This page lists the permissions required by Distributed Cloud Edge and the Identity and Access Management roles that encapsulate them.
Permissions
This section lists the permissions required to perform specific operations on Distributed Cloud Edge resources.
Operation and method | Resource | Permission |
---|---|---|
List Regions in the Cloud projectlocations.list |
Regions | edgecontainer.locations.list on the target Cloud project.
|
Get information about a Regionlocations.get |
Regions | edgecontainer.locations.get on the target Cloud project.
|
Create a Clusterclusters.create |
Clusters | edgecontainer.clusters.create on the target Cloud project.
|
List Clusters in the Cloud projectclusters.list |
Clusters | edgecontainer.clusters.list on the target Cloud project.
|
Obtain credentials for the Clusterclusters.get |
Clusters | edgecontainer.clusters.get on the target Cloud project.
|
Generate an Access Token for the clusterclusters.generateAccessToken |
Clusters | edgecontainer.clusters.generateAccessToken on the target Cloud project.
|
Modify a Clusterclusters.update |
Clusters | edgecontainer.clusters.update on the target Cloud project.
|
Delete a Clusterclusters.delete |
Clusters | edgecontainer.clusters.delete on the target Cloud project.
|
Create a NodePoolnodePools.create |
NodePools | edgecontainer.nodePools.create on the target Cloud project.
|
List NodePools in the Cloud projectnodePools.list |
NodePools | edgecontainer.nodePools.list on the target Cloud project.
|
Get information abut a NodePoolnodePools.get |
NodePools | edgecontainer.nodePools.get on the target Cloud project.
|
Modify a NodePoolnodePools.update |
NodePools | edgecontainer.nodePools.update on the target Cloud project.
|
Delete a NodePoolnodePools.delete |
NodePools | edgecontainer.nodePools.delete on the target Cloud project.
|
Create a Node (Machine)machines.create |
Nodes | edgecontainer.machines.create on the target Cloud project.
|
List Nodes (Machines) in the Cloud projectmachines.list |
Nodes | edgecontainer.machines.list on the target Cloud project.
|
Get information about a Node (Machine)machines.get |
Nodes | edgecontainer.machines.get on the target Cloud project.
|
Modify a Node (Machine)machines.update |
Nodes | edgecontainer.machines.update on the target Cloud project.
|
Deploy a workload to a Node (Machine)machines.use |
Nodes | edgecontainer.machines.use on the target Cloud project.
|
Delete a Node (Machine)machines.delete |
Nodes | edgecontainer.machines.delete on the target Cloud project.
|
List workloads deployed in a Zoneoperations.list |
Operations | edgecontainer.operations.list on the target Cloud project.
|
Get information about a workloadoperations.get |
Operations | edgecontainer.operations.get on the target Cloud project.
|
Cancel a workload in progressoperations.cancel |
Operations | edgecontainer.operations.cancel on the target Cloud project.
|
Delete a workloadoperations.delete |
Operations | edgecontainer.operations.delete on the target Cloud project.
|
Create a VPN ConnectionvpnConnections.create |
VPN Connections | edgecontainer.vpnConnections.create on the target Cloud project.
|
List VPN Connections in the Cloud projectvpnConnections.list |
VPN Connections | edgecontainer.vpnConnections.list on the target Cloud project.
|
Get information abut a VPN ConnectionvpnConnections.get |
VPN Connections | edgecontainer.vpnConnections.get on the target Cloud project.
|
Modify a VPN ConnectionvpnConnections.update |
VPN Connections | edgecontainer.vpnConnections.update on the target Cloud project.
|
Delete a VPN ConnectionvpnConnections.delete |
VPN Connections | edgecontainer.vpnConnections.delete on the target Cloud project.
|
List Zones in the Cloud projectzones.list |
Zones | edgenetwork.zones.list on the target machine Cloud project.
|
Get information about a Zonezones.get |
Zones | edgenetwork.zones.get on the target machine Cloud project.
|
Initialize a Zonezones.initialize |
Zones | edgenetwork.zones.initialize on the target machine Cloud project.
|
Create a Networknetworks.create |
Networks | edgenetwork.networks.create on the target machine Cloud project.
|
List Networks in the Cloud projectnetworks.list |
Networks | edgenetwork.networks.list on the target machine Cloud project. |
Get information about a Networknetworks.get |
Networks | edgenetwork.networks.get on the target machine Cloud project.
|
Get status about a Networknetworks.getStatus |
Networks | edgenetwork.networks.getStatus on the target machine Cloud project.
