使用 IAM 进行访问权限控制

Cyber Insurance Hub 使用 Identity and Access Management (IAM) 管理对模型资源的访问权限。如需授予对模型资源的访问权限，请为用户、群组或服务账号分配一个或多个 IAM 角色。IAM 角色包含网络保险中心的权限。

如需详细了解 IAM 角色，请参阅 IAM 角色和权限索引。

网络保险中心服务代理

当您加入网络保险中心时，系统会以 organizations-ORGANIZATION_ID@gcp-sa-riskmanager.iam.gserviceaccount.com 格式为您创建一个服务代理。此服务代理需要在组织级层具有 riskmanager.serviceAgent 角色。此角色可让网络保险中心服务代理从其他 Google Cloud 服务中检索所需的数据，以生成网络保险中心报告。 如需查看此角色包含的完整权限列表，请参阅 Risk Manager Service Agent 角色。

<0x

如需获得授予 Risk Manager Service Agent 角色的权限，请让您的管理员为您授予组织的 Organization Administrator (roles/resourcemanager.organizationAdmin) IAM 角色。 如需详细了解如何授予角色，请参阅管理对项目、文件夹和组织的访问权限。

此预定义角色包含授予 Risk Manager 服务代理角色所需的权限。如需查看所需的确切权限，请展开所需权限部分：

所需权限

如需授予“风险管理器服务代理”角色，您需要具备以下权限：

  • resourcemanager.organizations.getIamPolicy
  • resourcemanager.organizations.setIamPolicy

您也可以使用自定义角色或其他预定义角色来获取这些权限。

您可以在最初配置网络保险中心时向服务代理授予 Risk Manager Service Agent 角色。您还可以通过运行以下 CLI 命令向服务代理授予 Risk Manager 服务代理角色：

    gcloud organizations add-iam-policy-binding ORGANIZATION_ID \
      --member="serviceAccount:organizations-ORGANIZATION_ID@gcp-sa-riskmanager.iam.gserviceaccount.com" \
      --role="roles/riskmanager.serviceAgent"

将 ORGANIZATION_ID 替换为您的组织的数字 ID。

网络保险中心角色

网络保险中心提供预定义角色，可向特定的网络保险中心资源授予多项权限。

下表列出了网络保险中心的预定义角色、说明以及它们包含的权限。在组织级层授予这些角色。

Role Permissions

(roles/riskmanager.admin)

Grants all Risk Manager permissions

resourcemanager.projects.get

resourcemanager.projects.list

riskmanager.*

  • riskmanager.controlScoreBreakdowns.get
  • riskmanager.controlScoreBreakdowns.list
  • riskmanager.operations.delete
  • riskmanager.operations.get
  • riskmanager.operations.list
  • riskmanager.policies.get
  • riskmanager.policies.list
  • riskmanager.reports.create
  • riskmanager.reports.delete
  • riskmanager.reports.get
  • riskmanager.reports.list
  • riskmanager.reports.review
  • riskmanager.reports.share
  • riskmanager.serviceAccount.create
  • riskmanager.settings.get
  • riskmanager.settings.update

(roles/riskmanager.editor)

Access to edit Risk Manager resources

resourcemanager.projects.get

resourcemanager.projects.list

riskmanager.controlScoreBreakdowns.*

  • riskmanager.controlScoreBreakdowns.get
  • riskmanager.controlScoreBreakdowns.list

riskmanager.operations.*

  • riskmanager.operations.delete
  • riskmanager.operations.get
  • riskmanager.operations.list

riskmanager.policies.*

  • riskmanager.policies.get
  • riskmanager.policies.list

riskmanager.reports.create

riskmanager.reports.delete

riskmanager.reports.get

riskmanager.reports.list

riskmanager.serviceAccount.create

riskmanager.settings.*

  • riskmanager.settings.get
  • riskmanager.settings.update

(roles/riskmanager.viewer)

Access to view Risk Manager resources

resourcemanager.projects.get

resourcemanager.projects.list

riskmanager.controlScoreBreakdowns.*

  • riskmanager.controlScoreBreakdowns.get
  • riskmanager.controlScoreBreakdowns.list

riskmanager.operations.get

riskmanager.operations.list

riskmanager.policies.*

  • riskmanager.policies.get
  • riskmanager.policies.list

riskmanager.reports.get

riskmanager.reports.list

riskmanager.settings.get

(roles/riskmanager.reviewer)

Access to review Risk Manager reports

resourcemanager.projects.get

resourcemanager.projects.list

riskmanager.controlScoreBreakdowns.*

  • riskmanager.controlScoreBreakdowns.get
  • riskmanager.controlScoreBreakdowns.list

riskmanager.operations.get

riskmanager.operations.list

riskmanager.reports.get

riskmanager.reports.list

riskmanager.reports.review

Service agent roles

Service agent roles should only be granted to service agents.

