IAM overview

Identity and Access Management (IAM) lets you control user and group access to Spanner resources at the project, Spanner instance, and Spanner database levels. For example, you can specify that a user has full control of a specific database in a specific instance in your project, but cannot create, modify, or delete any instances in your project. Using access control with IAM lets you grant a permission to a user or group without having to modify each Spanner instance or database permission individually.

This document focuses on the IAM permissions relevant to Spanner and the IAM roles that grant those permissions. For a detailed description of IAM and its features, see the Identity and Access Management developer's guide. In particular, see the Managing IAM policies section.

Permissions

Permissions allow users to perform specific actions on Spanner resources. For example, the spanner.databases.read permission allows a user to read from a database using Spanner's read API, while spanner.databases.select allows a user to execute a SQL select statement on a database. You don't directly give users permissions; instead, you grant them predefined roles or custom roles, which have one or more permissions bundled within them.

The following tables list the IAM permissions that are associated with Spanner.

Instance configurations

The following permissions apply to Spanner instance configurations. For more information, see the instance configuration references for REST and RPC APIs.

Instance configuration permission name	Description
spanner.instanceConfigs.create	Create a custom instance configuration.
spanner.instanceConfigs.delete	Delete a custom instance configuration.
spanner.instanceConfigs.get	Get an instance configuration.
spanner.instanceConfigs.list	List the set of instance configurations.
spanner.instanceConfigs.update	Update a custom instance configuration.

Instance configuration operations

The following permissions apply to Spanner instance configuration operations. For more information, see the instance references for REST and RPC APIs.

Instance configuration operation permission name	Description
spanner.instanceConfigOperations.cancel	Cancel an instance configuration operation.
spanner.instanceConfigOperations.delete	Delete an instance configuration operation.
spanner.instanceConfigOperations.get	Get an instance configuration operation.
spanner.instanceConfigOperations.list	List instance configuration operations.

Instances

The following permissions apply to Spanner instances. For more information, see the instance references for REST and RPC APIs.

Instance permission name	Description
spanner.instances.create	Create an instance.
spanner.instances.delete	Delete an instance.
spanner.instances.get	Get the configuration of a specific instance.
spanner.instances.getIamPolicy	Get an instance's IAM Policy.
spanner.instances.list	List instances.
spanner.instances.setIamPolicy	Set an instance's IAM Policy.
spanner.instances.update	Update an instance.

Instance operations

The following permissions apply to Spanner instance operations. For more information, see the instance references for REST and RPC APIs.

Instance operation permission name	Description
spanner.instanceOperations.cancel	Cancel an instance operation.
spanner.instanceOperations.delete	Delete an instance operation.
spanner.instanceOperations.get	Get a specific instance operation.
spanner.instanceOperations.list	List instance operations.

Instance partitions

The following permissions apply to Spanner instance partitions. For more information, see the instance partition references for REST and RPC APIs.

Instance permission name	Description
spanner.instancePartitions.create	Create an instance partition.
spanner.instancePartitions.delete	Delete an instance partition.
spanner.instancePartitions.get	Get the configuration of a specific instance partition.
spanner.instancePartitions.list	List instance partitions.
spanner.instancePartitions.update	Update an instance partition.

Instance partition operations

The following permissions apply to Spanner instance partition operations. For more information, see the instance partition references for REST and RPC APIs.

Instance partition operation permission name	Description
spanner.instancePartitionOperations.cancel	Cancel an instance partition operation.
spanner.instancePartitionOperations.delete	Delete an instance partition operation.
spanner.instancePartitionOperations.get	Get a specific instance partition operation.
spanner.instancePartitionOperations.list	List instance partition operations.

Databases

The following permissions apply to Spanner databases. For more information, see the database references for REST and RPC APIs.

