GCP IAM 指南

IAM 角色

角色类型	说明	示例
基本角色	粗粒度遗留角色	roles/viewer, roles/editor
预定义角色	Google 为特定服务精心设计	roles/storage.objectAdmin
自定义角色	用户定义特定权限	projects/my-proj/roles/myRole

# 创建自定义角色
gcloud iam roles create myCustomRole \
  --project=my-project \
  --title="My Custom Role" \
  --permissions=storage.objects.get,storage.objects.list \
  --stage=GA

策略绑定

# 添加绑定（非破坏性） gcloud projects add-iam-policy-binding my-project \ --member="user:[email protected]" \ --role="roles/storage.objectViewer" # 获取完整 IAM 策略 gcloud projects get-iam-policy my-project --format=json # 移除绑定 gcloud projects remove-iam-policy-binding my-project \ --member="user:[email protected]" \ --role="roles/storage.objectViewer"

服务账号

# 创建服务账号 gcloud iam service-accounts create deploy-sa \ --display-name="Deployment SA" # 授予项目权限 gcloud projects add-iam-policy-binding my-project \ --member="serviceAccount:[email protected]" \ --role="roles/run.developer" # 允许用户模拟服务账号 gcloud iam service-accounts add-iam-policy-binding \ [email protected] \ --member="user:[email protected]" \ --role="roles/iam.serviceAccountTokenCreator"

工作负载身份联合

# 创建工作负载身份池
gcloud iam workload-identity-pools create github-pool \
  --project=my-project \
  --location=global \
  --display-name="GitHub Actions Pool"

# 创建 OIDC 提供商（GitHub Actions）
gcloud iam workload-identity-pools providers create-oidc github-provider \
  --project=my-project \
  --location=global \
  --workload-identity-pool=github-pool \
  --issuer-uri="https://token.actions.githubusercontent.com" \
  --attribute-mapping="google.subject=assertion.sub"

审计日志

# 查询审计日志
gcloud logging read \
  'logName="projects/my-project/logs/cloudaudit.googleapis.com%2Factivity"' \
  --limit=50 --format=json

# 将日志导出到 BigQuery
gcloud logging sinks create my-bq-sink \
  bigquery.googleapis.com/projects/my-project/datasets/audit_logs \
  --log-filter='logName:"cloudaudit.googleapis.com"'