JSON 方法所需的 IAM 權限

下表列出在特定資源上執行各項 Cloud Storage JSON 方法所需的 Identity and Access Management (IAM) 權限。IAM 權限會組合成角色。您將角色授予使用者和群組。

如要瞭解僅適用於停用統一 bucket 層級存取權的 bucket 的其他方法，請參閱 ACL 方法表格。

資源 方法 必要 IAM 權限1
AnywhereCache create storage.anywhereCaches.create
AnywhereCache disable storage.anywhereCaches.disable
AnywhereCache get storage.anywhereCaches.get
AnywhereCache list storage.anywhereCaches.list
AnywhereCache pause storage.anywhereCaches.pause
AnywhereCache resume storage.anywhereCaches.resume
AnywhereCache update storage.anywhereCaches.update
Buckets delete storage.buckets.delete
Buckets get storage.buckets.get
storage.buckets.getIamPolicy2
storage.buckets.getIpFilter13
storage.anywhereCaches.get18
Buckets getIamPolicy storage.buckets.getIamPolicy
Buckets insert storage.buckets.create
storage.buckets.enableObjectRetention3
storage.buckets.setIpFilter14
Buckets list storage.buckets.list
storage.buckets.getIamPolicy2
storage.buckets.getIpFilter13
storage.anywhereCaches.list
Buckets lockRetentionPolicy storage.buckets.update
Buckets patch storage.buckets.update
storage.buckets.getIamPolicy4
storage.buckets.setIamPolicy5
storage.buckets.setIpFilter14
storage.buckets.getIpFilter13
Buckets relocate storage.buckets.relocate
Buckets setIamPolicy storage.buckets.setIamPolicy
Buckets testIamPermissions 無
Buckets update storage.buckets.update
storage.buckets.getIamPolicy4
storage.buckets.setIamPolicy5
storage.buckets.setIpFilter14
storage.buckets.getIpFilter13
storage.anywhereCaches.update
DatasetConfigs delete storageinsights.datasetConfigs.delete
DatasetConfigs get storageinsights.datasetConfigs.get
DatasetConfigs insert storageinsights.datasetConfigs.create
DatasetConfigs list storageinsights.datasetConfigs.list
DatasetConfigs linkDataset storageinsights.datasetConfigs.linkDataset
DatasetConfigs unlinkDataset storageinsights.datasetConfigs.unlinkDataset
DatasetConfigs patch storageinsights.datasetConfigs.update
FeatureConfigs create storage.featureConfigs.create
FeatureConfigs delete storage.featureConfigs.delete
FeatureConfigs get storage.featureConfigs.get
FeatureConfigs list storage.featureConfigs.list
FeatureConfigs update storage.featureConfigs.update
Folders get storage.folders.get
Folders insert storage.folders.create
Folders list storage.folders.list
Folders rename storage.folders.rename (來源資料夾)
storage.folders.create (目的地資料夾)
Folders delete storage.folders.delete
IntelligenceConfig getIntelligenceConfig storage.intelligenceConfigs.get
IntelligenceConfig updateIntelligenceConfig storage.intelligenceConfigs.update
IntelligenceFindings get storage.buckets.viewIntelligenceDetails
IntelligenceFindings list storage.buckets.viewIntelligenceDetails
IntelligenceFindings summarize storage.buckets.viewIntelligenceDetails
IntelligenceFindings.revisions get storage.buckets.viewIntelligenceDetails
IntelligenceFindings.revisions list storage.buckets.viewIntelligenceDetails
Jobs create storagebatchoperations.jobs.create
Jobs get storagebatchoperations.jobs.get
storagebatchoperations.operations.get
Jobs list storagebatchoperations.jobs.list
