Dataplex Universal Catalog IAM 角色

借助 Identity and Access Management (IAM)，您可以控制哪些人可以在 Dataplex Universal Catalog 中执行哪些操作。您可以采用最小权限安全原则，以保护私密数据、避免未经授权的访问、缩小攻击面或满足法规遵从要求。

Dataplex Universal Catalog 提供了多个预定义的 IAM 角色，每个角色都具有一组特定的权限，可让用户执行相应操作。您可以使用 IAM 政策授予这些角色。

如需更精细的控制，您可以选择特定权限并向用户分配该新角色，从而创建自定义 IAM 角色。借助自定义角色，您可以构建符合组织需求的访问权限模型。

本文档介绍了与 Dataplex Universal Catalog 相关的预定义和自定义 IAM 角色。

如需详细了解 IAM 及其功能，请参阅 IAM 文档。

Dataplex Universal Catalog 角色简介

Dataplex Universal Catalog IAM 角色是一项或多项权限的集合。您向主账号授予角色，以允许他们对项目中的 Dataplex Universal Catalog 资源执行操作。例如，Dataplex Viewer 角色具有 dataplex.*.get 和 dataplex.*.list 权限，这些权限允许用户获取和列出项目中的 Dataplex Universal Catalog 资源。如需了解详情，请参阅 Dataplex Universal Catalog 权限。

您可以将 Dataplex Universal Catalog 角色应用于服务层次结构中的任何资源，包括项目、数据湖和数据区域。

基本角色

您可以使用 IAM Project 角色在项目级分配基本角色。下面列出了与 IAM 项目角色关联的权限：

项目角色 权限
Project Owner 拥有所有“项目修改者”权限，外加为项目管理访问控制的权限（获取/设置 IamPolicy）和设置项目结算的权限
Project Editor 拥有所有 Project Viewer 权限，外加可修改状态的操作（创建、删除、更新、使用）的所有项目权限
项目查看者 拥有不会修改状态的只读操作（获取、列出）的所有项目权限

Dataplex Universal Catalog 的预定义角色

预定义角色可提供执行一项任务或一组相关任务所需的权限。

请注意以下几点：

  • 如果您使用的是 Data Catalog，则 Data Catalog 条目访问权限不会自动转移到 Dataplex Universal Catalog 条目。您必须先明确授予对 Dataplex Universal Catalog 条目的访问权限，然后才能使用这些条目。
  • Dataplex Administrator、Dataplex Editor 和 Dataplex Viewer 角色不提供对元数据资源（例如条目组、条目类型、切面类型和条目）的访问权限。
  • 没有任何角色授予从系统定义的条目群组（例如 @bigquery 和 @dataplex）添加或删除 Dataplex Universal Catalog 条目的权限。
  • Dataplex Entry and EntryLink Owner 角色可提供以下权限：
    • 授予对条目相关操作的完整访问权限。
    • 授予添加某些系统切面类型（例如 Schema、Generic、Overview 和 Contacts）的切面的权限。
    • 授予创建 GenericEntry 类型的条目的权限。
    • 借助此角色，您可以创建具有条目类型和切面类型的条目，其中条目类型和切面类型与条目在同一项目中定义。否则，必须针对定义了条目类型和切面类型的项目授予额外的 Dataplex Entry Type User 和 Dataplex Aspect Type User 角色。
    • 使用 LookupEntry 方法或 SearchEntries 方法时，此角色不会授予读取从 Dataplex Universal Catalog 之外的Google Cloud 资源（例如 BigQuery 条目）创建的条目的权限。如需读取这些条目，您必须获得源系统资源的权限。或者，您也可以使用 GetEntry 方法读取仅具有 Dataplex Entry 和 EntryLink Owner 角色的条目。
  • 如需查看附加到条目的数据切面，您需要拥有从条目所代表的源资产读取数据的权限，以及查看条目的权限。 如果您有权查看某个条目，但缺少对源资产的数据读取权限，则仍可以查看该条目上的所有其他元数据，但 Dataplex Universal Catalog 会隐藏任何附加的数据切面的内容。

