Access control for projects with IAM

Google Cloud offers Identity and Access Management (IAM), which lets you give more granular access to specific Google Cloud resources and prevents unwanted access to other resources. IAM lets you adopt the security principle of least privilege, so you grant only the necessary access to your resources.

IAM lets you control who (users) has what access (roles) to which resources by setting allow policies. Allow policies grant specific roles to a user giving the user certain permissions.

This page explains the IAM permissions and roles you can use to manage access to projects. For more information, see Manage access to projects, folders, and organizations.

Permissions and roles

To control access to resources, Google Cloud requires that accounts making API requests have appropriate IAM roles. IAM roles include permissions that let users perform specific actions on Google Cloud resources. For example, the resourcemanager.projects.delete permission lets a user delete a project.

You don't directly give users permissions; instead, you grant them roles, which have one or more permissions bundled within them. You grant these roles on a particular resource, but they also apply to all of that resource's descendants in the resource hierarchy.

Permissions

To manage projects, the caller must have a role that includes the following permissions. The role is granted on the organization resource or folder that contains the projects:

Using predefined roles

IAM predefined roles let you manage the permissions available to users. For a full list of the roles that can be granted at the project level, see Understanding Roles.

The following table lists the predefined roles you can use to grant access to a project. Each role includes a description of its purpose and the permissions it contains.