Building Google Cloud Platform Solutions

Creating IAM custom roles

A group of permissions that can be assigned to a user, group, or a service account is called a role. In GCP, permissions for user resources cannot be directly assigned to users; they will have to grant those permissions to a role and attach the role to the user. There are three broad classifications of roles: primitive roles, predefined roles, and custom roles.

Primitive roles are viewer, editor, and owner roles, which have a broad usage and can be assigned at the project level. The predefined roles come into play when we need more fine-grained permissions. A user can be assigned to be an editor of a service, viewer of a service, a viewer plus editor of only one action, and so on. Multiple predefined roles can be ...