Dataplex Catalog Admin 和 Dataplex Catalog Editor 角色授予查看自定义条目所需的权限。

  • 如需使用 SearchEntries 方法搜索条目，您必须至少获得在 API 请求中使用的项目的以下 IAM 角色之一：Dataplex Catalog Admin、Dataplex Catalog Editor 或 Dataplex Catalog Viewer。搜索结果的权限检查与所选项目无关。

下表列出了 Dataplex Universal Catalog 预定义角色以及与每个角色关联的权限。

Role Permissions

(roles/dataplex.admin)

Full access to Dataplex Universal Catalog resources, except for catalog resources like entries and entry groups.

cloudasset.assets.analyzeIamPolicy

cloudasset.assets.searchAllIamPolicies

cloudasset.assets.searchAllResources

dataplex.assetActions.list

dataplex.assets.create

dataplex.assets.delete

dataplex.assets.get

dataplex.assets.getIamPolicy

dataplex.assets.list

dataplex.assets.setIamPolicy

dataplex.assets.update

dataplex.changeRequests.*

  • dataplex.changeRequests.adminDelete
  • dataplex.changeRequests.delete
  • dataplex.changeRequests.get
  • dataplex.changeRequests.getIamPolicy
  • dataplex.changeRequests.list
  • dataplex.changeRequests.setIamPolicy
  • dataplex.changeRequests.update
  • dataplex.changeRequests.use

dataplex.content.*

  • dataplex.content.create
  • dataplex.content.delete
  • dataplex.content.get
  • dataplex.content.getIamPolicy
  • dataplex.content.list
  • dataplex.content.setIamPolicy
  • dataplex.content.update

dataplex.dataAssets.*

  • dataplex.dataAssets.create
  • dataplex.dataAssets.delete
  • dataplex.dataAssets.get
  • dataplex.dataAssets.list
  • dataplex.dataAssets.update

dataplex.dataAttributeBindings.*

  • dataplex.dataAttributeBindings.create
  • dataplex.dataAttributeBindings.delete
  • dataplex.dataAttributeBindings.get
  • dataplex.dataAttributeBindings.getIamPolicy
  • dataplex.dataAttributeBindings.list
  • dataplex.dataAttributeBindings.setIamPolicy
  • dataplex.dataAttributeBindings.update

dataplex.dataAttributes.*

  • dataplex.dataAttributes.bind
  • dataplex.dataAttributes.create
  • dataplex.dataAttributes.delete
  • dataplex.dataAttributes.get
  • dataplex.dataAttributes.getIamPolicy
  • dataplex.dataAttributes.list
  • dataplex.dataAttributes.setIamPolicy
  • dataplex.dataAttributes.update

dataplex.dataDomainBindings.*

  • dataplex.dataDomainBindings.create
  • dataplex.dataDomainBindings.delete
  • dataplex.dataDomainBindings.get
  • dataplex.dataDomainBindings.list

dataplex.dataDomains.*

  • dataplex.dataDomains.create
  • dataplex.dataDomains.delete
  • dataplex.dataDomains.discover
  • dataplex.dataDomains.get
  • dataplex.dataDomains.getIamPolicy
  • dataplex.dataDomains.list
  • dataplex.dataDomains.lookupEntry
  • dataplex.dataDomains.modifyEntry
  • dataplex.dataDomains.setIamPolicy
  • dataplex.dataDomains.update

dataplex.dataProducts.*

  • dataplex.dataProducts.approve
  • dataplex.dataProducts.create
  • dataplex.dataProducts.delete
  • dataplex.dataProducts.get
  • dataplex.dataProducts.getIamPolicy
  • dataplex.dataProducts.list
  • dataplex.dataProducts.setIamPolicy
  • dataplex.dataProducts.update

dataplex.dataTaxonomies.*

  • dataplex.dataTaxonomies.configureDataAccess
  • dataplex.dataTaxonomies.configureResourceAccess
  • dataplex.dataTaxonomies.create
  • dataplex.dataTaxonomies.delete
  • dataplex.dataTaxonomies.get
  • dataplex.dataTaxonomies.getIamPolicy
  • dataplex.dataTaxonomies.list
  • dataplex.dataTaxonomies.setIamPolicy
  • dataplex.dataTaxonomies.update

