Nesta página, descrevemos as opções de controle de acesso disponíveis no Eventarc.
Informações gerais O Eventarc usa o gerenciamento de identidade e acesso (IAM, na sigla em inglês) para controle de acesso.
Para uma introdução sobre o IAM e os recursos dele, consulte a visão geral do IAM . Para saber como conceder e revogar o acesso, consulte Gerenciar o acesso a projetos, pastas e organizações .
Para ver listas de permissões e papéis compatíveis com o Eventarc, consulte as seções a seguir.
Agente de serviço do Eventarc Alguns serviços Google Cloud têm agentes de serviço que permitem que o serviço acesse seus recursos se tiver as permissões adequadas. Se uma API exigir um agente de serviço, o Google Cloud criará esse agente em algum momento depois que você ativar e começar a usar a API.
O Eventarc usa um modelo de provisionamento que cria o agente de serviço somente quando necessário, por exemplo, quando você cria um recurso do Eventarc pela primeira vez, e não quando a API é ativada inicialmente. O provisionamento do agente de serviço e a propagação das mudanças no sistema podem levar vários minutos. Para mais informações sobre esse atraso, consulte Permissão negada ao usar o agente de serviço do Eventarc .
Ativar as APIs Eventarc Para visualizar e atribuir papéis do IAM para o Eventarc, é preciso ativar as APIs Eventarc no projeto. Não será possível ver os papéis do Eventarc no console Google Cloud até que você ative as APIs.
Ative a API Eventarc e a API Eventarc Publishing :
Console
Roles required to enable APIs
To enable APIs, you need the Service Usage Admin IAM role (roles/serviceusage.serviceUsageAdmin), which contains the serviceusage.services.enable permission. Learn how to grant roles .
Enable the APIs
gcloud Roles required to enable APIs
To enable APIs, you need the Service Usage Admin IAM role (roles/serviceusage.serviceUsageAdmin), which contains the serviceusage.services.enable permission. Learn how to grant roles .
gcloud services enable eventarc.googleapis.com eventarcpublishing.googleapis.com Papéis predefinidos A tabela abaixo mostra os papéis de IAM do Eventarc com uma lista correspondente de todas as permissões que cada papel inclui.
Os papéis predefinidos abordam os casos de uso mais comuns. Se seu caso de uso não estiver coberto pelos papéis predefinidos, crie um papel personalizado do IAM .
Papéis do Eventarc
Role Permissions Eventarc Admin (roles/eventarc.admin )
Full control over all Eventarc resources.
Lowest-level resources where you can grant this role:
eventarc.*
eventarc.channelConnections.create eventarc.channelConnections.delete eventarc.channelConnections.get eventarc.channelConnections.getIamPolicy eventarc.channelConnections.list eventarc.channelConnections.publish eventarc.channelConnections.setIamPolicy eventarc.channels.attacheventarc.channels.createeventarc.channels.deleteeventarc.channels.geteventarc.channels.getIamPolicyeventarc.channels.listeventarc.channels.publisheventarc.channels.setIamPolicyeventarc.channels.undeleteeventarc.channels.updateeventarc.enrollments.createeventarc.enrollments.deleteeventarc.enrollments.geteventarc.enrollments.getIamPolicy eventarc.enrollments.listeventarc.enrollments.setIamPolicy eventarc.enrollments.updateeventarc.events.receiveAuditLogWritten eventarc.events.receiveEventeventarc.googleApiSources.create eventarc.googleApiSources.delete eventarc.googleApiSources.geteventarc.googleApiSources.getIamPolicy eventarc.googleApiSources.listeventarc.googleApiSources.setIamPolicy eventarc.googleApiSources.update eventarc.googleChannelConfigs.get eventarc.googleChannelConfigs.update eventarc.kafkaSources.createeventarc.kafkaSources.deleteeventarc.kafkaSources.geteventarc.kafkaSources.getIamPolicy eventarc.kafkaSources.listeventarc.kafkaSources.setIamPolicy eventarc.locations.geteventarc.locations.listeventarc.messageBuses.createeventarc.messageBuses.deleteeventarc.messageBuses.geteventarc.messageBuses.getIamPolicy eventarc.messageBuses.listeventarc.messageBuses.publisheventarc.messageBuses.setIamPolicy eventarc.messageBuses.updateeventarc.messageBuses.useeventarc.multiProjectSources.collectGoogleApiEvents eventarc.operations.canceleventarc.operations.deleteeventarc.operations.geteventarc.operations.listeventarc.pipelines.createeventarc.pipelines.deleteeventarc.pipelines.geteventarc.pipelines.getIamPolicy eventarc.pipelines.listeventarc.pipelines.setIamPolicy eventarc.pipelines.updateeventarc.providers.geteventarc.providers.listeventarc.triggers.createeventarc.triggers.deleteeventarc.triggers.geteventarc.triggers.getIamPolicyeventarc.triggers.listeventarc.triggers.setIamPolicyeventarc.triggers.undeleteeventarc.triggers.update resourcemanager.projects.get
resourcemanager.projects.list
Eventarc Connection Publisher Beta (roles/eventarc.connectionPublisher )
Can publish events to Eventarc channel connections.
