Google Cloud offers Identity and Access Management (IAM), which lets you give more granular access to specific Google Cloud resources and prevents unwanted access to other resources. This page describes the Cloud DNS API roles. For a detailed description of IAM, see the Identity and Access Management documentation.
IAM lets you adopt the security principle of least privilege so that you grant only the necessary access to your resources.
IAM lets you control who has what permissions to which
resources by setting IAM policies. IAM policies
grant specific roles to a user, giving the user certain permissions. For
example, a particular user might need to create and modify Domain Name System
(DNS) record resources. You would then give that user (who) the
/roles/dns.admin role, which has the dns.changes.create and
dns.resourceRecordSets.create permissions (what) so that they can create and
update resource record sets (which). In contrast, a support department might
only need to view existing resource record sets, so they would get a
/roles/dns.reader role.
Cloud DNS supports IAM permissions at the project level and individual DNS zone level. The default permission is at the project level. To configure permissions at the individual DNS zone (or resource) level, see Create a zone with specific IAM permissions.
Permissions and roles
Every Cloud DNS API method requires the caller to have the necessary IAM permissions. Permissions are assigned by granting roles to a user, group, or service account. In addition to the basic roles Owner, Editor, and Viewer, you can grant Cloud DNS API roles to the users of your project.
Permissions
The following table lists the permissions that the caller must have to call each method.
| Method | Required permission(s) |
|---|---|
dns.changes.create |
To create a resource record, set both
dns.changes.create and dns.resourceRecordSets.create
on the project containing the record set.
To update a resource record, set both
To delete a resource record, set both
|
dns.changes.get |
dns.changes.get on the project containing the managed zone. |
dns.changes.list |
dns.changes.list on the project containing the managed zone. |
dns.dnsKeys.get |
dns.dnsKeys.get on the project containing the managed zone. |
dns.dnsKeys.list |
dns.dnsKeys.list on the project containing the managed zone. |
dns.managedZoneOperations.get |
dns.managedZoneOperations.get on the project containing the managed zone. |
dns.managedZoneOperations.list |
dns.managedZoneOperations.list on the project containing the managed zone. |
dns.managedZones.create |
dns.managedZones.create on the project containing the
managed zone.If you are creating a private zone, you also need
If you are creating a private zone with GKE integration,
you also need |
dns.managedZones.delete |
dns.managedZones.delete on the project containing the managed zone. |
dns.managedZones.get |
dns.managedZones.get on the project containing the managed zone. |
dns.managedZones.list |
dns.managedZones.list on the project containing the
managed zone. |
dns.managedZones.update |
dns.managedZones.update on the project containing the
managed zone.If you are creating a private zone, you also need
If you are creating a private zone with GKE integration,
you also need |
dns.policies.create |
dns.policies.create on the project containing the policy.
If the policy is created on a VPC network, you also need
|