使用 IAM 控制访问权限

本文档介绍了如何在 Dataform 中执行以下操作：

准备工作

    登录您的 Google Cloud 账号。如果您是 Google Cloud新手，请 创建一个账号来评估我们的产品在实际场景中的表现。新客户还可获享 $300 赠金，用于运行、测试和部署工作负载。

    In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

    Roles required to select or create a project

    • Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
    • Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

    Go to project selector

    Verify that billing is enabled for your Google Cloud project.

    Roles required to enable APIs

    To enable APIs, you need the serviceusage.services.enable permission. If you created the project, then you likely already have this permission through the Owner role (roles/owner). Otherwise, you can get this permission through the Service Usage Admin role (roles/serviceusage.serviceUsageAdmin). Learn how to grant roles.

    Enable the APIs

    In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

    Roles required to select or create a project

    • Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
    • Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

    Go to project selector

    Verify that billing is enabled for your Google Cloud project.

    Roles required to enable APIs

    To enable APIs, you need the serviceusage.services.enable permission. If you created the project, then you likely already have this permission through the Owner role (roles/owner). Otherwise, you can get this permission through the Service Usage Admin role (roles/serviceusage.serviceUsageAdmin). Learn how to grant roles.

    Enable the APIs

向 Dataform 授予所需的访问权限

本部分介绍如何授予 Dataform 服务代理和自定义服务账号在 BigQuery 中运行工作流所需的 Identity and Access Management (IAM) 角色。

自定义服务账号和 Dataform 服务代理简介

您可以通过以下方式配置自定义服务账号，以代表您运行工作流：

创建 Dataform 代码库或工作流配置时，您可以选择您拥有 act-as 权限的任何服务账号。您必须为与 Dataform 资源关联的所有服务账号配置所需的 act-as 权限。

首次创建 Dataform 代码库时，Dataform 会自动生成服务代理。 Dataform 会使用服务代理代表您与 BigQuery 进行交互。

您的 Dataform 服务代理 ID 采用以下格式：

service-PROJECT_NUMBER@gcp-sa-dataform.iam.gserviceaccount.com

将 PROJECT_NUMBER 替换为您的Google Cloud 项目的数字 ID。您可以在Google Cloud 控制台信息中心找到 Google Cloud 项目 ID。如需了解详情，请参阅查找项目名称、编号和 ID。

Dataform 服务代理、自定义服务账号和 Google 账号所需的角色

Dataform 服务代理、自定义服务账号以及用于在 Dataform 中进行身份验证的 Google 账号的用户凭据（预览版）需要具有以下 BigQuery IAM 角色，才能在 BigQuery 中运行工作流：

  • 对 Dataform 需要同时具有读取和写入权限的项目拥有 BigQuery Data Editor (roles/bigquery.dataEditor) 角色。这些项目通常包括托管 Dataform 代码库的项目。
  • Dataform 需要对项目具有只读权限，因此您需要为这些项目授予 BigQuery Data Viewer (roles/bigquery.dataViewer) 角色。
  • 托管 Dataform 代码库的项目中的