App Hub IAM roles and permissions

App Hub provides the following Identity and Access Management (IAM) roles:

App Hub Admin (roles/apphub.admin): get full access to App Hub settings.
App Hub Editor (roles/apphub.editor): create and manage applications, services, and workloads.
App Hub Viewer (roles/apphub.viewer): view applications, services, and workloads.

Grant appropriate App Hub IAM roles to users or groups who will manage or view applications within the application management boundary. To grant roles, you can use the IAM page in the Google Cloud console or the Google Cloud CLI. For detailed instructions, see Manage access to projects, folders, and organizations.

App Hub roles

The following table describes App Hub IAM roles and their typical responsibilities:

Role	Description	Purpose
App Hub Admin	Use projects or folders to create applications, attach service projects to a host project, update application attributes, register services and workloads, update service and workload attributes, and delegate application control to the App Hub Editor.	Manage the full lifecycle of an application. Get administrative permissions and complete visibility of the end-to-end application architecture.
App Hub Editor	Create and update applications, register and unregister services and workloads, and update attributes.	Scale the capability to create, update, or delete services and workloads. Manage application deployments.
App Hub Viewer	View services, workloads, applications, and their attributes.	Visualize the status of services, workloads, applications, and their dependencies. Obtain visibility into applications as an App Hub user.

The following table lists the permissions that each App Hub IAM role has: