Access Control with IAM

Service Usage uses Identity and Access Management (IAM) to control access to services. This page explains the IAM roles and permissions related to Service Usage and how to use them to control access.

Resource model

For Service Usage, there are three relevant resources:

1. The service you are using.

2. The project from which you are using the service.

3. The operation or long-running operation returned by certain methods.

Each Service Usage method requires a permission on one or more of these resources.

IAM permissions

The following table shows the required permissions for each Service Usage API method. You can also find this information in the API reference.

Method	Required permissions
services.batchEnable	On the project: serviceusage.services.enable On the services: servicemanagement.services.bind
services.enable	On the project: serviceusage.services.enable On the service: servicemanagement.services.bind
services.disable	On the project: serviceusage.services.disable
services.get	On the project: serviceusage.services.get
services.list	On the project: serviceusage.services.list
services.consumerQuotaMetrics.list services.consumerQuotaMetrics.get services.consumerQuotaMetrics.limits.get services.consumerQuotaMetrics.limits.consumerOverrides.list services.consumerQuotaMetrics.limits.adminOverrides.list services.consumerQuotaMetrics.limits.producerOverrides.list	On the project: serviceusage.quota.get On the service: servicemanagement.services.bind
services.consumerQuotaMetrics.consumerOverrides.create services.consumerQuotaMetrics.consumerOverrides.patch services.consumerQuotaMetrics.consumerOverrides.delete services.adminQuotaMetrics.adminOverrides.create services.adminQuotaMetrics.adminOverrides.patch services.adminQuotaMetrics.adminOverrides.delete	On the project: serviceusage.quota.update On the service: servicemanagement.services.bind
To use a project for quota and billing purposes. For more information, see System parameters.	On the project: serviceusage.services.use

IAM roles

With IAM, you give users permission by granting them a role. The following tables list IAM basic and predefined roles, and the permissions related to Service Usage that those roles include.

For more information about roles, see Understanding roles.

Basic roles

Name	Title	Permissions
roles/viewer	Viewer	serviceusage.services.get serviceusage.services.list serviceusage.quotas.get
roles/editor roles/owner	Editor Owner	serviceusage.services.get serviceusage.services.list serviceusage.services.disable serviceusage.services.enable serviceusage.services.use serviceusage.quotas.get serviceusage.quotas.update

Predefined roles

Name	Title	Permissions
roles/serviceusage.serviceUsageViewer	Service Usage Viewer	monitoring.timeSeries.list serviceusage.operations.get serviceusage.operations.list serviceusage.services.get serviceusage.services.list serviceusage.quotas.get
roles/serviceusage.serviceUsageConsumer	Service Usage Consumer	monitoring.timeSeries.list serviceusage.operations.get serviceusage.operations.list serviceusage.services.get serviceusage.services.list serviceusage.services.use serviceusage.quotas.get
roles/serviceusage.serviceUsageAdmin	Service Usage Admin	monitoring.timeSeries.list serviceusage.operations.cancel serviceusage.operations.delete serviceusage.operations.get serviceusage.operations.list serviceusage.services.get serviceusage.services.list serviceusage.services.use serviceusage.services.enable serviceusage.services.disable serviceusage.quotas.get serviceusage.quotas.update
roles/servicemanagement.serviceConsumer	Service Consumer	servicemanagement.services.bind