Access control with IAM

This page describes the access control options that are available to you in Eventarc.


Eventarc uses Identity and Access Management (IAM) for access control.

For an introduction to IAM and its features, see the IAM overview. To learn how to grant and revoke access, see Granting, changing, and revoking access to resources.

For lists of the permissions and roles that Eventarc supports, see the following sections.

Enabling the Eventarc API

To view and assign IAM roles for Eventarc, you must enable the Eventarc API for your project. You will not be able to see the Eventarc roles in the Cloud Console until you enable the API.

Enable the API

Predefined roles

The following table lists the Eventarc predefined IAM roles with a corresponding list of all the permissions each role includes.

The predefined roles address most typical use cases. If your use case isn't covered by the predefined roles, you can create an IAM custom role.

Eventarc roles

Role Permissions

Eventarc Admin

Full control over all Eventarc resources.

  • eventarc.*
  • resourcemanager.projects.get
  • resourcemanager.projects.list

Eventarc Developer

Access to read and write Eventarc resources.

  • eventarc.locations.*
  • eventarc.operations.*
  • eventarc.triggers.create
  • eventarc.triggers.delete
  • eventarc.triggers.get
  • eventarc.triggers.getIamPolicy
  • eventarc.triggers.list
  • eventarc.triggers.undelete
  • eventarc.triggers.update
  • resourcemanager.projects.get
  • resourcemanager.projects.list

Eventarc Event Receiver

Can receive events from all event providers.


Eventarc Viewer

Can view the state of all Eventarc resources, including IAM policies.

  • eventarc.locations.*
  • eventarc.operations.get
  • eventarc.operations.list
  • eventarc.triggers.get
  • eventarc.triggers.getIamPolicy
  • eventarc.triggers.list
  • resourcemanager.projects.get
  • resourcemanager.projects.list

For more information on Eventarc roles and permissions, see Roles and permissions.

Project-level IAM management

At the project level, you can grant, change, and revoke IAM roles using the Google Cloud Console, the IAM API, or the gcloud command-line tool. For instructions, see Granting, changing, and revoking access to resources.

What's next

Learn more about IAM.