이 페이지의 일부 또는 모든 정보는 Trusted Cloud by S3NS에 적용되지 않을 수 있습니다. 자세한 내용은
Google Cloud와의 차이점을 참조하세요.
Privileged Access Manager에서 권한 부여 취소
주 구성원이 사용 권한에 대해 권한 부여를 요청하여 활성 상태가 되면 privilegedaccessmanager.grants.revoke 권한을 가진 주 구성원이 권한 부여를 취소할 수 있습니다. 활성 상태가 아닌 권한 부여는 취소할 수 없습니다.
시작하기 전에
Privileged Access Manager를 사용 설정하고 권한을 설정했는지 확인합니다.
Google Cloud 콘솔을 사용하여 권한 부여 취소
사용 권한에 대해 수행된 특정 권한 부여를 취소하려면 다음 안내를 완료하세요.
Privileged Access Manager 페이지로 이동합니다.
Privileged Access Manager로 이동
권한 부여를 취소하려는 조직, 폴더, 프로젝트를 선택합니다.
권한 부여 탭과 모든 사용자의 권한 부여 탭을 차례로 클릭합니다.
여기에는 모든 요청자의 모든 권한 부여, 권한 부여 상태, 관련 사용 권한 세부정보가 포함됩니다.
표에서 취소하려는 권한 부여와 동일한 행에 있는 more_vert
옵션 더보기를 클릭합니다.
활성 상태의 권한 부여를 취소하려면 권한 부여 취소를 클릭합니다.
사용 권한에 대해 수행된 모든 활성 권한 부여를 취소하려면 다음 안내를 따르세요.
Privileged Access Manager 페이지로 이동합니다.
Privileged Access Manager로 이동
사용 권한 탭을 클릭한 다음 모든 사용자를 위한 사용 권한 탭을 클릭합니다. 여기에서 사용 가능한 사용 권한, 부여되는 역할, 유효한 요청자와 승인자를 확인할 수 있습니다.
표에서 권한 부여를 취소하려는 사용 권한과 동일한 행에서 more_vert
옵션 더보기를 클릭합니다.
모든 권한 부여 취소를 클릭합니다.
프로그래매틱 방식으로 권한 부여 취소
gcloud
gcloud pam grants revoke
명령어는 활성 상태의 권한 부여를 취소합니다.
아래의 명령어 데이터를 사용하기 전에 다음을 바꿉니다.
GRANT_ID: 취소하려는 권한 부여의 ID입니다.
권한 부여를 확인하여 ID를 검색할 수 있습니다.
ENTITLEMENT_ID: 권한 부여가 속한 사용 권한의 ID입니다.REVOKE_REASON: 권한 부여가 취소된 이유입니다.RESOURCE_TYPE: 선택사항. 사용 권한이 속한 리소스 유형입니다. organization, folder 또는 project 값을 사용합니다.RESOURCE_ID: RESOURCE_TYPE에 사용됩니다. 사용 권한을 관리하려는 Trusted Cloud프로젝트, 폴더, 조직의 ID입니다. 프로젝트 ID는 my-project와 같은 영숫자 문자열입니다.
폴더 및 조직 ID는 123456789012와 같은 숫자입니다.
다음 명령어를 실행합니다.
Linux, macOS 또는 Cloud Shell
gcloud pam grants revoke \
GRANT_ID \
--entitlement=ENTITLEMENT_ID \
--reason="REVOKE_REASON" \
--location=global \
--RESOURCE_TYPE=RESOURCE_ID
Windows(PowerShell)
gcloud pam grants revoke `
GRANT_ID `
--entitlement=ENTITLEMENT_ID `
--reason="REVOKE_REASON" `
--location=global `
--RESOURCE_TYPE=RESOURCE_ID
Windows(cmd.exe)
gcloud pam grants revoke ^
GRANT_ID ^
--entitlement=ENTITLEMENT_ID ^
--reason="REVOKE_REASON" ^
--location=global ^
--RESOURCE_TYPE=RESOURCE_ID
다음과 비슷한 응답이 표시됩니다.
