute.images.setLabels

compute.images.useReadOnly

compute.instanceGroupManagers.create

compute.instanceGroupManagers.delete

compute.instanceGroupManagers.get

compute.instanceGroupManagers.update

compute.instanceGroupManagers.use

compute.instanceGroups.create

compute.instanceGroups.delete

compute.instanceGroups.get

compute.instanceGroups.update

compute.instanceGroups.use

compute.instanceTemplates.create

compute.instanceTemplates.delete

compute.instanceTemplates.get

compute.instanceTemplates.useReadOnly

compute.instances.addAccessConfig

compute.instances.create

compute.instances.delete

compute.instances.deleteAccessConfig

compute.instances.get

compute.instances.listTagBindings

compute.instances.resume

compute.instances.setDeletionProtection

compute.instances.setDiskAutoDelete

compute.instances.setLabels

compute.instances.setMetadata

compute.instances.setServiceAccount

compute.instances.setTags

compute.instances.start

compute.instances.stop

compute.instances.suspend

compute.instances.update

compute.instances.updateDisplayDevice

compute.instances.use

compute.interconnectAttachments.create

compute.interconnectAttachments.delete

compute.interconnectAttachments.get

compute.interconnectAttachments.setLabels

compute.interconnectAttachments.update

compute.interconnects.create

compute.interconnects.delete

compute.interconnects.get

compute.interconnects.setLabels

compute.interconnects.use

compute.machineImages.useReadOnly

compute.machineTypes.get

compute.networkEndpointGroups.attachNetworkEndpoints

compute.networkEndpointGroups.create

compute.networkEndpointGroups.delete

compute.networkEndpointGroups.get

compute.networkEndpointGroups.use

compute.networks.addPeering

compute.networks.create

compute.networks.delete

compute.networks.get

compute.networks.listPeeringRoutes

compute.networks.removePeering

compute.networks.switchToCustomMode

compute.networks.update

compute.networks.updatePolicy

compute.networks.use

compute.networks.useExternalIp

compute.organizations.disableXpnResource

compute.organizations.enableXpnHost

compute.organizations.enableXpnResource

compute.packetMirrorings.create

compute.packetMirrorings.delete

compute.packetMirrorings.get

compute.projects.get

compute.projects.setUsageExportBucket

compute.regionBackendServices.create

compute.regionBackendServices.delete

compute.regionBackendServices.get

compute.regionBackendServices.update

compute.regionBackendServices.use

compute.regionHealthChecks.create

compute.regionHealthChecks.delete

compute.regionHealthChecks.get

compute.regionHealthChecks.update

compute.regionHealthChecks.use

compute.regionHealthChecks.useReadOnly

compute.regionNetworkEndpointGroups.create

compute.regionNetworkEndpointGroups.delete

compute.regionNetworkEndpointGroups.get

compute.regionNetworkEndpointGroups.use

compute.regionOperations.get

compute.regionSslCertificates.create

compute.regionSslCertificates.delete

compute.regionSslCertificates.get

compute.regionTargetHttpProxies.create

compute.regionTargetHttpProxies.delete

compute.regionTargetHttpProxies.get

compute.regionTargetHttpProxies.use

compute.regionTargetHttpsProxies.create

compute.regionTargetHttpsProxies.delete

compute.regionTargetHttpsProxies.get

compute.regionTargetHttpsProxies.use

compute.regionUrlMaps.create

compute.regionUrlMaps.delete

compute.regionUrlMaps.get

compute.regionUrlMaps.use

compute.regions.get

compute.reservations.list

compute.resourcePolicies.create

compute.resourcePolicies.delete

compute.resourcePolicies.get

compute.resourcePolicies.use

compute.routers.create

compute.routers.delete

compute.routers.get

compute.routers.update

compute.routers.use

compute.routes.create

compute.routes.delete

compute.routes.get

compute.securityPolicies.create

compute.securityPolicies.delete

compute.securityPolicies.get

compute.securityPolicies.setLabels

compute.securityPolicies.update

compute.securityPolicies.use

compute.serviceAttachments.create

compute.serviceAttachments.get

compute.snapshots.useReadOnly

compute.sslCertificates.create

compute.sslCertificates.delete

compute.sslCertificates.get

compute.sslPolicies.create

compute.sslPolicies.delete

compute.sslPolicies.get

compute.sslPolicies.use

compute.subnetworks.create

compute.subnetworks.delete

compute.subnetworks.expandIpCidrRange

compute.subnetworks.get

compute.subnetworks.list

compute.subnetworks.mirror

compute.subnetworks.update

compute.subnetworks.use

compute.subnetworks.useExternalIp

compute.targetHttpProxies.create

compute.targetHttpProxies.delete

compute.targetHttpProxies.get

compute.targetHttpProxies.use

compute.targetHttpsProxies.create

compute.targetHttpsProxies.delete

compute.targetHttpsProxies.get

compute.targetHttpsProxies.setSslCertificates

compute.targetHttpsProxies.setSslPolicy

compute.targetHttpsProxies.use

compute.targetInstances.create

compute.targetInstances.delete

compute.targetInstances.get

compute.targetInstances.use

compute.targetPools.addHealthCheck

compute.targetPools.addInstance

compute.targetPools.create

compute.targetPools.delete

compute.targetPools.get

compute.targetPools.removeHealthCheck

compute.targetPools.removeInstance

compute.targetPools.use

compute.targetSslProxies.create

compute.targetSslProxies.delete

compute.targetSslProxies.get

compute.targetSslProxies.setSslCertificates

compute.targetSslProxies.use

compute.targetTcpProxies.create

compute.targetTcpProxies.delete

compute.targetTcpProxies.get

compute.targetTcpProxies.use

compute.targetVpnGateways.create

compute.targetVpnGateways.delete

compute.targetVpnGateways.get

compute.targetVpnGateways.setLabels

compute.targetVpnGateways.use

compute.urlMaps.create

compute.urlMaps.delete

compute.urlMaps.get

compute.urlMaps.update

compute.urlMaps.use

compute.vpnGateways.create

compute.vpnGateways.delete