使用 IAM 控管存取權

您可以透過 Identity and Access Management (IAM) 角色，控管哪些人員能在資源階層的不同層級，查看及管理 Security Command Center 環境中的資產、發現項目和安全性來源。具體角色取決於您是在組織層級還是專案層級啟用 Security Command Center。如要瞭解這些啟用範圍，請參閱「啟用 Security Command Center 的簡介」。

如何查看存取控管資訊

如要瞭解使用 Security Command Center 所需的 IAM 角色，請根據您啟用 Security Command Center 的層級，參閱下列其中一個頁面：

遷移自訂角色，改用 securitycentermanagement 權限

2026 年 11 月 9 日起，在「Settings」(設定) 頁面執行操作時，必須具備下列一或多項 securitycentermanagement 權限：

  • securitycentermanagement.securityCenterServices.get
  • securitycentermanagement.securityCenterServices.list
  • securitycentermanagement.securityCenterServices.update

如果您使用預先定義的 IAM 角色授予「Settings」(設定) 頁面的存取權，則無須進行任何變更。

下列預先定義的 IAM 角色已更新，納入新權限。

  • roles/securityposture.admin 和 roles/securityposture.postureDeployer 角色包含下列權限：

    • securitycentermanagement.securityCenterServices.get
    • securitycentermanagement.securityCenterServices.list
    • securitycentermanagement.securityCenterServices.update

  • 「寫入者」(roles/writer) 和「編輯者」(roles/editor) 角色包含 securitycentermanagement.securityCenterServices.update 權限。

如果您使用的自訂角色包含下表列出的權限，請更新自訂角色，加入替代權限。在自訂角色更新前，獲派該角色的使用者在使用「Settings」(設定) 頁面時，可能會看到 PERMISSION_DENIED 錯誤。

替換這項權限： 這項權限可讓您：

securitycenter.
containerthreatdetectionsettings.get

securitycentermanagement.
securityCenterServices.get

securitycenter.
containerthreatdetectionsettings.update

securitycentermanagement.
securityCenterServices.update

securitycenter.
eventthreatdetectionsettings.calculate

這項權限並非必要。替換為 securitycentermanagement.securityCenterServices.get

securitycenter.
eventthreatdetectionsettings.get

securitycentermanagement.
securityCenterServices.get

securitycenter.
eventthreatdetectionsettings.update

securitycentermanagement.
securityCenterServices.update

securitycenter.
integratedvulnerabilityscannersettings.calculate

這項權限並非必要。替換為 securitycentermanagement.securityCenterServices.get

securitycenter.
integratedvulnerabilityscannersettings.get

securitycentermanagement.
securityCenterServices.get

securitycenter.
integratedvulnerabilityscannersettings.update

securitycentermanagement.
securityCenterServices.update

securitycenter.
organizationsettings.get

securitycentermanagement.
securityCenterServices.get

securitycenter.
rapidvulnerabilitydetectionsettings.calculate

這項權限並非必要。替換為 securitycentermanagement.securityCenterServices.get

securitycenter.
rapidvulnerabilitydetectionsettings.get

securitycentermanagement.
securityCenterServices.get

securitycenter.
rapidvulnerabilitydetectionsettings.update

securitycentermanagement.
securityCenterServices.update

securitycenter.
securitycentersettings.get

securitycentermanagement.
securityCenterServices.get

securitycenter.
securityhealthanalyticssettings.calculate

這項權限並非必要。替換為 securitycentermanagement.securityCenterServices.get

securitycenter.
securityhealthanalyticssettings.get

securitycentermanagement.
securityCenterServices.get

securitycenter.
securityhealthanalyticssettings.update

securitycentermanagement.
securityCenterServices.update

securitycenter.
virtualmachinethreatdetectionsettings.calculate

這項權限並非必要。替換為 securitycentermanagement.securityCenterServices.get

securitycenter.
virtualmachinethreatdetectionsettings.get

securitycentermanagement.
securityCenterServices.get

securitycenter.
virtualmachinethreatdetectionsettings.update

securitycentermanagement.
securityCenterServices.update

securitycenter.
websecurityscannersettings.calculate

這項權限並非必要。替換為 securitycentermanagement.securityCenterServices.get

securitycenter.
websecurityscannersettings.get

securitycentermanagement.
securityCenterServices.get

securitycenter.
websecurityscannersettings.update

securitycentermanagement.
securityCenterServices.update

任何開頭為 securitycenter.
securityhealthanalyticscustommodules.* 的權限

以 securitycentermanagement.
securityhealthanalyticscustommodules.* 開頭的對應權限

任何開頭為 securitycenter.
effectivesecurityhealthanalyticscustommodules.* 的權限

以 securitycentermanagement.
effectivesecurityhealthanalyticscustommodules.* 開頭的對應權限