Cloud Storage에 대한 IAM 역할

이 문서에서는 Cloud Storage의 Identity and Access Management(IAM) 역할과 권한에 대해 설명합니다.

사전 정의된 역할

다음 표에서는 Cloud Storage와 관련된 Identity and Access Management(IAM) 역할을 설명하고 각 역할에 포함된 권한을 나열합니다. 달리 명시되지 않는 한 이러한 역할은 프로젝트, 버킷 또는 관리형 폴더에 적용될 수 있습니다. 하지만 개별 버킷에만 기존 역할을 부여할 수 있습니다.

버킷에 대한 액세스를 제어하는 방법은 IAM 권한 사용을 참고하세요. 관리형 폴더에 대한 액세스를 제어하는 방법은 관리형 폴더에 IAM 사용을 참고하세요.

Role Permissions

(roles/storage.admin)

Grants full control of objects and buckets.

When applied to an individual bucket, control applies only to the specified bucket and objects within the bucket.

Lowest-level resources where you can grant this role:

  • Bucket

cloudkms.keyHandles.*

  • cloudkms.keyHandles.create
  • cloudkms.keyHandles.get
  • cloudkms.keyHandles.list

cloudkms.operations.get

cloudkms.projects.showEffectiveAutokeyConfig

firebase.projects.get

monitoring.timeSeries.create

orgpolicy.policy.get

recommender.iamPolicyInsights.*

  • recommender.iamPolicyInsights.get
  • recommender.iamPolicyInsights.list
  • recommender.iamPolicyInsights.update

recommender.iamPolicyRecommendations.*

  • recommender.iamPolicyRecommendations.get
  • recommender.iamPolicyRecommendations.list
  • recommender.iamPolicyRecommendations.update

recommender.storageBucketSoftDeleteInsights.*

  • recommender.storageBucketSoftDeleteInsights.get
  • recommender.storageBucketSoftDeleteInsights.list
  • recommender.storageBucketSoftDeleteInsights.update

recommender.storageBucketSoftDeleteRecommendations.*

  • recommender.storageBucketSoftDeleteRecommendations.get
  • recommender.storageBucketSoftDeleteRecommendations.list
  • recommender.storageBucketSoftDeleteRecommendations.update

resourcemanager.hierarchyNodes.listEffectiveTags

resourcemanager.projects.get

resourcemanager.projects.list

storage.anywhereCaches.*

  • storage.anywhereCaches.create
  • storage.anywhereCaches.disable
  • storage.anywhereCaches.get
  • storage.anywhereCaches.list
  • storage.anywhereCaches.pause
  • storage.anywhereCaches.resume
  • storage.anywhereCaches.update

storage.bucketOperations.*

  • storage.bucketOperations.cancel
  • storage.bucketOperations.get
  • storage.bucketOperations.list

storage.buckets.*

  • storage.buckets.create
  • storage.buckets.createTagBinding
  • storage.buckets.delete
  • storage.buckets.deleteTagBinding
  • storage.buckets.enableObjectRetention
  • storage.buckets.get
  • storage.buckets.getIamPolicy
  • storage.buckets.getIpFilter
  • storage.buckets.getObjectInsights
  • storage.buckets.list
  • storage.buckets.listEffectiveTags
  • storage.buckets.listTagBindings
  • storage.buckets.relocate
  • storage.buckets.restore
  • storage.buckets.setIamPolicy
  • storage.buckets.setIpFilter
  • storage.buckets.update

storage.folders.*

  • storage.folders.create
  • storage.folders.delete
  • storage.folders.get
  • storage.folders.list
  • storage.folders.rename

storage.intelligenceConfigs.*

  • storage.intelligenceConfigs.get
  • storage.intelligenceConfigs.update

storage.managedFolders.*

  • storage.managedFolders.create
  • storage.managedFolders.delete
  • storage.managedFolders.get
  • storage.managedFolders.getIamPolicy
  • storage.managedFolders.list
  • storage.managedFolders.setIamPolicy

storage.multipartUploads.*

  • storage.multipartUploads.abort
  • storage.multipartUploads.create
  • storage.multipartUploads.list
  • storage.multipartUploads.listParts

storage.objects.*

  • storage.objects.create
  • storage.objects.delete
  • storage.objects.get
  • storage.objects.getIamPolicy
  • storage.objects.list
  • storage.objects.move
  • storage.objects.overrideUnlockedRetention
  • storage.objects.restore
  • storage.objects.setIamPolicy
  • storage.objects.setRetention
  • storage.objects.update

(roles/storage.bucketViewer)

