IAM permissions for Migrate for Compute Engine

This topic lists Identity and Access Management (IAM) roles required for users setting up and using Migrate for Compute Engine on Google Cloud, as well as for Migrate for Compute Engine components performing migration actions at runtime.

You assign roles and permissions to:

• Grant user access for creating service accounts that Migrate for Compute Engine components will use at runtime.
• Grant user access for installing and using the Migrate for Compute Engine Manager. In particular, you can grant permissions that will allow users to deploy and use Migrate for Compute Engine Manager instances (or to have read-only access to migration configuration).
• Grant Migrate for Compute Engine components the access they need to manage Google Cloud resources at runtime, including Compute Engine VM instances, Cloud Storage, and others.

For a list of permissions granted with each role, see Understanding roles.

For general information on granting roles, see Granting, changing, and revoking access to resources.

Roles required for creating service accounts

In order to create service accounts, the user you are logged in with needs to have the following roles:

Role	Permissions	Description
roles/resourcemanager.organizationAdmin	Administer all resources belonging to the organization.	Allows users to create a service account for in a project within an organization.
roles/iam.serviceAccountAdmin	Create and manage service accounts.	Allows users to create a service account for the Migrate for Compute Engine Manager or Migrate for Compute Engine Cloud Extension in a project within an organization or for a standalone project. Assign these roles on the infrastructure project you created when you set up Migrate for Compute Engine on Google Cloud.
roles/resourcemanager.projectIamAdmin	Administer IAM policies on projects.

Roles required when deploying the Migrate for Compute Engine Manager

Through these roles, a user can deploy or use the Migrate for Compute Engine Manager.

Roles required to deploy the Migrate for Compute Engine Manager

Role	Permissions	Description
roles/compute.instanceAdmin	Create, modify, and delete virtual machine instances.	Allows users to deploy the Migrate for Compute Engine Manager, as well as to perform migrations. Assign these roles when you set up the Migrate for Compute Engine Manager.
roles/iam.serviceAccountUser	Run operations as the service account.
roles/vmmigration.admin	Deploy new instances of Migrate for Compute Engine Manager and get information about them.	Allows users to deploy the Migrate for Compute Engine Manager, as well as to perform migrations.

Roles required to use the Migrate for Compute Engine Manager to migrate VMs

Role	Permissions	Description
roles/vmmigration.viewer	List Migrate for Compute Engine Manager deployments and get information about them.	Allows users to retrieve information about deployed Migrate for Compute Engine Manager instances, or to view it in the Google Cloud console. Intended for users who will be performing migrations, but not setting up the system.

Roles required when migrating VMs

Through these roles, Migrate for Compute Engine components have access they need to perform migration actions at runtime. These actions include creating and accessing Google Cloud resources and manage VM storage.

When you configure the Migrate for Compute Engine Manager, these roles are automatically assigned to the service accounts you create in that process. You can also create these service accounts manually, then specify the service accounts you create when configuring the Migrate for Compute Engine Manager.

You assign these roles by adding them to service accounts you then assign to the Migrate for Compute Engine components when setting them up on Google Cloud.

Role	Permissions	Description
roles/cloudmigration.inframanager	Create and manage VMs to run Migrate for Compute Engine infrastructure	Allows Migrate for Compute Engine to create and configure the resources needed to set up the system and perform migrations.
roles/cloudmigration.storageaccess	Access migration storage.	Allows the Migrate for Compute Engine Cloud Extension to manage storage needed during migration.

Service accounts assigned to Migrate for Compute Engine instances

Through these service accounts you create, Migrate for Compute Engine components have access needed at runtime to create and use Google Cloud.

When you set up Google Cloud as a destination, you select or create these service accounts.

The following table describes the service accounts and lists the roles assigned to them. For specifics about the roles assigned to these service accounts, see VM migration roles.

Service Account (suggested name)	Required Roles	Description
Migration Manager	roles/cloudmigration.inframanager roles/iam.serviceAccountUser roles/logging.logWriter roles/monitoring.metricWriter roles/monitoring.viewer roles/iam.serviceAccountTokenCreator	Used by the Migrate for Compute Engine Manager to orchestrate migrations, deploy Cloud Extensions, and create instances in your environment for migrated VMs.
Cloud Extension	roles/cloudmigration.storageaccess roles/logging.logWriter roles/monitoring.metricWriter	Used by Cloud Extensions nodes to access storage resources.

What's next

• Learn more about IAM.
• Grant IAM roles to users.