GCP roles

• IAM roles and permissions index https://cloud.google.com/iam/docs/understanding-roles
• Roles and permissions https://docs.cloud.google.com/iam/docs/roles-overview

• GCP Roles and permissions

Commands

gcloud iam roles list
gcloud iam roles describe

Official example

gcloud projects add-iam-policy-binding example-project-id-1 --member='user:[email protected]' --role='roles/editor'

Others

roles/iam.serviceAccountKeyAdmin

roles/owner
roles/editor
roles/admin
roles/writer

roles/cloudsql.admin
roles/cloudsql.editor

Storage

roles/storage.admin
roles/storage.objects.create
roles/storage.objectAdmin
roles/storage.objectViewer
roles/storage.objectUser
roles/storage.bucketViewer
roles/storage.legacyBucketWriter

 storage.buckets.create
storage.buckets.createTagBinding
storage.buckets.delete
storage.buckets.deleteTagBinding
storage.buckets.get
storage.buckets.getIamPolicy
storage.buckets.list
storage.buckets.listEffectiveTags
storage.buckets.listTagBindings
storage.buckets.setIamPolicy
storage.buckets.update

roles/compute.admin

roles/container.admin
roles/container.developer
roles/container.viewer

roles/compute.osLogin

• Cloud SQL IAM roles: https://cloud.google.com/sql/docs/mysql/iam-roles

Artifactregistry

 - roles/artifactregistry.reader, artifactregistry.writer,
 artifactregistry.editor,
 artifactregistry.createOnPushWriter

Errors

• Denied: Token exchange failed for project ... Caller does not have permission 'storage.buckets.get'

Related

• Service accounts
• AWS IAM role
• --role
• google_project_iam_policy
• gcloud projects get-iam-policy $(gcloud config get-value project)
• GKE roles

See also

• GCP roles, gcloud iam roles list, roles/owner, roles/admin, roles/editor, roles/viewer, roles/writer
• GCP roles: gcloud iam roles [ list | describe ]
• Google Cloud IAM, roles, gcloud iam