本頁面提供 Access Approval 的總覽。我們長期致力於資訊公開透明化、贏得使用者信任，以及讓客戶擁有資料的所有權，而這項存取權核准機制正是我們努力的一部分。資料存取透明化控管機制可協助您瞭解 Google 人員存取客戶資料的時間點，而存取權核准功能則可讓您授權存取權要求。此外，您還能更精細地控管 Google 何時可以存取客戶資料。如果客戶使用以客戶管理的加密金鑰 (CMEK) 簽署的存取權核准，Google 也會透過金鑰存取權理由，讓使用者瞭解並控管金鑰存取權要求。
這些產品各自提供存取權管理功能，讓您控管管理要求，並提供客戶資料存取權的相關資訊。
總覽
使用 Access Approval 後，Cloud Customer Care 和工程團隊每次需要存取客戶資料時，都必須明確取得您的核准。每項核准要求都會經過加密簽署和驗證，以確保其完整性。有效的存取權核准要求隨時可以撤銷。
存取權核准功能可在資料存取透明化記錄提供的資訊之上，提供額外的控制層級。資料存取透明化控管機制會記錄 Google 人員存取客戶資料時採取的動作。Access Approval 也會提供歷史記錄檢視畫面，讓您查看已核准、關閉、撤銷或過期的所有要求。
如果您想直接管理 Google 人員對客戶資料的存取權，建議您使用存取權核准功能。如要進一步瞭解 Google 人員可能需要存取客戶資料的原因，以及Google Cloud的特殊權限存取原則，請參閱「 Google Cloud的特殊權限存取」。
Access Approval 的運作方式
存取權核准功能會要求 Google 管理員先向授權客戶管理員提出要求並獲得核准，才能存取客戶資料。客戶會收到使用預先設定電子郵件或 Pub/Sub 訊息的待核准要求通知。
您可以透過郵件中的資訊，在 Google Cloud 控制台或使用 Access Approval API 核准或拒絕存取核准要求。只有在存取權核准要求獲得核准後，才能授予存取權。存取權核准功能會使用加密編譯金鑰簽署存取要求，並使用簽章驗證要求的完整性。您可以使用 Google 代管的簽署金鑰，也可以自備簽署金鑰。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-01 (世界標準時間)。"],[[["\u003cp\u003eAccess Approval requires Google personnel to obtain explicit customer approval before accessing Customer Data, enhancing control and transparency.\u003c/p\u003e\n"],["\u003cp\u003eIt works by sending approval requests to authorized customer administrators, who can approve or deny them via the Google Cloud console or API, ensuring that access is only granted post-approval.\u003c/p\u003e\n"],["\u003cp\u003eAccess Approval provides an additional control layer over Access Transparency by logging all access requests (approved, denied, revoked, or expired) and by allowing for revocation of active access.\u003c/p\u003e\n"],["\u003cp\u003eCustomers can use either a Google-managed key or a custom-managed encryption key for signing access requests, with the option to use Key Access Justifications for externally managed keys.\u003c/p\u003e\n"],["\u003cp\u003eAccess Approval can be enabled for all supported Google Cloud services automatically or limited to only services in the GA launch stage, or individually selecting the specific services.\u003c/p\u003e\n"]]],[],null,["# Overview of Access Approval\n===========================\n\nThis page provides an overview of Access Approval.\nAccess Approval is a part of Google's long-term commitment to\ntransparency, user trust, and customer ownership of their data.\n[Access Transparency](/assured-workloads/access-transparency/docs/overview) helps you\nto discover information about when Google personnel access\n[Customer Data](/terms/data-processing-addendum), and Access Approval\nlets you authorize such access requests. In addition, it provides enhanced\nlevels of granular control over when Google may access Customer Data. For\ncustomers who use access approvals that are signed with a customer-managed\nencryption key (CMEK), Google also provides users with visibility and control to\nkey access requests through\n[Key Access Justifications](/assured-workloads/key-access-justifications/docs/overview).\n\nTogether, each of these products provide access management capabilities that\ngive you control over and context for administrative requests to access Customer\nData.\n\nOverview\n--------\n\nAccess Approval ensures that Cloud Customer Care and engineering teams\nrequire your explicit approval whenever they need to access your Customer Data.\nEach approval request is cryptographically signed and verified to ensure its\nintegrity. Active access approval requests may be revoked at any time.\n\nAccess Approval provides an additional layer of control on top of the\ntransparency that Access Transparency logs provide. Access Transparency provides logs that\ncapture the actions Google personnel take when accessing your Customer Data.\nAccess Approval also provides a historical view of all requests that\nwere approved, dismissed, revoked, or expired.\n\nIf you want the ability to directly manage Google personnel's access to your\nCustomer Data, we recommend using Access Approval. For more information\nabout why Google personnel might need to access Customer Data and about\nGoogle Cloud's privileged access principles, see\n[Privileged access at Google Cloud](/assured-workloads/access-transparency/docs/privileged-access).\n\nHow Access Approval works\n-------------------------\n\nAccess Approval works by requiring Google Administrators to request and\nreceive an approval from an authorized customer administrator prior to accessing\nCustomer Data. Customers are notified of a pending approval request using a\npreconfigured email or a Pub/Sub message.\n\nUsing the information in the message, the Access Approval request may\nbe approved or denied within the Google Cloud console or by using the\n[Access Approval API](/assured-workloads/access-approval/docs/reference/rest).\nAccess is granted only after the Access Approval request is approved.\nAccess Approval uses a cryptographic key to sign the access request,\nand its signature is used to verify the integrity of the request. You can either\nuse a Google-managed signing key or bring your own signing key.\n\nHow Access Approval works with Assured Workloads\n------------------------------------------------\n\nWhen using Access Approval with an Assured Workloads\ncompliance boundary, the Assured Workloads personnel access assurances\napply before Access Approval is evaluated. The Access Approval\naccess request may contain non-compliant parameters (such as the `global`\nlocation); however, these conditions are secondary to the\nAssured Workloads workload configuration.\n\nFor example, if a Canada Protected B folder owner is sent an\nAccess Approval request for the `global` location, this request is\nfirst applied Canada Protected B restrictions-and those personnel are not\napplied further Access Approval regional restrictions.