本页面介绍了在 Cloud Marketplace 上购买和管理商业产品所需的 Identity and Access Management (IAM) 角色和权限。
借助 IAM，您可以通过定义谁（身份）对哪些资源具有哪种访问权限（角色）来管理访问权限控制。
准备工作
如需使用 gcloud 授予 Cloud Marketplace 角色和权限，请安装 gcloud CLI 。否则，您可以使用 Google Cloud 控制台授予角色。
购买和管理角色
我们建议您向从 Cloud Marketplace 购买服务的用户分配 Billing Account Administrator IAM 角色。
想要访问这些服务的用户至少必须具有 Viewer 角色。
OAuth 2.0 和域名验证的管理员权限
如果您的 Marketplace 解决方案需要 OAuth 2.0 验证或网域级配置（例如 SaaS 集成），您必须拥有管理权限才能管理项目的身份和安全设置。
场景
所需权限或角色
操作
重新获得管理员权限 roles/resourcemanager.organizationAdmin在组织级层授予此角色，以管理 Project Owner。
验证已获授权的网域 roles/cloudsecurityscanner.editor使用此角色可管理网络安全和网域相关配置。
管理 OAuth 验证 roles/owner 或 roles/editor配置 OAuth 权限请求页面，并提交品牌信息以供审核。
如需解决常见的验证问题（例如“找不到网域”或首页网址无响应），请确保您的网域已在 Search Console 中经过验证，并且您的隐私权政策可公开访问。如需详细了解身份验证，请参阅验证您的身份 。
如需更精细地控制用户的权限，您可以创建自定义角色 ，并向其授予您要授予的权限。
产品专属要求
如需在 Google Cloud 项目中使用以下服务，您必须拥有 Project Editor 角色：
Google Cloud Dataprep by Trifacta
Neo4j Aura Professional
Redis Enterprise Cloud
IAM 角色和权限列表
您可以为用户授予以下一个或多个 IAM 角色。根据您要授予用户的角色，您还必须将该角色分配给 Google Cloud 结算账号、组织或项目。如需了解详情，请参阅向用户授予 IAM 角色 部分。
Role
Permissions
Consumer Procurement Entitlement Manager
(roles/consumerprocurement.entitlementManager )
Allows managing entitlements and enabling, disabling, and inspecting service states for a consumer
project.
commerceoffercatalog.offers.get
consumerprocurement.consents.check
consumerprocurement.consents.grant
consumerprocurement.consents.list
consumerprocurement.consents.revoke
consumerprocurement.entitlements.*
consumerprocurement.entitlements.get consumerprocurement.entitlements.list
consumerprocurement.freeTrials.*
consumerprocurement.freeTrials.create consumerprocurement.freeTrials.get consumerprocurement.freeTrials.list
orgpolicy.policy.get
resourcemanager.projects.get
resourcemanager.projects.list
serviceusage.catalogs.listMembers
serviceusage.consumerpolicy.*
serviceusage.consumerpolicy.analyze serviceusage.consumerpolicy.get serviceusage.consumerpolicy.update
serviceusage.effectivepolicy.get
serviceusage.groups.*
serviceusage.groups.listserviceusage.groups.listExpandedMembers serviceusage.groups.listMembers
serviceusage.operations.get
serviceusage.services.disable
serviceusage.services.enable
serviceusage.services.get
serviceusage.services.list
serviceusage.services.listApis
serviceusage.services.listDependentServices
serviceusage.values.test
Consumer Procurement Entitlement Viewer
(roles/consumerprocurement.entitlementViewer )
Allows inspecting entitlements and service states for a consumer project.
