设置 Policy API

本页面介绍了如何在列出和获取政策之前设置 Cloud Identity Policy API。

安装 Python 客户端库

如需安装 Python 客户端库，请运行以下命令：

  pip install --upgrade google-api-python-client google-auth \
    google-auth-oauthlib google-auth-httplib2 absl-py

如需详细了解如何设置 Python 开发环境，请参阅 Python 开发环境设置指南。

启用 API 并设置服务帐号凭据

1. In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

   Roles required to select or create a project

   • Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
   • Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.
   Note: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.

   Go to project selector

2. Verify that billing is enabled for your Google Cloud project.

3. Enable the Cloud Identity API.

   Roles required to enable APIs

   To enable APIs, you need the serviceusage.services.enable permission. If you created the project, then you likely already have this permission through the Owner role (roles/owner). Otherwise, you can get this permission through the Service Usage Admin role (roles/serviceusage.serviceUsageAdmin). Learn how to grant roles.

   Enable the API

4. Create a service account:

   1. Ensure that you have the Create Service Accounts IAM role (roles/iam.serviceAccountCreator) and the Project IAM Admin role (roles/resourcemanager.projectIamAdmin). Learn how to grant roles.

   2. In the Google Cloud console, go to the Create service account page.

      Go to Create service account
   3. Select your project.

   4. In the Service account name field, enter a name. The Google Cloud console fills in the Service account ID field based on this name.

      In the Service account description field, enter a description. For example, Service account for quickstart.

   5. Click Create and continue.

   6. Grant the Service Account Token Creator role to the service account.

      To grant the role, find the Select a role list, then select Service Account Token Creator.

      Note: The Role field affects which resources the service account can access in your project. You can revoke these roles or grant additional roles later.
   7. Click Continue.

   8. In the Service account users role field, enter the identifier for the principal that will attach the service account to other resources, such as Compute Engine instances.

      This is typically the identifier for a user in a workforce identity pool. For details, see Represent workforce pool users in IAM policies.

   9. Click Done to finish creating the service account.

以服务帐号身份进行身份验证并进行全网域授权

如果您是管理身份政策的管理员，或者您希望向 账号提供全网域权限，以便其可以代表管理员管理 Google 政策，则应以 服务账号身份进行身份验证，然后向该服务账号授予全网域 权限。

**注意**： 由于全网域授权允许服务帐号模拟 管理员用户，因此服务帐号操作会被记录为由 该用户执行。

如需详细了解如何设置全网域授权，请参阅 使用全网域授权功能控制 API 访问权限。 查看最佳实践，以 降低与使用全网域授权相关的安全风险。

设置全网域授权后，即可使用 应用默认凭据 (ADC) 进行身份验证。使用 ADC 时，您的代码可以在开发或生产环境中运行，而无需更改应用向 Google Cloud 服务和 API 进行身份验证的方式。 在代码中初始化凭据时，通过对凭据使用 subject() 参数来指定服务帐号要操作的电子邮件地址。确保该电子邮件地址被授予了服务帐号的 Service Account User 角色（如上所述）。 例如：

重要提示 ：用于创建委托凭据的应用代码中指定的 OAuth 范围必须存在于 Google 管理控制台中全网域授权的已获授权范围列表中。范围更广 或更宽松的范围将不起作用。如果应用请求创建委托凭据的范围未在 全网域授权中获得授权，则应用会收到 unauthorized_client 错误。

Python

AUTH_SCOPES = ['https://www.googleapis.com/auth/iam']
# The read and write scope of the API. Note that you must authorize the
# exact same scope for domain-wide delegation in the Google Admin Console.
POLICY_SCOPES = ['https://www.googleapis.com/auth/cloud-identity.policies']
TOKEN_URI = "https://accounts.google.com/o/oauth2/token"

_ADMIN_EMAIL = flags.DEFINE_string(
    name='admin_email',
    default=None,
    help='Administrator email to call as',
    required=True,
)

# Fetch application default credentials (ADC)
credentials, _ = google.auth.default(scopes=AUTH_SCOPES)

# Populate account information
request = requests.Request()
credentials.refresh(request)

# Create an IAM signer
signer = iam.Signer(request, credentials,
                    credentials.service_account_email)

# Create domain-wide delegated (DWD) credentials
delegated_credentials = service_account.Credentials(
    signer=signer,
    service_account_email=credentials.service_account_email,
    token_uri=TOKEN_URI,
    scopes=POLICY_SCOPES,
    subject=_ADMIN_EMAIL.value
)

如需在使用应用默认凭据时模拟服务帐号，请使用 impersonate-service-account 标志。

Shell

gcloud auth application-default login --impersonate-service-account=<service_account_email>
--scopes=https://www.googleapis.com/auth/iam,https://www.googleapis.com/auth/cloud-identity.policies

列出和获取政策中提供了调用 Policy API 的详细示例代码，包括 身份验证代码。