使用 IAM 进行访问权限控制

本页面介绍如何使用 Identity and Access Management (IAM) 管理对 Colab Enterprise 资源的访问。如需管理对 其他 Gemini Enterprise Agent Platform 资源的访问权限，请参阅Agent Platform 使用 IAM 进行访问权限控制。

使用 IAM 控制对笔记本的访问权限

您可以在项目级层或基于笔记本管理对 Colab Enterprise 笔记本（IPYNB 文件）的访问权限。

  • 如需在项目级层授予对笔记本的访问权限，请为主账号（用户、群组或 服务账号）分配一个或多个 角色。
  • 如需授予对特定笔记本的访问权限，请为主账号分配一个或多个笔记本角色。如需了解详情，请参阅 管理对笔记本的访问权限。

运行与其他服务交互的代码 Google Cloud

授予对笔记本的访问权限仅限于与笔记本交互相关的特定权限。例如，您可以授予创建笔记本、在笔记本中编写代码或删除笔记本的权限。

如需运行与其他 Google Cloud 服务交互的代码，您必须 使用以下方法之一：

  • 在启用了最终用户凭据的运行时中运行代码。这意味着 您的笔记本具有与笔记本用户相同的服务 Google Cloud 访问权限 。

  • 运行用于对笔记本进行身份验证和授权以使其与 Google Cloud 服务交互的代码。

如需了解详情，请参阅运行与交互的代码 Google Cloud。

IAM 角色的类型

您可以在 Colab Enterprise 中使用不同类型的 IAM 角色：

  • 预定义角色允许您在项目级向 Colab Enterprise 资源授予一组相关 权限。

  • 基本角色（Owner、 Editor 和 Viewer）提供项目级层的 Colab Enterprise 资源的访问权限控制，并且适用于所有 Google Cloud 服务。

  • 自定义角色让您可以基于一组 特定权限创建具有这些权限的专属角色，然后 将该角色授予组织中的用户。

如需在 Colab Enterprise 项目中添加、更新或移除这些角色， 请参阅管理对项目、文件夹和 组织的访问权限一文。

Colab Enterprise 的预定义角色

Colab Enterprise 是 Agent Platform 的一部分，Colab Enterprise 资源通过 Agent Platform API 进行管理。 因此，您可以通过 Agent Platform 角色向主账号授予对 Colab Enterprise 资源的访问权限。

下表列出了所有 Agent Platform 预定义角色。

Role Permissions

(roles/aiplatform.admin)

Grants full access to all resources in Agent Platform.

