IAM のロールと権限

このページでは、Developer Connect のロールと権限について説明します。

Developer Connect でのアクセス制御は、 Identity and Access Management（IAM）を使用して制御します。IAM を使用すると、 リソースの権限を作成および 管理できます。 Google Cloud Developer Connect では、 事前定義された IAM ロールのセットが用意されています。 各ロールには、特定のタイプの アクセスまたはアクションに適した一連の権限が含まれています。最小権限の セキュリティ原則を導入し、 リソースに対する必要なアクセス権のみを付与することをおすすめします。

事前定義された Developer Connect のロール

役割を使用して、アカウントに権限を割り当てます。次の表に、Developer Connect で使用可能な IAM ロールと、それに含まれる権限を示します。

IAM のドキュメントには、 すべての事前定義ロールの検索可能なリファレンス が含まれています。

Role Permissions

(roles/developerconnect.admin)

Full access to Developer Connect resources.

developerconnect.connections.constructGitHubAppManifest

developerconnect.connections.create

developerconnect.connections.delete

developerconnect.connections.fetchGitHubInstallations

developerconnect.connections.fetchLinkableGitRepositories

developerconnect.connections.generateGitHubStateToken

developerconnect.connections.get

developerconnect.connections.list

developerconnect.connections.processGitHubAppCreationCallback

developerconnect.connections.processGitHubOAuthCallback

developerconnect.connections.update

developerconnect.gitRepositoryLinks.create

developerconnect.gitRepositoryLinks.delete

developerconnect.gitRepositoryLinks.fetchGitRefs

developerconnect.gitRepositoryLinks.get

developerconnect.gitRepositoryLinks.gitProxyRead

developerconnect.gitRepositoryLinks.gitProxyWrite

developerconnect.gitRepositoryLinks.list

developerconnect.locations.*

  • developerconnect.locations.get
  • developerconnect.locations.list

developerconnect.operations.*

  • developerconnect.operations.cancel
  • developerconnect.operations.delete
  • developerconnect.operations.get
  • developerconnect.operations.list

resourcemanager.projects.get

resourcemanager.projects.list

(roles/developerconnect.viewer)

Read-only access to Developer Connect resources.

developerconnect.connections.get

developerconnect.connections.list

developerconnect.gitRepositoryLinks.get

developerconnect.gitRepositoryLinks.list

developerconnect.locations.*

  • developerconnect.locations.get
  • developerconnect.locations.list

developerconnect.operations.get

developerconnect.operations.list

resourcemanager.projects.get

resourcemanager.projects.list

(roles/developerconnect.connectionHttpProxyWriter)

Grants read and write access to connections through the HTTP Proxy.

developerconnect.connections.httpProxyRead

developerconnect.connections.httpProxyWrite

(roles/developerconnect.gitProxyReader)

Grants read-only access to repositories through the Git Proxy.

developerconnect.gitRepositoryLinks.gitProxyRead

(roles/developerconnect.gitProxyUser)

Grants read and write access to repositories through the Git Proxy.

developerconnect.gitRepositoryLinks.gitProxyRead

developerconnect.gitRepositoryLinks.gitProxyWrite

(roles/developerconnect.insightsAdmin)

Admin access to Developer Connect Insights resources.

developerconnect.deploymentEvents.*

  • developerconnect.deploymentEvents.get
  • developerconnect.deploymentEvents.list

developerconnect.insightsConfigs.*

  • developerconnect.insightsConfigs.create
  • developerconnect.insightsConfigs.delete
  • developerconnect.insightsConfigs.get
  • developerconnect.insightsConfigs.list
  • developerconnect.insightsConfigs.update

developerconnect.locations.*

  • developerconnect.locations.get
  • developerconnect.locations.list

developerconnect.operations.get

developerconnect.operations.list

resourcemanager.projects.get

resourcemanager.projects.list

(roles/developerconnect.insightsAgent)

Allow Developer Connect to access SDLC information.

cloudasset.assets.exportResource

cloudasset.assets.listResource

cloudasset.assets.searchAllResources

cloudasset.feeds.create

cloudasset.feeds.get

cloudasset.feeds.update

containeranalysis.occurrences.get

containeranalysis.occurrences.list

logging.logEntries.create

(roles/developerconnect.insightsViewer)

Read-only access to Developer Connect Insights resources.

developerconnect.deploymentEvents.*

  • developerconnect.deploymentEvents.get
  • developerconnect.deploymentEvents.list

developerconnect.insightsConfigs.get

developerconnect.insightsConfigs.list

developerconnect.locations.*

  • developerconnect.locations.get
  • developerconnect.locations.list

developerconnect.operations.get

developerconnect.operations.list

resourcemanager.projects.get

resourcemanager.projects.list

(roles/developerconnect.oauthAdmin)

Grants read and write access to AccountConnector resources.

developerconnect.accountConnectors.*

  • developerconnect.accountConnectors.create
  • developerconnect.accountConnectors.delete
  • developerconnect.accountConnectors.fetchUserRepositories
  • developerconnect.accountConnectors.