Dataproc Metastore defines several Identity and Access Management (IAM) roles. Each predefined role contains a set of IAM permissions that allow principals to perform certain actions. You can use an IAM policy to give a principal one or more IAM roles.
Identity and Access Management (IAM) also offers the ability to create customized IAM roles. You can create custom IAM roles and assign the role one or more permissions. Then, you can grant the new role to your principals. Use custom roles to create an access control model that maps directly to your needs, alongside the available predefined roles.
This page focuses on the IAM roles relevant to Dataproc Metastore.
Before you begin
- Read the IAM documentation.
Dataproc Metastore roles
IAM Dataproc Metastore roles
are a bundle of one or more permissions.
You grant roles to principals to allow them to perform actions on the
Dataproc Metastore resources in your project. For example, the Dataproc Metastore User role contains the
metastore.*.get
and metastore.*.list
permissions, which allow a user to get
and list Dataproc Metastore services, metadata imports, backups, and operations in a
project.
The following table lists all Dataproc Metastore roles and the permissions associated with each role:
Role | Permissions |
---|---|
Dataproc Metastore Admin( Full access to all Dataproc Metastore resources. |
|
Dataproc Metastore Editor( Read and write access to all Dataproc Metastore resources. |
|
Metastore Federation Accessor( Access to the Metastore Federation resource. |
|
Dataproc Metastore Metadata Editor( Access to read and modify the metadata of databases and tables under those databases. |
|
Dataproc Metastore Metadata Mutate Admin( Access to mutate metadata from a Dataproc Metastore service's underlying metadata store. |
|
Dataproc Metastore Metadata Operator( Read-only access to Dataproc Metastore resources with additional metadata operations permission. |
|
Dataproc Metastore Data Owner( Full access to the metadata of databases and tables under those databases. |
|
Dataproc Metastore Metadata Query Admin( Access to query metadata from a Dataproc Metastore service's underlying metadata store. |
|
Dataproc Metastore Metadata User( Access to the Dataproc Metastore gRPC endpoint |
|
Dataproc Metastore Metadata Viewer( Access to read the metadata of databases and tables under those databases |
|
Dataproc Metastore Managed Migration Admin( Access to Dataproc Metastore Managed Migration resources and workflow. |
|
Dataproc Metastore Viewer( Read-only access to all Dataproc Metastore resources. |
|
What's next
- Learn how to create custom IAM roles.
- Learn how to grant and manage roles.
- See the Dataproc Metastore IAM permissions mapping.