auditTrail:
accessGrantTime: '2024-04-05T00:29:16.703069535Z'
accessRemoveTime: '2024-04-05T00:29:55.815041079Z'
createTime: '2024-04-05T00:27:43.822053968Z'
justification:
unstructuredJustification: Renaming a file to mitigate issue #312
name: projects/my-project/locations/global/entitlements/ENTITLEMENT_ID/grants/GRANT_ID
privilegedAccess:
gcpIamAccess:
resource: //cloudresourcemanager.googleapis.com/projects/my-project
resourceType: cloudresourcemanager.googleapis.com/Project
roleBindings:
- role: roles/storage.admin
requestedDuration: 2700s
requester: cruz@example.com
state: REVOKED
timeline:
events:
- eventTime: '2024-04-05T00:27:44.014277946Z'
requested:
expireTime: '2024-04-06T00:27:44.014277946Z'
- approved:
actor: alex@example.com
reason: Access allowed under existing policy
eventTime: '2024-04-05T00:29:14.921828714Z'
- eventTime: '2024-04-05T00:29:14.921763008Z'
scheduled:
scheduledActivationTime: '2024-04-05T00:29:14.921763008Z'
- activated: {}
eventTime: '2024-04-05T00:29:16.703069535Z'
- eventTime: '2024-04-05T00:29:55.815041079Z'
revoked:
actor: alex@example.com
reason: Revoking due to new access policy
REST
Privileged Access Manager API의 revokeGrant 메서드는 활성 상태의 권한 부여를 취소합니다.
요청 데이터를 사용하기 전에 다음을 바꿉니다.
SCOPE: 사용 권한이 있는 조직, 폴더, 프로젝트로, organizations/ORGANIZATION_ID, folders/FOLDER_ID 또는 projects/PROJECT_ID 형식입니다. 프로젝트 ID는 my-project와 같은 영숫자 문자열입니다. 폴더 및 조직 ID는 123456789012와 같은 숫자입니다.ENTITLEMENT_ID: 권한 부여가 속한 사용 권한의 ID입니다.GRANT_ID: 취소하려는 권한 부여의 ID입니다.
권한 부여를 확인하여 ID를 검색할 수 있습니다.
REVOKE_REASON: 권한 부여가 취소된 이유입니다.
HTTP 메서드 및 URL:
POST https://privilegedaccessmanager.googleapis.com/v1/SCOPE/locations/global/entitlements/ENTITLEMENT_ID/grants/GRANT_ID:revoke
JSON 요청 본문:
{
"reason": "REVOKE_REASON"
}
요청을 보내려면 다음 옵션 중 하나를 펼칩니다.
cURL(Linux, macOS, Cloud Shell)
요청 본문을 request.json 파일에 저장하고 다음 명령어를 실행합니다.
curl -X POST \
-H "Authorization: Bearer $(gcloud auth print-access-token)" \
-H "Content-Type: application/json; charset=utf-8" \
-d @request.json \
"https://privilegedaccessmanager.googleapis.com/v1/SCOPE/locations/global/entitlements/ENTITLEMENT_ID/grants/GRANT_ID:revoke"
PowerShell(Windows)
요청 본문을 request.json 파일에 저장하고 다음 명령어를 실행합니다.
$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }
Invoke-WebRequest `
-Method POST `
-Headers $headers `
-ContentType: "application/json; charset=utf-8" `
-InFile request.json `
-Uri "https://privilegedaccessmanager.googleapis.com/v1/SCOPE/locations/global/entitlements/ENTITLEMENT_ID/grants/GRANT_ID:revoke" | Select-Object -Expand Content
다음과 비슷한 JSON 응답이 표시됩니다.
{
"name": "projects/my-project/locations/global/operations/OPERATION_ID",
"metadata": {
"@type": "type.googleapis.com/google.cloud.privilegedaccessmanager.v1.OperationMetadata",
"createTime": "2024-03-06T23:07:48.716396505Z",
"target": "projects/my-project/locations/global/entitlements/ENTITLEMENT_ID/grants/GRANT_ID",
"verb": "update",
"requestedCancellation": false,
"apiVersion": "v1"
},
"done": false
}
취소 작업의 진행 상황을 확인하려면 다음 엔드포인트에 GET 요청을 전송하면 됩니다.
https://privilegedaccessmanager.googleapis.com/v1/SCOPE/locations/global/operations/OPERATION_ID
다음 엔드포인트에 GET 요청을 전송하여 모든 작업을 나열합니다.
https://privilegedaccessmanager.googleapis.com/v1/SCOPE/locations/global/operations
달리 명시되지 않는 한 이 페이지의 콘텐츠에는 Creative Commons Attribution 4.0 라이선스에 따라 라이선스가 부여되며, 코드 샘플에는 Apache 2.0 라이선스에 따라 라이선스가 부여됩니다. 자세한 내용은 Google Developers 사이트 정책을 참조하세요. 자바는 Oracle 및/또는 Oracle 계열사의 등록 상표입니다.
