JSON 方法所需的 IAM 權限

下表列出在特定資源上執行各項 Cloud Storage JSON 方法所需的 Identity and Access Management (IAM) 權限。IAM 權限會組合成角色。您將角色授予使用者和群組。

如要瞭解僅適用於停用統一 bucket 層級存取權的 bucket 的其他方法，請參閱 ACL 方法表格。

資源 方法 必要的 IAM 權限1
AnywhereCache create storage.anywhereCaches.create
AnywhereCache disable storage.anywhereCaches.disable
AnywhereCache get storage.anywhereCaches.get
AnywhereCache list storage.anywhereCaches.list
AnywhereCache pause storage.anywhereCaches.pause
AnywhereCache resume storage.anywhereCaches.resume
AnywhereCache update storage.anywhereCaches.update
Buckets delete storage.buckets.delete
Buckets get storage.buckets.get
storage.buckets.getIamPolicy2
storage.buckets.getIpFilter13
storage.anywhereCaches.get18
Buckets getIamPolicy storage.buckets.getIamPolicy
Buckets insert storage.buckets.create
storage.buckets.enableObjectRetention3
storage.buckets.setIpFilter14
Buckets list storage.buckets.list
storage.buckets.getIamPolicy2
storage.buckets.getIpFilter13
storage.anywhereCaches.list
Buckets lockRetentionPolicy storage.buckets.update
Buckets patch storage.buckets.update
storage.buckets.getIamPolicy4
storage.buckets.setIamPolicy5
storage.buckets.setIpFilter14
storage.buckets.getIpFilter13
Buckets relocate storage.buckets.relocate
Buckets setIamPolicy storage.buckets.setIamPolicy
Buckets testIamPermissions 無
Buckets update storage.buckets.update
storage.buckets.getIamPolicy4
storage.buckets.setIamPolicy5
storage.buckets.setIpFilter14
storage.buckets.getIpFilter13
storage.anywhereCaches.update
DatasetConfigs delete storageinsights.datasetConfigs.delete
DatasetConfigs get storageinsights.datasetConfigs.get
DatasetConfigs insert storageinsights.datasetConfigs.create
DatasetConfigs list storageinsights.datasetConfigs.list
DatasetConfigs linkDataset storageinsights.datasetConfigs.linkDataset
DatasetConfigs unlinkDataset storageinsights.datasetConfigs.unlinkDataset
DatasetConfigs patch storageinsights.datasetConfigs.update
FeatureConfigs create storage.featureConfigs.create
FeatureConfigs delete storage.featureConfigs.delete
FeatureConfigs get storage.featureConfigs.get
FeatureConfigs list storage.featureConfigs.list
FeatureConfigs update storage.featureConfigs.update
Folders get storage.folders.get
Folders insert storage.folders.create
Folders list storage.folders.list
Folders rename storage.folders.rename (來源資料夾)
storage.folders.create (目的地資料夾)
Folders delete storage.folders.delete
IntelligenceConfig getIntelligenceConfig storage.intelligenceConfigs.get
IntelligenceConfig updateIntelligenceConfig storage.intelligenceConfigs.update
IntelligenceFindings get storage.buckets.viewIntelligenceDetails
IntelligenceFindings list storage.buckets.viewIntelligenceDetails
IntelligenceFindings summarize storage.buckets.viewIntelligenceDetails
IntelligenceFindings.revisions get storage.buckets.viewIntelligenceDetails
IntelligenceFindings.revisions list storage.buckets.viewIntelligenceDetails
Jobs create storagebatchoperations.jobs.create
Jobs get storagebatchoperations.jobs.get
storagebatchoperations.operations.get
Jobs list storagebatchoperations.jobs.list