\n\n[Using a Google-managed signing key](/assured-workloads/access-approval/docs/review-approve-access-requests-google-keys)\nis the default option. If you want to use your own signing key, you can create\none using Cloud KMS, or bring an externally-managed key using\nCloud EKM. For more information about getting started with using a\ncustom signing key, see\n[Set up Access Approval using a custom signing key](/assured-workloads/access-approval/docs/review-approve-access-requests-custom-keys).\n| **Note:** The support response time increases by the duration that Customer Care spends waiting for your approval. We recommend being cautious when enabling Access Approval for projects and services where you might require high service availability and rapid response by Customer Care.\n\nGoogle services that support Access Approval\n--------------------------------------------\n\nAccess Approval lets you select the Google Cloud services you want to\nenroll in Access Approval. Access Approval requests your\nconsent only for access requests to Customer Data stored in the services you\nselect.\n\nYou have the following options for enrolling services in\nAccess Approval:\n\n- Automatically enable Access Approval for all supported services, regardless of its [product launch stage](/products#product-launch-stages) (such as Preview or General Availability (GA)). Selecting this option also automatically enrolls all the services that Access Approval supports in the future. This is the default option.\n- Only enable Access Approval for services in the GA launch stage. Selecting this option also automatically enrolls all the GA services that Access Approval supports in the future.\n- Choose the specific services you want to enroll in Access Approval.\n\nSee\n[Supported services](/assured-workloads/access-approval/docs/supported-services)\nfor a complete list of services that Access Approval supports.\n\nAccess Approval exclusions\n--------------------------\n\n[Access Transparency's exclusions](/assured-workloads/access-transparency/docs/exclusions)\nare also applicable to Access Approval.\n\nIn addition to these exclusions, the approval request may be automatically\napproved without the customer's action to address time-sensitive outages. Such\nauto-approved Access Approval requests are logged in an\n`auto approved` state.\n\nAuto-approval is automatically disabled for all workloads deployed with\nAssured Workloads Sovereign Controls or\n[Sovereign Controls by Partners](/sovereign-controls-by-partners/docs).\n\nCustomers seeking to ensure that administrative access requests can only be\nprocessed when the approvals are signed with a customer-managed key may\nconfigure Access Approval with a customer-managed key and use\nKey Access Justifications.\n\nRequirements for using Access Approval\n--------------------------------------\n\nYou can enable Access Approval for a\n[Google Cloud project](/resource-manager/docs/cloud-platform-resource-hierarchy#projects),\n[folder](/resource-manager/docs/cloud-platform-resource-hierarchy#folders), or\n[organization](/resource-manager/docs/cloud-platform-resource-hierarchy#organizations).\nBefore enabling Access Approval, you must\n[enable Access Transparency](/assured-workloads/access-transparency/docs/enable) for\nyour organization.\n\nAfter enabling Access Transparency, you can use the Google Cloud console to enable\nAccess Approval. To learn how to set up Access Approval, see\nthe [quickstarts](/assured-workloads/access-approval/docs/quickstart).\n\n### Requirements for a custom signing key\n\nUsing the default Google-managed signing key doesn't require any additional\nconfiguration. To use your own signing key, you can either create an asymmetric\nsigning key using [Cloud Key Management Service](/kms/docs) or use [Cloud External Key Manager](/kms/docs/ekm)\nto host an externally-managed signing key. For the limitations related to\nasymmetric signing keys supported by Cloud EKM, see\n[Restrictions for asymmetric signing keys](/kms/docs/ekm#restrictions-asymmetric).\n\nIf you want to use an externally-managed signing key, we recommend that you\nenable Cloud EKM. For more information about using Cloud EKM for\nmanaging keys that aren't stored in Google Cloud, see\n[Cloud EKM overview](/kms/docs/ekm#overview).\n| **Note:** Access Approval aims to provide a justification for every request to access your Customer Data stored on Google Cloud. Similarly, Key Access Justifications aims to provide a justification for every request to access your externally-managed keys. Cloud EKM brings your externally-managed keys into Google Cloud for signing access requests. If you want to be notified about the reason for every access to your externally-managed signing keys, you can use Key Access Justifications. For more information about Key Access Justifications, see [Overview of Key Access Justifications](/assured-workloads/key-access-justifications/docs/overview).\n\nWhat's next\n-----------\n\n- See the [quickstarts](/assured-workloads/access-approval/docs/quickstart) to set up Access Approval.\n- Learn how to [use Terraform to set up Access Approval](/assured-workloads/access-approval/docs/using-terraform).\n- Learn how to [approve access requests](/assured-workloads/access-approval/docs/approve-requests).\n- Learn about [Access Approval pricing](/assured-workloads/access-approval/pricing).\n- See the list of [Google Cloud services that Access Approval supports](/assured-workloads/access-approval/docs/supported-services)."]]