최종 업데이트: 2025-08-18(UTC)
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["필요한 정보가 없음","missingTheInformationINeed","thumb-down"],["너무 복잡함/단계 수가 너무 많음","tooComplicatedTooManySteps","thumb-down"],["오래됨","outOfDate","thumb-down"],["번역 문제","translationIssue","thumb-down"],["샘플/코드 문제","samplesCodeIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-08-18(UTC)"],[[["\u003cp\u003ePrincipals with the \u003ccode\u003eprivilegedaccessmanager.grants.revoke\u003c/code\u003e permission can revoke active grants made against entitlements.\u003c/p\u003e\n"],["\u003cp\u003eGrants can be revoked through the Google Cloud console by navigating to the Privileged Access Manager page and selecting either "Revoke grant" for a specific grant or "Revoke all grants" for all active grants of an entitlement.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003egcloud pam grants revoke\u003c/code\u003e command can be used to programmatically revoke an active grant by providing the grant ID, entitlement ID, and a reason for revocation.\u003c/p\u003e\n"],["\u003cp\u003eThe Privileged Access Manager API's \u003ccode\u003erevokeGrant\u003c/code\u003e method allows for revoking an active grant via a POST request, including the scope, entitlement ID, grant ID, and reason for revocation.\u003c/p\u003e\n"],["\u003cp\u003eWhen revoking grants through the console or API, you must ensure that Privileged Access Manager is enabled and the relevant permissions are set up beforehand.\u003c/p\u003e\n"]]],[],null,["After a principal has successfully [requested a grant](/iam/docs/pam-request-temporary-elevated-access)\nagainst an entitlement and it is active, principals with the\n`privilegedaccessmanager.grants.revoke` permission\ncan revoke the grant. Grants that don't have an active status can't be revoked.\n\nBefore you begin\n\nMake sure you have [enabled Privileged Access Manager and set up permissions for it](/iam/docs/pam-permissions-and-setup).\n\nRevoke grants using the Google Cloud console\n\nTo revoke a specific grant made against an entitlement, complete the following\ninstructions:\n\n1. Go to the **Privileged Access Manager** page.\n\n [Go to Privileged Access Manager](https://console.cloud.google.com/iam-admin/pam/entitlements/)\n2. Select the organization, folder, or project you want to revoke grants in.\n\n3. Click the **Grants** tab, followed by the **Grants for all users** tab.\n This contains all grants across all requesters, the grant statuses, and\n their associated entitlement details.\n\n4. In the table, click more_vert\n **More options** in the same row as a grant you want to revoke.\n\n5. To revoke an active grant, click **Revoke grant**.\n\nTo revoke all active grants made against an entitlement, complete the following\ninstructions:\n\n1. Go to the **Privileged Access Manager** page.\n\n [Go to Privileged Access Manager](https://console.cloud.google.com/iam-admin/pam/entitlements/)\n2. Click the **Entitlements** tab, followed by the\n **Entitlements for all users** tab. Here you can find the available\n entitlements, the roles they grant, and their valid requesters and\n approvers.\n\n3. In the table, click more_vert\n **More options** in the same row as an entitlement you want to revoke the\n grants for.\n\n4. Click **Revoke all grants**.\n\nRevoke grants programmatically \n\ngcloud\n\n\nThe\n\n`gcloud pam grants revoke`\n\ncommand revokes an active grant.