Set up IAM permissions

This page provides instructions for how to configure Identity and Access Management (IAM) permissions for Google Cloud NetApp Volumes.

Before you begin

NetApp Volumes uses Identity and Access Management (IAM) to control access to resources.

You grant access to NetApp Volumes operations by granting IAM roles to users. Permissions are granted by the role selected for the user. The two predefined roles are roles/netapp.admin and roles/netapp.viewer. You can assign these roles to specific users or service accounts.

IAM permissions only control access to NetApp Volumes administrative operations, like creating or deleting volumes. To control access to operations on the file share, like reading or deleting data, see NFS access control and SMB access control.

For more information, refer to the permissions and roles in the IAM overview.

Set up IAM


To follow step-by-step guidance for this task directly in the Google Cloud console, click Guide me:

Guide me


Identity and Access Management roles and permissions

You can use predefined roles or you can define custom roles. NetApp Volumes supports a granular set of permissions.

Get or grant all permissions

To get the permissions that you need to perform all actions, ask your administrator to grant you the NetApp Volumes Admin (roles/netapp.admin) IAM role on your project. Project Owner and Editor roles include these permissions. For more information about granting roles, see Manage access to projects, folders, and organizations.

You might also be able to get the required permissions through custom roles or other predefined roles.

Get or grant read-only permissions

To get the permissions that you need to have read-only access, ask your administrator to grant you the NetApp Volumes Viewer (roles/netapp.viewer) IAM role on your project. For more information about granting roles, see Manage access to projects, folders, and organizations.

You might also be able to get the required permissions through custom roles or other predefined roles.

Permission details

Permission Action NetApp Volumes Admin NetApp Volumes Viewer
netapp.locations.list Lists information about the supported locations for this service check check
netapp.locations.get Gets information about a location supported by this service check check
netapp.volumes.create Creates a volume check
netapp.volumes.list Lists all volumes in the project check check
netapp.volumes.get Gets the details of a specific volume check check
netapp.volumes.update Updates the volume check
netapp.volumes.delete Deletes the volume check
netapp.volumes.restore Restore backup to a new volume check
netapp.volumes.revert Reverts the volume check
netapp.storagePools.create Creates a storage pool check
netapp.storagePools.list Lists all of the pools in the project check check
netapp.storagePools.get Gets the details of a specific pool check check
netapp.storagePools.update Updates the pool check
netapp.storagePools.delete Deletes the storage pool check
netapp.snapshots.create Creates a snapshot check
netapp.snapshots.list Lists all of the snapshots check check
netapp.snapshots.get Gets the details of a specific snapshot check check
netapp.snapshots.update Updates a snapshot check
netapp.snapshots.delete Deletes a snapshot check
netapp.backups.create Creates a backup check
netapp.backups.list Lists all backups check check
netapp.backups.get Gets details of a specific backup check check
netapp.backups.update Updates a backup check
netapp.backups.delete Deletes a backup check
netapp.replications.create Creates a volume replication check
netapp.replications.list Lists all of the replications in the project check check
netapp.replications.get Gets the details of a specific replication check check
netapp.replications.update Updates a volume replication check
netapp.replications.delete Deletes a replication check
netapp.replications.stop Stops a replication check
netapp.replications.resume Resumes a replication check
netapp.replications.reverse Reverse and resume a replication check
netapp.activeDirectories.create Creates an Active Directory policy check
netapp.activeDirectories.get Gets the details of a specific Active Directory policy check check
netapp.activeDirectories.list Lists all of the Active Directory policies in the project check check
netapp.activeDirectories.update Updates an Active Directory policy check
netapp.activeDirectories.delete Deletes an Active Directory policy check
netapp.kmsConfigs.create Creates a CMEK policy check
netapp.kmsConfigs.get Gets the details of a specific CMEK policy check check
netapp.kmsConfigs.list Lists all of the CMEK policies in the project check check
netapp.kmsConfigs.update Updates a CMEK policy check
netapp.kmsConfigs.delete Deletes a CMEK policy check
netapp.kmsConfigs.verify Validates the key access of a CMEK policy check
netapp.kmsConfigs.encrypt Runs the CMEK migrate action check
netapp.backupVaults.create Creates a backup vault check
netapp.backupVaults.list Lists all backup vaults in the project check check
netapp.backupVaults.get Gets details of a specific backup vault check check
netapp.backupVaults.update Updates the backup vault check
netapp.backupVaults.delete Deletes the backup vault check
netapp.backupPolicies.create Creates a backup policy check
netapp.backupPolicies.list Lists all backup policies in the project check check
netapp.backupPolicies.get Gets details of a specific backup policy check check
netapp.backupPolicies.update Updates the backup policy check
netapp.backupPolicies.delete Deletes the backup policy check
netapp.operations.list Lists the running operations check check
netapp.operations.get Gets the details of running operations check check
netapp.operations.cancel Cancels a running operation check
netapp.operations.delete Deletes an operation check

Define custom roles

If the predefined IAM roles don't meet your needs, you can define a custom role with permissions that you specify using IAM custom roles. When you create custom roles for NetApp Volumes, make sure that you include both resourcemanager.projects.get and resourcemanager.projects.list so that the role has permission to query project resources.

What's next

See the quickstart guide for how to create a storage pool.