A role contains a set of permissions that allows you to perform specific actions on Google Cloud resources. To make permissions available to principals, including users, groups, and service accounts, you grant roles to the principals.
This page describes the IAM roles that you can grant.
Prerequisite for this guide
- Understand the basic concepts of IAM
Role types
There are three types of roles in IAM:
- Basic roles, which include the Owner, Editor, and Viewer roles that existed prior to the introduction of IAM.
- Predefined roles, which provide granular access for a specific service and are managed by Google Cloud.
- Custom roles, which provide granular access according to a user-specified list of permissions.
To determine if a permission is included in a basic, predefined, or custom role, you can use one of the following methods:
- Run the
gcloud iam roles describecommand to list the permissions in the role. - Call the
roles.get()REST API method to list the permissions in the role. - For basic and predefined roles only: Search the permissions reference to see if the permission is granted by the role.
- For predefined roles only: Search the predefined role descriptions on this page to see which permissions the role includes.
The sections below describe each role type and provide examples of how to use them.
Basic roles
There are several basic roles that existed prior to the introduction of IAM: Owner, Editor, and Viewer. These roles are concentric; that is, the Owner role includes the permissions in the Editor role, and the Editor role includes the permissions in the Viewer role. They were originally known as "primitive roles."
The following table summarizes the permissions that the basic roles include across all Google Cloud services:
Basic role definitions
| Name | Title | Permissions |
|---|---|---|
roles/viewer |
Viewer | Permissions for read-only actions that do not affect state, such as viewing (but not modifying) existing resources or data. |
roles/editor |
Editor |
All viewer permissions, plus permissions for actions that modify
state, such as changing existing resources.
Note:
The Editor role contains permissions to create and delete resources for
most Google Cloud services. However, it does not contain
permissions to perform all actions for all services. See the
section above for more information on how to
check if a role has the permissions that you need.
|
roles/owner |
Owner |
All Editor permissions and permissions for the following actions:
Note:
|
You can apply basic roles at the project or service resource levels by using the
Cloud Console, the API, and the gcloud tool. See
Granting, changing, and revoking access for
instructions.
To see how to grant roles using the Cloud Console, see Granting, changing, and revoking access.
Predefined roles
In addition to the basic roles, IAM provides additional predefined roles that give granular access to specific Google Cloud resources and prevent unwanted access to other resources. These roles are created and maintained by Google. Google automatically updates their permissions as necessary, such as when Google Cloud adds new features or services.
The following tables list these roles, their description, and the lowest-level resource type where the roles can be set. A particular role can be granted to this resource type, or in most cases any type above it in the Google Cloud resource hierarchy.
You can grant multiple roles to the same user, at any level of the resource hierarchy. For example, the same user can have the Compute Network Admin and Logs Viewer roles on a project, and also have the Pub/Sub Publisher role on a Pub/Sub topic within that project. To list the permissions contained in a role, see Getting the role metadata.
For help choosing the most appropriate predefined roles, see Choose predefined roles.
