When you use Cloud Load Balancing, you make API requests. Each API request requires that the Identity and Access Management (IAM) principal who makes the request has appropriate permission to create, modify, or delete the associated resources.
In IAM, permission to access a Google Cloud resource isn't granted directly to the end user. Instead, permissions are grouped into roles, and roles are granted to authenticated principals. Principals can be of the following types: a user, group, service account, or Google domain. An IAM policy defines and enforces what roles are granted to which principals, and this policy is then attached to a resource.
This page provides an overview of relevant IAM roles and permissions for Cloud Load Balancing. For a detailed description of IAM, see the IAM documentation.
Roles and permissions
To follow the examples in the load balancing how-to guides, principals need to create instances, firewall rules, and VPC networks. You can provide the necessary permissions in one of the following ways:
Grant the predefined roles that are related to load balancing. To view the specific permissions included in the predefined roles, see the following sections:
- Compute Load Balancer Admin role
(
roles/compute.loadBalancerAdmin) - Compute Network Admin role
(
roles/compute.networkAdmin) - Compute Security Admin role
(
roles/compute.securityAdmin) - Compute Instance Admin role
(
roles/compute.instanceAdmin)
- Compute Load Balancer Admin role
(
Create and grant custom roles that at least contain the permissions included in the predefined roles.
Use basic roles, making the principals project owners or editors. Whenever possible, avoid using the basic roles; they grant a large number of permissions, which violates the principle of least privilege.
Role change latency
Cloud Load Balancing caches IAM permissions for five minutes, so it takes up to five minutes for a role change to become effective.
Managing Access Control for Cloud Load Balancing using IAM
You can get and set IAM policies using the Google Cloud console, the IAM API, or the Google Cloud CLI. See Granting, changing, and revoking access for details.
What's next
- Learn more about IAM.
- Grant IAM roles.
- Learn about IAM Conditions for forwarding rules.
- Learn about organization policy constraints for Cloud Load Balancing.