storagebatchoperations.operations.list
Jobs cancel storagebatchoperations.jobs.cancel
storagebatchoperations.operations.cancel
Jobs delete storagebatchoperations.jobs.delete
ManagedFolders delete storage.managedfolders.delete
storage.managedfolders.setIamPolicy10
ManagedFolders get storage.managedfolders.get
ManagedFolders getIamPolicy storage.managedfolders.getIamPolicy
ManagedFolders insert storage.managedfolders.create
ManagedFolders list storage.managedfolders.list
ManagedFolders update storage.managedfolders.update
ManagedFolders setIamPolicy storage.managedfolders.setIamPolicy
Notifications delete storage.buckets.update
Notifications get storage.buckets.get
Notifications insert storage.buckets.update
Notifications list storage.buckets.get
Objects bulkRestore storage.buckets.restore
storage.objects.create
storage.objects.delete11
storage.objects.restore
storage.objects.setIamPolicy6、12
Objects compose storage.objects.get
storage.objects.create
storage.objects.delete7
storage.objects.getIamPolicy2、6
storage.objects.setRetention8
storage.objects.createContext19
Objects copy storage.objects.get (來源 bucket)
storage.objects.create (目的地 bucket)
storage.objects.delete (目的地 bucket)7
storage.objects.setRetention (目的地 bucket)8
storage.objects.createContext19
Objects delete storage.objects.delete
Objects get storage.objects.get
storage.objects.getIamPolicy2,6
Objects insert storage.objects.create
storage.objects.delete7
storage.objects.setRetention8
storage.objects.createContext19
Objects list storage.objects.list
storage.objects.getIamPolicy2,6
Objects move storage.objects.move15 (來源物件)
storage.objects.delete15 (來源物件)
storage.objects.get15 (來源物件)
storage.objects.create (目的地物件)
storage.objects.delete16 (目的地物件)
storage.folders.create17 (目的地物件)
Objects patch storage.objects.update
storage.objects.setRetention8
storage.objects.overrideUnlockedRetention9
storage.objects.getIamPolicy4、6
storage.objects.setIamPolicy5、6
storage.objects.createContext20
storage.objects.updateContext21
storage.objects.deleteContext22
Objects restore storage.objects.create
storage.objects.delete7
storage.objects.restore
storage.objects.getIamPolicy2,6
storage.objects.setIamPolicy6,12
Objects rewrite storage.objects.get (來源 bucket)
storage.objects.create (目的地 bucket)
storage.objects.delete (目的地 bucket)7
storage.objects.setRetention (目的地 bucket)8
storage.objects.createContext19
Objects update storage.objects.update
storage.objects.setRetention8
storage.objects.overrideUnlockedRetention9
storage.objects.getIamPolicy4、6
storage.objects.setIamPolicy5、6
storage.objects.createContext20
storage.objects.updateContext21
storage.objects.deleteContext22
Objects viewFullContext storage.objects.viewFullContext
Objects watchAll storage.buckets.update
Projects.hmacKeys create storage.hmacKeys.create
Projects.hmacKeys delete storage.hmacKeys.delete
Projects.hmacKeys get storage.hmacKeys.get
Projects.hmacKeys list storage.hmacKeys.list
Projects.hmacKeys update storage.hmacKeys.update
Projects.serviceAccount get resourceManager.projects.get