Role Permissions

(roles/riskmanager.serviceAgent)

Service agent that grants Risk Manager service access to fetch findings for generating Reports

cloudasset.assets.*

  • cloudasset.assets.analyzeIamPolicy
  • cloudasset.assets.analyzeMove
  • cloudasset.assets.analyzeOrgPolicy
  • cloudasset.assets.exportAccessLevel
  • cloudasset.assets.exportAccessPolicy
  • cloudasset.assets.exportAiplatformBatchPredictionJobs
  • cloudasset.assets.exportAiplatformCustomJobs
  • cloudasset.assets.exportAiplatformDataLabelingJobs
  • cloudasset.assets.exportAiplatformDatasets
  • cloudasset.assets.exportAiplatformEndpoints
  • cloudasset.assets.exportAiplatformHyperparameterTuningJobs
  • cloudasset.assets.exportAiplatformMetadataStores
  • cloudasset.assets.exportAiplatformModelDeploymentMonitoringJobs
  • cloudasset.assets.exportAiplatformModels
  • cloudasset.assets.exportAiplatformPipelineJobs
  • cloudasset.assets.exportAiplatformSpecialistPools
  • cloudasset.assets.exportAiplatformTrainingPipelines
  • cloudasset.assets.exportAllAccessPolicy
  • cloudasset.assets.exportAnthosConnectedCluster
  • cloudasset.assets.exportAnthosedgeCluster
  • cloudasset.assets.exportApigatewayApi
  • cloudasset.assets.exportApigatewayApiConfig
  • cloudasset.assets.exportApigatewayGateway
  • cloudasset.assets.exportApikeysKeys
  • cloudasset.assets.exportAppengineApplications
  • cloudasset.assets.exportAppengineServices
  • cloudasset.assets.exportAppengineVersions
  • cloudasset.assets.exportArtifactregistryDockerImages
  • cloudasset.assets.exportArtifactregistryRepositories
  • cloudasset.assets.exportAssuredWorkloadsWorkloads
  • cloudasset.assets.exportBeyondCorpApiGateways
  • cloudasset.assets.exportBeyondCorpAppConnections
  • cloudasset.assets.exportBeyondCorpAppConnectors
  • cloudasset.assets.exportBeyondCorpAppGateways
  • cloudasset.assets.exportBeyondCorpClientConnectorServices
  • cloudasset.assets.exportBeyondCorpClientGateways
  • cloudasset.assets.exportBigqueryDatasets
  • cloudasset.assets.exportBigqueryModels
  • cloudasset.assets.exportBigqueryTables
  • cloudasset.assets.exportBigtableAppProfile
  • cloudasset.assets.exportBigtableBackup
  • cloudasset.assets.exportBigtableCluster
  • cloudasset.assets.exportBigtableInstance
  • cloudasset.assets.exportBigtableTable
  • cloudasset.assets.exportCloudAssetFeeds
  • cloudasset.assets.exportCloudDeployDeliveryPipelines
  • cloudasset.assets.exportCloudDeployReleases
  • cloudasset.assets.exportCloudDeployRollouts
  • cloudasset.assets.exportCloudDeployTargets
  • cloudasset.assets.exportCloudDocumentAIEvaluation
  • cloudasset.assets.exportCloudDocumentAIHumanReviewConfig
  • cloudasset.assets.exportCloudDocumentAILabelerPool
  • cloudasset.assets.exportCloudDocumentAIProcessor
  • cloudasset.assets.exportCloudDocumentAIProcessorVersion
  • cloudasset.assets.exportCloudbillingBillingAccounts
  • cloudasset.assets.exportCloudbillingProjectBillingInfos
  • cloudasset.assets.exportCloudfunctionsFunctions
  • cloudasset.assets.exportCloudfunctionsGen2Functions
  • cloudasset.assets.exportCloudkmsCryptoKeyVersions
  • cloudasset.assets.exportCloudkmsCryptoKeys
  • cloudasset.assets.exportCloudkmsEkmConnections
  • cloudasset.assets.exportCloudkmsImportJobs
  • cloudasset.assets.exportCloudkmsKeyRings
  • cloudasset.assets.exportCloudmemcacheInstances
  • cloudasset.assets.exportCloudresourcemanagerFolders
  • cloudasset.assets.exportCloudresourcemanagerOrganizations
  • cloudasset.assets.exportCloudresourcemanagerProjects
  • cloudasset.assets.exportCloudresourcemanagerTagBindings
  • cloudasset.assets.exportCloudresourcemanagerTagKeys
  • cloudasset.assets.exportCloudresourcemanagerTagValues
  • cloudasset.assets.exportComposerEnvironments
  • cloudasset.assets.exportComputeAddress
  • cloudasset.assets.exportComputeAutoscalers
  • cloudasset.assets.exportComputeBackendBuckets
  • cloudasset.assets.exportComputeBackendServices
  • cloudasset.assets.exportComputeCommitments
  • cloudasset.assets.exportComputeDisks
  • cloudasset.assets.exportComputeExternalVpnGateways
  • cloudasset.assets.exportComputeFirewallPolicies
  • cloudasset.assets.exportComputeFirewalls
  • cloudasset.assets.exportComputeForwardingRules
  • cloudasset.assets.exportComputeGlobalAddress
  • cloudasset.assets.exportComputeGlobalForwardingRules
  • cloudasset.assets.exportComputeHealthChecks
  • cloudasset.assets.exportComputeHttpHealthChecks
  • cloudasset.assets.exportComputeHttpsHealthChecks
  • cloudasset.assets.exportComputeImages
  • cloudasset.assets.exportComputeInstanceGroupManagers
  • cloudasset.assets.exportComputeInstanceGroups
  • cloudasset.assets.exportComputeInstanceTemplates
  • cloudasset.assets.exportComputeInstances
  • cloudasset.assets.exportComputeInterconnect
  • cloudasset.assets.exportComputeInterconnectAttachment
  • cloudasset.assets.exportComputeLicenses
  • cloudasset.assets.exportComputeNetworkEndpointGroups
  • cloudasset.assets.exportComputeNetworks
  • cloudasset.assets.exportComputeNodeGroups
  • cloudasset.assets.exportComputeNodeTemplates
  • cloudasset.assets.exportComputePacketMirrorings
  • cloudasset.assets.exportComputeProjects
  • cloudasset.assets.exportComputeRegionAutoscaler
  • cloudasset.