commerceoffercatalog.offers.get
consumerprocurement.consents.check
consumerprocurement.consents.list
consumerprocurement.entitlements.*
consumerprocurement.entitlements.get consumerprocurement.entitlements.list
consumerprocurement.freeTrials.get
consumerprocurement.freeTrials.list
orgpolicy.policy.get
resourcemanager.projects.get
resourcemanager.projects.list
serviceusage.catalogs.listMembers
serviceusage.consumerpolicy.analyze
serviceusage.consumerpolicy.get
serviceusage.effectivepolicy.get
serviceusage.groups.*
serviceusage.groups.listserviceusage.groups.listExpandedMembers serviceusage.groups.listMembers
serviceusage.services.get
serviceusage.services.list
serviceusage.services.listApis
serviceusage.services.listDependentServices
serviceusage.values.test
Consumer Procurement Events Viewer
(roles/consumerprocurement.eventsViewer )
Allows viewing key events for an offer
consumerprocurement.events.*
consumerprocurement.events.getconsumerprocurement.events.list
Consumer Procurement License Pool Editor
(roles/consumerprocurement.licensePoolEditor )
Allows managing license pools and license assignments.
consumerprocurement.licensePools.*
consumerprocurement.licensePools.assign consumerprocurement.licensePools.enumerateLicensedUsers consumerprocurement.licensePools.get consumerprocurement.licensePools.unassign consumerprocurement.licensePools.update
Consumer Procurement License Pool Viewer
(roles/consumerprocurement.licensePoolViewer )
Allows viewing license pools and license assignments.
consumerprocurement.licensePools.enumerateLicensedUsers
consumerprocurement.licensePools.get
Consumer Procurement Order Administrator
(roles/consumerprocurement.orderAdmin )
Allows managing purchases.
billing.accounts.get
billing.accounts.getIamPolicy
billing.accounts.list
billing.accounts.redeemPromotion
billing.credits.list
billing.resourceAssociations.create
commerceoffercatalog.*
commerceoffercatalog.agreements.get commerceoffercatalog.agreements.list commerceoffercatalog.documents.get commerceoffercatalog.documents.list commerceoffercatalog.offers.get
consumerprocurement.accounts.*
consumerprocurement.accounts.create consumerprocurement.accounts.delete consumerprocurement.accounts.get consumerprocurement.accounts.list
consumerprocurement.consents.check
consumerprocurement.consents.grant
consumerprocurement.consents.list
consumerprocurement.consents.revoke
consumerprocurement.events.*
consumerprocurement.events.getconsumerprocurement.events.list
consumerprocurement.licensePools.*
consumerprocurement.licensePools.assign consumerprocurement.licensePools.enumerateLicensedUsers consumerprocurement.licensePools.get consumerprocurement.licensePools.unassign consumerprocurement.licensePools.update
consumerprocurement.orderAttributions.*
consumerprocurement.orderAttributions.get consumerprocurement.orderAttributions.list consumerprocurement.orderAttributions.update
consumerprocurement.orders.*
consumerprocurement.orders.cancel consumerprocurement.orders.getconsumerprocurement.orders.list consumerprocurement.orders.modify consumerprocurement.orders.place
discoveryengine.billingAccountLicenseConfigs.*
discoveryengine.billingAccountLicenseConfigs.distribute discoveryengine.billingAccountLicenseConfigs.get discoveryengine.billingAccountLicenseConfigs.list discoveryengine.billingAccountLicenseConfigs.retract
Consumer Procurement Order Viewer
(roles/consumerprocurement.orderViewer )
Allows inspecting purchases.
billing.accounts.get
billing.accounts.getIamPolicy
billing.accounts.list
billing.credits.list
commerceoffercatalog.*
commerceoffercatalog.agreements.get commerceoffercatalog.agreements.list commerceoffercatalog.documents.get commerceoffercatalog.documents.list commerceoffercatalog.offers.get
consumerprocurement.accounts.get
consumerprocurement.accounts.list
consumerprocurement.consents.check
consumerprocurement.consents.list
consumerprocurement.licensePools.enumerateLicensedUsers
consumerprocurement.licensePools.get
consumerprocurement.orderAttributions.get
consumerprocurement.orderAttributions.list
consumerprocurement.orders.get
consumerprocurement.orders.list
discoveryengine.billingAccountLicenseConfigs.get
discoveryengine.billingAccountLicenseConfigs.list
Consumer Procurement Administrator
(roles/consumerprocurement.procurementAdmin )
Allows managing purchases, consents at both billing account and project level.