aiplatform.*

  • aiplatform.agentAnomalyDetectionScopes.create
  • aiplatform.agentAnomalyDetectionScopes.delete
  • aiplatform.agentAnomalyDetectionScopes.get
  • aiplatform.agentAnomalyDetectionScopes.list
  • aiplatform.agentExamples.create
  • aiplatform.agentExamples.delete
  • aiplatform.agentExamples.get
  • aiplatform.agentExamples.list
  • aiplatform.agentExamples.update
  • aiplatform.agents.create
  • aiplatform.agents.delete
  • aiplatform.agents.get
  • aiplatform.agents.list
  • aiplatform.agents.update
  • aiplatform.analyzedInvocations.get
  • aiplatform.analyzedInvocations.list
  • aiplatform.analyzedSessions.aggregate
  • aiplatform.analyzedSessions.get
  • aiplatform.analyzedSessions.list
  • aiplatform.annotationSpecs.create
  • aiplatform.annotationSpecs.delete
  • aiplatform.annotationSpecs.get
  • aiplatform.annotationSpecs.list
  • aiplatform.annotationSpecs.update
  • aiplatform.annotations.create
  • aiplatform.annotations.delete
  • aiplatform.annotations.get
  • aiplatform.annotations.list
  • aiplatform.annotations.update
  • aiplatform.apps.create
  • aiplatform.apps.delete
  • aiplatform.apps.get
  • aiplatform.apps.list
  • aiplatform.apps.update
  • aiplatform.artifacts.create
  • aiplatform.artifacts.delete
  • aiplatform.artifacts.get
  • aiplatform.artifacts.list
  • aiplatform.artifacts.update
  • aiplatform.batchPredictionJobs.cancel
  • aiplatform.batchPredictionJobs.create
  • aiplatform.batchPredictionJobs.delete
  • aiplatform.batchPredictionJobs.get
  • aiplatform.batchPredictionJobs.list
  • aiplatform.cacheConfigs.get
  • aiplatform.cacheConfigs.update
  • aiplatform.cachedContents.create
  • aiplatform.cachedContents.delete
  • aiplatform.cachedContents.get
  • aiplatform.cachedContents.list
  • aiplatform.cachedContents.update
  • aiplatform.consents.get
  • aiplatform.consents.update
  • aiplatform.contexts.addContextArtifactsAndExecutions
  • aiplatform.contexts.addContextChildren
  • aiplatform.contexts.create
  • aiplatform.contexts.delete
  • aiplatform.contexts.get
  • aiplatform.contexts.list
  • aiplatform.contexts.queryContextLineageSubgraph
  • aiplatform.contexts.update
  • aiplatform.customJobs.cancel
  • aiplatform.customJobs.create
  • aiplatform.customJobs.delete
  • aiplatform.customJobs.get
  • aiplatform.customJobs.list
  • aiplatform.dataItems.create
  • aiplatform.dataItems.delete
  • aiplatform.dataItems.get
  • aiplatform.dataItems.list
  • aiplatform.dataItems.update
  • aiplatform.dataLabelingJobs.cancel
  • aiplatform.dataLabelingJobs.create
  • aiplatform.dataLabelingJobs.delete
  • aiplatform.dataLabelingJobs.get
  • aiplatform.dataLabelingJobs.list
  • aiplatform.datasetVersions.create
  • aiplatform.datasetVersions.delete
  • aiplatform.datasetVersions.get
  • aiplatform.datasetVersions.list
  • aiplatform.datasetVersions.restore
  • aiplatform.datasets.create
  • aiplatform.datasets.delete
  • aiplatform.datasets.export
  • aiplatform.datasets.get
  • aiplatform.datasets.import
  • aiplatform.datasets.list
  • aiplatform.datasets.update
  • aiplatform.deploymentResourcePools.create
  • aiplatform.deploymentResourcePools.delete
  • aiplatform.deploymentResourcePools.get
  • aiplatform.deploymentResourcePools.list
  • aiplatform.deploymentResourcePools.queryDeployedModels
  • aiplatform.deploymentResourcePools.update
  • aiplatform.edgeDeploymentJobs.create
  • aiplatform.edgeDeploymentJobs.delete
  • aiplatform.edgeDeploymentJobs.get
  • aiplatform.edgeDeploymentJobs.list
  • aiplatform.edgeDeviceDebugInfo.get
  • aiplatform.edgeDevices.create
  • aiplatform.edgeDevices.delete
  • aiplatform.edgeDevices.get
  • aiplatform.edgeDevices.list
  • aiplatform.edgeDevices.update
  • aiplatform.endpoints.create
  • aiplatform.endpoints.delete
  • aiplatform.endpoints.deploy
  • aiplatform.endpoints.explain
  • aiplatform.endpoints.get
  • aiplatform.endpoints.getIamPolicy
  • aiplatform.endpoints.list
  • aiplatform.endpoints.predict
  • aiplatform.endpoints.setIamPolicy
  • aiplatform.endpoints.undeploy
  • aiplatform.endpoints.update
  • aiplatform.entityTypes.create
  • aiplatform.entityTypes.delete
  • aiplatform.entityTypes.deleteFeatureValues
  • aiplatform.entityTypes.exportFeatureValues
  • aiplatform.entityTypes.get
  • aiplatform.entityTypes.getIamPolicy
  • aiplatform.entityTypes.importFeatureValues
  • aiplatform.entityTypes.list
  • aiplatform.entityTypes.readFeatureValues
  • aiplatform.entityTypes.setIamPolicy
  • aiplatform.entityTypes.streamingReadFeatureValues
