GCP cloud roles

• https://cloud.google.com/iam/docs/understanding-roles

gcloud iam roles list
gcloud iam roles describe

Official example:

gcloud projects add-iam-policy-binding example-project-id-1 --member='user:[email protected]' --role='roles/editor'

Others:

roles/iam.serviceAccountKeyAdmin

roles/owner
roles/editor

roles/cloudsql.admin
roles/cloudsql.editor

roles/storage.objects.create
roles/storage.objectAdmin
roles/storage.objectViewer
roles/storage.legacyBucketWriter

roles/container.developer

• Cloud SQL IAM roles: https://cloud.google.com/sql/docs/mysql/iam-roles

 storage.buckets.create
storage.buckets.createTagBinding
storage.buckets.delete
storage.buckets.deleteTagBinding
storage.buckets.get
storage.buckets.getIamPolicy
storage.buckets.list
storage.buckets.listEffectiveTags
storage.buckets.listTagBindings
storage.buckets.setIamPolicy
storage.buckets.update

Error

• Denied: Token exchange failed for project ... Caller does not have permission 'storage.buckets.get'

Related

• Service accounts
• AWS IAM role
• --role

See also

• GCP roles: gcloud iam roles [ list ]
• gcloud iam [ roles | service-accounts | get-iam-policy | roles describe ], gcloud asset search-all-iam-policies, list-grantable-roles
• Google Cloud IAM, roles, gcloud iam