Data Catalog Identity and Access Management (IAM)

Data Catalog provides and supports the following features:

• Centralized search and discovery. Data Catalog catalogs metadata for Google Cloud resources, such as BigQuery and Pub/Sub.
• Resource tagging. Data Catalog can create and attach metadata (tags) on Google Cloud resources.

This document describes Identity and Access Management (IAM) roles that allow users to use Data Catalog to search and tag Google Cloud resources.

IAM Terminology

Permissions

Checked at runtime to allow user to perform an operation or access a Google Cloud resource. Users are not granted permissions directly, but, instead, are granted roles that contain permissions.

Roles

A role is a predefined collection of permissions. Custom roles consisting of a custom collection of permissions may also be allowed.

Data Catalog Roles. For a list and description of Data Catalog predefined roles and the permissions associated with each role, see Data Catalog roles.

You can also see a current list of Data Catalog roles from the Google Cloud Console IAM Roles page.

1. In the Filter table field, select "Used in", then type "Data Catalog" and press Enter.
2. Click on one of the listed roles to view the role's permissions in the right pane.

Searching Google Cloud resources

Before searching, discovering, or displaying Google Cloud resources, Data Catalog checks that the user has been granted an IAM role with the metadata read permissions required by BigQuery, Pub/Sub, or other source system to access the resource.

Example: Data Catalog checks that the user has been granted a role with bigquery.tables.get permission before displaying BigQuery table metadata.

The table below lists the BigQuery and Pub/Sub permissions and the associated role needed for a user to use Data Catalog to search the listed Google Cloud resource.

Resource	Permission	Role
BigQuery datasets, tables, and models	bigquery.datasets.get bigquery.tables.get bigquery.models.getMetadata	roles/bigquery.metadataViewer Also see Data Catalog Viewer role
Pub/Sub topics	pubsub.topics.get	roles/pubsub.viewer Also see Data Catalog Viewer role

Data Catalog Viewer role

To simplify gaining access to Google Cloud resources, Data Catalog provides a Data Catalog Viewer role (roles/datacatalog.viewer) with metadata read permission for all cataloged Google Cloud resources. This role also grants the permissions to view Data Catalog tag templates and tags. In the future, this role may be extended to grant additional permissions when new types of resources become searchable in Data Catalog.

Grant the Data Catalog Viewer role on your project to allow users to view Google Cloud resources in Data Catalog.

Attaching tags to Google Cloud resources

Data Catalog allows users to extend metadata on Google Cloud resources by attaching tags. One or more tags that can be attached to a resource are defined in a tag template. When a user attempts to use the tag template to attach a tag to a Google Cloud resource, Data Catalog checks that the user has been granted permissions to use the tag template and to update resource metadata. Permissions are granted via IAM roles, as shown in the table below.

Each row lists only the permissions needed to tag resources. The corresponding roles may grant additional permissions. Click on each role to view all permissions associated with it.

Note: The owner of a data asset has the datacatalog.entries.updateTag permission by default. All other users will need to be granted the datacatalog.tagEditor role.

Resource	Permissions	Role
BigQuery datasets, tables, and models	datacatalog.tagTemplates.use datacatalog.entries.updateTag AND bigquery.datasets.updateTag bigquery.tables.updateTag bigquery.models.updateTag	roles/datacatalog.tagTemplateUser roles/datacatalog.tagEditor roles/bigquery.dataEditor
Pub/Sub topics	datacatalog.tagTemplates.use datacatalog.entries.updateTag pubsub.topics.updateTag	roles/datacatalog.tagTemplateUser roles/datacatalog.tagEditor roles/pubsub.editor

Use Custom Roles. Predefined BigQuery and Pub/Sub editor roles may provide broader write access than required (allow updating data in addition to updating metadata). Use custom roles to specify *.updateTag permissions only on a Google Cloud resource.

Data Catalog TagTemplate Creator role

The Data Catalog TagTemplate Creator role allows users to create tag templates.

Viewing tags on Google Cloud resources

Data Catalog allows users to view tags attached to Google Cloud resources only if the user has permissions on the resource to view its metadata and permissions on the tag template to view the corresponding tags. Permissions are granted via IAM roles, as explained in the table below.

Each row lists only the permissions needed to view tags, while the corresponding roles may grant additional permissions. Click on each role to view all permissions associated with it.

Resource	Permissions	Role
BigQuery datasets, tables, and models	datacatalog.tagTemplates.getTag AND bigquery.datasets.get bigquery.tables.get bigquery.models.getMetadata	roles/datacatalog.tagTemplateViewer roles/bigquery.metadataViewer
Pub/Sub topics	datacatalog.tagTemplates.getTag pubsub.topics.get	roles/datacatalog.tagTemplateViewer roles/pubsub.viewer

For more information

• Data Catalog roles
• BigQuery Access control reference
• Pub/Sub Access control