Lowest-level resources where you can grant this role:
eventarc.channelConnections.get
eventarc.channelConnections.list
eventarc.channelConnections.publish
resourcemanager.projects.get
resourcemanager.projects.list
Eventarc Developer (roles/eventarc.developer )
Access to read and write Eventarc resources.
Lowest-level resources where you can grant this role:
eventarc.channelConnections.create
eventarc.channelConnections.delete
eventarc.channelConnections.get
eventarc.channelConnections.getIamPolicy
eventarc.channelConnections.list
eventarc.channelConnections.publish
eventarc.channels.attach
eventarc.channels.create
eventarc.channels.delete
eventarc.channels.get
eventarc.channels.getIamPolicy
eventarc.channels.list
eventarc.channels.publish
eventarc.channels.undelete
eventarc.channels.update
eventarc.enrollments.create
eventarc.enrollments.delete
eventarc.enrollments.get
eventarc.enrollments.getIamPolicy
eventarc.enrollments.list
eventarc.enrollments.update
eventarc.googleApiSources.create
eventarc.googleApiSources.delete
eventarc.googleApiSources.get
eventarc.googleApiSources.getIamPolicy
eventarc.googleApiSources.list
eventarc.googleApiSources.update
eventarc.googleChannelConfigs.*
eventarc.googleChannelConfigs.get eventarc.googleChannelConfigs.update eventarc.kafkaSources.create
eventarc.kafkaSources.delete
eventarc.kafkaSources.get
eventarc.kafkaSources.getIamPolicy
eventarc.kafkaSources.list
eventarc.locations.*
eventarc.locations.geteventarc.locations.list eventarc.operations.*
eventarc.operations.canceleventarc.operations.deleteeventarc.operations.geteventarc.operations.list eventarc.pipelines.create
eventarc.pipelines.delete
eventarc.pipelines.get
eventarc.pipelines.getIamPolicy
eventarc.pipelines.list
eventarc.pipelines.update
eventarc.providers.*
eventarc.providers.geteventarc.providers.list eventarc.triggers.create
eventarc.triggers.delete
eventarc.triggers.get
eventarc.triggers.getIamPolicy
eventarc.triggers.list
eventarc.triggers.undelete
eventarc.triggers.update
resourcemanager.projects.get
resourcemanager.projects.list
Eventarc Event Receiver (roles/eventarc.eventReceiver )
Can receive events from all event providers.
