使用 IAM 控管存取權

「服務使用情形」使用 身分與存取權管理 (IAM) 來控管服務的存取權。本頁面說明與「服務使用情形」相關的 IAM 角色和權限，以及如何使用這些角色和權限來控管存取權。

資源模型

針對「服務使用情形」，有三種相關資源：

  1. 您正在使用的服務。

  2. 您使用的服務所在的專案。

  3. 某些方法傳回的作業或長時間執行的作業。

每種「服務使用情形」方法都需要上述一或多項資源的權限。

IAM 權限

下表顯示每個 Service Usage API 方法所需的權限。您也可以在 API 參考資料中找到這項資訊。

方法 所需權限
services.batchEnable 在專案中：serviceusage.services.enable
在服務中：servicemanagement.services.bind
services.enable 專案：serviceusage.services.enable
服務：servicemanagement.services.bind
services.disable 在專案中：serviceusage.services.disable
services.get 在專案中：serviceusage.services.get
services.list 在專案中：serviceusage.services.list
services.consumerQuotaMetrics.list
services.consumerQuotaMetrics.get
services.consumerQuotaMetrics.limits.get
services.consumerQuotaMetrics.limits.consumerOverrides.list
services.consumerQuotaMetrics.limits.adminOverrides.list
services.consumerQuotaMetrics.limits.producerOverrides.list 		專案：serviceusage.quota.get
服務：servicemanagement.services.bind
services.consumerQuotaMetrics.consumerOverrides.create
services.consumerQuotaMetrics.consumerOverrides.patch
services.consumerQuotaMetrics.consumerOverrides.delete
services.adminQuotaMetrics.adminOverrides.create
services.adminQuotaMetrics.adminOverrides.patch
services.adminQuotaMetrics.adminOverrides.delete 		專案：serviceusage.quota.update
服務：servicemanagement.services.bind
用於配額與帳單的專案。詳情請參閱「系統參數」。 在專案中：serviceusage.services.use

IAM 角色

使用 IAM 時，您必須為使用者授予角色，才能授予權限。下表列出 IAM 基本和預先定義角色，以及這些角色所含與「服務使用情形」相關的權限。

如要進一步瞭解角色，請參閱瞭解角色。

基本角色

名稱 名稱 權限
roles/viewer 檢視者 serviceusage.services.get
serviceusage.services.list
serviceusage.quotas.get

roles/editor

roles/owner

編輯者

擁有者

 serviceusage.services.get
serviceusage.services.list
serviceusage.services.disable
serviceusage.services.enable
serviceusage.services.use
serviceusage.quotas.get
serviceusage.quotas.update

預先定義的角色

Role Permissions

(roles/serviceusage.apiKeysAdmin)

Ability to create, delete, update, get and list API keys for a project.

apikeys.*

  • apikeys.keys.create
  • apikeys.keys.delete
  • apikeys.keys.get
  • apikeys.keys.getKeyString
  • apikeys.keys.list
  • apikeys.keys.lookup
  • apikeys.keys.undelete
  • apikeys.keys.update

orgpolicy.policy.get

serviceusage.apiKeys.*

  • serviceusage.apiKeys.regenerate
  • serviceusage.apiKeys.revert

serviceusage.operations.get

(roles/serviceusage.apiKeysViewer)

Ability to get and list API keys for a project.

apikeys.keys.get

apikeys.keys.getKeyString

apikeys.keys.list

apikeys.keys.lookup

(roles/serviceusage.serviceUsageAdmin)

Ability to enable, disable, and inspect service states, inspect operations, and consume quota and billing for a consumer project.

monitoring.timeSeries.list

serviceusage.operations.get

serviceusage.quotas.*

  • serviceusage.quotas.get
  • serviceusage.quotas.update

serviceusage.services.*

  • serviceusage.services.disable
  • serviceusage.services.enable
  • serviceusage.services.get
  • serviceusage.services.list
  • serviceusage.services.use

(roles/serviceusage.serviceUsageConsumer)

Ability to inspect service states and operations, and consume quota and billing for a consumer project.

monitoring.timeSeries.list

serviceusage.operations.get

serviceusage.quotas.get

serviceusage.services.get

serviceusage.services.list

serviceusage.services.use

(roles/serviceusage.serviceUsageViewer)

Ability to inspect service states and operations for a consumer project.

monitoring.timeSeries.list

serviceusage.operations.get

serviceusage.quotas.get

serviceusage.services.get

serviceusage.services.list