API roles and permissions

GKE on AWS has specific Identity and Access Management (IAM) permissions. Those permissions are described in the following tables. For instructions on managing permissions, see Granting, Changing, and Revoking Access to Resources.

GKE on AWS API permissions

The GKE on AWS API includes the predefined gkemulticloud.viewer, and gkemulticloud.admin roles. These roles are described in the following table:

Role Permissions

(roles/gkemulticloud.admin)

Admin access to Anthos Multi-cloud resources.

gkemulticloud.*

  • gkemulticloud.attachedClusters.create
  • gkemulticloud.attachedClusters.delete
  • gkemulticloud.attachedClusters.generateInstallManifest
  • gkemulticloud.attachedClusters.get
  • gkemulticloud.attachedClusters.import
  • gkemulticloud.attachedClusters.list
  • gkemulticloud.attachedClusters.update
  • gkemulticloud.attachedServerConfigs.get
  • gkemulticloud.awsClusters.create
  • gkemulticloud.awsClusters.delete
  • gkemulticloud.awsClusters.generateAccessToken
  • gkemulticloud.awsClusters.get
  • gkemulticloud.awsClusters.getAdminKubeconfig
  • gkemulticloud.awsClusters.list
  • gkemulticloud.awsClusters.update
  • gkemulticloud.awsNodePools.create
  • gkemulticloud.awsNodePools.delete
  • gkemulticloud.awsNodePools.get
  • gkemulticloud.awsNodePools.list
  • gkemulticloud.awsNodePools.update
  • gkemulticloud.awsServerConfigs.get
  • gkemulticloud.azureClients.create
  • gkemulticloud.azureClients.delete
  • gkemulticloud.azureClients.get
  • gkemulticloud.azureClients.list
  • gkemulticloud.azureClusters.create
  • gkemulticloud.azureClusters.delete
  • gkemulticloud.azureClusters.generateAccessToken
  • gkemulticloud.azureClusters.get
  • gkemulticloud.azureClusters.getAdminKubeconfig
  • gkemulticloud.azureClusters.list
  • gkemulticloud.azureClusters.update
  • gkemulticloud.azureNodePools.create
  • gkemulticloud.azureNodePools.delete
  • gkemulticloud.azureNodePools.get
  • gkemulticloud.azureNodePools.list
  • gkemulticloud.azureNodePools.update
  • gkemulticloud.azureServerConfigs.get
  • gkemulticloud.operations.cancel
  • gkemulticloud.operations.delete
  • gkemulticloud.operations.get
  • gkemulticloud.operations.list
  • gkemulticloud.operations.wait

resourcemanager.projects.get

resourcemanager.projects.list

(roles/gkemulticloud.viewer)

Viewer access to Anthos Multi-cloud resources.

gkemulticloud.attachedClusters.generateInstallManifest

gkemulticloud.attachedClusters.get

gkemulticloud.attachedClusters.list

gkemulticloud.attachedServerConfigs.get

gkemulticloud.awsClusters.generateAccessToken

gkemulticloud.awsClusters.get

gkemulticloud.awsClusters.list

gkemulticloud.awsNodePools.get

gkemulticloud.awsNodePools.list

gkemulticloud.awsServerConfigs.get

gkemulticloud.azureClients.get

gkemulticloud.azureClients.list

gkemulticloud.azureClusters.generateAccessToken

gkemulticloud.azureClusters.get

gkemulticloud.azureClusters.list

gkemulticloud.azureNodePools.get

gkemulticloud.azureNodePools.list

gkemulticloud.azureServerConfigs.get

gkemulticloud.operations.get

gkemulticloud.operations.list

gkemulticloud.operations.wait

resourcemanager.projects.get

resourcemanager.projects.list

What's next

Additional IAM roles, such as owner and editor, include GKE on AWS permissions. For more information, see the complete IAM Permissions reference list.