Skip to content

Roles and permissions

A permission is the smallest unit of authority: a single action on a single resource, named <service>.<resource>.<action> (for example compute.vm.create). A role is a named bundle of permissions. You grant a role to an identity with a binding, within a scope.

Permissions are system-defined and read-only. Roles are either built-in (system-defined and immutable) or custom (composed by you from any permission). You can enumerate permissions with ListPermissions and a role’s exact set with ListRolePermissions.

Role families

Built-in roles follow a consistent convention: a Viewer can read (get, list), an Editor adds create, update, and resource actions, and an Admin has full access including delete. They come at three levels:

Platform-wide roles (Viewer, Editor, Admin) grant the matching access across every service. They are listed below.
Per-service roles (for example Compute Editor) and per-resource roles (for example VM Admin) are scoped to one service, and are listed on that service’s own page.

Platform-wide roles

These primitive roles span every service. Granting one at a scope confers the corresponding access to all services within that scope.

Role	Description
`Viewer`	Read-only access to all resources across every service
`Editor`	Read and write access to all resources across every service
`Admin`	Full administrative access across every service, including IAM

Roles and permissions by service

Each service documents its own built-in roles and the permissions it defines:

Compute Virtual machines and operations.

Network VPCs, subnets, firewall policies, quotas.

Observability Telemetry queries, alerting, retention, sinks, quotas.

Registry Namespaces, repositories, artifacts, scanning.

Storage Buckets, objects, storage classes.

Taxonomy Organisations, workspaces, groups.

Topology Regions, zones, resource pools, targets.

Vault Secrets, crypto keys, PKI, leases.

IAM

The IAM service’s own built-in roles. Each row lists a role, what it grants, and the exact permissions it includes.

Role	Included permissions
IAM Viewer Read-only access to all IAM resources	`iam.binding.get` `iam.binding.list` `iam.operation.get` `iam.operation.list` `iam.permission.get` `iam.permission.list` `iam.policy.get` `iam.policy.list` `iam.role.get` `iam.role.list` `iam.rolepermission.list` `iam.token.list` `iam.user.get` `iam.user.list`
IAM Editor Read and write access to all IAM resources	`iam.binding.create` `iam.binding.get` `iam.binding.list` `iam.operation.get` `iam.operation.list` `iam.permission.get` `iam.permission.list` `iam.policy.create` `iam.policy.get` `iam.policy.list` `iam.policy.update` `iam.role.create` `iam.role.get` `iam.role.list` `iam.role.update` `iam.rolepermission.add` `iam.rolepermission.list` `iam.token.list` `iam.token.revoke` `iam.user.changepassword` `iam.user.create` `iam.user.get` `iam.user.list` `iam.user.update`
IAM Admin Full access to all IAM resources	`iam.binding.create` `iam.binding.delete` `iam.binding.get` `iam.binding.list` `iam.operation.get` `iam.operation.list` `iam.permission.get` `iam.permission.list` `iam.policy.create` `iam.policy.delete` `iam.policy.get` `iam.policy.list` `iam.policy.update` `iam.role.create` `iam.role.delete` `iam.role.get` `iam.role.list` `iam.role.update` `iam.rolepermission.add` `iam.rolepermission.list` `iam.rolepermission.remove` `iam.token.list` `iam.token.revoke` `iam.user.changepassword` `iam.user.create` `iam.user.delete` `iam.user.get` `iam.user.list` `iam.user.update`
User Viewer View users	`iam.operation.get` `iam.operation.list` `iam.user.get` `iam.user.list`
User Editor View and manage users	`iam.operation.get` `iam.operation.list` `iam.user.changepassword` `iam.user.create` `iam.user.get` `iam.user.list` `iam.user.update`
User Admin Full access to users	`iam.operation.get` `iam.operation.list` `iam.user.changepassword` `iam.user.create` `iam.user.delete` `iam.user.get` `iam.user.list` `iam.user.update`
Role Viewer View roles and role permissions	`iam.operation.get` `iam.operation.list` `iam.permission.get` `iam.permission.list` `iam.role.get` `iam.role.list` `iam.rolepermission.list`
Role Editor View and manage roles and role permissions	`iam.operation.get` `iam.operation.list` `iam.permission.get` `iam.permission.list` `iam.role.create` `iam.role.get` `iam.role.list` `iam.role.update` `iam.rolepermission.add` `iam.rolepermission.list`
Role Admin Full access to roles and role permissions	`iam.operation.get` `iam.operation.list` `iam.permission.get` `iam.permission.list` `iam.role.create` `iam.role.delete` `iam.role.get` `iam.role.list` `iam.role.update` `iam.rolepermission.add` `iam.rolepermission.list` `iam.rolepermission.remove`
Policy Viewer View policies	`iam.operation.get` `iam.operation.list` `iam.policy.get` `iam.policy.list`
Policy Editor View and manage policies	`iam.operation.get` `iam.operation.list` `iam.policy.create` `iam.policy.get` `iam.policy.list` `iam.policy.update`
Policy Admin Full access to policies	`iam.operation.get` `iam.operation.list` `iam.policy.create` `iam.policy.delete` `iam.policy.get` `iam.policy.list` `iam.policy.update`
Binding Viewer View IAM bindings	`iam.binding.get` `iam.binding.list` `iam.operation.get` `iam.operation.list`
Binding Editor View and manage IAM bindings	`iam.binding.create` `iam.binding.get` `iam.binding.list` `iam.operation.get` `iam.operation.list`
Binding Admin Full access to IAM bindings	`iam.binding.create` `iam.binding.delete` `iam.binding.get` `iam.binding.list` `iam.operation.get` `iam.operation.list`
IAM Token Viewer View authentication tokens	`iam.operation.get` `iam.operation.list` `iam.token.list`
IAM Token Editor View and revoke authentication tokens	`iam.operation.get` `iam.operation.list` `iam.token.list` `iam.token.revoke`
IAM Token Admin Full access to authentication tokens	`iam.operation.get` `iam.operation.list` `iam.token.list` `iam.token.revoke`

The authorization model: how a permission, role, scope, and policy combine.
Overview: the IAM service at a glance.