Database permission name	Description
spanner.databases.adapt	Lets the Spanner Adapter API interact directly with Spanner.
spanner.databases.beginOrRollbackReadWriteTransaction	Begin or roll back a read-write transaction on a Spanner database.
spanner.databases.beginPartitionedDmlTransaction	Execute an instance partitioned data manipulation language (DML) statement. For more information about instance partitioned queries, see Read data in parallel.
spanner.databases.beginReadOnlyTransaction	Begin a read-only transaction on a Spanner database.
spanner.databases.create	Create a database.
spanner.databases.createBackup	Create a backup from the database. Also requires spanner.backups.create to create the backup resource.
spanner.databases.drop	Drop a database.
spanner.databases.get	Get a database's metadata.
spanner.databases.getDdl	Get a database's schema.
spanner.databases.getIamPolicy	Get a database's IAM policy.
spanner.databases.list	List databases.
spanner.databases.read	Read from a database using the read API.
spanner.databases.select	Execute a SQL select statement on a database.
spanner.databases.setIamPolicy	Set a database's IAM policy.
spanner.databases.update	Update a database's metadata.
spanner.databases.updateDdl	Update a database's schema.
spanner.databases.useDataBoost	Use the compute resources of Spanner Data Boost to process instance partitioned queries.
spanner.databases.useRoleBasedAccess	Use fine-grained access control.
spanner.databases.write	Write into a database.

Database roles

The following permissions apply to Spanner database roles. For more information, see the database references for REST and RPC APIs.

Database role permission name	Description
spanner.databaseRoles.list	List database roles.
spanner.databaseRoles.use	Use a specified database role.

Database operations

The following permissions apply to Spanner database operations. For more information, see the database references for REST and RPC APIs.

Database operation permission name	Description
spanner.databaseOperations.cancel	Cancel a database operation.
spanner.databaseOperations.get	Get a specific database operation.
spanner.databaseOperations.list	List database and restore database operations.

Backups

The following permissions apply to Spanner backups. For more information, see the backups references for REST and RPC APIs.

Backup permission name	Description
spanner.backups.create	Create a backup. Also requires spanner.databases.createBackup on the source database.
spanner.backups.delete	Delete a backup.
spanner.backups.get	Get a backup.
spanner.backups.getIamPolicy	Get a backup's IAM policy.
spanner.backups.list	List backups.
spanner.backups.restoreDatabase	Restore database from a backup. Also requires spanner.databases.create to create the restored database on the target instance.
spanner.backups.setIamPolicy	Set a backup's IAM policy.
spanner.backups.update	Update a backup.

Backup operations

The following permissions apply to Spanner backup operations. For more information, see the database references for REST and RPC APIs.

Backup operation permission name	Description
spanner.backupOperations.cancel	Cancel a backup operation.
spanner.backupOperations.get	Get a specific backup operation.
spanner.backupOperations.list	List backup operations.

Backup schedules

The following permissions apply to Spanner backup schedules. For more information, see the database references for the REST and RPC APIs.

Backup schedule permission name	Description
spanner.backupSchedules.create	Create a backup schedule. Also requires spanner.databases.createBackup on the source database.
spanner.backupSchedules.delete	Delete a backup schedule.
spanner.backupSchedules.get	Get a backup schedule.
spanner.backupSchedules.list	List backup schedules.
spanner.backupSchedules.update	Update a backup schedule.

Sessions

The following permissions apply to Spanner sessions. For more information, see the database references for REST and RPC APIs.

Session permission name	Description
spanner.sessions.create	Create a session.
spanner.sessions.delete	Delete a session.
spanner.sessions.get	Get a session.
spanner.sessions.list	List sessions.

Predefined roles

A predefined role is a bundle of one or more permissions. For example, the predefined role roles/spanner.databaseUser contains the permissions spanner.databases.read and spanner.databases.write. There are two types of predefined roles for Spanner:

• Person roles: Granted to users or groups, which allows them to perform actions on the resources in your project.
• Machine roles: Granted to service accounts, which allows machines running as those service accounts to perform actions on the resources in your project.