dataplex.datascans.*

  • dataplex.datascans.cancel
  • dataplex.datascans.create
  • dataplex.datascans.delete
  • dataplex.datascans.get
  • dataplex.datascans.getData
  • dataplex.datascans.getIamPolicy
  • dataplex.datascans.list
  • dataplex.datascans.run
  • dataplex.datascans.setIamPolicy
  • dataplex.datascans.update

dataplex.entities.*

  • dataplex.entities.create
  • dataplex.entities.delete
  • dataplex.entities.get
  • dataplex.entities.list
  • dataplex.entities.update

dataplex.entries.link

dataplex.entryGroups.createTagBinding

dataplex.entryGroups.deleteTagBinding

dataplex.entryGroups.export

dataplex.entryGroups.import

dataplex.entryGroups.listEffectiveTags

dataplex.entryGroups.listTagBindings

dataplex.entryGroups.requestChanges

dataplex.entryGroups.useContextEntryLink

dataplex.entryGroups.useDefinitionEntryLink

dataplex.entryGroups.useRelatedEntryLink

dataplex.entryGroups.useSchemaJoinEntryLink

dataplex.entryGroups.useSynonymEntryLink

dataplex.entryLinks.*

  • dataplex.entryLinks.create
  • dataplex.entryLinks.delete
  • dataplex.entryLinks.get
  • dataplex.entryLinks.reference
  • dataplex.entryLinks.update

dataplex.entryTypes.createTagBinding

dataplex.entryTypes.deleteTagBinding

dataplex.entryTypes.listEffectiveTags

dataplex.entryTypes.listTagBindings

dataplex.environments.*

  • dataplex.environments.create
  • dataplex.environments.delete
  • dataplex.environments.execute
  • dataplex.environments.get
  • dataplex.environments.getIamPolicy
  • dataplex.environments.list
  • dataplex.environments.setIamPolicy
  • dataplex.environments.update

dataplex.glossaries.*

  • dataplex.glossaries.create
  • dataplex.glossaries.delete
  • dataplex.glossaries.get
  • dataplex.glossaries.getIamPolicy
  • dataplex.glossaries.import
  • dataplex.glossaries.list
  • dataplex.glossaries.requestChanges
  • dataplex.glossaries.setIamPolicy
  • dataplex.glossaries.update

dataplex.glossaryCategories.*

  • dataplex.glossaryCategories.create
  • dataplex.glossaryCategories.delete
  • dataplex.glossaryCategories.get
  • dataplex.glossaryCategories.list
  • dataplex.glossaryCategories.update

dataplex.glossaryTerms.*

  • dataplex.glossaryTerms.create
  • dataplex.glossaryTerms.delete
  • dataplex.glossaryTerms.get
  • dataplex.glossaryTerms.list
  • dataplex.glossaryTerms.update
  • dataplex.glossaryTerms.use

dataplex.governanceRules.*

  • dataplex.governanceRules.createTagBinding
  • dataplex.governanceRules.deleteTagBinding
  • dataplex.governanceRules.listEffectiveTags
  • dataplex.governanceRules.listTagBindings

dataplex.lakeActions.list

dataplex.lakes.*

  • dataplex.lakes.create
  • dataplex.lakes.delete
  • dataplex.lakes.get
  • dataplex.lakes.getIamPolicy
  • dataplex.lakes.list
  • dataplex.lakes.setIamPolicy
  • dataplex.lakes.update

dataplex.locations.*

  • dataplex.locations.get
  • dataplex.locations.list

dataplex.metadataFeeds.*

  • dataplex.metadataFeeds.create
  • dataplex.metadataFeeds.delete
  • dataplex.metadataFeeds.get
  • dataplex.metadataFeeds.list
  • dataplex.metadataFeeds.update

dataplex.metadataJobs.*

  • dataplex.metadataJobs.cancel
  • dataplex.metadataJobs.create
  • dataplex.metadataJobs.get
  • dataplex.metadataJobs.list

dataplex.operations.*

  • dataplex.operations.cancel
  • dataplex.operations.delete
  • dataplex.operations.get
  • dataplex.operations.list

dataplex.partitions.*

  • dataplex.partitions.create
  • dataplex.partitions.delete
  • dataplex.partitions.get
  • dataplex.partitions.list
  • dataplex.partitions.update