billing.accounts.get
billing.accounts.getIamPolicy
billing.accounts.list
billing.accounts.redeemPromotion
billing.credits.list
billing.resourceAssociations.create
commerceoffercatalog.*
commerceoffercatalog.agreements.get commerceoffercatalog.agreements.list commerceoffercatalog.documents.get commerceoffercatalog.documents.list commerceoffercatalog.offers.get
consumerprocurement.*
consumerprocurement.accounts.create consumerprocurement.accounts.delete consumerprocurement.accounts.get consumerprocurement.accounts.list consumerprocurement.consents.allowProjectGrant consumerprocurement.consents.check consumerprocurement.consents.grant consumerprocurement.consents.list consumerprocurement.consents.revoke consumerprocurement.entitlements.get consumerprocurement.entitlements.list consumerprocurement.events.getconsumerprocurement.events.list consumerprocurement.freeTrials.create consumerprocurement.freeTrials.get consumerprocurement.freeTrials.list consumerprocurement.licensePools.assign consumerprocurement.licensePools.enumerateLicensedUsers consumerprocurement.licensePools.get consumerprocurement.licensePools.unassign consumerprocurement.licensePools.update consumerprocurement.orderAttributions.get consumerprocurement.orderAttributions.list consumerprocurement.orderAttributions.update consumerprocurement.orders.cancel consumerprocurement.orders.getconsumerprocurement.orders.list consumerprocurement.orders.modify consumerprocurement.orders.place
discoveryengine.billingAccountLicenseConfigs.*
discoveryengine.billingAccountLicenseConfigs.distribute discoveryengine.billingAccountLicenseConfigs.get discoveryengine.billingAccountLicenseConfigs.list discoveryengine.billingAccountLicenseConfigs.retract
orgpolicy.policy.get
resourcemanager.projects.get
resourcemanager.projects.list
serviceusage.catalogs.listMembers
serviceusage.consumerpolicy.*
serviceusage.consumerpolicy.analyze serviceusage.consumerpolicy.get serviceusage.consumerpolicy.update
serviceusage.effectivepolicy.get
serviceusage.groups.*
serviceusage.groups.listserviceusage.groups.listExpandedMembers serviceusage.groups.listMembers
serviceusage.operations.get
serviceusage.services.disable
serviceusage.services.enable
serviceusage.services.get
serviceusage.services.list
serviceusage.services.listApis
serviceusage.services.listDependentServices
serviceusage.values.test
Consumer Procurement Viewer
(roles/consumerprocurement.procurementViewer )
Allows inspecting purchases, consents and entitlements and service states for a consumer project.
