How to Create and Manage Custom Roles in GCP

In Google Cloud, Identity and Access Management (IAM) allows the administrator to authorize the use of specific resources. With IAM, you can adopt the security principle of least privilege, which gives only the required permissions. You can manage resources by deciding who(identity) and what access(role) can be given to the organization or owner. A role […]

Sneha FarkyaOctober 07, 2022 · 8 mins Read

How to Create and Manage Custom Roles in GCP

Demo Sign Up

SHAREX in f

A role is a set of permissions that control what operations can be performed on a particular resource. The three roles used to access resources are:

Basic Roles: Basic roles contain the Owner, Editor, and Viewer permissions.

Predefined Roles: These are the set of permissions that are fully managed by Google. But what if you want to add or remove certain permission? Here’s where the Custom role comes in!

Custom roles: These are user-defined roles containing permissions to access resources in Google Cloud. They are created within a project or an organisation. They are not managed by Google. Instead, it’s the user who owns and manages it.

Required Permission

To create a custom role, you need to have the following permission: iam.roles.create

By default, the project owner has this permission. However, if you’re not an owner, you must have assigned the Organisation Role Administrator role (roles/iam.organizationRoleAdmin) or IAM Role Administrator role (roles/iam.roleAdmin).

Make a new custom role

To create new custom roles from scratch, follow the given steps:

Go to the Roles page in GCP

From the Organisation drop-down, select your organization.

Click on the Create Role

Fill up the Name, Title, and Description for the role.

custom roles, gcp roles, iam gcp, add custom roles, change roles gcp, custom roles google cloud — Creating custom roles in Google Cloud Platform Dashboard

Choose the permissions you want to include in the role and then click Add Permission.

Custom roles with predefined roles

You can also create custom roles from existing predefined roles. Here are the steps to follow:

Go to the Roles page in the Google Cloud console

Select in which project you want to create a role.

Choose the role on which you would like to base the new role.

Click on the Create Role from the selection.

Enter Name, Title, Description, and Role Launch Stage for the role.

Uncheck the permissions you don’t want in the role

Add any permission by clicking on Add Permission

Click Create

Updating the Custom roles

The read-modify-write pattern is commonly used to update the roles. However, it can cause friction if two or more owners of a project attempt to change roles simultaneously. To avoid this clash, IAM uses the etag property. It helps to determine whether the custom roles have changed since the last request. Update the roles on the roles page by following the steps:

Click Edit Role.

Edit the role’s Title, Description, or Role launch stage to update its metadata.

Follow these steps to update the role’s permissions:

New permission can be added to the role by clicking Add Permissions.

To remove permissions from a role, uncheck permissions.

Once the role has been edited, click Update to save it.

Disable a custom role

Select the project from which you want to disable the role and then:

Select the custom role you want to disable.

Click on Disable.

Deleting a custom role

Click on the role you want to delete and choose to delete at the top of the page. Deleted roles leave a trace in your allow policies, but do not have any effect on any role bindings. Within seven days, you can undelete a role. In this timeframe, the Google Cloud console shows the role as deleted user can opt to undelete within the period of 7 days after that the role is permanently deleted.

Sneha Farkya

FinOps enthusiast

Product Manager at Economize with over 3 years of experience, focused on FinOps strategies and cloud cost optimization. Dedicated to helping organizations streamline cloud expenses and drive financial efficiency.