dataplex.tasks.*

  • dataplex.tasks.cancel
  • dataplex.tasks.create
  • dataplex.tasks.delete
  • dataplex.tasks.get
  • dataplex.tasks.getIamPolicy
  • dataplex.tasks.list
  • dataplex.tasks.run
  • dataplex.tasks.setIamPolicy
  • dataplex.tasks.update

dataplex.zoneActions.list

dataplex.zones.*

  • dataplex.zones.create
  • dataplex.zones.delete
  • dataplex.zones.get
  • dataplex.zones.getIamPolicy
  • dataplex.zones.list
  • dataplex.zones.setIamPolicy
  • dataplex.zones.update

resourcemanager.projects.get

resourcemanager.projects.list

(roles/dataplex.dataScanAdmin)

Full access to DataScan resources.

dataplex.datascans.*

  • dataplex.datascans.cancel
  • dataplex.datascans.create
  • dataplex.datascans.delete
  • dataplex.datascans.get
  • dataplex.datascans.getData
  • dataplex.datascans.getIamPolicy
  • dataplex.datascans.list
  • dataplex.datascans.run
  • dataplex.datascans.setIamPolicy
  • dataplex.datascans.update

dataplex.operations.get

dataplex.operations.list

(roles/dataplex.editor)

Write access to Dataplex Universal Catalog resources, except for catalog resources like entries, entry groups, and glossaries.

cloudasset.assets.analyzeIamPolicy

dataplex.assetActions.list

dataplex.assets.create

dataplex.assets.delete

dataplex.assets.get

dataplex.assets.getIamPolicy

dataplex.assets.list

dataplex.assets.update

dataplex.content.delete

dataplex.content.get

dataplex.content.getIamPolicy

dataplex.content.list

dataplex.dataAssets.*

  • dataplex.dataAssets.create
  • dataplex.dataAssets.delete
  • dataplex.dataAssets.get
  • dataplex.dataAssets.list
  • dataplex.dataAssets.update

dataplex.dataAttributeBindings.create

dataplex.dataAttributeBindings.delete

dataplex.dataAttributeBindings.get

dataplex.dataAttributeBindings.getIamPolicy

dataplex.dataAttributeBindings.list

dataplex.dataAttributeBindings.update

dataplex.dataAttributes.bind

dataplex.dataAttributes.create

dataplex.dataAttributes.delete

dataplex.dataAttributes.get

dataplex.dataAttributes.getIamPolicy

dataplex.dataAttributes.list

dataplex.dataAttributes.update

dataplex.dataProducts.approve

dataplex.dataProducts.create

dataplex.dataProducts.delete

dataplex.dataProducts.get

dataplex.dataProducts.getIamPolicy

dataplex.dataProducts.list

dataplex.dataProducts.update

dataplex.dataTaxonomies.configureDataAccess

dataplex.dataTaxonomies.configureResourceAccess

dataplex.dataTaxonomies.create

dataplex.dataTaxonomies.delete

dataplex.dataTaxonomies.get

dataplex.dataTaxonomies.getIamPolicy

dataplex.dataTaxonomies.list

dataplex.dataTaxonomies.update

dataplex.datascans.cancel

dataplex.datascans.create

dataplex.datascans.delete

dataplex.datascans.get

dataplex.datascans.getIamPolicy

dataplex.datascans.list

dataplex.datascans.run

dataplex.datascans.update

dataplex.environments.create

dataplex.environments.delete

dataplex.environments.get

dataplex.environments.getIamPolicy

dataplex.environments.list

dataplex.environments.update

dataplex.lakeActions.list

dataplex.lakes.create

dataplex.lakes.delete

dataplex.lakes.get

dataplex.lakes.getIamPolicy

dataplex.lakes.list

dataplex.lakes.update

dataplex.operations.*

  • dataplex.operations.cancel
  • dataplex.operations.delete
  • dataplex.operations.get
  • dataplex.operations.list

dataplex.tasks.cancel

dataplex.tasks.create

dataplex.tasks.delete

dataplex.tasks.get

dataplex.tasks.getIamPolicy

dataplex.tasks.list

dataplex.tasks.run

dataplex.tasks.update

dataplex.zoneActions.list

dataplex.zones.create

dataplex.zones.delete

dataplex.zones.get

dataplex.zones.getIamPolicy

dataplex.zones.list

dataplex.zones.update

(roles/dataplex.viewer)

