我已经创建了一个具有组织查看器权限的GCP服务帐户(因此我认为在所有项目中都具有读取权限(
▶ gcloud organizations get-iam-policy 83838383838383 --flatten="bindings[].members" --format='table(bindings.role)' --filter="bindings.members:my-sa@my-project-id.iam.gserviceaccount.com"
ROLE
roles/resourcemanager.organizationViewer
然后我激活这个本地
▶ gcloud auth activate-service-account my-sa@my-project-id.iam.gserviceaccount.com --key-file=keyfile.json
Activated service account credentials for: [my-sa@my-project-id.iam.gserviceaccount.com]
然后尝试执行compute disk list(在创建SA的同一项目上(
▶ gcloud compute disks list
ERROR: (gcloud.compute.disks.list) Some requests did not succeed:
- Required 'compute.disks.list' permission for 'projects/my-project-id'
为什么？
错误消息指出服务帐户没有权限compute.disks.list。
角色roles/resourcemanager.organizationViewer具有什么权限？
gcloud iam roles describe roles/resourcemanager.organizationViewer --format=json
请注意，该角色只有一个权限resourcemanager.organizations.get
{
"description": "Access only to view an Organization.",
"etag": "AA==",
"includedPermissions": [
"resourcemanager.organizations.get"
],
"name": "roles/resourcemanager.organizationViewer",
"stage": "GA",
"title": "Organization Viewer"
}
该权限允许查看组织详细信息，但不允许查看组织的资源。