IAM のロールと権限

このページでは、Developer Connect のロールと権限について説明します。

Developer Connect でのアクセス制御は、 Identity and Access Management（IAM）を使用して制御します。IAM を使用すると、 リソースの権限を作成および 管理できます。 Google Cloud Developer Connect では、 事前定義された IAM ロールのセットが用意されています。 各ロールには、特定のタイプの アクセスまたはアクションに適した一連の権限が含まれています。最小権限の セキュリティ原則を導入し、 リソースに対する必要なアクセス権のみを付与することをおすすめします。

事前定義された Developer Connect のロール

役割を使用して、アカウントに権限を割り当てます。次の表に、Developer Connect で使用可能な IAM ロールと、それに含まれる権限を示します。

IAM のドキュメントには、 すべての事前定義ロールの検索可能なリファレンス が含まれています。

Role	Permissions
Developer Connect Admin (roles/developerconnect.admin) Full access to Developer Connect resources.	developerconnect.connections.constructGitHubAppManifest developerconnect.connections.create developerconnect.connections.createTagBinding developerconnect.connections.delete developerconnect.connections.deleteTagBinding developerconnect.connections.fetchGitHubInstallations developerconnect.connections.fetchLinkableGitRepositories developerconnect.connections.generateGitHubStateToken developerconnect.connections.get developerconnect.connections.list developerconnect.connections.listEffectiveTags developerconnect.connections.listTagBindings developerconnect.connections.processGitHubAppCreationCallback developerconnect.connections.processGitHubOAuthCallback developerconnect.connections.update developerconnect.gitRepositoryLinks.addPullRequestComment developerconnect.gitRepositoryLinks.addPullRequestReviewComment developerconnect.gitRepositoryLinks.create developerconnect.gitRepositoryLinks.delete developerconnect.gitRepositoryLinks.diffCommit developerconnect.gitRepositoryLinks.fetchCommit developerconnect.gitRepositoryLinks.fetchCommitList developerconnect.gitRepositoryLinks.fetchFileBlame developerconnect.gitRepositoryLinks.fetchGitRefs developerconnect.gitRepositoryLinks.fetchPullRequest developerconnect.gitRepositoryLinks.fetchPullRequestList developerconnect.gitRepositoryLinks.get developerconnect.gitRepositoryLinks.gitProxyRead developerconnect.gitRepositoryLinks.gitProxyWrite developerconnect.gitRepositoryLinks.list developerconnect.gitRepositoryLinks.modifyPullRequest developerconnect.gitRepositoryLinks.openPullRequest developerconnect.locations.* developerconnect.locations.get developerconnect.locations.list developerconnect.operations.* developerconnect.operations.cancel developerconnect.operations.delete developerconnect.operations.get developerconnect.operations.list resourcemanager.projects.get resourcemanager.projects.list
Developer Connect Viewer (roles/developerconnect.viewer) Read-only access to Developer Connect resources.	developerconnect.connections.get developerconnect.connections.list developerconnect.connections.listEffectiveTags developerconnect.connections.listTagBindings developerconnect.gitRepositoryLinks.get developerconnect.gitRepositoryLinks.list developerconnect.locations.* developerconnect.locations.get developerconnect.locations.list developerconnect.operations.get developerconnect.operations.list resourcemanager.projects.get resourcemanager.projects.list
Developer Connect HTTP Proxy Writer ^Beta (roles/developerconnect.connectionHttpProxyWriter) Grants read and write access to connections through the HTTP Proxy.	developerconnect.connections.httpProxyRead developerconnect.connections.httpProxyWrite
Developer Connect Git Proxy Reader (roles/developerconnect.gitProxyReader) Grants read-only access to repositories through the Git Proxy.	developerconnect.gitRepositoryLinks.gitProxyRead
Developer Connect Git Proxy User (roles/developerconnect.gitProxyUser) Grants read and write access to repositories through the Git Proxy.	developerconnect.gitRepositoryLinks.gitProxyRead developerconnect.gitRepositoryLinks.gitProxyWrite
Developer Connect Insights Admin (roles/developerconnect.insightsAdmin) Admin access to Developer Connect Insights resources.	developerconnect.deploymentEvents.* developerconnect.deploymentEvents.get developerconnect.deploymentEvents.list developerconnect.insightsConfigs.* developerconnect.insightsConfigs.create developerconnect.insightsConfigs.delete developerconnect.insightsConfigs.get developerconnect.insightsConfigs.list developerconnect.insightsConfigs.update developerconnect.locations.* developerconnect.locations.get developerconnect.locations.list developerconnect.operations.get developerconnect.operations.list resourcemanager.projects.get resourcemanager.projects.list
Developer Connect Insights Config Agent (roles/developerconnect.insightsAgent) Allow Developer Connect to access SDLC information.	cloudasset.assets.exportResource cloudasset.assets.listResource cloudasset.assets.searchAllResources cloudasset.feeds.create cloudasset.feeds.delete cloudasset.feeds.get cloudasset.feeds.update containeranalysis.occurrences.get containeranalysis.occurrences.list logging.logEntries.create
Developer Connect Insights Viewer (roles/developerconnect.insightsViewer) Read-only access to Developer Connect Insights resources.	developerconnect.deploymentEvents.* developerconnect.deploymentEvents.get developerconnect.deploymentEvents.list developerconnect.insightsConfigs.get developerconnect.insightsConfigs.list developerconnect.locations.* developerconnect.locations.get developerconnect.locations.list developerconnect.operations.get developerconnect.operations.list resourcemanager.projects.get resourcemanager.projects.list
Developer Connect OAuth Admin ^Beta (roles/developerconnect.oauthAdmin) Grants read and write access to AccountConnector resources.	developerconnect.accountConnectors.* developerconnect.accountConnectors.create developerconnect.accountConnectors.delete developerconnect.accountConnectors.fetchUserRepositories developerconnect.accountConnectors.get developerconnect.accountConnectors.gitProxyRead developerconnect.accountConnectors.gitProxyWrite developerconnect.accountConnectors.httpProxyRead developerconnect.accountConnectors.httpProxyWrite developerconnect.accountConnectors.list developerconnect.accountConnectors.update developerconnect.locations.* developerconnect.locations.get developerconnect.locations.list developerconnect.operations.get developerconnect.operations.list developerconnect.providers.list developerconnect.users.* developerconnect.users.delete developerconnect.users.deleteSelf developerconnect.users.fetchAccessToken developerconnect.users.finishOAuth developerconnect.users.getSelf developerconnect.users.list developerconnect.users.startOAuth resourcemanager.projects.get resourcemanager.projects.list
Developer Connect OAuth User ^Beta (roles/developerconnect.oauthUser) Grants read and write access to User resources, and read access to AccountConnectors.	developerconnect.accountConnectors.fetchUserRepositories developerconnect.accountConnectors.get developerconnect.accountConnectors.gitProxyRead developerconnect.accountConnectors.gitProxyWrite developerconnect.accountConnectors.httpProxyRead developerconnect.accountConnectors.httpProxyWrite developerconnect.accountConnectors.list developerconnect.locations.* developerconnect.locations.get developerconnect.locations.list developerconnect.operations.get developerconnect.operations.list developerconnect.users.deleteSelf developerconnect.users.fetchAccessToken developerconnect.users.finishOAuth developerconnect.users.getSelf developerconnect.users.startOAuth resourcemanager.projects.get resourcemanager.projects.list
Developer Connect Read Token Accessor ^Beta (roles/developerconnect.readTokenAccessor) Grants access to Read-Only tokens (both PAT and short-lived). Also grants access to view the git repository link.	developerconnect.connections.get developerconnect.gitRepositoryLinks.fetchReadToken developerconnect.gitRepositoryLinks.get
Developer Connect Token Accessor ^Beta (roles/developerconnect.tokenAccessor) Grants access to Read/Write and Read-Only tokens (both PAT and short-lived). Also grants access to view the git repository link.	developerconnect.connections.get developerconnect.gitRepositoryLinks.fetchReadToken developerconnect.gitRepositoryLinks.fetchReadWriteToken developerconnect.gitRepositoryLinks.get
Developer Connect User (roles/developerconnect.user) Grants access to view the connection and to the features that interact with the actual repository such as reading content from the repository	developerconnect.connections.fetchGitHubInstallations developerconnect.connections.fetchLinkableGitRepositories developerconnect.connections.get developerconnect.connections.list developerconnect.connections.listEffectiveTags developerconnect.connections.listTagBindings developerconnect.gitRepositoryLinks.addPullRequestComment developerconnect.gitRepositoryLinks.addPullRequestReviewComment developerconnect.gitRepositoryLinks.diffCommit developerconnect.gitRepositoryLinks.fetchCommit developerconnect.gitRepositoryLinks.fetchCommitList developerconnect.gitRepositoryLinks.fetchFileBlame developerconnect.gitRepositoryLinks.fetchGitRefs developerconnect.gitRepositoryLinks.fetchPullRequest developerconnect.gitRepositoryLinks.fetchPullRequestList developerconnect.gitRepositoryLinks.get developerconnect.gitRepositoryLinks.list developerconnect.gitRepositoryLinks.modifyPullRequest developerconnect.gitRepositoryLinks.openPullRequest developerconnect.locations.* developerconnect.locations.get developerconnect.locations.list developerconnect.operations.get developerconnect.operations.list resourcemanager.projects.get resourcemanager.projects.list