|
Delete a Networknetworks.delete |
Networks | edgenetwork.networks.delete on the target machine Cloud project.
|
Create a Subnetsubnetworks.create |
Subnets | edgenetwork.subnetworks.create on the target machine Cloud project.
|
List Subnets in the Cloud projectsubnetworks.list |
Subnets | edgenetwork.subnetworks.list on the target machine Cloud project. |
Get information about a Subnetsubnetworks.get |
Subnets | edgenetwork.subnetworks.get on the target machine Cloud project.
|
Delete a Subnetsubnetworks.delete |
Subnets | edgenetwork.subnetworks.delete on the target machine Cloud project.
|
List Interconnects in the Cloud projectinterconnects.list |
Interconnects | edgenetwork.interconnects.list on the target machine Cloud project. |
Get information about an Interconnectinterconnects.get |
Interconnects | edgenetwork.interconnects.get on the target machine Cloud project.
|
Get diagnostic information about an Interconnectinterconnects.getDiagnostics |
Interconnects | edgenetwork.interconnects.getDiagnostics on the target machine Cloud project.
|
Create an InterconnectAttachmentinterconnectAttachments.create |
InterconnectAttachments | edgenetwork.interconnectAttachments.create on the target machine Cloud project.
|
List InterconnectAttachments in the Cloud projectinterconnectAttachments.list |
InterconnectAttachments | edgenetwork.interconnectAttachments.list on the target machine Cloud project. |
Get information about an InterconnectAttachmentinterconnectAttachments.get |
InterconnectAttachments | edgenetwork.interconnectAttachments.get on the target machine Cloud project.
|
Delete an InterconnectAttachmentinterconnectAttachments.delete |
InterconnectAttachments | edgenetwork.interconnectAttachments.delete on the target machine Cloud project.
|
Create a Routerrouters.create |
Routers | edgenetwork.routers.create on the target machine Cloud project.
|
List Routers in the Cloud projectrouters.list |
Routers | edgenetwork.routers.list on the target machine Cloud project. |
Get status about a Routerrouters.getRouterStatus |
Routers | edgenetwork.routers.getRouterStatus on the target machine Cloud project.
|
Get information about a Routerrouters.get |
Routers | edgenetwork.routers.get on the target machine Cloud project.
|
Modify a Routerrouters.update |
Routers | edgenetwork.routers.update on the target machine Cloud project.
|
Delete a Routerrouters.delete |
Routers | edgenetwork.routers.delete on the target machine Cloud project.
|
List workloads deployed in a Zoneoperations.list |
Operations | edgenetwork.operations.list on the target machine Cloud project.
|
Get information about a workloadoperations.get |
Operations | edgenetwork.operations.get on the target machine Cloud project.
|
Cancel a workload in progressoperations.cancel |
Operations | edgenetwork.operations.cancel on the target machine Cloud project.
|
Delete a workloadoperations.delete |
Operations | edgenetwork.operations.delete on the target machine Cloud project.
|
List Locations in the machine Cloud projectlocations.list |
Locations | edgenetwork.locations.list on the target machine Cloud project.
|
Get information about a Locationlocations.get |
Locations | edgenetwork.locations.get on the target machine Cloud project.
|
Roles
This section lists the IAM roles that encapsulate Distributed Cloud Edge permissions.
Cloud project roles for Distributed Cloud Edge
The following table lists the Cloud project roles and the Distributed Cloud Edge permissions they encapsulate.
Role | Resources | Permissions |
---|---|---|
GDCE Vieweredgecontainer.viewer |
Zones, Nodes, NodePools, Clusters, VPN Connections |
|
GDCE Adminedgecontainer.admin |
Zones, Nodes, NodePools, Clusters, VPN Connections | Includes all permissions from the GDCE Viewer role, plus the following:
|
GDCE Machine Useredgecontainer.machineUser |
Machines |
|
GDCE Network Vieweredgenetwork.viewer |
Zones, Networks, Subnets, Interconnects, InterconnectAttachments, Routers, Locations, Operations |
|
GDCE Network Adminedgenetwork.admin |
Zones, Networks, Subnets, Interconnects, InterconnectAttachments, Routers, Operations | Includes all permissions from the GDCE Network Viewer role, plus the following:
|
Custom roles
Google Cloud also allows you to create custom roles that encapsulate permissions specific to your business needs, such as the principle of least privilege. For instructions, see Creating and managing custom roles.