Resource types that accept IAM policies

This page lists the resource types on which you can set Identity and Access Management (IAM) policies.

Note: Policies set on a parent resource (a project, folder, or organization) are inherited by the resource's children, regardless of the policy set on the child resource itself. For example, if the policy for a project grants a user the ability to administer Compute Engine virtual machine (VM) instances, then the user can administer any Compute Engine VM in that project, regardless of the policy you set on each VM.

Select a service to see which of its resource types support IAM policies:

All services AI Platform   AI Platform Notebooks Apigee Artifact Registry AutoML BigQuery Cloud Bigtable Binary Authorization Cloud Billing Cloud Data Fusion Cloud Deployment Manager Cloud Functions Cloud Healthcare API Cloud IoT Cloud Key Management Service Cloud Run  Cloud Runtime Configuration API Cloud Source Repositories Cloud Spanner Cloud Storage Cloud Tasks Compute Engine Container Analysis Data Catalog Dataproc Game Servers Identity and Access Management Identity-Aware Proxy Managed Service for Microsoft Active Directory Network Management API Pub/Sub Resource Manager Secret Manager Security Command Center Service Directory Service Management

Service	Resources that accept IAM policies
AI Platform	Jobs (training) Jobs (predicting) Models
AI Platform Notebooks	Instances
Apigee	Environments
Artifact Registry	Repositories
AutoML	Datasets Locations Models
BigQuery	Connections
Cloud Bigtable	Backups Instances Tables
Binary Authorization	Attestors Policy
Cloud Billing	Accounts
Cloud Data Fusion	Instances
Cloud Deployment Manager	Deployments
Cloud Functions	Functions
Cloud Healthcare API	Datasets DICOM stores FHIR stores H17v2 stores
Cloud IoT	Registries
Cloud Key Management Service	Cryptographic keys Import jobs Key rings
Cloud Run	Services
Cloud Runtime Configuration API	Configs
Cloud Source Repositories	Repos
Cloud Spanner	Backups Databases Instances
Cloud Storage	Buckets
Cloud Tasks	Queues
Compute Engine	Backend buckets Disks Images Instance templates Instances Licenses Machine images Node groups Node templates Region disks Reservations Resource policies Snapshots Subnetworks
Container Analysis	Notes Occurrences
Data Catalog	Entries Entry groups Policy tags Tag templates Taxonomies
Dataproc	Autoscaling policies (for locations) Autoscaling policies (for regions) Clusters Jobs Operations Workflow templates (for locations) Workflow templates (for regions)
Game Servers	Game server deployments
Identity and Access Management	Service accounts
Identity-Aware Proxy	Tunnel Tunnel instances Tunnel zones Web Web service versions Web services Web types
Managed Service for Microsoft Active Directory	Domains
Network Management API	Connectivity tests
Pub/Sub	Snapshots Subscriptions Topics
Resource Manager	Folders Organizations Projects
Secret Manager	Secrets
Security Command Center	Sources
Service Directory	Namespaces Services
Service Management	Consumers Services