storagebatchoperations.operations.list
Jobs cancel storagebatchoperations.jobs.cancel
storagebatchoperations.operations.cancel
Jobs delete storagebatchoperations.jobs.delete
ManagedFolders delete storage.managedfolders.delete
storage.managedfolders.setIamPolicy10
ManagedFolders get storage.managedfolders.get
ManagedFolders getIamPolicy storage.managedfolders.getIamPolicy
ManagedFolders insert storage.managedfolders.create
ManagedFolders list storage.managedfolders.list
ManagedFolders update storage.managedfolders.update
ManagedFolders setIamPolicy storage.managedfolders.setIamPolicy
Notifications delete storage.buckets.update
Notifications get storage.buckets.get
Notifications insert storage.buckets.update
Notifications list storage.buckets.get
Objects bulkRestore storage.buckets.restore
storage.objects.create
storage.objects.delete11
storage.objects.restore
storage.objects.setIamPolicy6,12
Objects compose storage.objects.get
storage.objects.create
storage.objects.delete7
storage.objects.getIamPolicy2,6
storage.objects.setRetention8
storage.objects.createContext19
Objects copy storage.objects.get (適用於來源 bucket)
storage.objects.create (適用於目的地 bucket)
storage.objects.delete (適用於目的地 bucket)7
storage.objects.setRetention (適用於目的地 bucket)8
storage.objects.createContext19
Objects delete storage.objects.delete
Objects get storage.objects.get
storage.objects.getIamPolicy2,6
Objects insert storage.objects.create
storage.objects.delete7
storage.objects.setRetention8
storage.objects.createContext19
Objects list storage.objects.list
storage.objects.getIamPolicy2,6
Objects move storage.objects.move15 (適用於來源物件)
storage.objects.delete15 (適用於來源物件)
storage.objects.get15 (適用於來源物件)
storage.objects.create (適用於目的地物件)
storage.objects.delete16 (適用於目的地物件)
storage.folders.create17 (適用於目的地物件)
Objects patch storage.objects.update
storage.objects.setRetention8
storage.objects.overrideUnlockedRetention9
storage.objects.getIamPolicy4,6
storage.objects.setIamPolicy5,6
storage.objects.createContext20
storage.objects.updateContext21
storage.objects.deleteContext22
Objects restore storage.objects.create
storage.objects.delete7
storage.objects.restore
storage.objects.getIamPolicy2,6
storage.objects.setIamPolicy6,12
Objects rewrite storage.objects.get (適用於來源 bucket)
storage.objects.create (適用於目的地 bucket)
storage.objects.delete (適用於目的地 bucket)7
storage.objects.setRetention (適用於目的地 bucket)8
storage.objects.createContext19
Objects update storage.objects.update
storage.objects.setRetention8
storage.objects.overrideUnlockedRetention9
storage.objects.getIamPolicy4、6
storage.objects.setIamPolicy5、6
storage.objects.createContext20
storage.objects.updateContext21
storage.objects.deleteContext22
Objects viewFullContext storage.objects.viewFullContext
Objects watchAll storage.buckets.update
Projects.hmacKeys create storage.hmacKeys.create
Projects.hmacKeys delete storage.hmacKeys.delete
Projects.hmacKeys get storage.hmacKeys.get
Projects.hmacKeys list storage.hmacKeys.list
Projects.hmacKeys update storage.hmacKeys.update
Projects.serviceAccount get resourceManager.projects.get

