IAM Roles & Permissions
Predefined and custom collections of fine-grained permissions.
Predefined and custom collections of fine-grained permissions.
What is IAM Roles & Permissions?
In Google Cloud IAM, permissions are never granted directly to users; instead, permissions are bundled into Roles. GCP provides hundreds of curated Predefined Roles maintained by Google (e.g. `roles/bigquery.dataEditor`) and allows security architects to author Custom Roles with specific granular permission strings (e.g. `compute.instances.start`).
Decision Guide: When to Choose This Service
Use Predefined Roles for standard Google-maintained service capabilities, and Custom Roles when you need strict least-privilege tailoring for specialized compliance mandates.
Do NOT use legacy Basic Roles (Owner, Editor, Viewer) for automated pipelines or production environments.
Core Architectural Pillars
`service.resource.verb` (e.g. `bigquery.tables.getData`).
Owner, Editor, Viewer (Avoid in production).
Google-managed service roles (e.g. `roles/run.developer`, `roles/pubsub.publisher`).
User-created collections of specific permissions scoped to a Project or Organization.
Machine-learning powered tool that analyzes 90 days of actual user API activity and suggests downsizing over-privileged roles to exact matching predefined roles.