使用 IAM 进行 Bigtable 访问权限控制

借助 Identity and Access Management (IAM)，您可以管理 Bigtable 资源的精细权限。IAM 可帮助您在项目、实例和表之间实施最小权限原则并保护数据。

Bigtable 使用 IAM 进行访问权限控制。如需控制谁有权访问资源，请对资源设置 IAM 政策。

Bigtable 资源按层次结构进行组织。Cloud de Confiance by S3NS 项目是 Bigtable 实例的父级，而 Bigtable 实例是其集群和表的父级。表是其授权视图的父级，而集群是其备份的父级。您可以在每个级别配置访问权限控制。

如果您在某个层级拥有权限，则会自动拥有该层级之下的权限。例如，如果您在项目级层拥有访问权限，则您有权访问该项目中的实例、集群、表、授权视图、持续物化视图。如果您获得了对授权视图或持续具体化视图的访问权限，则不会自动获得对授权视图或持续具体化视图的父级资源（例如表和实例）的访问权限。这种行为称为政策继承。

如需详细了解 IAM 层次结构，请参阅 IAM 政策继承。

访问权限控制示例

以下示例说明了如何在项目级层使用访问权限控制：

  • 允许用户从项目内的任何表中读取数据，但不允许他们写入数据。
  • 允许用户从项目内的任何表中读取数据以及向表中写入数据，但不允许他们管理实例。
  • 允许用户从项目内的任何表中读取数据以及向表中写入数据，并且允许他们管理实例。

以下示例说明了如何在实例级层使用访问权限控制：

  • 允许用户从具有多个实例的项目中的一个实例中读取任何表。
  • 允许用户仅管理具有多个实例的项目中的一个实例。

以下示例说明了如何在表级层使用访问权限控制：

  • 允许用户向表中写入数据，但不允许其从表中读取数据。
  • 允许用户从表中读取内容，但不允许其向表中写入数据。

以下示例说明了如何在备份级层使用访问权限控制：

  • 禁止用户删除备份。
  • 阻止用户从备份中恢复。

以下示例说明了如何在授权视图级层使用访问权限控制：

  • 允许用户读取授权视图，但不能修改。
  • 让用户只能查看表的多个授权视图中的一个视图的数据。

以下示例说明了如何在持续物化视图级层使用访问权限控制：

  • 允许用户从持续具体化视图中读取内容，但不允许其修改底层表。

如需详细了解 IAM 及其功能，请参阅 IAM 开发者指南。尤其是授予、更改和撤消访问权限部分。

在 Bigtable 中，您无法向以下主账号类型授予访问权限：

有关 Bigtable 支持的权限和角色的列表，请参阅以下各部分。

启用 Bigtable API

如需查看和分配 Bigtable IAM 角色，您必须为项目启用 Bigtable API。在启用此 API 之前，Bigtable 角色不会显示在Cloud de Confiance 控制台中。

启用 API 所需的角色

如需启用 API，您需要拥有 serviceusage.services.enable 权限。如果您创建了项目，则可能已经通过 Owner 角色 (roles/owner) 拥有此权限。否则，您可以通过 Service Usage Admin 角色 (roles/serviceusage.serviceUsageAdmin) 获得此权限。了解如何授予角色。

启用 API

权限

本部分总结了 Bigtable 支持的权限。

权限允许用户对 Bigtable 资源执行特定操作。例如，bigtable.instances.list 权限允许用户列出项目中的所有 Bigtable 实例。您不能直接向用户授予权限，而是要为每个用户分配预定义角色或自定义角色，这些角色会授予一项或多项权限。

下表列出了与 Bigtable 关联的 IAM 权限。

权限 以下角色拥有此权限

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Bigtable Administrator (roles/bigtable.admin)

Bigtable Editor (roles/bigtable.editor)

Databases Admin (roles/iam.databasesAdmin)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Bigtable Administrator (roles/bigtable.admin)

Bigtable Editor (roles/bigtable.editor)

Databases Admin (roles/iam.databasesAdmin)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Reader (roles/reader)

Viewer (roles/viewer)

Bigtable Administrator (roles/bigtable.admin)

Bigtable Editor (roles/bigtable.editor)

Bigtable User (roles/bigtable.user)

Bigtable Viewer (roles/bigtable.viewer)

Bigtable Reader (roles/bigtable.reader)

数据科学家 (roles/iam.dataScientist)

Databases Admin (roles/iam.databasesAdmin)

Site Reliability Engineer (roles/iam.siteReliabilityEngineer)

Support User (roles/iam.supportUser)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Reader (roles/reader)

Viewer (roles/viewer)

Bigtable Administrator (roles/bigtable.admin)

Bigtable Editor (roles/bigtable.editor)

Bigtable User (roles/bigtable.user)

Bigtable Viewer (roles/bigtable.viewer)

Security Admin (roles/iam.securityAdmin)

Security Reviewer (roles/iam.securityReviewer)

Bigtable Reader (roles/bigtable.reader)

数据科学家 (roles/iam.dataScientist)

Databases Admin (roles/iam.databasesAdmin)

Security Auditor (roles/iam.securityAuditor)

Site Reliability Engineer (roles/iam.siteReliabilityEngineer)

Support User (roles/iam.supportUser)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Bigtable Administrator (roles/bigtable.admin)

Bigtable Editor (roles/bigtable.editor)

Databases Admin (roles/iam.databasesAdmin)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Bigtable Administrator (roles/bigtable.admin)

Bigtable Editor (roles/bigtable.editor)

Databases Admin (roles/iam.databasesAdmin)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Bigtable Administrator (roles/bigtable.admin)

Tag User (roles/resourcemanager.tagUser)

DLP Organization Data Profiles Driver (roles/dlp.orgdriver)

DLP Project Data Profiles Driver (roles/dlp.projectdriver)

Databases Admin (roles/iam.databasesAdmin)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Bigtable Administrator (roles/bigtable.admin)

Bigtable Editor (roles/bigtable.editor)

Databases Admin (roles/iam.databasesAdmin)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Bigtable Administrator (roles/bigtable.admin)

Tag User (roles/resourcemanager.tagUser)

DLP Organization Data Profiles Driver (roles/dlp.orgdriver)

DLP Project Data Profiles Driver (roles/dlp.projectdriver)

Databases Admin (roles/iam.databasesAdmin)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Reader (roles/reader)

Viewer (roles/viewer)

Bigtable Administrator (roles/bigtable.admin)

Bigtable Editor (roles/bigtable.editor)

Bigtable User (roles/bigtable.user)

Bigtable Viewer (roles/bigtable.viewer)

Bigtable Reader (roles/bigtable.reader)

数据科学家 (roles/iam.dataScientist)

Databases Admin (roles/iam.databasesAdmin)

Site Reliability Engineer (roles/iam.siteReliabilityEngineer)

Support User (roles/iam.supportUser)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Reader (roles/reader)

Viewer (roles/viewer)

Bigtable Administrator (roles/bigtable.admin)

Bigtable Editor (roles/bigtable.editor)

Bigtable Viewer (roles/bigtable.viewer)

Security Admin (roles/iam.securityAdmin)

Security Reviewer (roles/iam.securityReviewer)

Databases Admin (roles/iam.databasesAdmin)

Security Auditor (roles/iam.securityAuditor)

Site Reliability Engineer (roles/iam.siteReliabilityEngineer)

Support User (roles/iam.supportUser)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Reader (roles/reader)

Viewer (roles/viewer)

Bigtable Administrator (roles/bigtable.admin)

Bigtable Editor (roles/bigtable.editor)

Bigtable User (roles/bigtable.user)

Bigtable Viewer (roles/bigtable.viewer)

Security Admin (roles/iam.securityAdmin)