Read access to Dataplex Universal Catalog resources, except for catalog resources like entries, entry groups, and glossaries.

cloudasset.assets.analyzeIamPolicy

dataplex.assetActions.list

dataplex.assets.get

dataplex.assets.getIamPolicy

dataplex.assets.list

dataplex.content.get

dataplex.content.getIamPolicy

dataplex.content.list

dataplex.dataAssets.get

dataplex.dataAssets.list

dataplex.dataAttributeBindings.get

dataplex.dataAttributeBindings.getIamPolicy

dataplex.dataAttributeBindings.list

dataplex.dataAttributes.get

dataplex.dataAttributes.getIamPolicy

dataplex.dataAttributes.list

dataplex.dataProducts.get

dataplex.dataProducts.getIamPolicy

dataplex.dataProducts.list

dataplex.dataTaxonomies.get

dataplex.dataTaxonomies.getIamPolicy

dataplex.dataTaxonomies.list

dataplex.datascans.get

dataplex.datascans.getIamPolicy

dataplex.datascans.list

dataplex.environments.get

dataplex.environments.getIamPolicy

dataplex.environments.list

dataplex.lakeActions.list

dataplex.lakes.get

dataplex.lakes.getIamPolicy

dataplex.lakes.list

dataplex.operations.get

dataplex.operations.list

dataplex.tasks.get

dataplex.tasks.getIamPolicy

dataplex.tasks.list

dataplex.zoneActions.list

dataplex.zones.get

dataplex.zones.getIamPolicy

dataplex.zones.list

(roles/dataplex.aspectTypeOwner)

Grants access to creating and managing Aspect Types. Does not give the right to create/modify Entries.

datacatalog.migrationConfig.get

dataplex.aspectTypes.*

  • dataplex.aspectTypes.create
  • dataplex.aspectTypes.delete
  • dataplex.aspectTypes.get
  • dataplex.aspectTypes.getIamPolicy
  • dataplex.aspectTypes.list
  • dataplex.aspectTypes.setIamPolicy
  • dataplex.aspectTypes.update
  • dataplex.aspectTypes.use

dataplex.dataDomains.discover

dataplex.operations.get

dataplex.projects.search

resourcemanager.projects.get

resourcemanager.projects.list

(roles/dataplex.aspectTypeUser)

Grants access to use Aspect Types to create/modify Entries with the corresponding aspects.

datacatalog.migrationConfig.get

dataplex.aspectTypes.get

dataplex.aspectTypes.list

dataplex.aspectTypes.use

dataplex.dataDomains.discover

dataplex.projects.search

resourcemanager.projects.get

resourcemanager.projects.list

(roles/dataplex.bindingAdmin)

Full access on DataAttribute Binding resources.

dataplex.dataAttributeBindings.*

  • dataplex.dataAttributeBindings.create
  • dataplex.dataAttributeBindings.delete
  • dataplex.dataAttributeBindings.get
  • dataplex.dataAttributeBindings.getIamPolicy
  • dataplex.dataAttributeBindings.list
  • dataplex.dataAttributeBindings.setIamPolicy
  • dataplex.dataAttributeBindings.update

(roles/dataplex.catalogAdmin)

Full access to catalog resources, including entries, entry groups, and glossaries.

datacatalog.migrationConfig.get

dataplex.aspectTypes.*

  • dataplex.aspectTypes.create
  • dataplex.aspectTypes.delete
  • dataplex.aspectTypes.get
  • dataplex.aspectTypes.getIamPolicy
  • dataplex.aspectTypes.list
  • dataplex.aspectTypes.setIamPolicy
  • dataplex.aspectTypes.update
  • dataplex.aspectTypes.use

dataplex.changeRequests.adminDelete

dataplex.changeRequests.delete

dataplex.changeRequests.get

dataplex.changeRequests.list

dataplex.changeRequests.use

dataplex.dataDomains.discover

dataplex.entries.*

  • dataplex.entries.create
  • dataplex.entries.delete
  • dataplex.entries.get
  • dataplex.entries.getData
  • dataplex.entries.link
  • dataplex.entries.list
  • dataplex.entries.update