Grants permission to view buckets and their metadata, excluding IAM policies.

storage.buckets.get

storage.buckets.list

(roles/storage.expressModeServiceInput)

Grants permission to Express Mode service accounts at a managed folder so they can create objects but not read them on input folders.

storage.objects.create

storage.objects.delete

storage.objects.list

storage.objects.update

(roles/storage.expressModeServiceOutput)

Grants permission to EasyGCP service accounts at a managed folder so they can read objects but not write them on output folders.

storage.objects.delete

storage.objects.get

storage.objects.list

(roles/storage.expressModeUserAccess)

Grants permission to Express Mode accounts at the project level so they can read, list, create and delete any object in any of their buckets in Express Mode.

orgpolicy.policy.get

storage.buckets.get

storage.buckets.list

storage.multipartUploads.*

  • storage.multipartUploads.abort
  • storage.multipartUploads.create
  • storage.multipartUploads.list
  • storage.multipartUploads.listParts

storage.objects.create

storage.objects.delete

storage.objects.get

storage.objects.list

storage.objects.restore

storage.objects.update

(roles/storage.folderAdmin)

Grants full control over folders and objects, including listing, creating, viewing, and deleting objects.

orgpolicy.policy.get

resourcemanager.projects.get

resourcemanager.projects.list

storage.folders.*

  • storage.folders.create
  • storage.folders.delete
  • storage.folders.get
  • storage.folders.list
  • storage.folders.rename

storage.managedFolders.*

  • storage.managedFolders.create
  • storage.managedFolders.delete
  • storage.managedFolders.get
  • storage.managedFolders.getIamPolicy
  • storage.managedFolders.list
  • storage.managedFolders.setIamPolicy

storage.multipartUploads.*

  • storage.multipartUploads.abort
  • storage.multipartUploads.create
  • storage.multipartUploads.list
  • storage.multipartUploads.listParts

storage.objects.*

  • storage.objects.create
  • storage.objects.delete
  • storage.objects.get
  • storage.objects.getIamPolicy
  • storage.objects.list
  • storage.objects.move
  • storage.objects.overrideUnlockedRetention
  • storage.objects.restore
  • storage.objects.setIamPolicy
  • storage.objects.setRetention
  • storage.objects.update

(roles/storage.hmacKeyAdmin)

Full control of Cloud Storage HMAC keys.

firebase.projects.get

orgpolicy.policy.get

resourcemanager.projects.get

resourcemanager.projects.list

storage.hmacKeys.*

  • storage.hmacKeys.create
  • storage.hmacKeys.delete
  • storage.hmacKeys.get
  • storage.hmacKeys.list
  • storage.hmacKeys.update

(roles/storage.insightsCollectorService)

Read-only access to Cloud Storage Inventory metadata for Storage Insights.

resourcemanager.projects.get

resourcemanager.projects.list

storage.buckets.get

storage.buckets.getObjectInsights

(roles/storage.legacyBucketOwner)

Grants permission to create, overwrite, and delete objects; list objects in a bucket and read object metadata, excluding allow policies, when listing; and read and edit bucket metadata, including allow policies.

Use of this role is also reflected in the bucket's ACLs. For more information, see IAM relation to ACLs.

Lowest-level resources where you can grant this role:

  • Bucket

storage.anywhereCaches.*

  • storage.anywhereCaches.create
  • storage.anywhereCaches.disable
  • storage.anywhereCaches.get
  • storage.anywhereCaches.list
  • storage.anywhereCaches.pause
  • storage.anywhereCaches.resume
  • storage.anywhereCaches.update

storage.bucketOperations.*

  • storage.bucketOperations.cancel
  • storage.bucketOperations.get
  • storage.bucketOperations.list

storage.buckets.createTagBinding

storage.buckets.deleteTagBinding

storage.buckets.enableObjectRetention

storage.buckets.get

storage.buckets.getIamPolicy

storage.buckets.getIpFilter

storage.buckets.listEffectiveTags

storage.buckets.listTagBindings

storage.buckets.relocate

storage.buckets.restore

storage.buckets.setIamPolicy

storage.buckets.setIpFilter

storage.buckets.update

storage.folders.*

  • storage.folders.create
  • storage.folders.delete
  • storage.folders.get
  • storage.folders.list
  • storage.folders.rename

storage.managedFolders.*

  • storage.managedFolders.create
  • storage.managedFolders.delete
  • storage.managedFolders.get
  • storage.managedFolders.getIamPolicy
  • storage.managedFolders.list
  • storage.managedFolders.setIamPolicy

storage.multipartUploads.*

  • storage.multipartUploads.abort
  • storage.multipartUploads.create
  • storage.multipartUploads.list
  • storage.multipartUploads.listParts

storage.objects.create

storage.objects.delete

storage.objects.list

storage.objects.restore

storage.objects.setRetention

(roles/storage.legacyBucketReader)

Grants permission to list a bucket's contents and read bucket metadata, excluding allow policies. Also grants permission to read object metadata, excluding allow policies, when listing objects.