Security Reviewer (roles/iam.securityReviewer)

Bigtable Reader (roles/bigtable.reader)

数据科学家 (roles/iam.dataScientist)

Databases Admin (roles/iam.databasesAdmin)

Security Auditor (roles/iam.securityAuditor)

Site Reliability Engineer (roles/iam.siteReliabilityEngineer)

Support User (roles/iam.supportUser)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Reader (roles/reader)

Viewer (roles/viewer)

Bigtable Administrator (roles/bigtable.admin)

Bigtable Editor (roles/bigtable.editor)

Bigtable Viewer (roles/bigtable.viewer)

Tag User (roles/resourcemanager.tagUser)

Tag Viewer (roles/resourcemanager.tagViewer)

DLP Organization Data Profiles Driver (roles/dlp.orgdriver)

DLP Project Data Profiles Driver (roles/dlp.projectdriver)

Databases Admin (roles/iam.databasesAdmin)

Security Auditor (roles/iam.securityAuditor)

Site Reliability Engineer (roles/iam.siteReliabilityEngineer)

Support User (roles/iam.supportUser)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Reader (roles/reader)

Viewer (roles/viewer)

Bigtable Administrator (roles/bigtable.admin)

Bigtable Editor (roles/bigtable.editor)

Bigtable Viewer (roles/bigtable.viewer)

Tag User (roles/resourcemanager.tagUser)

Tag Viewer (roles/resourcemanager.tagViewer)

DLP Organization Data Profiles Driver (roles/dlp.orgdriver)

DLP Project Data Profiles Driver (roles/dlp.projectdriver)

Databases Admin (roles/iam.databasesAdmin)

Security Auditor (roles/iam.securityAuditor)

Site Reliability Engineer (roles/iam.siteReliabilityEngineer)

Support User (roles/iam.supportUser)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Bigtable Administrator (roles/bigtable.admin)

Bigtable Editor (roles/bigtable.editor)

Bigtable User (roles/bigtable.user)

Databases Admin (roles/iam.databasesAdmin)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Reader (roles/reader)

Viewer (roles/viewer)

Bigtable Administrator (roles/bigtable.admin)

Bigtable Editor (roles/bigtable.editor)

Bigtable User (roles/bigtable.user)

Bigtable Reader (roles/bigtable.reader)

数据科学家 (roles/iam.dataScientist)

Databases Admin (roles/iam.databasesAdmin)

Support User (roles/iam.supportUser)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Reader (roles/reader)

Viewer (roles/viewer)

Bigtable Administrator (roles/bigtable.admin)

Bigtable Editor (roles/bigtable.editor)

Bigtable User (roles/bigtable.user)

Bigtable Reader (roles/bigtable.reader)

数据科学家 (roles/iam.dataScientist)

Databases Admin (roles/iam.databasesAdmin)

Support User (roles/iam.supportUser)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Bigtable Administrator (roles/bigtable.admin)

Security Admin (roles/iam.securityAdmin)

Databases Admin (roles/iam.databasesAdmin)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Bigtable Administrator (roles/bigtable.admin)

Bigtable Editor (roles/bigtable.editor)

Databases Admin (roles/iam.databasesAdmin)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Bigtable Administrator (roles/bigtable.admin)

Bigtable Editor (roles/bigtable.editor)

Databases Admin (roles/iam.databasesAdmin)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Bigtable Administrator (roles/bigtable.admin)

Bigtable Editor (roles/bigtable.editor)

Databases Admin (roles/iam.databasesAdmin)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Reader (roles/reader)

Viewer (roles/viewer)

Bigtable Administrator (roles/bigtable.admin)

Bigtable Editor (roles/bigtable.editor)

Bigtable User (roles/bigtable.user)

Bigtable Viewer (roles/bigtable.viewer)

Bigtable Reader (roles/bigtable.reader)

数据科学家 (roles/iam.dataScientist)

Databases Admin (roles/iam.databasesAdmin)

Site Reliability Engineer (roles/iam.siteReliabilityEngineer)

Support User (roles/iam.supportUser)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Reader (roles/reader)

Viewer (roles/viewer)

Bigtable Administrator (roles/bigtable.admin)

Bigtable Editor (roles/bigtable.editor)

Bigtable Viewer (roles/bigtable.viewer)

Security Admin (roles/iam.securityAdmin)

Security Reviewer (roles/iam.securityReviewer)

Databases Admin (roles/iam.databasesAdmin)

Security Auditor (roles/iam.securityAuditor)

Site Reliability Engineer (roles/iam.siteReliabilityEngineer)

Support User (roles/iam.supportUser)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Reader (roles/reader)

Viewer (roles/viewer)

Bigtable Administrator (roles/bigtable.admin)

Bigtable Editor (roles/bigtable.editor)

Bigtable User (roles/bigtable.user)

Bigtable Viewer (roles/bigtable.viewer)

Security Admin (roles/iam.securityAdmin)

Security Reviewer (roles/iam.securityReviewer)

Bigtable Reader (roles/bigtable.reader)

数据科学家 (roles/iam.dataScientist)

Databases Admin (roles/iam.databasesAdmin)

Security Auditor (roles/iam.securityAuditor)

Site Reliability Engineer (roles/iam.siteReliabilityEngineer)

Support User (roles/iam.supportUser)

Wiz Cloud Inventory Viewer (roles/wiz.cloudInventoryViewer)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Reader (roles/reader)

Viewer (roles/viewer)

Bigtable Administrator (roles/bigtable.admin)

Bigtable Editor (roles/bigtable.editor)

Databases Admin (roles/iam.databasesAdmin)

Support User (roles/iam.supportUser)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Bigtable Administrator (roles/bigtable.admin)

Bigtable Editor (roles/bigtable.editor)

Databases Admin (roles/iam.databasesAdmin)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Bigtable Administrator (roles/bigtable.admin)

Security Admin (roles/iam.securityAdmin)

Databases Admin (roles/iam.databasesAdmin)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Bigtable Administrator (roles/bigtable.admin)

Bigtable Editor (roles/bigtable.editor)

Databases Admin (roles/iam.databasesAdmin)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Bigtable Administrator (roles/bigtable.admin)

Bigtable Editor (roles/bigtable.editor)

Databases Admin (roles/iam.databasesAdmin)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Bigtable Administrator (roles/bigtable.admin)

Bigtable Editor (roles/bigtable.editor)

Databases Admin (roles/iam.databasesAdmin)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Reader (roles/reader)

Viewer (roles/viewer)

Bigtable Administrator (roles/bigtable.admin)

Bigtable Editor (roles/bigtable.editor)

Bigtable User (roles/bigtable.user)

Bigtable Viewer (roles/bigtable.viewer)

Bigtable Reader (roles/bigtable.reader)

数据科学家 (roles/iam.dataScientist)

Databases Admin (roles/iam.databasesAdmin)

Site Reliability Engineer (roles/iam.siteReliabilityEngineer)

Support User (roles/iam.supportUser)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Reader (roles/reader)

Viewer (roles/viewer)

Bigtable Administrator (roles/bigtable.admin)

Bigtable Editor (roles/bigtable.editor)

Bigtable User (roles/bigtable.user)

Bigtable Viewer (roles/bigtable.viewer)

Security Admin (roles/iam.securityAdmin)

Security Reviewer (roles/iam.securityReviewer)

Bigtable Reader (roles/bigtable.reader)

数据科学家 (roles/iam.dataScientist)

Databases Admin (roles/iam.databasesAdmin)

Security Auditor (roles/iam.securityAuditor)

Site Reliability Engineer (roles/iam.siteReliabilityEngineer)

Support User (roles/iam.supportUser)