dataplex.entryGroups.*

  • dataplex.entryGroups.create
  • dataplex.entryGroups.createTagBinding
  • dataplex.entryGroups.delete
  • dataplex.entryGroups.deleteTagBinding
  • dataplex.entryGroups.export
  • dataplex.entryGroups.get
  • dataplex.entryGroups.getIamPolicy
  • dataplex.entryGroups.import
  • dataplex.entryGroups.list
  • dataplex.entryGroups.listEffectiveTags
  • dataplex.entryGroups.listTagBindings
  • dataplex.entryGroups.requestChanges
  • dataplex.entryGroups.setIamPolicy
  • dataplex.entryGroups.update
  • dataplex.entryGroups.useContactsAspect
  • dataplex.entryGroups.useContextAspect
  • dataplex.entryGroups.useContextEntry
  • dataplex.entryGroups.useContextEntryLink
  • dataplex.entryGroups.useDataProfileAspect
  • dataplex.entryGroups.useDataQualityRuleTemplateAspect
  • dataplex.entryGroups.useDataQualityRuleTemplateEntry
  • dataplex.entryGroups.useDataQualityScorecardAspect
  • dataplex.entryGroups.useDataRulesAspect
  • dataplex.entryGroups.useDatabaseDataPolicyAspect
  • dataplex.entryGroups.useDefinitionEntryLink
  • dataplex.entryGroups.useDescriptionsAspect
  • dataplex.entryGroups.useGenericAspect
  • dataplex.entryGroups.useGenericEntry
  • dataplex.entryGroups.useGraphProfileAspect
  • dataplex.entryGroups.useMySQLConnectorTypes
  • dataplex.entryGroups.useOracleConnectorTypes
  • dataplex.entryGroups.useOverviewAspect
  • dataplex.entryGroups.usePostgreSQLConnectorTypes
  • dataplex.entryGroups.useQueriesAspect
  • dataplex.entryGroups.useRefreshCadenceAspect
  • dataplex.entryGroups.useRelatedEntryLink
  • dataplex.entryGroups.useSQLAccessAspect
  • dataplex.entryGroups.useSQLServerConnectorTypes
  • dataplex.entryGroups.useSQLTriggersAspect
  • dataplex.entryGroups.useSchemaAspect
  • dataplex.entryGroups.useSchemaJoinAspect
  • dataplex.entryGroups.useSchemaJoinEntryLink
  • dataplex.entryGroups.useSecondaryIndexesAspect
  • dataplex.entryGroups.useStorageAspect
  • dataplex.entryGroups.useSynonymEntryLink

dataplex.entryLinks.*

  • dataplex.entryLinks.create
  • dataplex.entryLinks.delete
  • dataplex.entryLinks.get
  • dataplex.entryLinks.reference
  • dataplex.entryLinks.update

dataplex.entryTypes.*

  • dataplex.entryTypes.create
  • dataplex.entryTypes.createTagBinding
  • dataplex.entryTypes.delete
  • dataplex.entryTypes.deleteTagBinding
  • dataplex.entryTypes.get
  • dataplex.entryTypes.getIamPolicy
  • dataplex.entryTypes.list
  • dataplex.entryTypes.listEffectiveTags
  • dataplex.entryTypes.listTagBindings
  • dataplex.entryTypes.setIamPolicy
  • dataplex.entryTypes.update
  • dataplex.entryTypes.use

dataplex.glossaries.*

  • dataplex.glossaries.create
  • dataplex.glossaries.delete
  • dataplex.glossaries.get
  • dataplex.glossaries.getIamPolicy
  • dataplex.glossaries.import
  • dataplex.glossaries.list
  • dataplex.glossaries.requestChanges
  • dataplex.glossaries.setIamPolicy
  • dataplex.glossaries.update

dataplex.glossaryCategories.*

  • dataplex.glossaryCategories.create
  • dataplex.glossaryCategories.delete
  • dataplex.glossaryCategories.get
  • dataplex.glossaryCategories.list
  • dataplex.glossaryCategories.update

dataplex.glossaryTerms.*

  • dataplex.glossaryTerms.create
  • dataplex.glossaryTerms.delete
  • dataplex.glossaryTerms.get
  • dataplex.glossaryTerms.list
  • dataplex.glossaryTerms.update
  • dataplex.glossaryTerms.use

dataplex.locations.*

  • dataplex.locations.get
  • dataplex.locations.list

dataplex.operations.get

dataplex.projects.search

resourcemanager.projects.get

resourcemanager.projects.list

(roles/dataplex.catalogEditor)

