GCP for DevOps — IAM Roles

3 minute read

IAM Roles

A role is a collection of permissions. Instead of granting individual permissions to users, you grant roles. GCP offers three categories of roles: basic, predefined, and custom.

Three Types of Roles

┌─────────────────────────────────────────────────────┐
│                    IAM Roles                        │
├─────────────┬─────────────────┬─────────────────────┤
│   Basic     │   Predefined    │      Custom         │
│ (Primitive) │ (Google-managed)│  (User-defined)     │
├─────────────┼─────────────────┼─────────────────────┤
│ Owner       │ roles/compute.  │ roles/my-custom-    │
│ Editor      │  instanceAdmin  │  role               │
│ Viewer      │ roles/storage.  │                     │
│             │  objectViewer   │ You pick exactly    │
│ Thousands   │                 │ which permissions   │
│ of perms    │ Scoped to one   │ to include          │
│             │ service         │                     │
└─────────────┴─────────────────┴─────────────────────┘

Basic Roles

Basic roles existed before Cloud IAM and grant broad access across all services in a project.

Role	Permissions	Use Case
`roles/viewer`	Read-only access to all resources	Auditors, read-only users
`roles/editor`	Read + write access to most resources	Avoid in production
`roles/owner`	Full control + IAM management + billing	Project administrators only
`roles/browser`	List projects and folders only	Org-level navigation

⚠️ DevOps Best Practice: Never use roles/editor or roles/owner for service accounts or automation. Use predefined or custom roles with least-privilege access.

Predefined Roles

Google maintains over 1,000 predefined roles scoped to individual services. These follow the pattern roles/<service>.<roleName>.

# List all predefined roles
$ gcloud iam roles list --filter="name:roles/compute" --format="table(name,title)"

NAME                                    TITLE
roles/compute.admin                     Compute Admin
roles/compute.instanceAdmin             Compute Instance Admin (beta)
roles/compute.instanceAdmin.v1          Compute Instance Admin (v1)
roles/compute.networkAdmin              Compute Network Admin
roles/compute.networkViewer             Compute Network Viewer
roles/compute.osAdminLogin              Compute OS Admin Login
roles/compute.osLogin                   Compute OS Login
roles/compute.securityAdmin             Compute Security Admin
roles/compute.storageAdmin              Compute Storage Admin
roles/compute.viewer                    Compute Viewer

# View permissions in a specific role
$ gcloud iam roles describe roles/compute.instanceAdmin.v1

includedPermissions:
- compute.acceleratorTypes.get
- compute.acceleratorTypes.list
- compute.addresses.create
- compute.addresses.delete
- compute.addresses.get
- compute.addresses.list
- compute.addresses.use
- compute.instances.create
- compute.instances.delete
- compute.instances.get
- compute.instances.list
- compute.instances.start
- compute.instances.stop
... (many more)
title: Compute Instance Admin (v1)

Commonly Used Predefined Roles for DevOps

Role	Description
`roles/compute.instanceAdmin.v1`	Create, modify, delete VMs
`roles/container.admin`	Full access to GKE clusters
`roles/storage.objectAdmin`	Full control over GCS objects
`roles/cloudbuild.builds.builder`	Run and cancel builds
`roles/run.admin`	Full access to Cloud Run services
`roles/logging.admin`	Full access to Logging
`roles/monitoring.admin`	Full access to Cloud Monitoring
`roles/iam.serviceAccountUser`	Impersonate a service account

Custom Roles

When predefined roles are too broad, create a custom role with only the permissions you need.

# Create a custom role at the project level
$ gcloud iam roles create devopsDeployer \
    --project=my-project \
    --title="DevOps Deployer" \
    --description="Deploy applications to GKE and Cloud Run" \
    --permissions="container.deployments.create,container.deployments.update,container.deployments.get,run.services.create,run.services.update,run.services.get" \
    --stage=GA

Created role [devopsDeployer].
description: Deploy applications to GKE and Cloud Run
includedPermissions:
- container.deployments.create
- container.deployments.get
- container.deployments.update
- run.services.create
- run.services.get
- run.services.update
name: projects/my-project/roles/devopsDeployer
stage: GA
title: DevOps Deployer

# Create a custom role from a YAML file
$ cat deployer-role.yaml
title: "DevOps Deployer"
description: "Deploy applications to GKE and Cloud Run"
stage: "GA"
includedPermissions:
- container.deployments.create
- container.deployments.update
- container.deployments.get
- run.services.create
- run.services.update
- run.services.get

$ gcloud iam roles create devopsDeployer \
    --project=my-project \
    --file=deployer-role.yaml

# Update a custom role — add a permission
$ gcloud iam roles update devopsDeployer \
    --project=my-project \
    --add-permissions="run.services.delete"

# List custom roles in a project
$ gcloud iam roles list --project=my-project --format="table(name,title)"

NAME                                          TITLE
projects/my-project/roles/devopsDeployer      DevOps Deployer

Role Recommendations

IAM Recommender analyses your actual permission usage and suggests least-privilege role replacements.

# List IAM recommendations for a project
$ gcloud recommender recommendations list \
    --project=my-project \
    --recommender=google.iam.policy.Recommender \
    --location=global \
    --format="table(content.operationGroups[0].operations[0].value.bindings[0].role,priority,stateInfo.state)"

ROLE                                    PRIORITY  STATE
roles/storage.objectViewer              P2        ACTIVE
roles/compute.viewer                    P2        ACTIVE

Choosing the Right Role

                 ┌─────────────────────────┐
                 │  Need access to a GCP   │
                 │  resource?              │
                 └────────────┬────────────┘
                              │
                    ┌─────────▼──────────┐
                    │ Is there a          │
                    │ predefined role     │──── Yes ──→ Use it
                    │ that fits?          │
                    └─────────┬──────────┘
                              │ No
                    ┌─────────▼──────────┐
                    │ Can you combine     │
                    │ multiple predefined │──── Yes ──→ Use multiple
                    │ roles?              │              roles
                    └─────────┬──────────┘
                              │ No
                    ┌─────────▼──────────┐
                    │ Create a custom     │
                    │ role with only the  │
                    │ permissions needed  │
                    └────────────────────┘

Common Mistakes

Mistake	Why It’s Wrong	Fix
Using `roles/editor` for CI/CD	Grants write to all services	Use predefined per-service roles
Granting roles at org level	Inherited by all projects	Grant at project or resource level
Not reviewing custom roles	Permissions may become stale	Use IAM Recommender
Ignoring role conditions	Roles apply 24/7 by default	Add time or resource conditions

Quick Reference

Command	Description
`gcloud iam roles list`	List all predefined roles
`gcloud iam roles describe ROLE`	View role permissions
`gcloud iam roles create NAME --project=PROJ --file=FILE`	Create custom role
`gcloud iam roles update NAME --project=PROJ --add-permissions=PERMS`	Add permissions
`gcloud iam roles delete NAME --project=PROJ`	Delete custom role
`gcloud iam roles undelete NAME --project=PROJ`	Restore deleted role (within 7 days)

Next → Service Accounts

Share on

Twitter Facebook LinkedIn