Wiz Cloud Inventory Viewer (roles/wiz.cloudInventoryViewer)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Bigtable Administrator (roles/bigtable.admin)

Bigtable Editor (roles/bigtable.editor)

Databases Admin (roles/iam.databasesAdmin)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Reader (roles/reader)

Viewer (roles/viewer)

Bigtable Administrator (roles/bigtable.admin)

Bigtable Editor (roles/bigtable.editor)

Bigtable User (roles/bigtable.user)

Bigtable Viewer (roles/bigtable.viewer)

Security Admin (roles/iam.securityAdmin)

Security Reviewer (roles/iam.securityReviewer)

Bigtable Reader (roles/bigtable.reader)

数据科学家 (roles/iam.dataScientist)

Databases Admin (roles/iam.databasesAdmin)

Security Auditor (roles/iam.securityAuditor)

Site Reliability Engineer (roles/iam.siteReliabilityEngineer)

Support User (roles/iam.supportUser)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Bigtable Administrator (roles/bigtable.admin)

Bigtable Editor (roles/bigtable.editor)

Databases Admin (roles/iam.databasesAdmin)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Bigtable Administrator (roles/bigtable.admin)

Tag User (roles/resourcemanager.tagUser)

DLP Organization Data Profiles Driver (roles/dlp.orgdriver)

DLP Project Data Profiles Driver (roles/dlp.projectdriver)

Databases Admin (roles/iam.databasesAdmin)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Bigtable Administrator (roles/bigtable.admin)

Bigtable Editor (roles/bigtable.editor)

Databases Admin (roles/iam.databasesAdmin)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Bigtable Administrator (roles/bigtable.admin)

Tag User (roles/resourcemanager.tagUser)

DLP Organization Data Profiles Driver (roles/dlp.orgdriver)

DLP Project Data Profiles Driver (roles/dlp.projectdriver)

Databases Admin (roles/iam.databasesAdmin)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Reader (roles/reader)

Viewer (roles/viewer)

Bigtable Administrator (roles/bigtable.admin)

Bigtable Editor (roles/bigtable.editor)

Bigtable User (roles/bigtable.user)

Bigtable Reader (roles/bigtable.reader)

数据科学家 (roles/iam.dataScientist)

Databases Admin (roles/iam.databasesAdmin)

Support User (roles/iam.supportUser)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Reader (roles/reader)

Viewer (roles/viewer)

Bigtable Administrator (roles/bigtable.admin)

Bigtable Editor (roles/bigtable.editor)

Bigtable User (roles/bigtable.user)

Bigtable Viewer (roles/bigtable.viewer)

Bigtable Reader (roles/bigtable.reader)

数据科学家 (roles/iam.dataScientist)

Databases Admin (roles/iam.databasesAdmin)

Site Reliability Engineer (roles/iam.siteReliabilityEngineer)

Support User (roles/iam.supportUser)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Reader (roles/reader)

Viewer (roles/viewer)

Bigtable Administrator (roles/bigtable.admin)

Bigtable Editor (roles/bigtable.editor)

Bigtable Viewer (roles/bigtable.viewer)

Security Admin (roles/iam.securityAdmin)

Security Reviewer (roles/iam.securityReviewer)

Databases Admin (roles/iam.databasesAdmin)

Security Auditor (roles/iam.securityAuditor)

Site Reliability Engineer (roles/iam.siteReliabilityEngineer)

Support User (roles/iam.supportUser)

Wiz Cloud Inventory Viewer (roles/wiz.cloudInventoryViewer)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Reader (roles/reader)

Viewer (roles/viewer)

Bigtable Administrator (roles/bigtable.admin)

Bigtable Editor (roles/bigtable.editor)

Bigtable User (roles/bigtable.user)

Bigtable Viewer (roles/bigtable.viewer)

Security Admin (roles/iam.securityAdmin)

Security Reviewer (roles/iam.securityReviewer)

Bigtable Reader (roles/bigtable.reader)

数据科学家 (roles/iam.dataScientist)

Databases Admin (roles/iam.databasesAdmin)

Security Auditor (roles/iam.securityAuditor)

Site Reliability Engineer (roles/iam.siteReliabilityEngineer)

Support User (roles/iam.supportUser)

Wiz Cloud Inventory Viewer (roles/wiz.cloudInventoryViewer)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Reader (roles/reader)

Viewer (roles/viewer)

Bigtable Administrator (roles/bigtable.admin)

Bigtable Editor (roles/bigtable.editor)

Bigtable Viewer (roles/bigtable.viewer)

Tag User (roles/resourcemanager.tagUser)

Tag Viewer (roles/resourcemanager.tagViewer)

DLP Organization Data Profiles Driver (roles/dlp.orgdriver)

DLP Project Data Profiles Driver (roles/dlp.projectdriver)

Databases Admin (roles/iam.databasesAdmin)

Security Auditor (roles/iam.securityAuditor)

Site Reliability Engineer (roles/iam.siteReliabilityEngineer)

Support User (roles/iam.supportUser)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Reader (roles/reader)

Viewer (roles/viewer)

Bigtable Administrator (roles/bigtable.admin)

Bigtable Editor (roles/bigtable.editor)

Bigtable Viewer (roles/bigtable.viewer)

Tag User (roles/resourcemanager.tagUser)

Tag Viewer (roles/resourcemanager.tagViewer)

DLP Organization Data Profiles Driver (roles/dlp.orgdriver)

DLP Project Data Profiles Driver (roles/dlp.projectdriver)

Databases Admin (roles/iam.databasesAdmin)

Security Auditor (roles/iam.securityAuditor)

Site Reliability Engineer (roles/iam.siteReliabilityEngineer)

Support User (roles/iam.supportUser)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Reader (roles/reader)

Viewer (roles/viewer)

Bigtable Administrator (roles/bigtable.admin)

Bigtable Editor (roles/bigtable.editor)

Bigtable User (roles/bigtable.user)

Bigtable Reader (roles/bigtable.reader)

数据科学家 (roles/iam.dataScientist)

Databases Admin (roles/iam.databasesAdmin)

Support User (roles/iam.supportUser)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Bigtable Administrator (roles/bigtable.admin)

Security Admin (roles/iam.securityAdmin)

Databases Admin (roles/iam.databasesAdmin)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Bigtable Administrator (roles/bigtable.admin)

Bigtable Editor (roles/bigtable.editor)

Databases Admin (roles/iam.databasesAdmin)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Reader (roles/reader)

Viewer (roles/viewer)

Bigtable Administrator (roles/bigtable.admin)

Bigtable Editor (roles/bigtable.editor)

Bigtable User (roles/bigtable.user)

Bigtable Reader (roles/bigtable.reader)

数据科学家 (roles/iam.dataScientist)

Databases Admin (roles/iam.databasesAdmin)

Support User (roles/iam.supportUser)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Reader (roles/reader)

Viewer (roles/viewer)

Bigtable Administrator (roles/bigtable.admin)

Bigtable Editor (roles/bigtable.editor)

Bigtable User (roles/bigtable.user)

Security Admin (roles/iam.securityAdmin)

Security Reviewer (roles/iam.securityReviewer)

Bigtable Reader (roles/bigtable.reader)

数据科学家 (roles/iam.dataScientist)

Databases Admin (roles/iam.databasesAdmin)

Security Auditor (roles/iam.securityAuditor)

Support User (roles/iam.supportUser)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Reader (roles/reader)

Viewer (roles/viewer)

Bigtable Administrator (roles/bigtable.admin)

Bigtable Editor (roles/bigtable.editor)

Bigtable User (roles/bigtable.user)

Bigtable Viewer (roles/bigtable.viewer)

Security Admin (roles/iam.securityAdmin)

Security Reviewer (roles/iam.securityReviewer)