Access Approval roles
| Role | Permissions |
|---|---|
|
Access Approval Approver
Beta
Ability to view or act on access approval requests and view configuration |
|
|
Access Approval Config Editor
Beta
Ability update the Access Approval configuration |
|
|
Access Approval Viewer
Beta
Ability to view access approval requests and configuration |
|
Access Context Manager roles
| Role | Permissions |
|---|---|
|
Cloud Access Binding Admin
Create, edit, and change Cloud access bindings. |
|
|
Cloud Access Binding Reader
Read access to Cloud access bindings. |
|
|
Access Context Manager Admin
Full access to policies, access levels, and access zones |
|
|
Access Context Manager Editor
Edit access to policies. Create, edit, and change access levels and access zones. |
|
|
Access Context Manager Reader
Read access to policies, access levels, and access zones. |
|
|
VPC Service Controls Troubleshooter Viewer
|
|
Actions roles
| Role | Permissions |
|---|---|
|
Actions Admin
Access to edit and deploy an action |
|
|
Actions Viewer
Access to view an action |
|
AI Notebooks roles
| Role | Permissions |
|---|---|
|
Notebooks Admin
Full access to Notebooks, all resources. Lowest-level resources where you can grant this role:
|
|
|
Notebooks Legacy Admin
Full access to Notebooks all resources through compute API. |
|
|
Notebooks Legacy Viewer
Read-only access to Notebooks all resources through compute API. |
|
|
Notebooks Runner
Restricted access for running scheduled Notebooks. |
|
|
Notebooks Viewer
Read-only access to Notebooks, all resources. Lowest-level resources where you can grant this role:
|
|
AI Platform roles
| Role | Permissions |
|---|---|
|
AI Platform Admin
Provides full access to AI Platform resources, and its jobs, operations, models, and versions. Lowest-level resources where you can grant this role:
|
|
|
AI Platform Developer
Provides ability to use AI Platform resources for creating models, versions, jobs for training and prediction, and sending online prediction requests. Lowest-level resources where you can grant this role:
|
|
|
AI Platform Job Owner
Provides full access to all permissions for a particular job resource. This role is automatically granted to the user who creates the job. Lowest-level resources where you can grant this role:
|
|
|
AI Platform Model Owner
Provides full access to the model and its versions. This role is automatically granted to the user who creates the model. Lowest-level resources where you can grant this role:
|
|
|
AI Platform Model User
Provides permissions to read the model and its versions, and use them for prediction. Lowest-level resources where you can grant this role:
|
|
|
AI Platform Operation Owner
Provides full access to all permissions for a particular operation resource. Lowest-level resources where you can grant this role:
|
|
|
AI Platform Viewer
Provides read-only access to AI Platform resources. Lowest-level resources where you can grant this role:
|
|
Android Management roles
| Role | Permissions |
|---|---|
|
Android Management User
Full access to manage devices. |
|
Anthos Multi-cloud roles
| Role | Permissions |
|---|---|
|
Anthos Multi-cloud Admin
Admin access to Anthos Multi-cloud resources. |
|
|
Anthos Multi-cloud Telemetry Writer
Grant access to write cluster telemetry data such as logs, metrics, and resource metadata. |
|
|
Anthos Multi-cloud Viewer
Viewer access to Anthos Multi-cloud resources. |
|
API Gateway roles
| Role | Permissions |
|---|---|
|
ApiGateway Admin
Full access to ApiGateway and related resources. |
|
|
ApiGateway Viewer
Read-only access to ApiGateway and related resources. |
|
Apigee roles
| Role | Permissions |
|---|---|
|
Apigee Organization Admin
Full access to all apigee resource features |
|
|
Apigee Analytics Agent
Curated set of permissions for Apigee Universal Data Collection Agent to manage analytics for an Apigee Organization |
|
|
Apigee Analytics Editor
Analytics editor for an Apigee Organization |
|
|
Apigee Analytics Viewer
Analytics viewer for an Apigee Organization |
|
|
Apigee API Admin