Use of this role is also reflected in the bucket's ACLs. For more information, see IAM relation to ACLs.

Lowest-level resources where you can grant this role:

  • Bucket

storage.buckets.get

storage.folders.get

storage.folders.list

storage.managedFolders.get

storage.managedFolders.list

storage.multipartUploads.list

storage.objects.list

(roles/storage.legacyBucketWriter)

Grants permission to create, overwrite, and delete objects; list objects in a bucket and read object metadata, excluding allow policies, when listing; and read bucket metadata, excluding allow policies.

Use of this role is also reflected in the bucket's ACLs. For more information, see IAM relation to ACLs.

Lowest-level resources where you can grant this role:

  • Bucket

storage.buckets.get

storage.folders.*

  • storage.folders.create
  • storage.folders.delete
  • storage.folders.get
  • storage.folders.list
  • storage.folders.rename

storage.managedFolders.create

storage.managedFolders.delete

storage.managedFolders.get

storage.managedFolders.list

storage.multipartUploads.*

  • storage.multipartUploads.abort
  • storage.multipartUploads.create
  • storage.multipartUploads.list
  • storage.multipartUploads.listParts

storage.objects.create

storage.objects.delete

storage.objects.list

storage.objects.restore

storage.objects.setRetention

(roles/storage.legacyObjectOwner)

Grants permission to view and edit objects and their metadata, including ACLs.

Lowest-level resources where you can grant this role:

  • Bucket

storage.objects.get

storage.objects.getIamPolicy

storage.objects.overrideUnlockedRetention

storage.objects.setIamPolicy

storage.objects.setRetention

storage.objects.update

(roles/storage.legacyObjectReader)

Grants permission to view objects and their metadata, excluding ACLs.

Lowest-level resources where you can grant this role:

  • Bucket

storage.objects.get

(roles/storage.objectAdmin)

Grants full control of objects, including listing, creating, viewing, and deleting objects.

Lowest-level resources where you can grant this role:

  • Bucket

monitoring.timeSeries.create

orgpolicy.policy.get

resourcemanager.projects.get

resourcemanager.projects.list

storage.folders.*

  • storage.folders.create
  • storage.folders.delete
  • storage.folders.get
  • storage.folders.list
  • storage.folders.rename

storage.managedFolders.create

storage.managedFolders.delete

storage.managedFolders.get

storage.managedFolders.list

storage.multipartUploads.*

  • storage.multipartUploads.abort
  • storage.multipartUploads.create
  • storage.multipartUploads.list
  • storage.multipartUploads.listParts

storage.objects.*

  • storage.objects.create
  • storage.objects.delete
  • storage.objects.get
  • storage.objects.getIamPolicy
  • storage.objects.list
  • storage.objects.move
  • storage.objects.overrideUnlockedRetention
  • storage.objects.restore
  • storage.objects.setIamPolicy
  • storage.objects.setRetention
  • storage.objects.update

(roles/storage.objectCreator)

Allows users to create objects. Does not give permission to view, delete, or overwrite objects.

Lowest-level resources where you can grant this role:

  • Bucket

orgpolicy.policy.get

resourcemanager.projects.get

resourcemanager.projects.list

storage.folders.create

storage.managedFolders.create

storage.multipartUploads.abort

storage.multipartUploads.create

storage.multipartUploads.listParts

storage.objects.create

(roles/storage.objectUser)

Access to create, read, update and delete objects and multipart uploads in GCS.

monitoring.timeSeries.create

orgpolicy.policy.get

resourcemanager.projects.get

resourcemanager.projects.list

storage.folders.*

  • storage.folders.create
  • storage.folders.delete
  • storage.folders.get
  • storage.folders.list
  • storage.folders.rename

storage.managedFolders.create

storage.managedFolders.delete

storage.managedFolders.get

storage.managedFolders.list

storage.multipartUploads.*

  • storage.multipartUploads.abort
  • storage.multipartUploads.create
  • storage.multipartUploads.list
  • storage.multipartUploads.listParts

storage.objects.create

storage.objects.delete

storage.objects.get

storage.objects.list

storage.objects.move

storage.objects.restore

storage.objects.update

(roles/storage.objectViewer)

Grants access to view objects and their metadata, excluding ACLs. Can also list the objects in a bucket.