Bigtable Reader (roles/bigtable.reader)

数据科学家 (roles/iam.dataScientist)

Databases Admin (roles/iam.databasesAdmin)

Security Auditor (roles/iam.securityAuditor)

Site Reliability Engineer (roles/iam.siteReliabilityEngineer)

Support User (roles/iam.supportUser)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Bigtable Administrator (roles/bigtable.admin)

Bigtable Editor (roles/bigtable.editor)

Databases Admin (roles/iam.databasesAdmin)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Bigtable Administrator (roles/bigtable.admin)

Bigtable Editor (roles/bigtable.editor)

Databases Admin (roles/iam.databasesAdmin)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Reader (roles/reader)

Viewer (roles/viewer)

Bigtable Administrator (roles/bigtable.admin)

Bigtable Editor (roles/bigtable.editor)

Bigtable User (roles/bigtable.user)

Bigtable Viewer (roles/bigtable.viewer)

Bigtable Reader (roles/bigtable.reader)

数据科学家 (roles/iam.dataScientist)

Databases Admin (roles/iam.databasesAdmin)

Site Reliability Engineer (roles/iam.siteReliabilityEngineer)

Support User (roles/iam.supportUser)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Reader (roles/reader)

Viewer (roles/viewer)

Bigtable Administrator (roles/bigtable.admin)

Bigtable Editor (roles/bigtable.editor)

Bigtable Viewer (roles/bigtable.viewer)

Security Admin (roles/iam.securityAdmin)

Security Reviewer (roles/iam.securityReviewer)

Databases Admin (roles/iam.databasesAdmin)

Security Auditor (roles/iam.securityAuditor)

Site Reliability Engineer (roles/iam.siteReliabilityEngineer)

Support User (roles/iam.supportUser)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Reader (roles/reader)

Viewer (roles/viewer)

Bigtable Administrator (roles/bigtable.admin)

Bigtable Editor (roles/bigtable.editor)

Bigtable User (roles/bigtable.user)

Bigtable Viewer (roles/bigtable.viewer)

Security Admin (roles/iam.securityAdmin)

Security Reviewer (roles/iam.securityReviewer)

Bigtable Reader (roles/bigtable.reader)

数据科学家 (roles/iam.dataScientist)

Databases Admin (roles/iam.databasesAdmin)

Security Auditor (roles/iam.securityAuditor)

Site Reliability Engineer (roles/iam.siteReliabilityEngineer)

Support User (roles/iam.supportUser)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Reader (roles/reader)

Viewer (roles/viewer)

Bigtable Administrator (roles/bigtable.admin)

Bigtable Editor (roles/bigtable.editor)

Bigtable User (roles/bigtable.user)

Bigtable Reader (roles/bigtable.reader)

数据科学家 (roles/iam.dataScientist)

Databases Admin (roles/iam.databasesAdmin)

Support User (roles/iam.supportUser)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Bigtable Administrator (roles/bigtable.admin)

Security Admin (roles/iam.securityAdmin)

Databases Admin (roles/iam.databasesAdmin)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Bigtable Administrator (roles/bigtable.admin)

Bigtable Editor (roles/bigtable.editor)

Databases Admin (roles/iam.databasesAdmin)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Bigtable Administrator (roles/bigtable.admin)

Bigtable Editor (roles/bigtable.editor)

Databases Admin (roles/iam.databasesAdmin)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Bigtable Administrator (roles/bigtable.admin)

Bigtable Editor (roles/bigtable.editor)

Databases Admin (roles/iam.databasesAdmin)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Reader (roles/reader)

Viewer (roles/viewer)

Bigtable Administrator (roles/bigtable.admin)

Bigtable Editor (roles/bigtable.editor)

Bigtable User (roles/bigtable.user)

Bigtable Viewer (roles/bigtable.viewer)

Bigtable Reader (roles/bigtable.reader)

数据科学家 (roles/iam.dataScientist)

Databases Admin (roles/iam.databasesAdmin)

Site Reliability Engineer (roles/iam.siteReliabilityEngineer)

Support User (roles/iam.supportUser)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Reader (roles/reader)

Viewer (roles/viewer)

Bigtable Administrator (roles/bigtable.admin)

Bigtable Editor (roles/bigtable.editor)

Bigtable Viewer (roles/bigtable.viewer)

Security Admin (roles/iam.securityAdmin)

Security Reviewer (roles/iam.securityReviewer)

Databases Admin (roles/iam.databasesAdmin)

Security Auditor (roles/iam.securityAuditor)

Site Reliability Engineer (roles/iam.siteReliabilityEngineer)

Support User (roles/iam.supportUser)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Reader (roles/reader)

Viewer (roles/viewer)

Bigtable Administrator (roles/bigtable.admin)

Bigtable Editor (roles/bigtable.editor)

Bigtable User (roles/bigtable.user)

Bigtable Viewer (roles/bigtable.viewer)

Security Admin (roles/iam.securityAdmin)

Security Reviewer (roles/iam.securityReviewer)

Bigtable Reader (roles/bigtable.reader)

数据科学家 (roles/iam.dataScientist)

Databases Admin (roles/iam.databasesAdmin)

Security Auditor (roles/iam.securityAuditor)

Site Reliability Engineer (roles/iam.siteReliabilityEngineer)

Support User (roles/iam.supportUser)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Reader (roles/reader)

Viewer (roles/viewer)

Bigtable Administrator (roles/bigtable.admin)

Bigtable Editor (roles/bigtable.editor)

Bigtable User (roles/bigtable.user)

Bigtable Reader (roles/bigtable.reader)

数据科学家 (roles/iam.dataScientist)

Databases Admin (roles/iam.databasesAdmin)

Support User (roles/iam.supportUser)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Reader (roles/reader)

Viewer (roles/viewer)

Bigtable Administrator (roles/bigtable.admin)

Bigtable Editor (roles/bigtable.editor)

Bigtable User (roles/bigtable.user)

Bigtable Reader (roles/bigtable.reader)

数据科学家 (roles/iam.dataScientist)

Databases Admin (roles/iam.databasesAdmin)

Support User (roles/iam.supportUser)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Bigtable Administrator (roles/bigtable.admin)

Security Admin (roles/iam.securityAdmin)

Databases Admin (roles/iam.databasesAdmin)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Bigtable Administrator (roles/bigtable.admin)

Bigtable Editor (roles/bigtable.editor)

Databases Admin (roles/iam.databasesAdmin)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Reader (roles/reader)

Viewer (roles/viewer)

Bigtable Administrator (roles/bigtable.admin)

Bigtable Editor (roles/bigtable.editor)

Bigtable User (roles/bigtable.user)

Bigtable Viewer (roles/bigtable.viewer)

Bigtable Reader (roles/bigtable.reader)

数据科学家 (roles/iam.dataScientist)

Databases Admin (roles/iam.databasesAdmin)

Site Reliability Engineer (roles/iam.siteReliabilityEngineer)

Support User (roles/iam.supportUser)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Reader (roles/reader)

Viewer (roles/viewer)

Bigtable Administrator (roles/bigtable.admin)

Bigtable Editor (roles/bigtable.editor)

Bigtable User (roles/bigtable.user)

Bigtable Viewer (roles/bigtable.viewer)

Security Admin (roles/iam.securityAdmin)

Security Reviewer (roles/iam.securityReviewer)

Bigtable Reader (roles/bigtable.reader)

数据科学家 (roles/iam.dataScientist)

Databases Admin (roles/iam.databasesAdmin)

Security Auditor (roles/iam.securityAuditor)

Site Reliability Engineer (roles/iam.siteReliabilityEngineer)

Support User (roles/iam.supportUser)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Bigtable Administrator (roles/bigtable.admin)