billing.accounts.get
billing.accounts.getIamPolicy
billing.accounts.list
billing.credits.list
commerceoffercatalog.*
commerceoffercatalog.agreements.get commerceoffercatalog.agreements.list commerceoffercatalog.documents.get commerceoffercatalog.documents.list commerceoffercatalog.offers.get
consumerprocurement.accounts.get
consumerprocurement.accounts.list
consumerprocurement.consents.check
consumerprocurement.consents.list
consumerprocurement.entitlements.*
consumerprocurement.entitlements.get consumerprocurement.entitlements.list
consumerprocurement.freeTrials.get
consumerprocurement.freeTrials.list
consumerprocurement.licensePools.enumerateLicensedUsers
consumerprocurement.licensePools.get
consumerprocurement.orderAttributions.get
consumerprocurement.orderAttributions.list
consumerprocurement.orders.get
consumerprocurement.orders.list
discoveryengine.billingAccountLicenseConfigs.get
discoveryengine.billingAccountLicenseConfigs.list
orgpolicy.policy.get
resourcemanager.projects.get
resourcemanager.projects.list
serviceusage.catalogs.listMembers
serviceusage.consumerpolicy.analyze
serviceusage.consumerpolicy.get
serviceusage.effectivepolicy.get
serviceusage.groups.*
serviceusage.groups.listserviceusage.groups.listExpandedMembers serviceusage.groups.listMembers
serviceusage.services.get
serviceusage.services.list
serviceusage.services.listApis
serviceusage.services.listDependentServices
serviceusage.values.test
向用户授予 IAM 角色
在上述表格 中的角色中，consumerprocurement.orderAdmin 和 consumerprocurement.orderViewer 角色必须在结算账号或组织级层分配，而 consumerprocurement.entitlementManager 和 consumerprocurement.entitlementViewer 角色必须在项目或组织级层分配。
如需使用 gcloud 为用户授予角色，请运行以下命令之一：
组织 您必须具有 resourcemanager.organizationAdmin
gcloud organizations add-iam-policy-binding organization-id \
--member= member --role= role-id
占位值如下：
organization-id ：您要为其授予角色的组织的数字 ID。member ：要向其授予访问权限的用户。role-id ：上表中的角色 ID。 结算账号 您必须具有 billing.admin 角色
gcloud beta billing accounts set-iam-policy account-id \
policy-file
占位值如下：
account-id ：您的结算账号 ID，可从“管理结算账号”页面 获取。policy-file ：IAM 政策文件 ，采用 JSON 或 YAML 格式。政策文件必须包含上表中的角色 ID，以及要为其分配这些角色的用户。 项目 您必须具有 resourcemanager.folderAdmin
gcloud projects add-iam-policy-binding project-id \
--member= member --role= role-id
占位值如下：
project-id ：要为其授予角色的项目。member ：要向其授予访问权限的用户。role-id ：上表中的角色 ID。 如需使用 Google Cloud 控制台向用户授予角色，请参阅有关授予、更改和撤消用户访问权限 的 IAM 文档。
将自定义角色与 Cloud Marketplace 搭配使用
如果您想精细控制您授予用户的权限，您可以使用授予的权限创建自定义角色 。
如果您要为从 Cloud Marketplace 购买服务的用户创建自定义角色，则该角色必须包含用户用于购买服务的结算账号的以下权限：
通过单点登录 (SSO) 访问合作伙伴网站
某些 Cloud Marketplace API 产品支持单点登录 (SSO) 到合作伙伴的外部网站。组织内的授权用户可以访问商品详情页面上的“在提供商处管理”按钮。点击此按钮后，系统会将用户转到合作伙伴的网站。在某些情况下，系统会提示用户“使用 Google 账号登录”。在其他情况下，用户会通过共享账号上下文登录。
如需使用 SSO 功能，用户需要导航到产品详情页面，然后选择适当的项目。该项目必须与购买该方案的结算账号关联。如需详细了解 Cloud Marketplace API 方案管理，请参阅管理结算方案 。
此外，用户必须在所选项目中拥有足够的 IAM 权限。对于大多数产品，需要 roles/consumerprocurement.entitlementManagerroles/editor基本角色 ）。
特定产品的最小权限
以下产品可以基于一组不同的权限来访问单点登录功能：
Apache Kafka on Confluent Cloud
DataStax Astra for Apache Cassandra
Elastic Cloud
Neo4j Aura Professional
Redis Enterprise Cloud
对于这些产品，您可以使用以下最小权限：
consumerprocurement.entitlements.getconsumerprocurement.entitlements.listserviceusage.services.getserviceusage.services.listresourcemanager.projects.get
这些权限通常通过 roles/consumerprocurement.entitlementManagerroles/consumerprocurement.entitlementViewer