Lowest-level resources where you can grant this role:

  • Bucket

resourcemanager.projects.get

resourcemanager.projects.list

storage.folders.get

storage.folders.list

storage.managedFolders.get

storage.managedFolders.list

storage.objects.get

storage.objects.list

사전 정의된 Storage Insights 역할

다음 표에서는 Storage Insights와 관련된 IAM 역할을 설명하고 각 역할에 포함된 권한을 나열합니다.

Role Permissions

(roles/storageinsights.admin)

Full access to Storage Insights resources.

resourcemanager.projects.get

resourcemanager.projects.list

storageinsights.*

  • storageinsights.datasetConfigs.create
  • storageinsights.datasetConfigs.delete
  • storageinsights.datasetConfigs.get
  • storageinsights.datasetConfigs.linkDataset
  • storageinsights.datasetConfigs.list
  • storageinsights.datasetConfigs.unlinkDataset
  • storageinsights.datasetConfigs.update
  • storageinsights.locations.get
  • storageinsights.locations.list
  • storageinsights.operations.cancel
  • storageinsights.operations.delete
  • storageinsights.operations.get
  • storageinsights.operations.list
  • storageinsights.reportConfigs.create
  • storageinsights.reportConfigs.delete
  • storageinsights.reportConfigs.get
  • storageinsights.reportConfigs.list
  • storageinsights.reportConfigs.update
  • storageinsights.reportDetails.get
  • storageinsights.reportDetails.list

(roles/storageinsights.analyst)

Data access to Storage Insights.

resourcemanager.projects.get

resourcemanager.projects.list

storageinsights.datasetConfigs.get

storageinsights.datasetConfigs.linkDataset

storageinsights.datasetConfigs.list

storageinsights.datasetConfigs.unlinkDataset

storageinsights.locations.*

  • storageinsights.locations.get
  • storageinsights.locations.list

storageinsights.operations.get

storageinsights.operations.list

storageinsights.reportConfigs.get

storageinsights.reportConfigs.list

storageinsights.reportDetails.*

  • storageinsights.reportDetails.get
  • storageinsights.reportDetails.list

(roles/storageinsights.serviceAgent)

Permissions for Insights to write reports into customer project

bigquery.datasets.create

serviceusage.services.use

storageinsights.reportDetails.list

(roles/storageinsights.viewer)

Read-only access to Storage Insights resources.

resourcemanager.projects.get

resourcemanager.projects.list

storageinsights.datasetConfigs.get

storageinsights.datasetConfigs.list

storageinsights.locations.*

  • storageinsights.locations.get
  • storageinsights.locations.list

storageinsights.operations.get

storageinsights.operations.list

storageinsights.reportConfigs.get

storageinsights.reportConfigs.list

storageinsights.reportDetails.*

  • storageinsights.reportDetails.get
  • storageinsights.reportDetails.list

기본 역할

기본 역할은 IAM 이전에 있었던 역할입니다. 이러한 역할에는 고유한 특성이 있습니다.

  • 기본 역할은 프로젝트 내의 개별 버킷이 아닌 전체 프로젝트에만 부여될 수 있습니다. 프로젝트에 부여하는 다른 역할과 마찬가지로 기본 역할은 프로젝트의 모든 버킷과 객체에 적용됩니다.

  • 기본 역할에는 이 섹션에서 다루지 않는 다른 Trusted Cloud서비스에 대한 추가 권한이 포함됩니다. 기본 역할이 부여하는 권한에 대한 일반적인 설명은 기본 역할을 참조하세요.

  • 각 기본 역할에는 기본 역할을 그룹처럼 사용할 수 있는 단축값이 있습니다. 이 방법을 사용하면 기본 역할이 있는 주 구성원은 그룹의 일부로 간주됩니다. 그룹의 모든 사용자는 단축값에 있는 액세스 권한에 따라 리소스에 대한 추가 액세스 권한을 얻습니다.

    • 단축값은 버킷의 역할을 부여할 때 사용할 수 있습니다.

    • 객체에 ACL을 설정할 때 단축값을 사용할 수 있습니다.

  • 기본 역할은 본질적으로 이름이 의미하는 Cloud Storage 리소스에 대한 액세스 권한을 모두 부여하지 않습니다. 그 대신 본질적으로 예상 액세스의 일부 권한과 단축값 사용을 통해 예상 액세스의 나머지 권한을 제공합니다. 단축값은 다른 IAM 주 구성원과 마찬가지로 수동으로 추가 또는 삭제할 수 있으므로 주 구성원이 얻게 될 액세스 권한이 취소될 수 있습니다.

