Resource types that accept IAM policies

This page lists the resource types on which you can set Identity and Access Management (IAM) policies.

Note: Policies set on a parent resource (a project, folder, or organization) are inherited by the resource's children, regardless of the policy set on the child resource itself. For example, if the policy for a project grants a user the ability to administer Compute Engine virtual machine (VM) instances, then the user can administer any Compute Engine VM in that project, regardless of the policy you set on each VM.

Select a service to see which of its resource types support IAM policies:

All services Identity-Aware Proxy   API Gateway   Apigee   BigQuery   BigQuery Connection API   Cloud Bigtable   Binary Authorization   Cloud Billing   Cloud Functions   Cloud IoT   Cloud Key Management Service   Resource Manager   Cloud Tasks   Compute Engine   Container Analysis   Data Catalog   Cloud Data Fusion   Database Migration Service   Dataproc   Cloud Deployment Manager   Cloud Domains   Eventarc   Game Servers   GKE Hub   Cloud Healthcare API   Identity and Access Management   Managed Service for Microsoft Active Directory   Dataproc Metastore   AI Platform   Network Connectivity Center   Network Management API   AI Platform Notebooks   Certificate Authority Service   Pub/Sub   Cloud Run   Secret Manager   Security Command Center   Service Directory   Service Management   Cloud Source Repositories   Cloud Spanner   Cloud Storage   Artifact Registry   AutoML  

Service	Resources that accept IAM policies
Identity-Aware Proxy	All web services Individual web services Tunnel Tunnel instances Tunnel zones Web service types Web service versions
API Gateway	APIs Configs Gateways
Apigee	Environments
BigQuery	Row access policies Tables
BigQuery Connection API	Connections
Cloud Bigtable	Backups Instances Tables
Binary Authorization	Attestors Policy
Cloud Billing	Billing accounts
Cloud Functions	Functions
Cloud IoT	Groups Registries
Cloud Key Management Service	Crypto keys Import jobs Key rings
Resource Manager	Folders Organizations Projects Tag keys Tag values
Cloud Tasks	Queues
Compute Engine	Disks Firewall policies Images Instance templates Instances Licenses Node groups Node templates Region disks Reservations Resource policies Snapshots Subnetworks
Container Analysis	Notes Occurrences
Data Catalog	Entry groups Policy tags Tag templates Taxonomies
Cloud Data Fusion	Instances
Database Migration Service	Connection profiles Migration jobs
Dataproc	Autoscaling policies Clusters Jobs Operations Workflow templates
Cloud Deployment Manager	Deployments
Cloud Domains	Registrations
Eventarc	Triggers
Game Servers	Game server deployments
GKE Hub	Memberships
Cloud Healthcare API	Consent stores DICOM stores Datasets FHIR stores HL7v2 stores
Identity and Access Management	Service accounts
Managed Service for Microsoft Active Directory	Domains
Dataproc Metastore	Services
AI Platform	Jobs Models
Network Connectivity Center	Hubs Internal ranges Policy based routes Spokes
Network Management API	Connectivity tests
AI Platform Notebooks	Instances
Certificate Authority Service	Certificate authorities Certificate revocation lists Reusable configs
Pub/Sub	Schemas Snapshots Subscriptions Topics
Cloud Run	Services
Secret Manager	Secrets
Security Command Center	Sources
Service Directory	Namespaces Services
Service Management	Consumers Services
Cloud Source Repositories	Repos
Cloud Spanner	Backups Databases Instances
Cloud Storage	Buckets
Artifact Registry	Repositories
AutoML	Datasets Locations Models