IAM roles and permissions

This page describes Cloud Deploy service accounts, roles, and permissions.

Access in Cloud Deploy is controlled using Identity and Access Management (IAM). IAM lets you create and manage permissions for Google Cloud resources. Cloud Deploy provides a specific set of predefined IAM roles where each role contains a set of permissions. You can use these roles to give more fine-grained access to specific Google Cloud resources and prevent unwanted access to other resources. IAM lets you adopt the security principle of least privilege, so you grant only the necessary access to your resources.

See Using IAM to restrict Cloud Deploy access to learn about advanced access-control security features.

Service accounts in Cloud Deploy

By default, Cloud Deploy runs using the default Compute Engine service account. For more information on configuring this service account for use with Cloud Deploy, or choosing a different account, see the Cloud Deploy execution service account documentation.

Find out more about how Cloud Deploy uses service accounts.

Predefined Cloud Deploy roles

With IAM, every API method in Cloud Deploy API requires that the identity making the API request has the appropriate permissions to use the resource. Permissions are granted by setting policies that grant roles to a principal (user, group, or service account) of your project. You can grant multiple roles to a principal on the same resource.

The IAM documentation includes a searchable reference of all predefined roles.

The following table lists the Cloud Deploy IAM roles and the permissions that they include:

Role Permissions

(roles/clouddeploy.admin)

Full control of Cloud Deploy resources.

clouddeploy.*

  • clouddeploy.automationRuns.cancel
  • clouddeploy.automationRuns.get
  • clouddeploy.automationRuns.list
  • clouddeploy.automations.create
  • clouddeploy.automations.delete
  • clouddeploy.automations.get
  • clouddeploy.automations.list
  • clouddeploy.automations.update
  • clouddeploy.config.get
  • clouddeploy.customTargetTypes.create
  • clouddeploy.customTargetTypes.delete
  • clouddeploy.customTargetTypes.get
  • clouddeploy.customTargetTypes.getIamPolicy
  • clouddeploy.customTargetTypes.list
  • clouddeploy.customTargetTypes.setIamPolicy
  • clouddeploy.customTargetTypes.update
  • clouddeploy.deliveryPipelines.create
  • clouddeploy.deliveryPipelines.createTagBinding
  • clouddeploy.deliveryPipelines.delete
  • clouddeploy.deliveryPipelines.deleteTagBinding
  • clouddeploy.deliveryPipelines.get
  • clouddeploy.deliveryPipelines.getIamPolicy
  • clouddeploy.deliveryPipelines.list
  • clouddeploy.deliveryPipelines.listEffectiveTags
  • clouddeploy.deliveryPipelines.listTagBindings
  • clouddeploy.deliveryPipelines.setIamPolicy
  • clouddeploy.deliveryPipelines.update
  • clouddeploy.deployPolicies.create
  • clouddeploy.deployPolicies.delete
  • clouddeploy.deployPolicies.get
  • clouddeploy.deployPolicies.getIamPolicy
  • clouddeploy.deployPolicies.list
  • clouddeploy.deployPolicies.override
  • clouddeploy.deployPolicies.setIamPolicy
  • clouddeploy.deployPolicies.update
  • clouddeploy.jobRuns.get
  • clouddeploy.jobRuns.list
  • clouddeploy.jobRuns.terminate
  • clouddeploy.locations.get
  • clouddeploy.locations.list
  • clouddeploy.operations.cancel
  • clouddeploy.operations.delete
  • clouddeploy.operations.get
  • clouddeploy.operations.list
  • clouddeploy.releases.abandon
  • clouddeploy.releases.create
  • clouddeploy.releases.get
  • clouddeploy.releases.list
  • clouddeploy.rollouts.advance
  • clouddeploy.rollouts.approve
  • clouddeploy.rollouts.cancel
  • clouddeploy.rollouts.create
  • clouddeploy.rollouts.get
  • clouddeploy.rollouts.ignoreJob
  • clouddeploy.rollouts.list
  • clouddeploy.rollouts.retryJob
  • clouddeploy.rollouts.rollback
  • clouddeploy.targets.create
  • clouddeploy.targets.createTagBinding
  • clouddeploy.targets.delete
  • clouddeploy.targets.deleteTagBinding
  • clouddeploy.targets.get
  • clouddeploy.targets.getIamPolicy
  • clouddeploy.targets.list
  • clouddeploy.targets.listEffectiveTags
  • clouddeploy.targets.listTagBindings
  • clouddeploy.targets.setIamPolicy
  • clouddeploy.targets.update

resourcemanager.projects.get

resourcemanager.projects.list

(roles/clouddeploy.editor)

Editor role for Cloud Deploy

clouddeploy.automationRuns.*

  • clouddeploy.automationRuns.cancel
  • clouddeploy.automationRuns.get
  • clouddeploy.automationRuns.list

clouddeploy.automations.*

  • clouddeploy.automations.create
  • clouddeploy.automations.delete
  • clouddeploy.automations.get
  • clouddeploy.automations.list
  • clouddeploy.automations.update

clouddeploy.config.get

clouddeploy.customTargetTypes.create

clouddeploy.customTargetTypes.delete

clouddeploy.customTargetTypes.get

clouddeploy.customTargetTypes.getIamPolicy

clouddeploy.customTargetTypes.list

clouddeploy.customTargetTypes.update

clouddeploy.deliveryPipelines.create

clouddeploy.deliveryPipelines.delete

clouddeploy.deliveryPipelines.get

clouddeploy.deliveryPipelines.getIamPolicy

clouddeploy.deliveryPipelines.list

clouddeploy.deliveryPipelines.listEffectiveTags

clouddeploy.deliveryPipelines.listTagBindings

clouddeploy.deliveryPipelines.update

clouddeploy.deployPolicies.create

clouddeploy.deployPolicies.delete

clouddeploy.deployPolicies.get

clouddeploy.deployPolicies.getIamPolicy

clouddeploy.deployPolicies.list

clouddeploy.deployPolicies.override

clouddeploy.deployPolicies.update

clouddeploy.jobRuns.*

  • clouddeploy.jobRuns.get
  • clouddeploy.jobRuns.list
  • clouddeploy.jobRuns.terminate

clouddeploy.locations.*

  • clouddeploy.locations.get
  • clouddeploy.locations.list

clouddeploy.operations.*

  • clouddeploy.operations.cancel
  • clouddeploy.operations.delete
  • clouddeploy.operations.get
  • clouddeploy.operations.list

clouddeploy.releases.*

  • clouddeploy.releases.abandon
  • clouddeploy.releases.create
  • clouddeploy.releases.get
  • clouddeploy.releases.list

clouddeploy.rollouts.*

  • clouddeploy.rollouts.advance
  • clouddeploy.rollouts.approve
  • clouddeploy.rollouts.cancel
  • clouddeploy.rollouts.create
  • clouddeploy.rollouts.get
  • clouddeploy.rollouts.ignoreJob
  • clouddeploy.rollouts.list
  • clouddeploy.rollouts.retryJob
  • clouddeploy.rollouts.rollback

clouddeploy.targets.create