This page describes how you can control Memorystore for Redis project access and permissions using Identity and Access Management (IAM).
Overview
Google Cloud offers IAM, which lets you give more granular access to specific Google Cloud resources and prevents unwanted access to other resources. This page describes the Memorystore for Redis IAM roles and permissions. For a detailed description of roles and permissions, see the IAM documentation.
Memorystore for Redis provides a set of predefined roles designed to help you easily control access to your Redis resources. If the predefined roles do not provide the sets of permissions you need, you can also create your own custom roles. In addition, the older basic roles (Editor, Viewer, and Owner) are also still available to you, although they do not provide the same fine-grained control as the Memorystore for Redis roles. In particular, the basic roles provide access to resources across Google Cloud, rather than just for Memorystore for Redis. For more information about basic roles, see Basic roles.
Permissions and roles
This section summarizes the permissions and roles that Memorystore for Redis supports.
Predefined roles
Memorystore for Redis provides some predefined roles that you can use to provide finer-grained permissions to project members. The role you grant to a project member controls what actions the member can take. Project members can be individuals, groups, or service accounts.
You can grant multiple roles to the same project member, and if you have the permissions to do so, you can change the roles granted to a project member at any time.
The broader roles include the more narrowly defined roles. For example, the Redis Editor role includes all of the permissions of the Redis Viewer role, along with the addition of permissions for the Redis Editor role. Likewise, the Redis Admin role includes all of the permissions of the Redis Editor role, along with its additional permissions.
The basic roles (Owner, Editor, Viewer) provide permissions across Google Cloud. The roles specific to Memorystore for Redis provide only Memorystore for Redis permissions, except for the following Google Cloud permissions, which are needed for general Google Cloud usage:
resourcemanager.projects.get
resourcemanager.projects.list
The following table lists the predefined roles available for Memorystore for Redis, along with their Memorystore for Redis permissions:
Role | Name | Redis permissions | Description |
---|---|---|---|
|
Owner |
|
Full access and control for all Google Cloud resources; manage user access |
|
Editor | All redis permissions except for *.getIamPolicy &
.setIamPolicy |
Read-write access to all Google Cloud and Redis resources (full control except for the ability to modify permissions) |
|
Viewer |
|
Read-only access to all Google Cloud resources, including Redis resources |
|
Redis Admin |
|
Full control for all Memorystore for Redis resources. |
|
Redis Editor | All redis permissions except for
|
Manage Memorystore for Redis instances. Can't create or delete instances. |
|
Redis Viewer | All redis permissions except for
|
Read-only access to all Memorystore for Redis resources. |
Permissions and their roles
The following table lists each permission that Memorystore for Redis supports and the Memorystore for Redis roles that include it:
Permission | Redis role | Basic role |
---|---|---|
|
Redis Admin Redis Editor Redis Viewer |
Reader |
|
Redis Admin Redis Editor Redis Viewer |
Reader |
|
Redis Admin | Writer |
|
Redis Admin Redis Editor |
Writer |
|
Redis Admin | Writer |
|
Redis Admin | Writer |
|
Redis Admin | Writer |
|
Redis Admin | Writer |
|
Redis Admin | Writer |
|
Redis Admin | Writer |
|
Redis Admin Redis Editor Redis Viewer |
Reader |
|
Redis Admin Redis Editor Redis Viewer |
Reader |
|
Redis Admin Redis Editor Redis Viewer |
Reader |
|
Redis Admin Redis Editor Redis Viewer |
Reader |
|
Redis Admin | Writer |
Custom roles
If the predefined roles do not address your unique business requirements, you
can define your own custom roles with permissions that you specify. To support
this, IAM offers custom roles. When you create custom roles
for Memorystore for Redis, make sure that you include
both resourcemanager.projects.get
and resourcemanager.projects.list
.
Otherwise, the Google Cloud Console will not function correctly
for Memorystore for Redis. For more information, see
Permission dependencies.
Required permissions for common tasks in the Cloud Console
To enable a user to work with Memorystore for Redis using
the Cloud Console, the user's role must include the
resourcemanager.projects.get
and the resourcemanager.projects.list
permission.
The following table provides the other permissions required for some common tasks in the Cloud Console:
Task | Required additional permissions |
---|---|
Display the instance listing page |
|
Creating and editing an instance |
|
Deleting an instance |
|
Connecting to an instance from the Cloud Shell |
|
Viewing instance information |
|
Importing and exporting RDB backup files |
|
Upgrading the Redis version of an instance |
|
Required permissions for gcloud commands
To enable a user to work with Memorystore for Redis using gcloud
commands,
the user's role must include the resourcemanager.projects.get
and the
resourcemanager.projects.list
permission.
The following table lists the permissions that the user invoking a gcloud
command must have for each gcloud redis
subcommand:
Command | Required permissions |
---|---|
gcloud redis instances auth |
|
gcloud redis instances create |
|
gcloud redis instances delete |
|
gcloud redis instances update |
|
gcloud redis instances list |
|
gcloud redis instances describe |
|
gcloud redis instances import |
|
gcloud redis instances export |
|
gcloud redis instances upgrade |
|
gcloud redis operations list |
|
gcloud redis operations describe |
|
gcloud redis regions list |
|
gcloud redis regions describe |
|
gcloud redis zones list |
|
Required permissions for API methods
The following table lists the permissions that the caller must have to call each
method in the Memorystore for Redis API or to perform tasks
using Google Cloud tools that use the API
(such as the Cloud Console or the gcloud
command line tool):
Method | Required permissions |
---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Redis AUTH permissions
The following table shows the minimum permissions a user needs to complete some basic Memorystore for Redis AUTH tasks.
Permissions needed | Create a Memorystore instance with Redis AUTH enabled | Enable / disable AUTH on an existing Redis instance | View the AUTH string | View whether AUTH is enabled / disabled for a Redis instance |
---|---|---|---|---|
redis.instances.create | ✓ | X | X | X |
redis.instances.update | X | ✓ | X | X | redis.instances.get | X | X | X | ✓ |
redis.instances.updateAuth | ✓ | ✓ | X | X |
redis.instances.getAuthString | X | X | ✓ | X |
In-transit encryption permissions
The table below shows permissions required for enabling and managing In-transit encryption for Memorystore for Redis.
Permissions needed | Create a Memorystore instance with in-transit encryption | Download the Certificate Authority |
---|---|---|
redis.instances.create | ✓ | X |
redis.instances.get | X | ✓ |
What's next
- Learn how to grant and revoke access to project members.
- Learn more about IAM.
- Learn more about custom roles.