Access control

Preview

This product is covered by the Pre-GA Offerings Terms of the Google Cloud Platform Terms of Service. Pre-GA products may have limited support, and changes to pre-GA products may not be compatible with other pre-GA versions. For more information, see the launch stage descriptions.

Overview of access control

This page describes the access control options that are available to you in Cloud Domains.

Overview

Google Cloud offers Identity and Access Management (IAM), which enables you to give more granular access to specific Google Cloud resources and prevents unwanted access to other resources. This page describes the Cloud Domains API roles. For a detailed description of IAM, see the IAM documentation.

IAM enables you to adopt the security principle of least privilege, so that you grant only the necessary access to your resources.

IAM enables you to control who has what permissions to which resources by setting IAM policies. To understand role types, see Role types. IAM policies grant specific roles to a user, giving the user certain permissions. For example, a particular user might need to create and modify the contact settings for a domain. So, you would give that user the roles/domains.admin role. On the other hand, a user may only need to view existing resource domains, so they would get a roles/domains.viewer role. For Cloud Domains, you can configure both project-level and resource-level access.

Here are some examples of permissions for a viewer role:

• View all domains registered in a project.
• View registration details, for example, DNS, expiry time, etc.
• Search domain availability and get registration parameters.

Here are some examples of permissions for an administrator role:

• Register a new domain.
• Update registration settings, including DNS settings and contact settings.
• Export or transfer the domain registration

For a detailed description of IAM and its features, see the IAM developer's guide. In particular, see Granting, changing, and revoking access to a project Members.

Enabling the Cloud Domains API

To view and assign Cloud Domains IAM roles, you must enable the Cloud Domains API for your project. You cannot see the Cloud Domains roles in the Cloud Console until you enable the API.

For lists of the permissions and roles that Cloud Domains supports, see the following sections.

Permissions and roles

Permissions

The following table lists the permissions that the caller must have to call each method:

Method	Required Permission(s)
domains.registrations.searchDomains for searching for an available domain	domains.registrations.list
domains.registrations.retrieveRegisterParameters for getting parameters to register a new domain	domains.registrations.list
domains.registrations.registerDomain for registering a domain	domains.registrations.create
domains.registrations.list for listing the registration resources in a project	domains.registrations.list
domains.registrations.get for getting the details of a registration resource	domains.registrations.get
domains.registrations.update for editing the details of a registration resource	domains.registrations.update
domains.registrations.configureManagementSettings for configuring the management settings of a registration resource	domains.registrations.configureManagement
domains.registrations.configureDnsSettings for configuring DNS settings of a registration resource	domains.registrations.configureDns
domains.registrations.configureContactSettings for configuring the contact settings of a registration resource	domains.registrations.configureContact
domains.registrations.export for exporting a domain	domains.registrations.configureManagement
domains.registrations.delete for deleting a domain	domains.registrations.delete
domains.registrations.retrieveAuthorizationCode for retrieving the authorization code for a domain transfer	domains.registrations.configureManagement
domains.registrations.resetAuthorizationCode for resetting the authorization code for a domain transfer	domains.registrations.configureManagement

Roles

Role	Title	Description	Permissions	Lowest resource
roles/domains.admin	Domains Administrator	Provides read-write access to all registration resources. Can take over a domain implicitly with the ability to update the registration information and transfer the domain.	domains.registrations.get domains.registrations.list domains.registrations.create domains.registrations.update domains.registrations.delete domains.registrations.configureContact domains.registrations.configureDns domains.registrations.configureManagement resourcemanager.projects.get resourcemanager.projects.list domains.operations.get domains.operations.list domains.registrations.getIamPolicy domains.registrations.setIamPolicy	Project
roles/domains.viewer	Domains viewer	Has view-only access to projects.	domains.registrations.get domains.registrations.list resourcemanager.projects.get resourcemanager.projects.list domains.operations.get domains.operations.list domains.registrations.getIamPolicy	Project

Access control using the Cloud Console

You can use the Cloud Console to manage access control for your projects.

For detailed instructions, see Granting, changing, and revoking access to resources.

Next steps

• To get started using Cloud Domains, see the Quickstart.
• For details about IAM, see the IAM documentation.