  • aiplatform.entityTypes.update
  • aiplatform.entityTypes.writeFeatureValues
  • aiplatform.evaluationExperiments.create
  • aiplatform.evaluationExperiments.delete
  • aiplatform.evaluationExperiments.get
  • aiplatform.evaluationExperiments.list
  • aiplatform.evaluationExperiments.update
  • aiplatform.evaluationItems.create
  • aiplatform.evaluationItems.delete
  • aiplatform.evaluationItems.get
  • aiplatform.evaluationItems.list
  • aiplatform.evaluationItems.update
  • aiplatform.evaluationMetrics.create
  • aiplatform.evaluationMetrics.delete
  • aiplatform.evaluationMetrics.get
  • aiplatform.evaluationMetrics.list
  • aiplatform.evaluationRuns.cancel
  • aiplatform.evaluationRuns.create
  • aiplatform.evaluationRuns.delete
  • aiplatform.evaluationRuns.execute
  • aiplatform.evaluationRuns.get
  • aiplatform.evaluationRuns.list
  • aiplatform.evaluationRuns.update
  • aiplatform.evaluationSets.create
  • aiplatform.evaluationSets.delete
  • aiplatform.evaluationSets.get
  • aiplatform.evaluationSets.import
  • aiplatform.evaluationSets.list
  • aiplatform.evaluationSets.update
  • aiplatform.exampleStores.create
  • aiplatform.exampleStores.delete
  • aiplatform.exampleStores.get
  • aiplatform.exampleStores.list
  • aiplatform.exampleStores.readExample
  • aiplatform.exampleStores.update
  • aiplatform.exampleStores.writeExample
  • aiplatform.executions.addExecutionEvents
  • aiplatform.executions.create
  • aiplatform.executions.delete
  • aiplatform.executions.get
  • aiplatform.executions.list
  • aiplatform.executions.queryExecutionInputsAndOutputs
  • aiplatform.executions.update
  • aiplatform.extensions.delete
  • aiplatform.extensions.execute
  • aiplatform.extensions.get
  • aiplatform.extensions.import
  • aiplatform.extensions.list
  • aiplatform.extensions.update
  • aiplatform.featureGroups.create
  • aiplatform.featureGroups.delete
  • aiplatform.featureGroups.get
  • aiplatform.featureGroups.getIamPolicy
  • aiplatform.featureGroups.list
  • aiplatform.featureGroups.setIamPolicy
  • aiplatform.featureGroups.update
  • aiplatform.featureMonitorJobs.create
  • aiplatform.featureMonitorJobs.get
  • aiplatform.featureMonitorJobs.list
  • aiplatform.featureMonitors.create
  • aiplatform.featureMonitors.delete
  • aiplatform.featureMonitors.get
  • aiplatform.featureMonitors.list
  • aiplatform.featureMonitors.update
  • aiplatform.featureOnlineStores.create
  • aiplatform.featureOnlineStores.delete
  • aiplatform.featureOnlineStores.get
  • aiplatform.featureOnlineStores.getIamPolicy
  • aiplatform.featureOnlineStores.list
  • aiplatform.featureOnlineStores.setIamPolicy
  • aiplatform.featureOnlineStores.update
  • aiplatform.featureViewSyncs.get
  • aiplatform.featureViewSyncs.list
  • aiplatform.featureViews.create
  • aiplatform.featureViews.delete
  • aiplatform.featureViews.directWrite
  • aiplatform.featureViews.fetchFeatureValues
  • aiplatform.featureViews.get
  • aiplatform.featureViews.getIamPolicy
  • aiplatform.featureViews.list
  • aiplatform.featureViews.searchNearestEntities
  • aiplatform.featureViews.setIamPolicy
  • aiplatform.featureViews.sync
  • aiplatform.featureViews.update
  • aiplatform.features.create
  • aiplatform.features.delete
  • aiplatform.features.get
  • aiplatform.features.list
  • aiplatform.features.update
  • aiplatform.featurestores.batchReadFeatureValues
  • aiplatform.featurestores.create
  • aiplatform.featurestores.delete
  • aiplatform.featurestores.exportFeatures
  • aiplatform.featurestores.get
  • aiplatform.featurestores.getIamPolicy
  • aiplatform.featurestores.importFeatures
  • aiplatform.featurestores.list
  • aiplatform.featurestores.readFeatures
  • aiplatform.featurestores.setIamPolicy
  • aiplatform.featurestores.update
  • aiplatform.featurestores.writeFeatures
  • aiplatform.humanInTheLoops.cancel
  • aiplatform.humanInTheLoops.create
  • aiplatform.humanInTheLoops.delete
  • aiplatform.humanInTheLoops.get
  • aiplatform.humanInTheLoops.list
  • aiplatform.humanInTheLoops.queryAnnotationStats
  • aiplatform.humanInTheLoops.send
  • aiplatform.humanInTheLoops.update
  • aiplatform.hyperparameterTuningJobs.cancel
  • aiplatform.hyperparameterTuningJobs.create
  • aiplatform.hyperparameterTuningJobs.delete
  • aiplatform.hyperparameterTuningJobs.get
  • aiplatform.hyperparameterTuningJobs.list
  • aiplatform.indexEndpoints.create
  • aiplatform.indexEndpoints.delete
  • aiplatform.indexEndpoints.deploy
  • aiplatform.indexEndpoints.get
  • aiplatform.indexEndpoints.list
