Permisos y funciones de IAM

En esta página, se describen los roles y permisos de Developer Connect.

El control de acceso en Developer Connect se realiza con Identity and Access Management (IAM). IAM te permite crear y administrar permisos para los Google Cloud recursos. Developer Connect proporciona un conjunto específico de roles de IAM predefinidos , en el que cada rol contiene un conjunto de permisos adecuados para un tipo particular de acceso o acción. Te recomendamos que adoptes el principio de seguridad de menor privilegio, y que otorgues solo el acceso necesario a tus recursos.

Roles predefinidos de Developer Connect

Asigna permisos a las cuentas con los roles. En la siguiente tabla, se enumeran los roles de IAM disponibles para Developer Connect y los permisos que incluyen:

La documentación de IAM incluye una referencia con capacidad de búsqueda de todos los roles predefinidos.

Role Permissions

(roles/developerconnect.admin)

Full access to Developer Connect resources.

developerconnect.connections.constructGitHubAppManifest

developerconnect.connections.create

developerconnect.connections.delete

developerconnect.connections.fetchGitHubInstallations

developerconnect.connections.fetchLinkableGitRepositories

developerconnect.connections.generateGitHubStateToken

developerconnect.connections.get

developerconnect.connections.list

developerconnect.connections.processGitHubAppCreationCallback

developerconnect.connections.processGitHubOAuthCallback

developerconnect.connections.update

developerconnect.gitRepositoryLinks.create

developerconnect.gitRepositoryLinks.delete

developerconnect.gitRepositoryLinks.fetchGitRefs

developerconnect.gitRepositoryLinks.get

developerconnect.gitRepositoryLinks.gitProxyRead

developerconnect.gitRepositoryLinks.gitProxyWrite

developerconnect.gitRepositoryLinks.list

developerconnect.locations.*

  • developerconnect.locations.get
  • developerconnect.locations.list

developerconnect.operations.*

  • developerconnect.operations.cancel
  • developerconnect.operations.delete
  • developerconnect.operations.get
  • developerconnect.operations.list

resourcemanager.projects.get

resourcemanager.projects.list

(roles/developerconnect.viewer)

Read-only access to Developer Connect resources.

developerconnect.connections.get

developerconnect.connections.list

developerconnect.gitRepositoryLinks.get

developerconnect.gitRepositoryLinks.list

developerconnect.locations.*

  • developerconnect.locations.get
  • developerconnect.locations.list

developerconnect.operations.get

developerconnect.operations.list

resourcemanager.projects.get

resourcemanager.projects.list

(roles/developerconnect.connectionHttpProxyWriter)

Grants read and write access to connections through the HTTP Proxy.

developerconnect.connections.httpProxyRead

developerconnect.connections.httpProxyWrite

(roles/developerconnect.gitProxyReader)

Grants read-only access to repositories through the Git Proxy.

developerconnect.gitRepositoryLinks.gitProxyRead

(roles/developerconnect.gitProxyUser)

Grants read and write access to repositories through the Git Proxy.

developerconnect.gitRepositoryLinks.gitProxyRead

developerconnect.gitRepositoryLinks.gitProxyWrite

(roles/developerconnect.insightsAdmin)

Admin access to Developer Connect Insights resources.

developerconnect.deploymentEvents.*

  • developerconnect.deploymentEvents.get
  • developerconnect.deploymentEvents.list

developerconnect.insightsConfigs.*

  • developerconnect.insightsConfigs.create
  • developerconnect.insightsConfigs.delete
  • developerconnect.insightsConfigs.get
  • developerconnect.insightsConfigs.list
  • developerconnect.insightsConfigs.update

developerconnect.locations.*

  • developerconnect.locations.get
  • developerconnect.locations.list

developerconnect.operations.get

developerconnect.operations.list

resourcemanager.projects.get

resourcemanager.projects.list

(roles/developerconnect.insightsAgent)

Allow Developer Connect to access SDLC information.

cloudasset.assets.exportResource

cloudasset.assets.listResource

cloudasset.assets.searchAllResources

cloudasset.feeds.create

cloudasset.feeds.get

cloudasset.feeds.update

containeranalysis.occurrences.get

containeranalysis.occurrences.list

logging.logEntries.create

(roles/developerconnect.insightsViewer)

Read-only access to Developer Connect Insights resources.

developerconnect.deploymentEvents.*

  • developerconnect.deploymentEvents.get
  • developerconnect.deploymentEvents.list

developerconnect.insightsConfigs.get

developerconnect.insightsConfigs.list

developerconnect.locations.*

  • developerconnect.locations.get
  • developerconnect.locations.list

developerconnect.operations.get

developerconnect.operations.list

resourcemanager.projects.get

resourcemanager.projects.list

(roles/developerconnect.oauthAdmin)

Grants read and write access to AccountConnector resources.

developerconnect.accountConnectors.*

  • developerconnect.accountConnectors.create
  • developerconnect.accountConnectors.delete
  • developerconnect.accountConnectors.fetchUserRepositories
  • developerconnect.accountConnectors.get
  • developerconnect.accountConnectors.gitProxyRead
  • developerconnect.accountConnectors.gitProxyWrite
  • developerconnect.accountConnectors.httpProxyRead
  • developerconnect.accountConnectors.httpProxyWrite
  • developerconnect.accountConnectors.list
  • developerconnect.accountConnectors.update

developerconnect.locations.*

  • developerconnect.locations.get
  • developerconnect.locations.list

developerconnect.operations.get

developerconnect.operations.list

developerconnect.providers.list

developerconnect.users.*

  • developerconnect.users.delete
  • developerconnect.users.deleteSelf
  • developerconnect.users.fetchAccessToken
  • developerconnect.users.finishOAuth
  • developerconnect.users.getSelf
  • developerconnect.users.list
  • developerconnect.users.startOAuth

resourcemanager.projects.get

resourcemanager.projects.list

(roles/developerconnect.oauthUser)

Grants read and write access to User resources, and read access to AccountConnectors.

developerconnect.accountConnectors.fetchUserRepositories

developerconnect.accountConnectors.get

developerconnect.accountConnectors.gitProxyRead

developerconnect.accountConnectors.gitProxyWrite

developerconnect.accountConnectors.httpProxyRead

developerconnect.accountConnectors.httpProxyWrite

developerconnect.accountConnectors.list

developerconnect.locations.*

  • developerconnect.locations.get
  • developerconnect.locations.list

developerconnect.operations.get

developerconnect.operations.list

developerconnect.users.deleteSelf

developerconnect.users.fetchAccessToken

developerconnect.users.finishOAuth

developerconnect.users.getSelf

developerconnect.users.startOAuth

resourcemanager.projects.get

resourcemanager.projects.list

(roles/developerconnect.readTokenAccessor)

Grants access to Read-Only tokens (both PAT and short-lived). Also grants access to view the git repository link.