This page offers guidance on which type of role—predefined, custom, or basic—you should use to control access to Google Cloud resources.
The following summarizes our recommendations for choosing which type of role to use:
- We recommend that you prioritize using predefined roles because they're managed by Google and offer a balance of security and convenience.
- If you need a role that closely adheres to the principle of least privilege, and you can't find a predefined role that fits your security requirements, use custom roles.
- Don't use basic roles unless you have no alternative or are using them in a test environment.
When to use predefined roles
Generally, we recommend that you use predefined roles instead of basic or custom roles. Predefined roles give granular access to specific Google Cloud resources, are maintained by Google, and are updated automatically when new permissions, features, or services are added to Google Cloud.
We recommend prioritizing predefined roles that contain all of the permissions that a user is likely to need for a given use case. Most services provide broad Admin, Editor, and Viewer roles that serve this purpose. For example, the Bigtable Admin role provides administrative permissions to create new instances and access to all table data in a project, and the Bigtable Viewer role provides view-only access to the Bigtable in the Google Cloud console.