IAM roles and permissions

Preview

This product or feature is subject to the "Pre-GA Offerings Terms" in the General Service Terms section of the Service Specific Terms. Pre-GA products and features are available "as is" and might have limited support. For more information, see the launch stage descriptions.

This page describes Developer Connect roles and permissions.

Access control in Developer Connect is controlled using Identity and Access Management (IAM). IAM lets you create and manage permissions for Google Cloud resources. Developer Connect provides a specific set of predefined IAM roles where each role contains a set of permissions suited to a particular type of access or action. We recommend that you adopt the security principle of least privilege, and grant only the necessary access to your resources.

Predefined Developer Connect roles

You assign permissions to accounts through the use of roles. The following table lists the roles available for Developer Connect and the permissions that they include:

Role	Description	Permissions
Name:developerconnect.admin Title: Developer Connect Admin	Grants full access to Developer Connect resources.	developerconnect.operations.delete developerconnect.operations.cancel developerconnect.connections.create developerconnect.connections.update developerconnect.connections.delete developerconnect.connections.constructGitHubAppManifest developerconnect.connections.processGitHubOAuthCallback developerconnect.connections.processGitHubAppCreationCallback developerconnect.connections.generateGitHubStateToken developerconnect.gitRepositoryLinks.create developerconnect.gitRepositoryLinks.delete
Name:developerconnect.readTokenAccessor Title: Developer Connect Read Token Accessor	Grants access to read-only tokens. Also grants access to view the Git repository link.	developerconnect.connections.get developerconnect.gitRepositoryLinks.get developerconnect.gitRepositoryLinks.fetchReadToken
Name:developerconnect.tokenAccessor Title: Developer Connect Token Accessor	Grants access to read/write and read-only tokens. Also grants access to view the Git repository link.	developerconnect.connections.get developerconnect.gitRepositoryLinks.get developerconnect.gitRepositoryLinks.fetchReadToken developerconnect.gitRepositoryLinks.fetchReadWriteToke
Name:developerconnect.user Title: Developer Connect User	Grants access to view the connection and access to the features that interact with the Git repository, such as reading content from the Git repository, or linking to the Git repository.	developerconnect.connections.fetchGitHubInstallations developerconnect.connections.fetchLinkableGitRepositories developerconnect.gitRepositoryLinks.fetchGitRefs
Name:developerconnect.viewer Title: Developer Connect Viewer	Grants read-only access to Developer Connect resources.	resourcemanager.projects.get resourcemanager.projects.list developerconnect.operations.list developerconnect.operations.get developerconnect.locations.list developerconnect.locations.get developerconnect.connections.list developerconnect.connections.get developerconnect.gitRepositoryLinks.list developerconnect.gitRepositoryLinks.get

Developer Connect service account

Developer Connect uses a service account to execute tasks on your behalf when communicating with other services.

The identifier for the Developer Connect service agent is as follows, where PROJECT_NUMBER is your Google Cloud project number.

[e-mail]

You use this identifier to grant or modify IAM roles and permissions.

Configure access to resources

For specific steps on granting roles, see Granting, changing, and revoking access to resources.

What's next

• Learn about IAM.
• Connect to a GitHub repository.