Building Google Cloud Platform Solutions

Resource-level policies

In addition to project-level policies that define access for entire classes of resources within a project, many resource types support more fine-grained access controls. Resource types that support per-instance IAM policies include Compute Engine VMs, Cloud Storage Buckets, BigQuery datasets, service accounts, and Pub/Sub topics, and subscriptions.

This is useful when we want to grant an actor access to one or more instances of a given resource type, but not all. As an example, an App Engine service running in another project may care to receive Pub/Sub messages from your project. With per-subscription IAM policies, you could allow that service to create subscriptions for a given topic and pull messages from that subscription. ...