Lowest-level resources where you can grant this role:
eventarc.events.*
eventarc.events.receiveAuditLogWritten eventarc.events.receiveEvent Eventarc Message Bus Admin (roles/eventarc.messageBusAdmin )
Full control over Message Buses resources.
eventarc.messageBuses.create
eventarc.messageBuses.delete
eventarc.messageBuses.get
eventarc.messageBuses.getIamPolicy
eventarc.messageBuses.list
eventarc.messageBuses.publish
eventarc.messageBuses.update
eventarc.messageBuses.use
Eventarc Message Bus User (roles/eventarc.messageBusUser )
Access to publish to or bind to a Message Bus.
eventarc.messageBuses.get
eventarc.messageBuses.list
eventarc.messageBuses.publish
eventarc.messageBuses.use
Eventarc Event Collector Beta (roles/eventarc.multiProjectEventCollector )
Can collect events from multiple projects in an org for a source resource.
eventarc.multiProjectSources.collectGoogleApiEvents
Eventarc Publisher Beta (roles/eventarc.publisher )
Can publish events to Eventarc channels.
Lowest-level resources where you can grant this role:
eventarc.channels.get
eventarc.channels.list
eventarc.channels.publish
resourcemanager.projects.get
resourcemanager.projects.list
Eventarc Service Agent (roles/eventarc.serviceAgent )
Gives Eventarc service account access to managed resources.
Warning: Do not grant service agent roles to any principals except service agents . cloudfunctions.functions.get
compute.instanceGroupManagers.get
compute.networkAttachments.get
compute.networkAttachments.update
compute.networkAttachments.use
compute.regionOperations.get
container.clusters.connect
container.clusters.get
container.deployments.create
container.deployments.delete
container.deployments.get
container.deployments.list
container.deployments.update
container.namespaces.create
container.namespaces.delete
container.namespaces.get
container.namespaces.list
container.serviceAccounts.create
container.serviceAccounts.delete
container.serviceAccounts.get
container.serviceAccounts.list
container.services.get
container.services.list
dns.networks.targetWithPeeringZone
eventarc.channels.publish
eventarc.messageBuses.publish
eventarc.operations.get
iam.serviceAccounts.actAs
iam.serviceAccounts.getAccessToken
iam.serviceAccounts.getOpenIdToken
monitoring.timeSeries.create
pubsub.subscriptions.consume
pubsub.subscriptions.create
pubsub.subscriptions.delete
pubsub.subscriptions.get
pubsub.subscriptions.list
pubsub.subscriptions.update
pubsub.topics.attachSubscription
pubsub.topics.create
pubsub.topics.delete
pubsub.topics.get
pubsub.topics.list
pubsub.topics.publish
pubsub.topics.update
run.jobs.get
run.services.get
serviceusage.services.use
storage.buckets.get
storage.buckets.update
workflows.workflows.get
Eventarc Viewer (roles/eventarc.viewer )
Can view the state of all Eventarc resources, including IAM policies.
Lowest-level resources where you can grant this role:
eventarc.channelConnections.get
eventarc.channelConnections.getIamPolicy
eventarc.channelConnections.list
eventarc.channels.get
eventarc.channels.getIamPolicy
eventarc.channels.list
eventarc.enrollments.get
eventarc.enrollments.getIamPolicy
eventarc.enrollments.list
eventarc.googleApiSources.get
eventarc.googleApiSources.getIamPolicy
eventarc.googleApiSources.list
eventarc.googleChannelConfigs.get
eventarc.kafkaSources.get
eventarc.kafkaSources.getIamPolicy
eventarc.kafkaSources.list
eventarc.locations.*
eventarc.locations.geteventarc.locations.list eventarc.messageBuses.get
eventarc.messageBuses.getIamPolicy
eventarc.messageBuses.list
eventarc.messageBuses.use
eventarc.multiProjectSources.collectGoogleApiEvents
eventarc.operations.get
eventarc.operations.list
eventarc.pipelines.get
eventarc.pipelines.getIamPolicy
eventarc.pipelines.list
eventarc.providers.*
eventarc.providers.geteventarc.providers.list eventarc.triggers.get
eventarc.triggers.getIamPolicy
eventarc.triggers.list
resourcemanager.projects.get
resourcemanager.projects.list
Gerenciamento do IAM no nível do projeto No nível do projeto, é possível conceder, alterar e revogar papéis do IAM usando o console do Google Cloud , a API IAM ou a Google Cloud CLI. Para instruções, consulte Gerenciar o acesso a projetos, pastas e organizações .