\n\n\nBefore using any of the command data below,\nmake the following replacements:\n\n- \u003cvar translate=\"no\"\u003eGRANT_ID\u003c/var\u003e: The ID of the grant you want to revoke. You can retrieve the ID by [viewing grants](/iam/docs/pam-view-grants).\n- \u003cvar translate=\"no\"\u003eENTITLEMENT_ID\u003c/var\u003e: The ID of the entitlement that the grant belongs to.\n- \u003cvar translate=\"no\"\u003eREVOKE_REASON\u003c/var\u003e: Why the grant has been revoked.\n- \u003cvar translate=\"no\"\u003eRESOURCE_TYPE\u003c/var\u003e: Optional. The resource type that the entitlement belongs to. Use the value `organization`, `folder`, or `project`.\n- \u003cvar translate=\"no\"\u003eRESOURCE_ID\u003c/var\u003e: Used with \u003cvar translate=\"no\"\u003e\u003ccode translate=\"no\" dir=\"ltr\"\u003eRESOURCE_TYPE\u003c/code\u003e\u003c/var\u003e. The ID of the Google Cloud project, folder, or organization that you want to manage entitlements for. Project IDs are alphanumeric strings, like `my-project`. Folder and organization IDs are numeric, like `123456789012`.\n\n\nExecute the\n\nfollowing\n\ncommand:\n\nLinux, macOS, or Cloud Shell \n\n```bash\ngcloud pam grants revoke \\\n GRANT_ID \\\n --entitlement=ENTITLEMENT_ID \\\n --reason=\"\u003cvar translate=\"no\"\u003eREVOKE_REASON\u003c/var\u003e\" \\\n --location=global \\\n --RESOURCE_TYPE=RESOURCE_ID\n```\n\nWindows (PowerShell) \n\n```bash\ngcloud pam grants revoke `\n GRANT_ID `\n --entitlement=ENTITLEMENT_ID `\n --reason=\"\u003cvar translate=\"no\"\u003eREVOKE_REASON\u003c/var\u003e\" `\n --location=global `\n --RESOURCE_TYPE=RESOURCE_ID\n```\n\nWindows (cmd.exe) \n\n```bash\ngcloud pam grants revoke ^\n GRANT_ID ^\n --entitlement=ENTITLEMENT_ID ^\n --reason=\"\u003cvar translate=\"no\"\u003eREVOKE_REASON\u003c/var\u003e\" ^\n --location=global ^\n --RESOURCE_TYPE=RESOURCE_ID\n```\n\nYou should receive a response similar to the following:\n\n```\nauditTrail:\n accessGrantTime: '2024-04-05T00:29:16.703069535Z'\n accessRemoveTime: '2024-04-05T00:29:55.815041079Z'\ncreateTime: '2024-04-05T00:27:43.822053968Z'\njustification:\n unstructuredJustification: Renaming a file to mitigate issue #312\nname: projects/my-project/locations/global/entitlements/ENTITLEMENT_ID/grants/GRANT_ID\nprivilegedAccess:\n gcpIamAccess:\n resource: //cloudresourcemanager.googleapis.com/projects/my-project\n resourceType: cloudresourcemanager.googleapis.com/Project\n roleBindings:\n - role: roles/storage.admin\nrequestedDuration: 2700s\nrequester: cruz@example.com\nstate: REVOKED\ntimeline:\n events:\n - eventTime: '2024-04-05T00:27:44.014277946Z'\n requested:\n expireTime: '2024-04-06T00:27:44.014277946Z'\n - approved:\n actor: alex@example.com\n reason: Access allowed under existing policy\n eventTime: '2024-04-05T00:29:14.921828714Z'\n - eventTime: '2024-04-05T00:29:14.921763008Z'\n scheduled:\n scheduledActivationTime: '2024-04-05T00:29:14.921763008Z'\n - activated: {}\n eventTime: '2024-04-05T00:29:16.703069535Z'\n - eventTime: '2024-04-05T00:29:55.815041079Z'\n revoked:\n actor: alex@example.com\n reason: Revoking due to new access policy\n```\n\nREST\n\n\nThe Privileged Access Manager API's\n`revokeGrant`\nmethod revokes an active grant.\n\n\nBefore using any of the request data,\nmake the following replacements:\n\n- \u003cvar translate=\"no\"\u003eSCOPE\u003c/var\u003e: The organization, folder, or project that the entitlement is in, in the format of `organizations/`\u003cvar translate=\"no\"\u003eORGANIZATION_ID\u003c/var\u003e, `folders/`\u003cvar translate=\"no\"\u003eFOLDER_ID\u003c/var\u003e, or `projects/`\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e. Project IDs are alphanumeric strings, like `my-project`. Folder and organization IDs are numeric, like `123456789012`.