    기본 역할의 주 구성원이 단축값으로 인해 일반적으로 얻게 되는 추가 액세스 권한에 대한 설명은 수정 가능한 동작을 참조하세요.

내장 권한

다음 표에서는 각 기본 역할과 항상 연결되는 Cloud Storage 권한을 설명합니다.

역할 설명 Cloud Storage 권한
뷰어 (roles/viewer) 프로젝트의 버킷을 나열하고, 나열 시 ACL을 제외한 버킷 메타데이터를 보고, 프로젝트의 HMAC 키를 나열하고 가져올 수 있는 권한을 부여합니다. storage.buckets.getIpFilter
storage.buckets.list
storage.hmacKeys.get
storage.hmacKeys.list
편집자(roles/editor) 프로젝트의 버킷을 생성, 나열, 삭제하고, 나열 시 ACL을 제외한 버킷 메타데이터를 보고, 프로젝트의 HMAC 키를 제어할 수 있는 권한을 부여합니다. storage.buckets.create
storage.buckets.delete
storage.buckets.getIpFilter
storage.buckets.list
storage.hmacKeys.*
소유자(roles/owner)

프로젝트의 버킷을 생성, 나열, 삭제하고, 나열 시 ACL을 제외한 버킷 메타데이터를 보고, 태그 바인딩을 생성, 삭제, 나열하고 프로젝트의 HMAC 키를 제어할 수 있는 권한을 부여합니다. 프로젝트, 폴더 또는 조직에서 Storage Intelligence 구성을 사용 설정, 사용 중지, 업데이트하고 가져올 수 있습니다.

Trusted Cloud by S3NS 에서 이 역할이 있는 주 구성원은 일반적으로 프로젝트의 주 구성원 역할 변경, 청구 변경과 같은 관리 태스크를 수행할 수 있습니다.

 storage.buckets.create
storage.buckets.delete
storage.buckets.list
storage.buckets.createTagBinding
storage.buckets.deleteTagBinding
storage.buckets.getIpFilter
storage.buckets.listEffectiveTags
storage.buckets.listTagBindings
storage.buckets.setIpFilter
storage.hmacKeys.*
storage.intelligenceConfigs.get
storage.intelligenceConfigs.update

수정 가능한 동작

기본 역할이 부여된 주 구성원은 단축값으로 인해 프로젝트의 버킷 및 객체에 대한 추가 액세스 권한을 갖는 경우가 많습니다. 버킷이 생성되면 단축값에 특정 버킷 수준 액세스 권한이 부여되지만 나중에 버킷 IAM 정책 및 객체 ACL을 수정하여 액세스 권한을 삭제하거나 변경할 수 있습니다.

균일한 버킷 수준 액세스가 사용 설정된 버킷을 만들면 단축값을 통해 다음 액세스 권한이 부여됩니다.

  • roles/viewer가 부여된 주 구성원은 버킷에 대한 roles/storage.legacyBucketReader 및 roles/storage.legacyObjectReader 역할을 부여받습니다.

  • roles/editor가 부여된 주 구성원은 버킷에 대한 roles/storage.legacyBucketOwner 및 roles/storage.legacyObjectOwner 역할을 부여받습니다.

  • roles/owner가 부여된 주 구성원은 버킷에 대한 roles/storage.legacyBucketOwner 및 roles/storage.legacyObjectOwner 역할을 부여받습니다.

균일한 버킷 수준 액세스가 사용 설정되지 않은 버킷을 만들면 단축값을 사용해 다음 액세스 권한이 부여됩니다.

  • roles/viewer가 부여된 주 구성원은 버킷에 대한 roles/storage.legacyBucketReader 역할을 부여받습니다.

  • roles/editor가 부여된 주 구성원은 버킷에 대한 roles/storage.legacyBucketOwner 역할을 부여받습니다.

  • roles/owner가 부여된 주 구성원은 버킷에 대한 roles/storage.legacyBucketOwner 역할을 부여받습니다.

  • 또한 버킷에는 기본 객체 액세스 제어 목록(ACL)이 있습니다. 이 기본 ACL은 버킷의 새 객체에 적용되는 경우가 많으며, 종종 단축값에 추가 액세스 권한을 부여합니다.

커스텀 역할

지정한 권한 모음이 포함된 고유한 역할을 정의해야 할 수 있습니다. 이를 지원하기 위해 IAM은 커스텀 역할을 제공합니다.

다음 단계