Google Cloud Platform for Developers

Cloud Spanner IAM Roles

In addition to the three primitive IAM roles (owner, editor, viewer), Cloud Spanner supports five product-specific IAM roles:

• roles/spanner.admin: Full control over one or more instances
• roles/spanner.databaseAdmin: Full control over all databases within an instance
• roles/spanner.databaseReader: Read-only access and query executions
• roles/spanner.databaseUser: Full CRUD and DDL support for one or more databases
• roles/spanner.viewer: Ability to view Cloud Spanner metadata

Of these roles, the databaseReader and databaseUser roles are particularly useful as they provide the mechanism for per-database client access.