Bigtable Editor (roles/bigtable.editor)

Databases Admin (roles/iam.databasesAdmin)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Bigtable Administrator (roles/bigtable.admin)

Bigtable Editor (roles/bigtable.editor)

Databases Admin (roles/iam.databasesAdmin)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Bigtable Administrator (roles/bigtable.admin)

Bigtable Editor (roles/bigtable.editor)

Databases Admin (roles/iam.databasesAdmin)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Reader (roles/reader)

Viewer (roles/viewer)

Bigtable Administrator (roles/bigtable.admin)

Bigtable Editor (roles/bigtable.editor)

Bigtable User (roles/bigtable.user)

Bigtable Viewer (roles/bigtable.viewer)

Bigtable Reader (roles/bigtable.reader)

数据科学家 (roles/iam.dataScientist)

Databases Admin (roles/iam.databasesAdmin)

Site Reliability Engineer (roles/iam.siteReliabilityEngineer)

Support User (roles/iam.supportUser)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Reader (roles/reader)

Viewer (roles/viewer)

Bigtable Administrator (roles/bigtable.admin)

Bigtable Editor (roles/bigtable.editor)

Bigtable Viewer (roles/bigtable.viewer)

Security Admin (roles/iam.securityAdmin)

Security Reviewer (roles/iam.securityReviewer)

Databases Admin (roles/iam.databasesAdmin)

Security Auditor (roles/iam.securityAuditor)

Site Reliability Engineer (roles/iam.siteReliabilityEngineer)

Support User (roles/iam.supportUser)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Reader (roles/reader)

Viewer (roles/viewer)

Bigtable Administrator (roles/bigtable.admin)

Bigtable Editor (roles/bigtable.editor)

Bigtable User (roles/bigtable.user)

Bigtable Viewer (roles/bigtable.viewer)

Security Admin (roles/iam.securityAdmin)

Security Reviewer (roles/iam.securityReviewer)

Bigtable Reader (roles/bigtable.reader)

数据科学家 (roles/iam.dataScientist)

Databases Admin (roles/iam.databasesAdmin)

Security Auditor (roles/iam.securityAuditor)

Site Reliability Engineer (roles/iam.siteReliabilityEngineer)

Support User (roles/iam.supportUser)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Bigtable Administrator (roles/bigtable.admin)

Security Admin (roles/iam.securityAdmin)

Databases Admin (roles/iam.databasesAdmin)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Bigtable Administrator (roles/bigtable.admin)

Bigtable Editor (roles/bigtable.editor)

Databases Admin (roles/iam.databasesAdmin)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Reader (roles/reader)

Viewer (roles/viewer)

Bigtable Administrator (roles/bigtable.admin)

Bigtable Editor (roles/bigtable.editor)

Bigtable User (roles/bigtable.user)

Bigtable Viewer (roles/bigtable.viewer)

Bigtable Reader (roles/bigtable.reader)

数据科学家 (roles/iam.dataScientist)

Databases Admin (roles/iam.databasesAdmin)

Site Reliability Engineer (roles/iam.siteReliabilityEngineer)

Support User (roles/iam.supportUser)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Bigtable Administrator (roles/bigtable.admin)

Bigtable Editor (roles/bigtable.editor)

Databases Admin (roles/iam.databasesAdmin)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Bigtable Administrator (roles/bigtable.admin)

Bigtable Editor (roles/bigtable.editor)

Databases Admin (roles/iam.databasesAdmin)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Reader (roles/reader)

Viewer (roles/viewer)

Bigtable Administrator (roles/bigtable.admin)

Bigtable Editor (roles/bigtable.editor)

Bigtable User (roles/bigtable.user)

Bigtable Viewer (roles/bigtable.viewer)

Bigtable Reader (roles/bigtable.reader)

数据科学家 (roles/iam.dataScientist)

Databases Admin (roles/iam.databasesAdmin)

Site Reliability Engineer (roles/iam.siteReliabilityEngineer)

Support User (roles/iam.supportUser)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Reader (roles/reader)

Viewer (roles/viewer)

Bigtable Administrator (roles/bigtable.admin)

Bigtable Editor (roles/bigtable.editor)

Bigtable User (roles/bigtable.user)

Bigtable Viewer (roles/bigtable.viewer)

Bigtable Reader (roles/bigtable.reader)

数据科学家 (roles/iam.dataScientist)

Databases Admin (roles/iam.databasesAdmin)

Site Reliability Engineer (roles/iam.siteReliabilityEngineer)

Support User (roles/iam.supportUser)

Wiz Cloud Inventory Viewer (roles/wiz.cloudInventoryViewer)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Reader (roles/reader)

Viewer (roles/viewer)

Bigtable Administrator (roles/bigtable.admin)

Bigtable Editor (roles/bigtable.editor)

Bigtable Viewer (roles/bigtable.viewer)

Security Admin (roles/iam.securityAdmin)

Security Reviewer (roles/iam.securityReviewer)

Databases Admin (roles/iam.databasesAdmin)

Security Auditor (roles/iam.securityAuditor)

Site Reliability Engineer (roles/iam.siteReliabilityEngineer)

Support User (roles/iam.supportUser)

Wiz Cloud Inventory Viewer (roles/wiz.cloudInventoryViewer)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Reader (roles/reader)

Viewer (roles/viewer)

Bigtable Administrator (roles/bigtable.admin)

Bigtable Editor (roles/bigtable.editor)

Bigtable User (roles/bigtable.user)

Bigtable Viewer (roles/bigtable.viewer)

Security Admin (roles/iam.securityAdmin)

Security Reviewer (roles/iam.securityReviewer)

Bigtable Reader (roles/bigtable.reader)

数据科学家 (roles/iam.dataScientist)

Databases Admin (roles/iam.databasesAdmin)

Security Auditor (roles/iam.securityAuditor)

Site Reliability Engineer (roles/iam.siteReliabilityEngineer)

Support User (roles/iam.supportUser)

Wiz Cloud Inventory Viewer (roles/wiz.cloudInventoryViewer)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Bigtable Administrator (roles/bigtable.admin)

Bigtable Editor (roles/bigtable.editor)

Bigtable User (roles/bigtable.user)

Databases Admin (roles/iam.databasesAdmin)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Reader (roles/reader)

Viewer (roles/viewer)

Bigtable Administrator (roles/bigtable.admin)

Bigtable Editor (roles/bigtable.editor)

Bigtable User (roles/bigtable.user)

Bigtable Reader (roles/bigtable.reader)

数据科学家 (roles/iam.dataScientist)

Databases Admin (roles/iam.databasesAdmin)

Support User (roles/iam.supportUser)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Reader (roles/reader)

Viewer (roles/viewer)

Bigtable Administrator (roles/bigtable.admin)

Bigtable Editor (roles/bigtable.editor)

Bigtable User (roles/bigtable.user)

Bigtable Reader (roles/bigtable.reader)

数据科学家 (roles/iam.dataScientist)

Databases Admin (roles/iam.databasesAdmin)

Support User (roles/iam.supportUser)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Bigtable Administrator (roles/bigtable.admin)

Security Admin (roles/iam.securityAdmin)

Databases Admin (roles/iam.databasesAdmin)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Bigtable Administrator (roles/bigtable.admin)

Bigtable Editor (roles/bigtable.editor)

Databases Admin (roles/iam.databasesAdmin)

服务代理角色

Admin (roles/admin)

Owner (roles/owner)

Writer (roles/writer)

Editor (roles/editor)

Bigtable Administrator (roles/bigtable.admin)

Bigtable Editor (roles/bigtable.editor)

Databases Admin (roles/iam.databasesAdmin)

服务代理角色

预定义角色

每个预定义角色都包括一项或多项权限。例如，roles/bigtable.reader 提供对 Bigtable 实例、集群、表和列族的相关信息以及表中所含数据的只读权限。您将角色分配给用户或组，这些角色允许他们对项目中的资源执行操作。

下表列出了 Bigtable 的预定义角色，包括与每个角色关联的权限列表：

Role Permissions

(roles/bigtable.admin)

Administers all Bigtable instances within a project, including the data stored within tables. Can create new instances. Intended for project administrators.