\n- \u003cvar translate=\"no\"\u003eENTITLEMENT_ID\u003c/var\u003e: The ID of the entitlement that the grant belongs to.\n- \u003cvar translate=\"no\"\u003eGRANT_ID\u003c/var\u003e: The ID of the grant you want to revoke. You can retrieve the ID by [viewing grants](/iam/docs/pam-view-grants).\n- \u003cvar translate=\"no\"\u003eREVOKE_REASON\u003c/var\u003e: The reason the grant was revoked.\n\n\nHTTP method and URL:\n\n```\nPOST https://privilegedaccessmanager.googleapis.com/v1/SCOPE/locations/global/entitlements/ENTITLEMENT_ID/grants/GRANT_ID:revoke\n```\n\n\nRequest JSON body:\n\n```\n{\n \"reason\": \"REVOKE_REASON\"\n}\n```\n\nTo send your request, expand one of these options:\n\ncurl (Linux, macOS, or Cloud Shell) **Note:** The following command assumes that you have logged in to the `gcloud` CLI with your user account by running [`gcloud init`](/sdk/gcloud/reference/init) or [`gcloud auth login`](/sdk/gcloud/reference/auth/login) , or by using [Cloud Shell](/shell/docs), which automatically logs you into the `gcloud` CLI . You can check the currently active account by running [`gcloud auth list`](/sdk/gcloud/reference/auth/list).\n\n\nSave the request body in a file named `request.json`,\nand execute the following command:\n\n```\ncurl -X POST \\\n -H \"Authorization: Bearer $(gcloud auth print-access-token)\" \\\n -H \"Content-Type: application/json; charset=utf-8\" \\\n -d @request.json \\\n \"https://privilegedaccessmanager.googleapis.com/v1/SCOPE/locations/global/entitlements/ENTITLEMENT_ID/grants/GRANT_ID:revoke\"\n```\n\nPowerShell (Windows) **Note:** The following command assumes that you have logged in to the `gcloud` CLI with your user account by running [`gcloud init`](/sdk/gcloud/reference/init) or [`gcloud auth login`](/sdk/gcloud/reference/auth/login) . You can check the currently active account by running [`gcloud auth list`](/sdk/gcloud/reference/auth/list).\n\n\nSave the request body in a file named `request.json`,\nand execute the following command:\n\n```\n$cred = gcloud auth print-access-token\n$headers = @{ \"Authorization\" = \"Bearer $cred\" }\n\nInvoke-WebRequest `\n -Method POST `\n -Headers $headers `\n -ContentType: \"application/json; charset=utf-8\" `\n -InFile request.json `\n -Uri \"https://privilegedaccessmanager.googleapis.com/v1/SCOPE/locations/global/entitlements/ENTITLEMENT_ID/grants/GRANT_ID:revoke\" | Select-Object -Expand Content\n```\n\nYou should receive a JSON response similar to the following:\n\n```\n{\n \"name\": \"projects/my-project/locations/global/operations/OPERATION_ID\",\n \"metadata\": {\n \"@type\": \"type.googleapis.com/google.cloud.privilegedaccessmanager.v1.OperationMetadata\",\n \"createTime\": \"2024-03-06T23:07:48.716396505Z\",\n \"target\": \"projects/my-project/locations/global/entitlements/ENTITLEMENT_ID/grants/GRANT_ID\",\n \"verb\": \"update\",\n \"requestedCancellation\": false,\n \"apiVersion\": \"v1\"\n },\n \"done\": false\n}\n```\n\nTo check on the progress of a revoke operation, you can send a\n`GET` request to the following endpoint:\n\n```\nhttps://privilegedaccessmanager.googleapis.com/v1/SCOPE/locations/global/operations/OPERATION_ID\n```\n\nSend a `GET` request to the following endpoint to list all\noperations: \n\n```\nhttps://privilegedaccessmanager.googleapis.com/v1/SCOPE/locations/global/operations\n```"]]
