This page describes how you can control CTS access and permissions using Identity and Access Management (IAM).
Google Cloud offers Identity and Access Management (IAM), which lets you give more granular access to specific Google Cloud resources and prevents unwanted access to other resources. This page describes the Cloud Talent Solution IAM roles and permissions. For a detailed description of Google Cloud IAM, see the IAM documentation.
CTS provides a set of predefined roles designed to help you easily control access to your CTS resources. You can also create your own custom roles, if the predefined roles do not provide the sets of permissions you need. In addition, the older basic roles (Editor, Viewer, and Owner) are also still available to you, although they do not provide the same fine-grained control as the CTS roles. In particular, the basic roles provide access to resources across Google Cloud rather than just for CTS. See the basic roles documentation for more information.
The table below outlines the predefined roles available for Job Search.
|Admin||Allows users to access the Google Cloud Management tools only.|
|jobsEditor||Allows Job Search users to create, modify or delete job or company content.|
|jobsViewer||Allows read-only access to job or company content in Job Search.|
CTS provides predefined roles you can use to provide finer-grained permissions to principals. The role you grant to a principal controls what actions the principal can take. Principals can be individuals, groups, or service accounts.
You can grant multiple roles to the same principal, and you can change the roles granted to a principal at any time, provided you have the permissions to do so.
The broader roles include the more narrowly defined roles. For example, the jobsEditor role includes all of the permissions of the jobsViewer role, along with the addition permissions of the jobsEditor role.
The basic roles (Owner, Editor, Viewer) provide permissions across Google Cloud. The roles specific to CTS provide only CTS permissions, except for the following Google Cloud permissions, which are needed for general Google Cloud usage:
The following table lists the predefined roles available for CTS, along with their permissions:
||Full access and control for all Google Cloud resources; manage user access and set up billing for a project.|
||Editor||All ||Read-write access to all Google Cloud and CTS resources except the ability to modify permissions and billing.|
||Read-only access to all Google Cloud resources, including Cloud Talent Solution resources.|
||Cloud Talent Solution Admin||
||Access to Cloud Talent Solution self-service tools.|
||Job Search Editor||
||Write access to all Job Search data.|
||Job Search Viewer||
||Read-only access to all Job Search resources.|
Managing CTS IAM
You can get and set IAM policies and roles using the Google Cloud Console, IAM API methods, or the Cloud Talent Solution APIs themselves. For more information, see Granting, Changing, and Revoking Access.
- Learn how to grant and revoke access.
- Learn more about IAM.
- Learn more about basic roles.
- Learn more about custom roles.