Lowest-level resources where you can grant this role:

  • Table

bigtable.*

  • bigtable.appProfiles.create
  • bigtable.appProfiles.delete
  • bigtable.appProfiles.get
  • bigtable.appProfiles.list
  • bigtable.appProfiles.update
  • bigtable.authorizedViews.create
  • bigtable.authorizedViews.createTagBinding
  • bigtable.authorizedViews.delete
  • bigtable.authorizedViews.deleteTagBinding
  • bigtable.authorizedViews.get
  • bigtable.authorizedViews.getIamPolicy
  • bigtable.authorizedViews.list
  • bigtable.authorizedViews.listEffectiveTags
  • bigtable.authorizedViews.listTagBindings
  • bigtable.authorizedViews.mutateRows
  • bigtable.authorizedViews.readRows
  • bigtable.authorizedViews.sampleRowKeys
  • bigtable.authorizedViews.setIamPolicy
  • bigtable.authorizedViews.update
  • bigtable.backups.create
  • bigtable.backups.delete
  • bigtable.backups.get
  • bigtable.backups.getIamPolicy
  • bigtable.backups.list
  • bigtable.backups.read
  • bigtable.backups.restore
  • bigtable.backups.setIamPolicy
  • bigtable.backups.update
  • bigtable.clusters.create
  • bigtable.clusters.delete
  • bigtable.clusters.get
  • bigtable.clusters.list
  • bigtable.clusters.update
  • bigtable.hotTablets.list
  • bigtable.instances.create
  • bigtable.instances.createTagBinding
  • bigtable.instances.delete
  • bigtable.instances.deleteTagBinding
  • bigtable.instances.executeQuery
  • bigtable.instances.get
  • bigtable.instances.getIamPolicy
  • bigtable.instances.list
  • bigtable.instances.listEffectiveTags
  • bigtable.instances.listTagBindings
  • bigtable.instances.ping
  • bigtable.instances.setIamPolicy
  • bigtable.instances.update
  • bigtable.keyvisualizer.get
  • bigtable.keyvisualizer.list
  • bigtable.locations.list
  • bigtable.logicalViews.create
  • bigtable.logicalViews.delete
  • bigtable.logicalViews.get
  • bigtable.logicalViews.getIamPolicy
  • bigtable.logicalViews.list
  • bigtable.logicalViews.readRows
  • bigtable.logicalViews.setIamPolicy
  • bigtable.logicalViews.update
  • bigtable.materializedViews.create
  • bigtable.materializedViews.delete
  • bigtable.materializedViews.get
  • bigtable.materializedViews.getIamPolicy
  • bigtable.materializedViews.list
  • bigtable.materializedViews.readRows
  • bigtable.materializedViews.sampleRowKeys
  • bigtable.materializedViews.setIamPolicy
  • bigtable.materializedViews.update
  • bigtable.memoryLayers.get
  • bigtable.memoryLayers.list
  • bigtable.memoryLayers.update
  • bigtable.schemaBundles.create
  • bigtable.schemaBundles.delete
  • bigtable.schemaBundles.get
  • bigtable.schemaBundles.getIamPolicy
  • bigtable.schemaBundles.list
  • bigtable.schemaBundles.setIamPolicy
  • bigtable.schemaBundles.update
  • bigtable.tables.checkConsistency
  • bigtable.tables.create
  • bigtable.tables.delete
  • bigtable.tables.generateConsistencyToken
  • bigtable.tables.get
  • bigtable.tables.getIamPolicy
  • bigtable.tables.list
  • bigtable.tables.mutateRows
  • bigtable.tables.readRows
  • bigtable.tables.sampleRowKeys
  • bigtable.tables.setIamPolicy
  • bigtable.tables.undelete
  • bigtable.tables.update

cloudkms.keyHandles.*

  • cloudkms.keyHandles.create
  • cloudkms.keyHandles.get
  • cloudkms.keyHandles.list

cloudkms.operations.get

cloudkms.projects.showEffectiveAutokeyConfig

monitoring.metricDescriptors.get

monitoring.metricDescriptors.list

monitoring.timeSeries.*

  • monitoring.timeSeries.create
  • monitoring.timeSeries.list

resourcemanager.projects.get

(roles/bigtable.editor)

Editor role for bigtable

bigtable.appProfiles.*

  • bigtable.appProfiles.create
  • bigtable.appProfiles.delete
  • bigtable.appProfiles.get
  • bigtable.appProfiles.list
  • bigtable.appProfiles.update

bigtable.authorizedViews.create

bigtable.authorizedViews.delete

bigtable.authorizedViews.get

bigtable.authorizedViews.getIamPolicy

bigtable.authorizedViews.list

bigtable.authorizedViews.listEffectiveTags

bigtable.authorizedViews.listTagBindings

bigtable.authorizedViews.mutateRows

bigtable.authorizedViews.readRows

bigtable.authorizedViews.sampleRowKeys

bigtable.authorizedViews.update

bigtable.backups.create

bigtable.backups.delete

bigtable.backups.get

bigtable.backups.getIamPolicy

bigtable.backups.list

bigtable.backups.read

bigtable.backups.restore

bigtable.backups.update

bigtable.clusters.*

  • bigtable.clusters.create
  • bigtable.clusters.delete
  • bigtable.clusters.get
  • bigtable.clusters.list
  • bigtable.clusters.update

bigtable.hotTablets.list

bigtable.instances.create

bigtable.instances.delete

bigtable.instances.executeQuery

bigtable.instances.get

bigtable.instances.getIamPolicy

bigtable.instances.list

bigtable.instances.listEffectiveTags

bigtable.instances.listTagBindings

bigtable.instances.ping

bigtable.instances.update

bigtable.keyvisualizer.*

  • bigtable.keyvisualizer.get
  • bigtable.keyvisualizer.list

bigtable.locations.list

bigtable.logicalViews.create

bigtable.logicalViews.delete

bigtable.logicalViews.get

bigtable.logicalViews.getIamPolicy

bigtable.logicalViews.list

bigtable.logicalViews.readRows

bigtable.logicalViews.update

bigtable.materializedViews.create

bigtable.materializedViews.delete

bigtable.materializedViews.get

bigtable.materializedViews.getIamPolicy

bigtable.materializedViews.list

bigtable.materializedViews.readRows

bigtable.materializedViews.sampleRowKeys

bigtable.materializedViews.update

bigtable.memoryLayers.*

  • bigtable.memoryLayers.get
  • bigtable.memoryLayers.list
  • bigtable.memoryLayers.update

bigtable.schemaBundles.create

bigtable.schemaBundles.delete

bigtable.schemaBundles.get

bigtable.schemaBundles.getIamPolicy

bigtable.schemaBundles.list

bigtable.schemaBundles.update

bigtable.tables.checkConsistency

bigtable.tables.create

bigtable.tables.delete

bigtable.tables.generateConsistencyToken

bigtable.tables.get

bigtable.tables.getIamPolicy

bigtable.tables.list

bigtable.tables.mutateRows

bigtable.tables.readRows

bigtable.tables.sampleRowKeys

bigtable.tables.undelete

bigtable.tables.update

monitoring.metricDescriptors.get

monitoring.metricDescriptors.list

monitoring.timeSeries.list

resourcemanager.projects.get

resourcemanager.projects.list

(roles/bigtable.user)

Provides read-write access to the data stored within Bigtable tables. Intended for application developers or service accounts.