Service agent roles

Service agent roles should only be granted to service agents.

Role	Permissions
Developer Connect Service Agent (roles/developerconnect.serviceAgent) Gives the Developer Connect API Service Account access to necessary GCP resources. Warning: Do not grant service agent roles to any principals except service agents.	apphub.applications.get apphub.services.get apphub.services.list apphub.workloads.get apphub.workloads.list developerconnect.connections.get developerconnect.connections.httpProxyRead developerconnect.connections.httpProxyWrite developerconnect.gitRepositoryLinks.get developerconnect.operations.get

Developer Connect サービス アカウント

Developer Connect は、他のサービスと通信するときに、ユーザーに代わってタスクを実行するサービス エージェントを使用します。 このサービス エージェントは、Developer Connect（リポジトリ接続またはアカウント コネクタの作成）を初めて操作するときに自動的に作成されます。

Developer Connect サービス エージェントの ID は次のとおりです。PROJECT_NUMBER は Google Cloud プロジェクト番号です。

service-PROJECT_NUMBER@gcp-sa-devconnect.

この ID を使用して、IAM ロールと権限を付与または変更します。

リソースへのアクセスの構成

ロールを付与する具体的な手順については、 リソースへのアクセス権の付与、変更、取り消しをご覧ください。

次のステップ

• IAM について学習する。
• GitHub リポジトリに接続する。