啟用憑證販售功能

在無邊界湖倉中，您可以透過 Lakehouse 執行階段目錄，為目錄端點啟用憑證臨時配發模式。

憑證臨時配發模式會將範圍縮小的短期儲存空間權杖，配發給授權的查詢引擎和工作負載。採用這種驗證方式後，您或查詢執行階段就不需要具備基礎 Cloud Storage bucket 的直接讀取和寫入權限。

事前準備

1. 請參閱「關於 Lakehouse 執行階段目錄」，瞭解 Lakehouse 執行階段目錄的運作方式和服務限制。
登入 Google Cloud 帳戶。如果您未曾使用過 Google Cloud，歡迎 建立帳戶，親自體驗實際使用我們產品的成效。新客戶還能獲得價值 $300 美元的免費抵免額，用於執行、測試及部署工作負載。

In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

Roles required to select or create a project

• Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
• Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

Go to project selector

Verify that billing is enabled for your Google Cloud project.

Enable the BigLake API, if it is not already enabled.

Roles required to enable APIs

To enable APIs, you need the serviceusage.services.enable permission. If you created the project, then you likely already have this permission through the Owner role (roles/owner). Otherwise, you can get this permission through the Service Usage Admin role (roles/serviceusage.serviceUsageAdmin). Learn how to grant roles.

Enable the API

In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

Roles required to select or create a project

• Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
• Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

Go to project selector

Verify that billing is enabled for your Google Cloud project.

Enable the BigLake API, if it is not already enabled.

Roles required to enable APIs

To enable APIs, you need the serviceusage.services.enable permission. If you created the project, then you likely already have this permission through the Owner role (roles/owner). Otherwise, you can get this permission through the Service Usage Admin role (roles/serviceusage.serviceUsageAdmin). Learn how to grant roles.

Enable the API

必要的角色

如要取得啟用憑證販售功能所需的權限，請要求管理員授予您下列 IAM 角色：

• 全部：
  • 專案的 BigLake 管理員 (roles/biglake.admin)
  • 專案的儲存空間管理員 (roles/storage.admin)
• 自動佈建的 Apache Iceberg REST 目錄服務帳戶：所有相關聯 Cloud Storage bucket 的 Storage 物件使用者 (roles/storage.objectUser)。啟用憑證販售功能後，請將所有相關聯 Storage bucket 的 Storage 物件使用者角色 (roles/storage.objectUser)，明確授予目錄自動佈建的 Apache Iceberg REST 目錄服務帳戶。

如要進一步瞭解如何授予角色，請參閱「管理專案、資料夾和組織的存取權」。

您或許也能透過自訂角色或其他預先定義的角色，取得必要權限。

啟用憑證販售

如果 Apache Iceberg REST 目錄端點的驗證方式設為使用者憑證，您可以切換至憑證臨時配發模式。

gcloud biglake iceberg catalogs update \
    CATALOG_NAME \
    --project PROJECT_ID \
    --credential-mode vended-credentials

PATCH /iceberg/v1/restcatalog/extensions/projects/PROJECT_ID/catalogs/CATALOG_ID?updateMask=credential_mode