Lowest-level resources where you can grant this role:

  • Table

bigtable.appProfiles.get

bigtable.appProfiles.list

bigtable.authorizedViews.get

bigtable.authorizedViews.list

bigtable.authorizedViews.mutateRows

bigtable.authorizedViews.readRows

bigtable.authorizedViews.sampleRowKeys

bigtable.backups.get

bigtable.backups.list

bigtable.clusters.get

bigtable.clusters.list

bigtable.hotTablets.list

bigtable.instances.executeQuery

bigtable.instances.get

bigtable.instances.list

bigtable.instances.ping

bigtable.keyvisualizer.*

  • bigtable.keyvisualizer.get
  • bigtable.keyvisualizer.list

bigtable.locations.list

bigtable.logicalViews.get

bigtable.logicalViews.list

bigtable.logicalViews.readRows

bigtable.materializedViews.get

bigtable.materializedViews.list

bigtable.materializedViews.readRows

bigtable.materializedViews.sampleRowKeys

bigtable.memoryLayers.get

bigtable.memoryLayers.list

bigtable.schemaBundles.get

bigtable.schemaBundles.list

bigtable.tables.checkConsistency

bigtable.tables.generateConsistencyToken

bigtable.tables.get

bigtable.tables.list

bigtable.tables.mutateRows

bigtable.tables.readRows

bigtable.tables.sampleRowKeys

monitoring.metricDescriptors.get

monitoring.metricDescriptors.list

monitoring.timeSeries.*

  • monitoring.timeSeries.create
  • monitoring.timeSeries.list

resourcemanager.projects.get

(roles/bigtable.viewer)

Provides no data access. Intended as a minimal set of permissions to access the Cloud de Confiance console for Bigtable.

Lowest-level resources where you can grant this role:

  • Table

bigtable.appProfiles.get

bigtable.appProfiles.list

bigtable.authorizedViews.get

bigtable.authorizedViews.getIamPolicy

bigtable.authorizedViews.list

bigtable.authorizedViews.listEffectiveTags

bigtable.authorizedViews.listTagBindings

bigtable.backups.get

bigtable.backups.getIamPolicy

bigtable.backups.list

bigtable.clusters.get

bigtable.clusters.list

bigtable.hotTablets.list

bigtable.instances.get

bigtable.instances.getIamPolicy

bigtable.instances.list

bigtable.instances.listEffectiveTags

bigtable.instances.listTagBindings

bigtable.locations.list

bigtable.logicalViews.get

bigtable.logicalViews.getIamPolicy

bigtable.logicalViews.list

bigtable.materializedViews.get

bigtable.materializedViews.getIamPolicy

bigtable.materializedViews.list

bigtable.memoryLayers.get

bigtable.memoryLayers.list

bigtable.schemaBundles.get

bigtable.schemaBundles.getIamPolicy

bigtable.schemaBundles.list

bigtable.tables.checkConsistency

bigtable.tables.generateConsistencyToken

bigtable.tables.get

bigtable.tables.getIamPolicy

bigtable.tables.list

monitoring.metricDescriptors.get

monitoring.metricDescriptors.list

monitoring.timeSeries.list

resourcemanager.projects.get

(roles/bigtable.reader)

Provides read-only access to the data stored within Bigtable tables. Intended for data scientists, dashboard generators, and other data-analysis scenarios.

Lowest-level resources where you can grant this role:

  • Table

bigtable.appProfiles.get

bigtable.appProfiles.list

bigtable.authorizedViews.get

bigtable.authorizedViews.list

bigtable.authorizedViews.readRows

bigtable.authorizedViews.sampleRowKeys

bigtable.backups.get

bigtable.backups.list

bigtable.clusters.get

bigtable.clusters.list

bigtable.hotTablets.list

bigtable.instances.executeQuery

bigtable.instances.get

bigtable.instances.list

bigtable.instances.ping

bigtable.keyvisualizer.*

  • bigtable.keyvisualizer.get
  • bigtable.keyvisualizer.list

bigtable.locations.list

bigtable.logicalViews.get

bigtable.logicalViews.list

bigtable.logicalViews.readRows

bigtable.materializedViews.get

bigtable.materializedViews.list

bigtable.materializedViews.readRows

bigtable.materializedViews.sampleRowKeys

bigtable.memoryLayers.get

bigtable.memoryLayers.list

bigtable.schemaBundles.get

bigtable.schemaBundles.list

bigtable.tables.checkConsistency

bigtable.tables.generateConsistencyToken

bigtable.tables.get

bigtable.tables.list

bigtable.tables.readRows

bigtable.tables.sampleRowKeys

monitoring.metricDescriptors.get

monitoring.metricDescriptors.list

monitoring.timeSeries.*

  • monitoring.timeSeries.create
  • monitoring.timeSeries.list

resourcemanager.projects.get

自定义角色

如果 Bigtable 的预定义角色不能满足您的业务需求，您可以自行定义自定义角色并为其指定权限。

如果您的自定义角色需要支持访问 Cloud de Confiance 控制台，您必须确定用户将执行的任务，然后确保该自定义角色拥有每项任务所需的权限，如下表所示。如果自定义角色不具有任务所需的全部权限，并且用户尝试执行该任务，则 Cloud de Confiance 控制台将无法正确运行。

Cloud de Confiance 控制台任务 所需权限
拥有对 Cloud de Confiance 控制台的基本访问权限
  • bigtable.appProfiles.get
  • bigtable.appProfiles.list
  • bigtable.clusters.get
  • bigtable.clusters.list
  • bigtable.instances.get
  • bigtable.instances.list
  • bigtable.locations.list
  • bigtable.tables.get
  • bigtable.tables.list
  • resourcemanager.projects.get
创建实例或集群

基本访问权限，以及：

  • bigtable.clusters.create
  • bigtable.instances.create
修改实例或集群

基本访问权限，以及：

  • bigtable.clusters.update
  • bigtable.instances.update
管理复制配置

基本访问权限，以及：

  • bigtable.appProfiles.create
  • bigtable.appProfiles.delete
  • bigtable.appProfiles.update
删除实例或集群

基本访问权限，以及：

  • bigtable.clusters.delete
  • bigtable.instances.delete
通过查看图表来监控实例

基本访问权限，以及：

  • monitoring.metricDescriptors.get
  • monitoring.metricDescriptors.list
  • monitoring.timeSeries.list
创建和更新表

基本访问权限，以及：

  • bigtable.tables.create
  • bigtable.tables.update
恢复备份

基本访问权限，以及：

  • bigtable.backups.list
  • bigtable.tables.create
  • bigtable.backups.restore

IAM 管理

本部分介绍了如何在项目、实例、表和备份级别管理 IAM 角色和相关权限。

项目级层 IAM 管理

在项目级层，您可以使用 Cloud de Confiance 控制台、IAM API 或 Google Cloud CLI 来授予、更改和撤消 IAM 角色。如需了解详情，请参阅授予、更改和撤消访问权限。

创建项目后，您可以根据特定的访问权限级别向用户授予项目级 IAM 角色。

所需的角色

在为用户设置实例级层、表级层、备份级层、授权视图级层或持续具体化视图级层 IAM 角色之前，请确保用户至少拥有以下项目级 IAM 角色之一：

  • Bigtable Viewer（推荐）
  • Bigtable Reader
  • Bigtable User
  • Bigtable Administrator

选择一个项目级角色，其权限不超过用户在项目中的所有实例、表、备份、授权视图或持续物化视图中实际需要的权限。因此，在几乎所有情况下，您都应该授予 Bigtable Viewer 角色。

