使用 IAM 控管存取權

本頁說明可用於設定 Secret Manager 的 Identity and Access Management (IAM) 角色。角色會限制主體存取資源的能力。一律只授予執行特定工作所需的最低權限。

Secret 管理員角色

以下是與 Secret Manager 相關聯的 IAM 角色。如要瞭解如何使用 IAM 角色授予、變更或撤銷資源存取權，請參閱「授予、變更及撤銷資源存取權」。

Role Permissions

(roles/secretmanager.admin)

Full access to administer Secret Manager resources.

Lowest-level resources where you can grant this role:

  • Secret

cloudkms.keyHandles.*

  • cloudkms.keyHandles.create
  • cloudkms.keyHandles.get
  • cloudkms.keyHandles.list

cloudkms.operations.get

cloudkms.projects.showEffectiveAutokeyConfig

resourcemanager.projects.get

resourcemanager.projects.list

secretmanager.*

  • secretmanager.locations.get
  • secretmanager.locations.list
  • secretmanager.secrets.create
  • secretmanager.secrets.createTagBinding
  • secretmanager.secrets.delete
  • secretmanager.secrets.deleteTagBinding
  • secretmanager.secrets.enableManagedRotation
  • secretmanager.secrets.get
  • secretmanager.secrets.getIamPolicy
  • secretmanager.secrets.list
  • secretmanager.secrets.listEffectiveTags
  • secretmanager.secrets.listTagBindings
  • secretmanager.secrets.rotate
  • secretmanager.secrets.setIamPolicy
  • secretmanager.secrets.update
  • secretmanager.versions.access
  • secretmanager.versions.add
  • secretmanager.versions.destroy
  • secretmanager.versions.disable
  • secretmanager.versions.enable
  • secretmanager.versions.get
  • secretmanager.versions.list

(roles/secretmanager.editor)

Editor role for secretmanager

resourcemanager.projects.get

resourcemanager.projects.list

secretmanager.locations.*

  • secretmanager.locations.get
  • secretmanager.locations.list

secretmanager.secrets.create

secretmanager.secrets.delete

secretmanager.secrets.enableManagedRotation

secretmanager.secrets.get

secretmanager.secrets.getIamPolicy

secretmanager.secrets.list

secretmanager.secrets.listEffectiveTags

secretmanager.secrets.listTagBindings

secretmanager.secrets.rotate

secretmanager.secrets.update

secretmanager.versions.add

secretmanager.versions.destroy

secretmanager.versions.disable

secretmanager.versions.enable

secretmanager.versions.get

secretmanager.versions.list

(roles/secretmanager.secretAccessor)

Allows accessing the payload of secrets.

Lowest-level resources where you can grant this role:

  • Secret

resourcemanager.projects.get

resourcemanager.projects.list

secretmanager.versions.access

(roles/secretmanager.viewer)

Allows viewing metadata of all Secret Manager resources

Lowest-level resources where you can grant this role:

  • Secret

resourcemanager.projects.get

resourcemanager.projects.list

secretmanager.locations.*

  • secretmanager.locations.get
  • secretmanager.locations.list

secretmanager.secrets.get

secretmanager.secrets.getIamPolicy

secretmanager.secrets.list

secretmanager.secrets.listEffectiveTags

secretmanager.secrets.listTagBindings

secretmanager.versions.get

secretmanager.versions.list

(roles/secretmanager.secretVersionAdder)

Allows adding versions to existing secrets.

Lowest-level resources where you can grant this role:

  • Secret

resourcemanager.projects.get

resourcemanager.projects.list

secretmanager.secrets.rotate

secretmanager.versions.add

(roles/secretmanager.secretVersionManager)

Allows creating and managing versions of existing secrets.

Lowest-level resources where you can grant this role:

  • Secret

resourcemanager.projects.get

resourcemanager.projects.list

secretmanager.secrets.rotate

secretmanager.versions.add

secretmanager.versions.destroy

secretmanager.versions.disable

secretmanager.versions.enable

secretmanager.versions.get

secretmanager.versions.list

最低權限原則

遵循最低權限原則時，您會授予執行特定工作所需的最低資源存取權。舉例來說，如果主體只需要存取單一密鑰，請勿授予該主體存取專案或機構中其他密鑰或所有密鑰的權限。如果主體只需要讀取密鑰，請勿授予該主體修改密鑰的權限。

您可以使用 IAM，在 Google Cloud 密鑰、專案、資料夾或機構層級授予 IAM 角色和權限。一律在資源階層的最低層級套用權限。

下表顯示服務帳戶的有效功能，具體取決於授予 Secret Manager Secret Accessor 角色 (roles/secretmanager.secretAccessor) 的資源階層層級。

資源階層 功能
密鑰 僅存取該密鑰
專案 存取專案中的所有密鑰
資料夾 存取資料夾中所有專案的所有密鑰
機構 存取機構中所有專案的所有密鑰

角色