1 如果您在要求中使用 userProject 參數或 x-goog-user-project 標頭，除了提出要求所需的一般 IAM 權限外，您還必須具備指定專案 ID 的 serviceusage.services.use 權限。

2 如果您想將 ACL 或 IAM 政策納入full投影，才需要這項權限。如果您沒有這項權限並要求 full 投影，那麼只會收到局部投影。

3 只有在要求包含 enableObjectRetention 查詢參數時，才需要這項權限。

4 只有在想將 ACL 納入回應時，才需要這項權限。

5 如果您想在要求中加入 ACL 或變更禁止公開存取設定，則必須具備這項權限。

6 如果 bucket 啟用統一 bucket 層級存取權，則不適用這項權限。

7 只有在要求導致同名物件遭到覆寫時，才需要這項權限。

8 如果要求主體包含 retention 屬性，或對具有現有保留設定的物件提出 UPDATE 要求，則必須具備這項權限。

9 只有在要求包含查詢參數 overrideUnlockedRetention=true 時，才需要這項權限。

10 只有在要求包含查詢參數 allowNonEmpty=true 時，才需要這項權限。

11 只有在要求包含查詢參數 allowOverwrite=true，且要求會導致同名物件遭到覆寫時，才需要這項權限。

12 只有在要求包含查詢參數 copySourceAcl=true 時，才需要這項權限。

13 如果您想在 Buckets: get 要求中加入儲存空間 IP 篩選規則，才需要這項權限。如果沒有這項權限，投影畫面只會顯示部分內容。

14 如要建立、列出、刪除及更新 bucket IP 過濾規則，才需要這項權限。

15 如要移動已啟用階層命名空間的值區中的物件，您必須具備 storage.objects.delete 和 storage.objects.get 權限，或 storage.objects.move 權限 (如要在不授予物件讀取或刪除權限的情況下移動物件)。

16 只有在您要取代物件時，才需要這項權限。

17 只有在您想自動建立任何缺少的父項資料夾時，才需要這項權限。

18 只有在想傳回使用 Rapid Cache 建立的快取時，才需要這項權限。

19 只有在要求包含非空白的 destination.contexts.custom 屬性 (用於組成物件) 或非空白的 contexts.custom 屬性 (用於複製、插入或重寫物件) 時，才需要這項權限。

20 只有在您想為物件新增情境時，才需要這項權限。

21 只有在您想更新物件的背景資訊時，才需要這項權限。

22 只有在想刪除物件的內容時，才需要這項權限。

ACL 相關方法

下表列出執行 JSON 方法所需的 IAM 權限，這些方法專門用於管理 ACL。這些方法僅適用於已停用「統一 bucket 層級存取權」的 bucket。

資源 方法 必要 IAM 權限1
BucketAccessControls delete storage.buckets.get
storage.buckets.getIamPolicy
storage.buckets.setIamPolicy
storage.buckets.update
BucketAccessControls get storage.buckets.get
storage.buckets.getIamPolicy
BucketAccessControls insert storage.buckets.get
storage.buckets.getIamPolicy
storage.buckets.setIamPolicy
storage.buckets.update
BucketAccessControls list storage.buckets.get
storage.buckets.getIamPolicy
BucketAccessControls patch storage.buckets.get
storage.buckets.getIamPolicy
storage.buckets.setIamPolicy
storage.buckets.update
BucketAccessControls update storage.buckets.get
storage.buckets.getIamPolicy
storage.buckets.setIamPolicy
storage.buckets.update
DefaultObjectAccessControls delete storage.buckets.get
storage.buckets.getIamPolicy
storage.buckets.setIamPolicy
storage.buckets.update
DefaultObjectAccessControls get storage.buckets.get
storage.buckets.getIamPolicy
DefaultObjectAccessControls insert storage.buckets.get
storage.buckets.getIamPolicy
storage.buckets.setIamPolicy
storage.buckets.update
DefaultObjectAccessControls list storage.buckets.get
storage.buckets.getIamPolicy
DefaultObjectAccessControls patch storage.buckets.get
storage.buckets.getIamPolicy
storage.buckets.setIamPolicy
storage.buckets.update
DefaultObjectAccessControls update storage.buckets.get
storage.buckets.getIamPolicy
storage.buckets.setIamPolicy
storage.buckets.update
ObjectAccessControls delete storage.objects.get
storage.objects.getIamPolicy
storage.objects.setIamPolicy
storage.objects.update
ObjectAccessControls get storage.objects.get
storage.objects.getIamPolicy
ObjectAccessControls insert storage.objects.get
storage.objects.getIamPolicy
storage.objects.setIamPolicy
storage.objects.update
ObjectAccessControls list storage.objects.get
storage.objects.getIamPolicy
ObjectAccessControls patch storage.objects.get
storage.objects.getIamPolicy
storage.objects.setIamPolicy
storage.objects.update
ObjectAccessControls update storage.objects.get
storage.objects.getIamPolicy
storage.objects.setIamPolicy
storage.objects.update

1 如果您在要求中使用 userProject 參數或 x-goog-user-project 標頭，除了發出要求所需的正常 IAM 權限外，您還必須具備指定專案 ID 的 serviceusage.services.use 權限。

後續步驟