Configuring access and security · Topic 1 of 3

IAM Policies, Role Types and Custom Roles

Viewing and creating IAM allow policies, bindings and inheritance in the organization hierarchy, basic, predefined and custom roles, and creating custom roles.

4 min

In a nutshell

An allow policy contains bindings of roles to principals, optionally with conditions.
Bindings are inherited downward and additive; deny policies can override.
Basic roles are broad; predefined roles are the default choice; custom roles fill gaps.

What it is

Identity and Access Management (IAM) decides who (a principal) can do what (a role, which is a set of permissions) on which resource. These grants are stored in an allow policy attached to an organization, folder, project or resource. Roles come in three types: basic, predefined and custom.

How it works

Allow policies and bindings

An allow policy is a list of bindings; each binding links one role to one or more principals, optionally with a condition.

# view the policy on a project
gcloud projects get-iam-policy shop-prod-1234 --format=json

# add a binding
gcloud projects add-iam-policy-binding shop-prod-1234 \
  --member="group:ops@example.com" --role="roles/compute.instanceAdmin.v1"

# add a binding on a folder or the organization
gcloud resource-manager folders add-iam-policy-binding FOLDER_ID \
  --member="group:network-admins@example.com" --role="roles/compute.networkAdmin"
gcloud organizations add-iam-policy-binding ORGANIZATION_ID \
  --member="group:billing@example.com" --role="roles/billing.viewer"

# grant on a single resource, such as a bucket
gcloud storage buckets add-iam-policy-binding gs://reports-1234 \
  --member="user:ana@example.com" --role="roles/storage.objectViewer"

IAM Conditions limit a binding, for example to resources with a certain name prefix or until a date (temporary access).

Inheritance in the hierarchy

Rule	Meaning
Inherited downward	A role on the organization applies to every folder, project and resource below
Additive (union)	Effective access is the union of all bindings at each level; a lower level cannot remove an inherited grant
Grant at the lowest level that works	Least privilege: a bucket-level grant is better than a project-level grant if only that bucket is needed

To block access regardless of allow policies, Google Cloud also has IAM deny policies, which take precedence over allow policies.

Exam tip

If someone still has access after you removed their project binding, look for a binding on a parent folder, the organization, or a group they belong to.

The three role types

Type	Examples	When to use
Basic roles	Owner (`roles/owner`), Editor (`roles/editor`), Viewer (`roles/viewer`)	Very broad, across all services; avoid in production
Predefined roles	`roles/storage.objectViewer`, `roles/compute.instanceAdmin.v1`, `roles/bigquery.dataEditor`	Maintained by Google for specific services and jobs; first choice
Custom roles	A role you define with a chosen list of permissions	When no predefined role matches least privilege

Creating custom roles

Custom roles can be created at the organization or project level (not on folders).

gcloud iam roles create instanceRestarter --project=shop-prod-1234 \
  --title="Instance Restarter" --description="Start and stop VMs" \
  --permissions=compute.instances.get,compute.instances.list,compute.instances.start,compute.instances.stop \
  --stage=GA

# or copy an existing role as a starting point
gcloud iam roles copy --source=roles/compute.viewer --destination=customViewer \
  --dest-project=shop-prod-1234

Custom roles need maintenance: Google does not update them when new permissions appear, and some permissions cannot be used in custom roles. Creating them requires the Role Administrator role (roles/iam.roleAdmin) or Organization Role Administrator (roles/iam.organizationRoleAdmin).

A worked scenario

Support staff must start and stop VMs in one project but not create or delete them. No predefined role is that narrow, so the engineer creates a project-level custom role with get, list, start and stop permissions and grants it to the support group on that project. The network team gets roles/compute.networkAdmin on the Production folder, inherited by all its projects. A contractor gets roles/storage.objectViewer on one bucket with an IAM condition that expires at the end of the month.

How the exam asks about this

"Least privilege for a task no predefined role covers exactly." A custom role.
"Give a team the same access to every project in a department." Grant on the department's folder.
"Access should expire automatically." An IAM condition with a date.
"Why can the user still access the project?" An inherited binding from a parent or group membership.
"View current bindings on a project." gcloud projects get-iam-policy.

What to remember for the exam

An allow policy contains bindings of roles to principals, optionally with conditions.
Bindings are inherited downward and additive; deny policies can override.
Basic roles are broad; predefined roles are the default choice; custom roles fill gaps.
Custom roles exist at organization or project level, need maintenance, and need Role Administrator.
Grant to groups, at the lowest level that works.

Watch out

Basic roles such as Editor grant wide access to almost every service. They violate least privilege in production.

Common mistakes

Creating custom roles when a predefined role fits. They add maintenance.

Trying to create a custom role on a folder. Only organization or project level.

Removing a project binding and assuming access is gone. Check inherited and group bindings.

Check yourself

At which levels can custom roles be created?
At the organization level or the project level.
What are the three types of IAM roles?
Basic, predefined and custom roles.
How can you grant access that expires automatically?
Add an IAM condition with an expiry date to the binding.

Topic 1 of 3 in Configuring access and security

Test yourself on Configuring access and security

The full Google Cloud Associate Cloud Engineer question bank has 661 questions, with timed practice exams and an explanation for every answer.

Subscribe Try Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by Google Cloud. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.