  • aiplatform.indexEndpoints.queryVectors
  • aiplatform.indexEndpoints.undeploy
  • aiplatform.indexEndpoints.update
  • aiplatform.indexes.create
  • aiplatform.indexes.delete
  • aiplatform.indexes.get
  • aiplatform.indexes.list
  • aiplatform.indexes.update
  • aiplatform.locations.evaluateInstances
  • aiplatform.locations.get
  • aiplatform.locations.list
  • aiplatform.memories.create
  • aiplatform.memories.delete
  • aiplatform.memories.generate
  • aiplatform.memories.get
  • aiplatform.memories.list
  • aiplatform.memories.retrieve
  • aiplatform.memories.update
  • aiplatform.memoryRevisions.get
  • aiplatform.memoryRevisions.list
  • aiplatform.memoryRevisions.rollback
  • aiplatform.metadataSchemas.create
  • aiplatform.metadataSchemas.delete
  • aiplatform.metadataSchemas.get
  • aiplatform.metadataSchemas.list
  • aiplatform.metadataStores.create
  • aiplatform.metadataStores.delete
  • aiplatform.metadataStores.get
  • aiplatform.metadataStores.list
  • aiplatform.migratableResources.migrate
  • aiplatform.migratableResources.search
  • aiplatform.modelDeploymentMonitoringJobs.create
  • aiplatform.modelDeploymentMonitoringJobs.delete
  • aiplatform.modelDeploymentMonitoringJobs.get
  • aiplatform.modelDeploymentMonitoringJobs.list
  • aiplatform.modelDeploymentMonitoringJobs.pause
  • aiplatform.modelDeploymentMonitoringJobs.resume
  • aiplatform.modelDeploymentMonitoringJobs.searchStatsAnomalies
  • aiplatform.modelDeploymentMonitoringJobs.update
  • aiplatform.modelEvaluationSlices.get
  • aiplatform.modelEvaluationSlices.import
  • aiplatform.modelEvaluationSlices.list
  • aiplatform.modelEvaluations.exportEvaluatedDataItems
  • aiplatform.modelEvaluations.get
  • aiplatform.modelEvaluations.import
  • aiplatform.modelEvaluations.list
  • aiplatform.modelMonitoringJobs.create
  • aiplatform.modelMonitoringJobs.delete
  • aiplatform.modelMonitoringJobs.get
  • aiplatform.modelMonitoringJobs.list
  • aiplatform.modelMonitors.create
  • aiplatform.modelMonitors.delete
  • aiplatform.modelMonitors.get
  • aiplatform.modelMonitors.list
  • aiplatform.modelMonitors.searchModelMonitoringAlerts
  • aiplatform.modelMonitors.searchModelMonitoringStats
  • aiplatform.modelMonitors.update
  • aiplatform.models.delete
  • aiplatform.models.export
  • aiplatform.models.get
  • aiplatform.models.list
  • aiplatform.models.update
  • aiplatform.models.upload
  • aiplatform.monitoredAgents.disable
  • aiplatform.monitoredAgents.enable
  • aiplatform.monitoredAgents.get
  • aiplatform.monitoredAgents.list
  • aiplatform.nasJobs.cancel
  • aiplatform.nasJobs.create
  • aiplatform.nasJobs.delete
  • aiplatform.nasJobs.get
  • aiplatform.nasJobs.list
  • aiplatform.nasTrialDetails.get
  • aiplatform.nasTrialDetails.list
  • aiplatform.notebookExecutionJobs.create
  • aiplatform.notebookExecutionJobs.delete
  • aiplatform.notebookExecutionJobs.get
  • aiplatform.notebookExecutionJobs.list
  • aiplatform.notebookRuntimeTemplates.apply
  • aiplatform.notebookRuntimeTemplates.create
  • aiplatform.notebookRuntimeTemplates.delete
  • aiplatform.notebookRuntimeTemplates.get
  • aiplatform.notebookRuntimeTemplates.getIamPolicy
  • aiplatform.notebookRuntimeTemplates.list
  • aiplatform.notebookRuntimeTemplates.setIamPolicy
  • aiplatform.notebookRuntimeTemplates.update
  • aiplatform.notebookRuntimes.assign
  • aiplatform.notebookRuntimes.delete
  • aiplatform.notebookRuntimes.get
  • aiplatform.notebookRuntimes.list
  • aiplatform.notebookRuntimes.start
  • aiplatform.notebookRuntimes.update
  • aiplatform.notebookRuntimes.upgrade
  • aiplatform.onlineEvaluators.create
  • aiplatform.onlineEvaluators.delete
  • aiplatform.onlineEvaluators.get
  • aiplatform.onlineEvaluators.list
  • aiplatform.onlineEvaluators.update
  • aiplatform.operations.list
  • aiplatform.persistentResources.create
  • aiplatform.persistentResources.delete
  • aiplatform.persistentResources.get
  • aiplatform.persistentResources.list
  • aiplatform.pipelineJobs.cancel
  • aiplatform.pipelineJobs.create
  • aiplatform.pipelineJobs.delete
  • aiplatform.pipelineJobs.get
  • aiplatform.pipelineJobs.list
  • aiplatform.provisionedThroughputRevisions.get
  • aiplatform.provisionedThroughputRevisions.list
  • aiplatform.provisionedThroughputs.cancel
  • aiplatform.provisionedThroughputs.create
  • aiplatform.provisionedThroughputs.get
  • aiplatform.provisionedThroughputs.list
  • aiplatform.provisionedThroughputs.split
  • aiplatform.provisionedThroughputs.update