1 如果您在要求中使用 userProject 參數或 x-goog-user-project 標頭，除了提出要求所需的一般 IAM 權限外，您還必須具備指定專案 ID 的 serviceusage.services.use 權限。

2 只有在您想將 ACL 或 IAM 政策納入 full 投影時，才需要這項權限。如果您沒有這項權限並要求 full 投影，那麼只會收到局部投影。

3 只有在要求包含 enableObjectRetention 查詢參數時，才需要這項權限。

4 只有在您想將 ACL 納入回應時，才需要這項權限。

5 如果您想在要求中加入 ACL 或禁止公開存取設定的變更，就必須具備這項權限。

6 這項權限不適用於已啟用統一 bucket 層級存取權的 bucket。

7 只有在要求導致同名物件遭到覆寫時，才需要這項權限。

8 如果要求主體包含 retention 屬性，或對具有現有保留設定的物件提出 UPDATE 要求，則必須具備這項權限。

9 只有在要求包含查詢參數 overrideUnlockedRetention=true 時，才需要這項權限。

10 只有在要求包含查詢參數 allowNonEmpty=true 時，才需要這項權限。

11 只有在要求包含查詢參數 allowOverwrite=true，且要求導致同名物件遭到覆寫時，才需要這項權限。

12 只有在要求包含查詢參數 copySourceAcl=true 時，才需要這項權限。

13 只有在您想將值區 IP 篩選規則納入 Buckets: get 要求時，才需要這項權限。如果沒有這項權限，您只會收到部分預測結果。

14 只有在建立、列出、刪除及更新值區 IP 篩選規則時，才需要這項權限。

15 如要移動已啟用階層命名空間的值區中的物件，您必須具備 storage.objects.delete 和 storage.objects.get 權限，或 storage.objects.move 權限 (如要在不授予物件讀取或刪除權限的情況下移動物件)。

16 只有在您要取代物件時，才需要這項權限。

17 只有在您想自動建立任何缺少的上層資料夾時，才需要這項權限。

18 只有在您想傳回使用 Rapid Cache 建立的快取時，才需要這項權限。

19 只有在要求包含非空白的 destination.contexts.custom 屬性 (用於組成物件) 或非空白的 contexts.custom 屬性 (用於複製、插入或重寫物件) 時，才需要這項權限。

20 只有在您想為物件新增情境時，才需要這項權限。

21 只有在您想更新物件的背景資訊時，才需要這項權限。

22 只有在您想刪除物件的背景資訊時，才需要這項權限。

ACL 相關方法

下表列出執行 JSON 方法所需的 IAM 權限，這些方法專門用於管理 ACL。這些方法僅適用於已停用統一值區層級存取權的值區。

資源 方法 必要的 IAM 權限1
BucketAccessControls delete storage.buckets.get
storage.buckets.getIamPolicy
storage.buckets.setIamPolicy
storage.buckets.update
BucketAccessControls get storage.buckets.get
storage.buckets.getIamPolicy
BucketAccessControls insert storage.buckets.get
storage.buckets.getIamPolicy
storage.buckets.setIamPolicy
storage.buckets.update
BucketAccessControls list storage.buckets.get
storage.buckets.getIamPolicy
BucketAccessControls patch storage.buckets.get
storage.buckets.getIamPolicy
storage.buckets.setIamPolicy
storage.buckets.update
BucketAccessControls update storage.buckets.get
storage.buckets.getIamPolicy
storage.buckets.setIamPolicy
storage.buckets.update
DefaultObjectAccessControls delete storage.buckets.get
storage.buckets.getIamPolicy
storage.buckets.setIamPolicy
storage.buckets.update
DefaultObjectAccessControls get storage.buckets.get
storage.buckets.getIamPolicy
DefaultObjectAccessControls insert storage.buckets.get
storage.buckets.getIamPolicy
storage.buckets.setIamPolicy
storage.buckets.update
DefaultObjectAccessControls list storage.buckets.get
storage.buckets.getIamPolicy
DefaultObjectAccessControls patch storage.buckets.get
storage.buckets.getIamPolicy
storage.buckets.setIamPolicy
storage.buckets.update
DefaultObjectAccessControls update storage.buckets.get
storage.buckets.getIamPolicy
storage.buckets.setIamPolicy
storage.buckets.update
ObjectAccessControls delete storage.objects.get
storage.objects.getIamPolicy
storage.objects.setIamPolicy
storage.objects.update
ObjectAccessControls get storage.objects.get
storage.objects.getIamPolicy
ObjectAccessControls insert storage.objects.get
storage.objects.getIamPolicy
storage.objects.setIamPolicy
storage.objects.update
ObjectAccessControls list storage.objects.get
storage.objects.getIamPolicy
ObjectAccessControls patch storage.objects.get
storage.objects.getIamPolicy
storage.objects.setIamPolicy
storage.objects.update
ObjectAccessControls update storage.objects.get
storage.objects.getIamPolicy
storage.objects.setIamPolicy
storage.objects.update

1 如果您在要求中使用 userProject 參數或 x-goog-user-project 標頭，除了提出要求所需的一般 IAM 權限外，您還必須具備指定專案 ID 的 serviceusage.services.use 權限。

後續步驟