Full read/write access to all apigee API resources |
|
|
Apigee API Reader
Reader of apigee resources |
|
|
Apigee Developer Admin
Developer admin of apigee resources |
|
|
Apigee Environment Admin
Full read/write access to apigee environment resources, including deployments. |
|
|
Apigee Monetization Admin
All permissions related to monetization |
|
|
Apigee Portal Admin
Portal admin for an Apigee Organization |
|
|
Apigee Read-only Admin
Viewer of all apigee resources |
|
|
Apigee Runtime Agent
Curated set of permissions for a runtime agent to access Apigee Organization resources |
|
|
Apigee Security Admin
Security admin for an Apigee Organization |
|
|
Apigee Security Viewer
Security viewer for an Apigee Organization |
|
|
Apigee Synchronizer Manager
Curated set of permissions for a Synchronizer to manage environments in an Apigee Organization |
|
|
Apigee Connect Admin
Admin of Apigee Connect |
|
|
Apigee Connect Agent
Ability to set up Apigee Connect agent between external clusters and Google. |
|
App Engine roles
| Role | Permissions |
|---|---|
|
App Engine Admin
Read/Write/Modify access to all application configuration and settings. To deploy new versions, a principal must have the
Service Account User
( Lowest-level resources where you can grant this role:
|
|
|
App Engine Creator
Ability to create the App Engine resource for the project. Lowest-level resources where you can grant this role:
|
|
|
App Engine Viewer
Read-only access to all application configuration and settings. Lowest-level resources where you can grant this role:
|
|
|
App Engine Code Viewer
Read-only access to all application configuration, settings, and deployed source code. Lowest-level resources where you can grant this role:
|
|
|
App Engine Deployer
Read-only access to all application configuration and settings. To deploy new versions, you must also have the
Service Account User
( Cannot modify existing versions other than deleting versions that are not receiving traffic. Lowest-level resources where you can grant this role:
|
|
|
App Engine Service Admin
Read-only access to all application configuration and settings. Write access to module-level and version-level settings. Cannot deploy a new version. Lowest-level resources where you can grant this role:
|
|
Artifact Registry roles
| Role | Permissions |
|---|---|
|
Artifact Registry Administrator
Administrator access to create and manage repositories. |
|
|
Artifact Registry Reader
Access to read repository items. |
|
|
Artifact Registry Repository Administrator
Access to manage artifacts in repositories. |
|
|
Artifact Registry Writer
Access to read and write repository items. |
|
Assured Workloads roles
| Role | Permissions |
|---|---|
|
Assured Workloads Administrator
Grants full access to Assured Workloads resources, CRM resources - project/folder and Organization Policy administration |
|
|
Assured Workloads Editor
Grants read, write access to Assured Workloads resources, CRM resources - project/folder and Organization Policy administration |
|
|
Assured Workloads Reader
Grants read access to all Assured Workloads resources and CRM resources - project/folder |
|
AutoML roles
| Role | Permissions |
|---|---|
|
AutoML Admin
Beta
Full access to all AutoML resources Lowest-level resources where you can grant this role:
|
|
|
AutoML Editor
Beta
Editor of all AutoML resources Lowest-level resources where you can grant this role:
|
|
|
AutoML Predictor
Beta
Predict using models Lowest-level resources where you can grant this role:
|
|
|
AutoML Viewer
Beta
Viewer of all AutoML resources Lowest-level resources where you can grant this role:
|
|
BigQuery roles
| Role | Permissions |
|---|---|
|
BigQuery Admin
Provides permissions to manage all resources within the project. Can manage all data within the project, and can cancel jobs from other users running within the project. Lowest-level resources where you can grant this role:
|
|
|
BigQuery Connection Admin
|
|
|
BigQuery Connection User
|
|
|
BigQuery Data Editor
When applied to a table or view, this role provides permissions to:
This role cannot be applied to individual models or routines. When applied to a dataset, this role provides permissions to:
When applied at the project or organization level, this role can also create new datasets. Lowest-level resources where you can grant this role:
|
|
|
BigQuery Data Owner
When applied to a table or view, this role provides permissions to:
This role cannot be applied to individual models or routines. When applied to a dataset, this role provides permissions to:
When applied at the project or organization level, this role can also create new datasets. Lowest-level resources where you can grant this role:
|
|
|
BigQuery Data Viewer
When applied to a table or view, this role provides permissions to:
This role cannot be applied to individual models or routines. When applied to a dataset, this role provides permissions to:
When applied at the project or organization level, this role can also enumerate all datasets in the project. Additional roles, however, are necessary to allow the running of jobs. Lowest-level resources where you can grant this role:
|
|
|
BigQuery Filtered Data Viewer
Access to view filtered table data defined by a row access policy |
|
|
BigQuery Job User
Provides permissions to run jobs, including queries, within the project. Lowest-level resources where you can grant this role:
|
|
|
BigQuery Metadata Viewer
When applied to a table or view, this role provides permissions to:
This role cannot be applied to individual models or routines. When applied to a dataset, this role provides permissions to:
When applied at the project or organization level, this role provides permissions to:
Additional roles are necessary to allow the running of jobs. Lowest-level resources where you can grant this role:
|
|
|
BigQuery Read Session User
Access to create and use read sessions |
|
|
BigQuery Resource Admin
Administer all BigQuery resources. |
|
|
BigQuery Resource Editor
Manage all BigQuery resources, but cannot make purchasing decisions. |
|
|
BigQuery Resource Viewer
View all BigQuery resources but cannot make changes or purchasing decisions. |
|
|
BigQuery User
When applied to a dataset, this role provides the ability to read the dataset's metadata and list tables in the dataset. When applied to a project, this role also provides the ability to run jobs, including queries,
within the project. A principal with this role can enumerate their own jobs, cancel their own jobs, and
enumerate datasets within a project. Additionally, allows the creation of new datasets within the
project; the creator is granted the BigQuery Data Owner role ( Lowest-level resources where you can grant this role:
|
|
Billing roles
| Role | Permissions |
|---|---|
|
Billing Account Administrator
Provides access to see and manage all aspects of billing accounts. Lowest-level resources where you can grant this role:
|
|
|
Billing Account Costs Manager
Can view and export cost information of billing accounts. |
|
|
Billing Account Creator
Provides access to create billing accounts. Lowest-level resources where you can grant this role:
|
|
|
Project Billing Manager
Provides access to assign a project's billing account or disable its billing. Lowest-level resources where you can grant this role:
|
|
|
Billing Account User
Provides access to associate projects with billing accounts. Lowest-level resources where you can grant this role:
|
|
|
Billing Account Viewer
View billing account cost information and transactions. Lowest-level resources where you can grant this role:
|
|
Binary Authorization roles
CA Service roles
| Role | Permissions |
|---|---|
|
CA Service Admin
Full access to all CA Service resources. |
|
|
CA Service Auditor
Read-only access to all CA Service resources. |
|
|
CA Service Operation Manager
Create and manage CAs, revoke certificates, create certificates templates, and read-only access for CA Service resources. |
|
|
CA Service Certificate Manager
Create certificates and read-only access for CA Service resources. |
|
|
CA Service Certificate Requester
Request certificates from CA Service. |
|
|