Write access to catalog resources, including entries, entry groups, and glossaries. Cannot set IAM policies on resources.

datacatalog.migrationConfig.get

dataplex.aspectTypes.create

dataplex.aspectTypes.delete

dataplex.aspectTypes.get

dataplex.aspectTypes.getIamPolicy

dataplex.aspectTypes.list

dataplex.aspectTypes.update

dataplex.aspectTypes.use

dataplex.changeRequests.get

dataplex.changeRequests.list

dataplex.dataDomains.discover

dataplex.entries.*

  • dataplex.entries.create
  • dataplex.entries.delete
  • dataplex.entries.get
  • dataplex.entries.getData
  • dataplex.entries.link
  • dataplex.entries.list
  • dataplex.entries.update

dataplex.entryGroups.create

dataplex.entryGroups.delete

dataplex.entryGroups.get

dataplex.entryGroups.getIamPolicy

dataplex.entryGroups.list

dataplex.entryGroups.listEffectiveTags

dataplex.entryGroups.listTagBindings

dataplex.entryGroups.update

dataplex.entryGroups.useContactsAspect

dataplex.entryGroups.useContextAspect

dataplex.entryGroups.useContextEntry

dataplex.entryGroups.useContextEntryLink

dataplex.entryGroups.useDataProfileAspect

dataplex.entryGroups.useDataQualityRuleTemplateAspect

dataplex.entryGroups.useDataQualityRuleTemplateEntry

dataplex.entryGroups.useDataQualityScorecardAspect

dataplex.entryGroups.useDataRulesAspect

dataplex.entryGroups.useDatabaseDataPolicyAspect

dataplex.entryGroups.useDefinitionEntryLink

dataplex.entryGroups.useDescriptionsAspect

dataplex.entryGroups.useGenericAspect

dataplex.entryGroups.useGenericEntry

dataplex.entryGroups.useGraphProfileAspect

dataplex.entryGroups.useMySQLConnectorTypes

dataplex.entryGroups.useOracleConnectorTypes

dataplex.entryGroups.useOverviewAspect

dataplex.entryGroups.usePostgreSQLConnectorTypes

dataplex.entryGroups.useQueriesAspect

dataplex.entryGroups.useRefreshCadenceAspect

dataplex.entryGroups.useRelatedEntryLink

dataplex.entryGroups.useSQLAccessAspect

dataplex.entryGroups.useSQLServerConnectorTypes

dataplex.entryGroups.useSQLTriggersAspect

dataplex.entryGroups.useSchemaAspect

dataplex.entryGroups.useSchemaJoinAspect

dataplex.entryGroups.useSchemaJoinEntryLink

dataplex.entryGroups.useSecondaryIndexesAspect

dataplex.entryGroups.useStorageAspect

dataplex.entryGroups.useSynonymEntryLink

dataplex.entryLinks.create

dataplex.entryLinks.delete

dataplex.entryLinks.get

dataplex.entryLinks.update

dataplex.entryTypes.create

dataplex.entryTypes.delete

dataplex.entryTypes.get

dataplex.entryTypes.getIamPolicy

dataplex.entryTypes.list

dataplex.entryTypes.listEffectiveTags

dataplex.entryTypes.listTagBindings

dataplex.entryTypes.update

dataplex.entryTypes.use

dataplex.glossaries.create

dataplex.glossaries.delete

dataplex.glossaries.get

dataplex.glossaries.getIamPolicy

dataplex.glossaries.list

dataplex.glossaries.update

dataplex.glossaryCategories.*

  • dataplex.glossaryCategories.create
  • dataplex.glossaryCategories.delete
  • dataplex.glossaryCategories.get
  • dataplex.glossaryCategories.list
  • dataplex.glossaryCategories.update

dataplex.glossaryTerms.*

  • dataplex.glossaryTerms.create
  • dataplex.glossaryTerms.delete
  • dataplex.glossaryTerms.get
  • dataplex.glossaryTerms.list
  • dataplex.glossaryTerms.update
  • dataplex.glossaryTerms.use

dataplex.locations.*

  • dataplex.locations.get
  • dataplex.locations.list

dataplex.operations.get

dataplex.projects.search

resourcemanager.projects.get

resourcemanager.projects.list

(roles/dataplex.catalogViewer)