如果用户不具有其中任何一个项目级角色，则将无法通过 Cloud de Confiance 控制台使用 Bigtable。 Cloud de Confiance 控制台要求用户必须具有其中一个项目级角色，这样它才能代表用户检索实例、集群、表或备份的相关信息。

授予实例级层 IAM 角色

在实例级层，您可以向用户或服务账号授予 Bigtable 的任意预定义角色。您还可以授予您已定义的任何自定义角色。

要在实例级层向用户或服务账号授予预定义角色或自定义角色，请执行以下操作：

控制台

  1. 前往Cloud de Confiance 控制台中的“Bigtable 实例”页面。

    转到实例页面

  2. 勾选要管理其角色的实例旁边的复选框。系统将显示信息面板。

  3. 在信息面板中，点击权限。

  4. 在添加主账号下，开始输入要添加的用户或服务账号的电子邮件地址，然后点击该用户或服务账号的电子邮件地址。

  5. 点击选择角色列表，然后点击 Bigtable 以选择预定义角色，或点击自定义以选择自定义角色。

  6. 点击您要分配的每个角色的名称。

  7. 点击添加。系统将向用户或服务账号授予您在实例级层指定的角色。

gcloud

  1. 如果您不知道实例 ID，请使用 bigtable instances list 命令查看项目的实例列表： 

    gcloud bigtable instances list

  2. 使用 bigtable instances set-iam-policy 命令：

    gcloud bigtable instances set-iam-policy \
  INSTANCE_ID \
  POLICY_FILE

    提供以下信息：

    • INSTANCE_ID：实例的永久性标识符。
    • POLICY_FILE：包含有效 IAM 政策的本地 JSON 或 YAML 文件的路径。

授予表级层 IAM 角色

在表级层，您可以向用户或服务账号授予 Bigtable 的任意预定义角色。您还可以授予您已定义的任何自定义角色。

如需在表级层向用户或服务账号授予预定义角色或自定义角色，请执行以下操作：

控制台

  1. 前往Cloud de Confiance 控制台中的“Bigtable 实例”页面。

    转到实例页面

  2. 点击包含您要设置 IAM 角色的表的实例的名称。

  3. 在左侧导航窗格中选择表格。

  4. 勾选您要管理其角色的表旁边的复选框。系统将显示信息面板。

  5. 在信息面板中，点击权限。

  6. 在添加主账号下，开始输入要添加的用户或服务账号的电子邮件地址，然后点击该用户或服务账号的电子邮件地址。

  7. 点击选择角色下拉列表，然后点击 Bigtable 以选择预定义角色，或点击自定义以选择自定义角色。

  8. 点击您要分配的每个角色的名称。

  9. 点击添加。系统将向该用户或服务账号授予您在表级层指定的角色。

gcloud

  1. 如果您不知道实例 ID，请使用 bigtable instances list 命令查看项目的实例列表：

    gcloud bigtable instances list

  2. 如果您不知道实例的表 ID，请使用 bigtable instances tables list 命令查看实例中的表列表。

    gcloud bigtable instances tables list --instances=INSTANCE_ID

    提供以下信息：

    • INSTANCE_ID：实例的永久性标识符。

  3. 使用 bigtable instances tables set-iam-policy 命令：

    gcloud bigtable instances tables set-iam-policy \
  TABLE_ID \
  --instance=INSTANCE_ID \
  POLICY_FILE

    提供以下信息：

    • TABLE_ID：表的永久标识符。
    • INSTANCE_ID：实例的永久性标识符。
    • POLICY_FILE：包含有效 IAM 政策的本地 JSON 或 YAML 文件的路径。

授予备份级 IAM 角色

在备份级层，您可以向用户或服务账号授予 Bigtable 的任意预定义角色。您还可以授予您已定义的任何自定义角色。

如需在备份级层向用户或服务账号授予预定义角色或自定义角色，请执行以下操作：

gcloud

  1. 如果您不知道实例 ID，请使用 bigtable instances list 命令查看项目的实例列表： 

    gcloud bigtable instances list

  2. 如果您不知道实例中的备份 ID，请使用 bigtable instances backups list 命令查看实例中的备份列表。

    gcloud bigtable backups list --instances=INSTANCE_ID

    提供以下信息：

    • INSTANCE_ID：实例的永久性标识符。

  3. 使用 gcloud bigtable backups set-iam-policy 命令：

    gcloud bigtable backups set-iam-policy BACKUP_ID \
  --instance=INSTANCE_ID \
  --cluster=CLUSTER_ID \
  POLICY_FILE

    提供以下信息：

    • BACKUP_ID：备份的永久性标识符。
    • INSTANCE_ID：实例的永久性标识符。
    • TABLE_ID：表的永久标识符。
    • POLICY_FILE：包含有效 IAM 政策的本地 JSON 或 YAML 文件的路径。

授予授权视图级层 IAM 角色

在授权视图级层，您可以向用户或服务账号授予 Bigtable 的任意预定义角色。您还可以授予您已定义的任何自定义角色。

如需在授权视图级层向用户或服务账号授予预定义角色或自定义角色，请执行以下操作：

控制台

  1. 在 Cloud de Confiance 控制台中，打开 Bigtable 实例列表。

    打开实例列表

  2. 点击包含授权视图的实例。

  3. 在导航窗格中，点击 Bigtable Studio。

  4. 在探索器中，展开表和授权视图。

  5. 在要修改的授权视图旁边，点击 more_vert 操作菜单，然后点击授予访问权限。

  6. 添加至少一个主账号，然后选择应向该主账号或主账号群组分配的角色。

  7. 可选：如需授予其他角色的访问权限，请点击添加其他角色，然后输入每个其他角色的主账号和角色。

  8. 点击保存。

gcloud

  1. 如果您不知道实例 ID，请使用 bigtable instances list 命令查看项目的实例列表：

    gcloud bigtable instances list

  2. 如果您不知道实例的表 ID，请使用 bigtable instances tables list 命令查看实例中的表列表。

    gcloud bigtable instances tables list --instances=INSTANCE_ID

  3. 如果您不知道视图 ID，请使用 bigtable authorized-views list 命令查看表的所有授权视图的列表。

    gcloud bigtable instances tables authorized-views list \
  --instance=INSTANCE_ID \
  --table=TABLE_ID

  4. 使用 bigtable authorized-views set-iam-policy 命令：

    gcloud bigtable authorized-views set-iam-policy TABLE_ID{"</var>"}} \
  AUTHORIZED_VIEW_ID{"</var>"}} --instance=INSTANCE_ID{"</var>"}} POLICY_FILE{"</var>"}}

    提供以下信息：

    • INSTANCE_ID：实例的永久性标识符。
    • TABLE_ID：表的永久标识符。
    • AUTHORIZED_VIEW_ID：视图的永久标识符。
    • POLICY_FILE：包含有效 IAM 政策的本地 JSON 或 YAML 文件的路径。

IAM Conditions

IAM Conditions 让您可为某些 Cloud de Confiance资源（包括 Bigtable 资源）定义和强制执行基于属性的条件访问权限控制。

在 Bigtable 中，您可以根据以下特性强制执行条件访问权限：

  • 日期/时间特性：用于设置对 Bigtable 资源的临时（很快就会过期）、预定或限时访问权限。例如，您可以允许用户在指定日期之前访问表。
  • 资源属性：用于根据资源名称、资源类型或资源服务属性配置有条件访问权限。在 Bigtable 中，您可以使用实例、集群、表、备份和授权视图的特性来配置条件访问权限。例如，您可以允许用户仅管理以特定前缀开头的表，也可以允许用户仅访问特定表。

如需详细了解 IAM Conditions，请参阅条件概览。

后续步骤

详细了解 IAM。