CA Service Certificate Template User
Read, list and use certificate templates. |
|
|
CA Service Workload Certificate Requester
Request certificates from CA Service with caller's identity. |
|
Cloud Asset roles
| Role | Permissions |
|---|---|
|
Cloud Asset Owner
Full access to cloud assets metadata |
|
|
Cloud Asset Viewer
Read only access to cloud assets metadata |
|
Cloud Bigtable roles
| Role | Permissions |
|---|---|
|
Bigtable Administrator
Administers all instances within a project, including the data stored within tables. Can create new instances. Intended for project administrators. Lowest-level resources where you can grant this role:
|
|
|
Bigtable Reader
Provides read-only access to the data stored within tables. Intended for data scientists, dashboard generators, and other data-analysis scenarios. Lowest-level resources where you can grant this role:
|
|
|
Bigtable User
Provides read-write access to the data stored within tables. Intended for application developers or service accounts. Lowest-level resources where you can grant this role:
|
|
|
Bigtable Viewer
Provides no data access. Intended as a minimal set of permissions to access the Cloud Console for Bigtable. Lowest-level resources where you can grant this role:
|
|
Cloud Build roles
| Role | Permissions |
|---|---|
|
Cloud Build Approver
Can approve or reject pending builds. |
|
|
Cloud Build Service Account
Provides access to perform builds. |
|
|
Cloud Build Editor
Provides access to create and cancel builds. Lowest-level resources where you can grant this role:
|
|
|
Cloud Build Viewer
Provides access to view builds. Lowest-level resources where you can grant this role:
|
|
|
Cloud Build Integrations Editor
Can update Integrations |
|
|
Cloud Build Integrations Owner
Can create/delete Integrations |
|
|
Cloud Build Integrations Viewer
Can view Integrations |
|
|
Cloud Build WorkerPool Editor
Can update and view WorkerPools |
|
|
Cloud Build WorkerPool Owner
Can create, delete, update, and view WorkerPools |
|
|
Cloud Build WorkerPool User
Can run builds in the WorkerPool |
|
|
Cloud Build WorkerPool Viewer
Can view WorkerPools |
|
Cloud Composer roles
| Role | Permissions |
|---|---|
|
Cloud Composer v2 API Service Agent Extension
Cloud Composer v2 API Service Agent Extension is a supplementary role required to manage Composer v2 environments. |
|
|
Composer Administrator
Provides full control of Cloud Composer resources. Lowest-level resources where you can grant this role:
|
|
|
Environment and Storage Object Administrator
Provides full control of Cloud Composer resources and of the objects in all project buckets. Lowest-level resources where you can grant this role:
|
|
|
Environment User and Storage Object Viewer
Provides the permissions necessary to list and get Cloud Composer environments and operations. Provides read-only access to objects in all project buckets. Lowest-level resources where you can grant this role:
|
|
|
Composer Shared VPC Agent
Role that should be assigned to Composer Agent service account in Shared VPC host project |
|
|
Composer User
Provides the permissions necessary to list and get Cloud Composer environments and operations. Lowest-level resources where you can grant this role:
|
|
|
Composer Worker
Provides the permissions necessary to run a Cloud Composer environment VM. Intended for service accounts. Lowest-level resources where you can grant this role:
|
|
Cloud Connectors roles
| Role | Permissions |
|---|---|
|
Connector Admin
Full access to all resources of Connectors Service. |
|
|
Connectors Viewer
Read-only access to Connectors all resources. |
|
Cloud Data Fusion roles
| Role | Permissions |
|---|---|
|
Cloud Data Fusion Admin
Beta
Full access to Cloud Data Fusion Instances, Namespaces and related resources. Lowest-level resources where you can grant this role:
|
|
|
Cloud Data Fusion Runner
Beta
Access to Cloud Data Fusion runtime resources. |
|
|
Cloud Data Fusion Viewer
Beta
Read-only access to Cloud Data Fusion Instances, Namespaces and related resources. Lowest-level resources where you can grant this role:
|
|
Cloud Data Labeling roles
| Role | Permissions |
|---|---|
|
Data Labeling Service Admin
Beta
Full access to all Data Labeling resources |
|
|
Data Labeling Service Editor
Beta
Editor of all Data Labeling resources |
|
|
Data Labeling Service Viewer
Beta
Viewer of all Data Labeling resources |
|
Cloud Debugger roles
| Role | Permissions |
|---|---|
|
Cloud Debugger Agent
Beta
Provides permissions to register the debug target, read active breakpoints, and report breakpoint results. Lowest-level resources where you can grant this role:
|
|
|
Cloud Debugger User
Beta
Provides permissions to create, view, list, and delete breakpoints (snapshots & logpoints) as well as list debug targets (debuggees). Lowest-level resources where you can grant this role:
|
|
Cloud Deploy roles
| Role | Permissions |
|---|---|
|
Cloud Deploy Admin
Beta
Full control of Cloud Deploy resources. |
|
|
Cloud Deploy Approver
Beta
Permission to approve or reject rollouts. |
|
|
Cloud Deploy Developer
Beta
Permission to manage deployment configuration without permission to access operational resources, such as targets. |
|
|
Cloud Deploy Runner
Beta
Permission to execute Cloud Deploy work without permission to deliver to a target. |
|
|
Cloud Deploy Operator
Beta
Permission to manage deployment configuration. |
|
|
Cloud Deploy Releaser
Beta
Permission to create Cloud Deploy releases and rollouts. |
|
|
Cloud Deploy Viewer
Beta
Can view Cloud Deploy resources. |
|
Cloud DLP roles
| Role | Permissions |
|---|---|
|
DLP Administrator
Administer DLP including jobs and templates. |
|
|
DLP Analyze Risk Templates Editor
Edit DLP analyze risk templates. |
|
|
DLP Analyze Risk Templates Reader
Read DLP analyze risk templates. |
|
|
DLP Column Data Profiles Reader
Read DLP column profiles. |
|
|
DLP Data Profiles Reader
Read DLP profiles. |
|
|
DLP De-identify Templates Editor
Edit DLP de-identify templates. |
|
|
DLP De-identify Templates Reader
Read DLP de-identify templates. |
|
|
DLP Cost Estimation
Manage DLP Cost Estimates. |
|
|
DLP Inspect Findings Reader
Read DLP stored findings. |
|
|
DLP Inspect Templates Editor
Edit DLP inspect templates. |
|
|
DLP Inspect Templates Reader
Read DLP inspect templates. |
|
|
DLP Job Triggers Editor
Edit job triggers configurations. |
|
|
DLP Job Triggers Reader
Read job triggers. |
|
|
DLP Jobs Editor
Edit and create jobs |
|
|
DLP Jobs Reader
Read jobs |
|
|
DLP Organization Data Profiles Driver
Permissions needed by the DLP service account to generate data profiles within an organization or folder. |
|
|
DLP Project Data Profiles Reader
Read DLP project profiles. |
|
|
DLP Project Data Profiles Driver
Permissions needed by the DLP service account to generate data profiles within a project. |
|
|
DLP Reader
Read DLP entities, such as jobs and templates. |
|
|
DLP Stored InfoTypes Editor
Edit DLP stored info types. |
|
|
DLP Stored InfoTypes Reader
Read DLP stored info types. |
|
|
DLP Table Data Profiles Reader
Read DLP table profiles. |
|
|
DLP User
Inspect, Redact, and De-identify Content |
|
Cloud Domains roles
| Role | Permissions |
|---|---|
|
Cloud Domains Admin
Full access to Cloud Domains Registrations and related resources. |
|
|
Cloud Domains Viewer
Read-only access to Cloud Domains Registrations and related resources. |
|
Cloud Filestore roles
| Role | Permissions |
|---|---|
|
Cloud Filestore Editor
Beta
Read-write access to Filestore instances and related resources. |
|
|
Cloud Filestore Viewer
Beta
Read-only access to Filestore instances and related resources. |
|
Cloud Functions roles
| Role | Permissions |
|---|---|
|
Cloud Functions Admin
Full access to functions, operations and locations. |
|
|
Cloud Functions Developer
Read and write access to all functions-related resources. |
|
|
Cloud Functions Invoker
Ability to invoke HTTP functions with restricted access. |
|
|
Cloud Functions Viewer
Read-only access to functions and locations. |
|
Cloud Game Services roles
| Role | Permissions |
|---|---|
|
Game Services API Admin
Full access to Game Services API and related resources. |
