Cloud Tasks uses Identity and Access Management (IAM) for access control.
Access control can be configured at the project level and at the queue level. For example: You can grant access with limited capabilities, like to create and add tasks to a queue, but not to delete the queue. Or you can grant access to all Cloud Tasks resources within a project to a group of developers.
For a detailed description of IAM and its features, see the IAM documentation. In particular, see its Manage access to projects, folders, and organizations section.
Every Cloud Tasks method requires the caller to have the necessary permissions.
See below for a list of the permissions and roles supported. The Cloud Tasks
IAM permissions are also checked when queue.yaml/xml
is updated or when the Google Cloud console
is used.
Roles
The following table lists the Cloud Tasks IAM roles with a corresponding list of all the permissions each role includes. Note that every permission is applicable to a particular resource type.
Role | Permissions |
---|---|
Cloud Tasks Admin Beta( Full access to queues and tasks. Contains 2 owner permissions |
cloudtasks.*
monitoring.timeSeries.list resourcemanager.projects.get resourcemanager.projects.list |
Cloud Tasks Enqueuer Beta( Access to create tasks. |
cloudtasks.tasks.create cloudtasks.tasks.fullView resourcemanager.projects.get resourcemanager.projects.list |
Cloud Tasks Queue Admin Beta( Admin access to queues. Contains 2 owner permissions |
cloudtasks.locations.*
cloudtasks.queues.*
resourcemanager.projects.get resourcemanager.projects.list |
Cloud Tasks Task Deleter Beta( Access to delete tasks. |
cloudtasks.tasks.delete resourcemanager.projects.get resourcemanager.projects.list |
Cloud Tasks Task Runner Beta( Access to run tasks. |
cloudtasks.tasks.fullView cloudtasks.tasks.run resourcemanager.projects.get resourcemanager.projects.list |
Cloud Tasks Viewer Beta( Get and list access to tasks, queues, and locations. |
cloudtasks.locations.*
cloudtasks.queues.get cloudtasks.queues.list cloudtasks.tasks.fullView cloudtasks.tasks.get cloudtasks.tasks.list monitoring.timeSeries.list resourcemanager.projects.get resourcemanager.projects.list |