下列範例示範以 gcloud CLI 啟用必要 API、建立服務帳戶、指派 Compute Viewer 角色及建立 JSON 服務帳戶金鑰。命令與權限可能隨 Google Cloud 更新而變更，執行前請先與現行 GCP 及 Workload Security 文件比對。
使用 gcloud CLI 的程式碼
文件
步驟 1－確認 API 是否已啟用
gcloud services list --enabled
$ gcloud services list --enabled
NAME TITLE
bigquery.googleapis.com BigQuery API
bigquerystorage.googleapis.com BigQuery Storage API
cloudapis.googleapis.com Google Cloud APIs
clouddebugger.googleapis.com Cloud Debugger API
cloudtrace.googleapis.com Cloud Trace API
compute.googleapis.com Compute Engine API
datastore.googleapis.com Cloud Datastore API
logging.googleapis.com Cloud Logging API
monitoring.googleapis.com Cloud Monitoring API
oslogin.googleapis.com Cloud OS Login API
servicemanagement.googleapis.com Service Management API
serviceusage.googleapis.com Service Usage API
sql-component.googleapis.com Cloud SQL
storage-api.googleapis.com Google Cloud Storage JSON API
storage-component.googleapis.com Cloud Storage
步驟 2－啟用 Cloud Resource Manager API
gcloud services enable cloudresourcemanager.googleapis.com
$ gcloud services enable cloudresourcemanager.googleapis.com
Operation "operations/<OPERATION_ID>" finished successfully.
步驟 3－啟用 Compute Engine API
gcloud services enable compute.googleapis.com
$ gcloud services enable compute.googleapis.com
Operation "operations/<OPERATION_ID>" finished successfully.
建立服務帳戶的程式碼
文件
步驟 1－建立服務帳戶
gcloud iam service-accounts create gcp-cloud-account --display-name "GCP Cloud Account"
$ gcloud iam service-accounts create gcp-cloud-account --display-name "GCP Cloud Account"
Created service account [gcp-cloud-account].
步驟 2－查詢服務帳戶 ID
gcloud iam service-accounts list
$ gcloud iam service-accounts list
NAME EMAIL DISABLED
Compute Engine default service account <GCP_PROJECT_NUMBER>-compute@developer.gserviceaccount.com False
GCP Cloud Account gcp-cloud-account@<GCP_PROJECT_ID>.iam.gserviceaccount.com False
步驟 3－查詢 Compute Viewer 角色
gcloud iam roles list --filter "Compute Viewer"
$ gcloud iam roles list --filter "Compute Viewer"
---
description: Read-only access to Compute Engine networking resources.
etag: AA==
name: roles/compute.networkViewer
stage: GA
title: Compute Network Viewer
---
description: Read-only access to get and list information about all Compute Engine
resources, including instances, disks, and firewalls. Allows getting and listing
information about disks, images, and snapshots, but does not allow reading the data
stored on them.
etag: AA==
name: roles/compute.viewer
stage: GA
title: Compute Viewer
---
description: Read-only access to Notebooks all resources through compute API.
etag: AA==
name: roles/notebooks.legacyViewer
title: Notebooks Legacy Viewer
---
description: Viewer of compute recommendations.
etag: AA==
name: roles/recommender.computeViewer
stage: GA
title: Compute Recommender Viewer
步驟 4－將角色指派給服務帳戶
gcloud projects add-iam-policy-binding <GCP_PROJECT_ID> --member serviceAccount:gcp-cloud-account@<GCP_PROJECT_ID>.iam.gserviceaccount.com --role roles/compute.viewer
$ gcloud projects add-iam-policy-binding <GCP_PROJECT_ID> --member serviceAccount:gcp-cloud-account@<GCP_PROJECT_ID>.iam.gserviceaccount.com --role roles/compute.viewer
Updated IAM policy for project [<GCP_PROJECT_ID>].
bindings:
- members:
- serviceAccount:service-<GCP_PROJECT_NUMBER>@compute-system.iam.gserviceaccount.com
role: roles/compute.serviceAgent
- members:
- serviceAccount:gcp-cloud-account@<GCP_PROJECT_ID>.iam.gserviceaccount.com
- serviceAccount:<ADDITIONAL_SERVICE_ACCOUNT_ID>@<GCP_PROJECT_ID>.iam.gserviceaccount.com
role: roles/compute.viewer
- members:
- serviceAccount:<GCP_PROJECT_NUMBER>-compute@developer.gserviceaccount.com
- serviceAccount:<GCP_PROJECT_NUMBER>@cloudservices.gserviceaccount.com
role: roles/editor
- members:
- user:<PROJECT_OWNER_EMAIL_1>
- user:<PROJECT_OWNER_EMAIL_2>
- user:<PROJECT_OWNER_EMAIL_3>
- user:<PROJECT_OWNER_EMAIL_4>
- user:<PROJECT_OWNER_EMAIL_5>
- user:<PROJECT_OWNER_EMAIL_6>
- user:<PROJECT_OWNER_EMAIL_7>
- user:<PROJECT_OWNER_EMAIL_8>
- user:<PROJECT_OWNER_EMAIL_9>
- user:<PROJECT_OWNER_EMAIL_10>
role: roles/owner
etag: <POLICY_ETAG>
version: 1
步驟 5－建立 JSON 服務帳戶金鑰
gcloud iam service-accounts keys create gcpcloudaccount.json --iam-account=gcp-cloud-account@<GCP_PROJECT_ID>.iam.gserviceaccount.com
$ gcloud iam service-accounts keys create gcpcloudaccount.json --iam-account=gcp-cloud-account@<GCP_PROJECT_ID>.iam.gserviceaccount.com
created key [<SERVICE_ACCOUNT_KEY_ID>] of type [json] as [gcpcloudaccount.json] for [gcp-cloud-account@<GCP_PROJECT_ID>.iam.gserviceaccount.com]
取得 JSON 服務帳戶金鑰檔案後，即可依 Workload Security 的現行流程新增 Google Cloud 帳戶。請將金鑰視為敏感憑證並妥善保管。
額外資源
下列連結是歷史或社群提供的工具與文章，不屬於趨勢科技正式支援內容。使用前應自行檢閱原始碼、文件、維護狀態及安全性，不得直接用於正式環境。
工具與文章