|
|
Game Services API Viewer
Read-only access to Game Services API and related resources. |
|
Cloud Healthcare roles
| Role | Permissions |
|---|---|
|
Healthcare Annotation Editor
Create, delete, update, read and list annotations. |
|
|
Healthcare Annotation Reader
Read and list annotations in an Annotation store. |
|
|
Healthcare Annotation Administrator
Administer Annotation stores. |
|
|
Healthcare Annotation Store Viewer
List Annotation Stores in a dataset. |
|
|
Healthcare Attribute Definition Editor
Edit AttributeDefinition objects. |
|
|
Healthcare Attribute Definition Reader
Read AttributeDefinition objects in a consent store. |
|
|
Healthcare Consent Artifact Administrator
Administer ConsentArtifact objects. |
|
|
Healthcare Consent Artifact Editor
Edit ConsentArtifact objects. |
|
|
Healthcare Consent Artifact Reader
Read ConsentArtifact objects in a consent store. |
|
|
Healthcare Consent Editor
Edit Consent objects. |
|
|
Healthcare Consent Reader
Read Consent objects in a consent store. |
|
|
Healthcare Consent Store Administrator
Administer Consent stores. |
|
|
Healthcare Consent Store Viewer
List Consent Stores in a dataset. |
|
|
Healthcare Dataset Administrator
Administer Healthcare Datasets. |
|
|
Healthcare Dataset Viewer
List the Healthcare Datasets in a project. |
|
|
Healthcare DICOM Editor
Edit DICOM images individually and in bulk. |
|
|
Healthcare DICOM Store Administrator
Administer DICOM stores. |
|
|
Healthcare DICOM Store Viewer
List DICOM Stores in a dataset. |
|
|
Healthcare DICOM Viewer
Retrieve DICOM images from a DICOM store. |
|
|
Healthcare FHIR Resource Editor
Create, delete, update, read and search FHIR resources. |
|
|
Healthcare FHIR Resource Reader
Read and search FHIR resources. |
|
|
Healthcare FHIR Store Administrator
Administer FHIR resource stores. |
|
|
Healthcare FHIR Store Viewer
List FHIR Stores in a dataset. |
|
|
Healthcare HL7v2 Message Consumer
List and read HL7v2 messages, update message labels, and publish new messages. |
|
|
Healthcare HL7v2 Message Editor
Read, write, and delete access to HL7v2 messages. |
|
|
Healthcare HL7v2 Message Ingest
Ingest HL7v2 messages received from a source network. |
|
|
Healthcare HL7v2 Store Administrator
Administer HL7v2 Stores. |
|
|
Healthcare HL7v2 Store Viewer
View HL7v2 Stores in a dataset. |
|
|
Healthcare NLP Service Viewer
Beta
Extract and analyze medical entities from a given text. |
|
|
Healthcare User Data Mapping Editor
Edit UserDataMapping objects. |
|
|
Healthcare User Data Mapping Reader
Read UserDataMapping objects in a consent store. |
|
Cloud IAP roles
| Role | Permissions |
|---|---|
|
IAP Policy Admin
Provides full access to Identity-Aware Proxy resources. Lowest-level resources where you can grant this role:
|
|
|
IAP-secured Web App User
Provides permission to access HTTPS resources which use Identity-Aware Proxy. |
|
|
IAP Settings Admin
Administrator of IAP Settings. |
|
|
IAP-secured Tunnel User
Access Tunnel resources which use Identity-Aware Proxy |
|
Cloud IoT roles
| Role | Permissions |
|---|---|
|
Cloud IoT Admin
Full control of all Cloud IoT resources and permissions. Lowest-level resources where you can grant this role:
|
|
|
Cloud IoT Device Controller
Access to update the device configuration, but not to create or delete devices. Lowest-level resources where you can grant this role:
|
|
|
Cloud IoT Editor
Read-write access to all Cloud IoT resources. Lowest-level resources where you can grant this role:
|
|
|
Cloud IoT Provisioner
Access to create and delete devices from registries, but not to modify the registries, and enable devices to publish to topics associated with IoT registry. Lowest-level resources where you can grant this role:
|
|
|
Cloud IoT Viewer
Read-only access to all Cloud IoT resources. Lowest-level resources where you can grant this role:
|
|
Cloud KMS roles
| Role | Permissions |
|---|---|
|
Cloud KMS Admin
Provides full access to Cloud KMS resources, except encrypt and decrypt operations. Lowest-level resources where you can grant this role:
|
|