Read access to catalog resources, including entries, entry groups, and glossaries. Can view IAM policies on catalog resources.

datacatalog.migrationConfig.get

dataplex.aspectTypes.get

dataplex.aspectTypes.getIamPolicy

dataplex.aspectTypes.list

dataplex.changeRequests.get

dataplex.changeRequests.list

dataplex.dataDomains.discover

dataplex.entries.get

dataplex.entries.list

dataplex.entryGroups.get

dataplex.entryGroups.getIamPolicy

dataplex.entryGroups.list

dataplex.entryGroups.listEffectiveTags

dataplex.entryGroups.listTagBindings

dataplex.entryGroups.requestChanges

dataplex.entryLinks.get

dataplex.entryTypes.get

dataplex.entryTypes.getIamPolicy

dataplex.entryTypes.list

dataplex.entryTypes.listEffectiveTags

dataplex.entryTypes.listTagBindings

dataplex.glossaries.get

dataplex.glossaries.getIamPolicy

dataplex.glossaries.list

dataplex.glossaries.requestChanges

dataplex.glossaryCategories.get

dataplex.glossaryCategories.list

dataplex.glossaryTerms.get

dataplex.glossaryTerms.list

dataplex.locations.*

  • dataplex.locations.get
  • dataplex.locations.list

dataplex.projects.search

resourcemanager.projects.get

resourcemanager.projects.list

(roles/dataplex.changeRequestOwner)

Grants Change Request creator necessary permissions on a created ChangeRequest instance.

dataplex.changeRequests.delete

dataplex.changeRequests.get

dataplex.changeRequests.update

(roles/dataplex.dataDomainAdmin)

Allows full management of the Data Domain and its bindings.

dataplex.dataDomainBindings.*

  • dataplex.dataDomainBindings.create
  • dataplex.dataDomainBindings.delete
  • dataplex.dataDomainBindings.get
  • dataplex.dataDomainBindings.list

dataplex.dataDomains.create

dataplex.dataDomains.delete

dataplex.dataDomains.discover

dataplex.dataDomains.get

dataplex.dataDomains.getIamPolicy

dataplex.dataDomains.list

dataplex.dataDomains.lookupEntry

dataplex.dataDomains.setIamPolicy

dataplex.dataDomains.update

dataplex.operations.get

resourcemanager.projects.get

resourcemanager.projects.list

(roles/dataplex.dataDomainEditor)

Allows updating the Data Domain as well as full management of its bindings.

dataplex.dataDomainBindings.*

  • dataplex.dataDomainBindings.create
  • dataplex.dataDomainBindings.delete
  • dataplex.dataDomainBindings.get
  • dataplex.dataDomainBindings.list

dataplex.dataDomains.discover

dataplex.dataDomains.get

dataplex.dataDomains.getIamPolicy

dataplex.dataDomains.list

dataplex.dataDomains.lookupEntry

dataplex.dataDomains.update

dataplex.operations.get

resourcemanager.projects.get

resourcemanager.projects.list

(roles/dataplex.dataDomainEntryReader)

Allows discovering and viewing the Data Domain, its subdomains, and metadata of all its resources.

dataplex.dataDomains.discover

dataplex.dataDomains.get

dataplex.dataDomains.list

dataplex.dataDomains.lookupEntry

(roles/dataplex.dataDomainViewer)

Allows viewing the configuration of the Data Domain and its bindings.

dataplex.dataDomainBindings.get

dataplex.dataDomainBindings.list

dataplex.dataDomains.discover

dataplex.dataDomains.get

dataplex.dataDomains.getIamPolicy

dataplex.dataDomains.list

dataplex.dataDomains.lookupEntry

resourcemanager.projects.get

resourcemanager.projects.list

(roles/dataplex.dataOwner)

Owner access to data. To be granted to Dataplex Universal Catalog resources Lake, Zone or Asset only.

dataplex.assets.ownData

dataplex.assets.readData

dataplex.assets.writeData

(roles/dataplex.dataProductsAdmin)

Full access to Data Products.

dataplex.dataAssets.*