The following table lists the access control with IAM predefined roles, including a list of the permissions associated with each role:

Role	Permissions
Cloud Spanner Admin (roles/spanner.admin) Has complete access to all Spanner resources in a Google Cloud project. A principal with this role can: Grant and revoke permissions to other principals for all Spanner resources in the project. Allocate and delete chargeable Spanner resources. Issue get/list/modify operations on Cloud Spanner resources. Read from and write to all Cloud Spanner databases in the project. Fetch project metadata. Lowest-level resources where you can grant this role: Instance Database	cloudkms.keyHandles.* cloudkms.keyHandles.create cloudkms.keyHandles.get cloudkms.keyHandles.list cloudkms.operations.get cloudkms.projects.showEffectiveAutokeyConfig monitoring.timeSeries.* monitoring.timeSeries.create monitoring.timeSeries.list resourcemanager.projects.get resourcemanager.projects.list spanner.* spanner.backupOperations.cancel spanner.backupOperations.get spanner.backupOperations.list spanner.backupSchedules.create spanner.backupSchedules.delete spanner.backupSchedules.get spanner.backupSchedules.getIamPolicy spanner.backupSchedules.list spanner.backupSchedules.setIamPolicy spanner.backupSchedules.update spanner.backups.copy spanner.backups.create spanner.backups.delete spanner.backups.get spanner.backups.getIamPolicy spanner.backups.list spanner.backups.restoreDatabase spanner.backups.setIamPolicy spanner.backups.update spanner.databaseOperations.cancel spanner.databaseOperations.get spanner.databaseOperations.list spanner.databaseRoles.list spanner.databases.adapt spanner.databases.addSplitPoints spanner.databases.beginOrRollbackReadWriteTransaction spanner.databases.beginPartitionedDmlTransaction spanner.databases.beginReadOnlyTransaction spanner.databases.changequorum spanner.databases.create spanner.databases.createBackup spanner.databases.drop spanner.databases.get spanner.databases.getDdl spanner.databases.getIamPolicy spanner.databases.list spanner.databases.partitionQuery spanner.databases.partitionRead spanner.databases.read spanner.databases.runGraphAlgorithms spanner.databases.select spanner.databases.setIamPolicy spanner.databases.update spanner.databases.updateDdl spanner.databases.useDataBoost spanner.databases.useRoleBasedAccess spanner.databases.write spanner.instanceConfigOperations.cancel spanner.instanceConfigOperations.delete spanner.instanceConfigOperations.get spanner.instanceConfigOperations.list spanner.instanceConfigs.create spanner.instanceConfigs.delete spanner.instanceConfigs.get spanner.instanceConfigs.list spanner.instanceConfigs.update spanner.instanceOperations.cancel spanner.instanceOperations.delete spanner.instanceOperations.get spanner.instanceOperations.list spanner.instancePartitionOperations.cancel spanner.instancePartitionOperations.delete spanner.instancePartitionOperations.get spanner.instancePartitionOperations.list spanner.instancePartitions.create spanner.instancePartitions.delete spanner.instancePartitions.get spanner.instancePartitions.list spanner.instancePartitions.update spanner.instances.create spanner.instances.createTagBinding spanner.instances.delete spanner.instances.deleteTagBinding spanner.instances.get spanner.instances.getIamPolicy spanner.instances.list spanner.instances.listEffectiveTags spanner.instances.listTagBindings spanner.instances.setIamPolicy spanner.instances.update spanner.sessions.create spanner.sessions.delete spanner.sessions.get spanner.sessions.list
Cloud Spanner Editor (roles/spanner.editor) Editor role for Cloud Spanner	monitoring.timeSeries.list resourcemanager.projects.get resourcemanager.projects.list spanner.backupOperations.* spanner.backupOperations.cancel spanner.backupOperations.get spanner.backupOperations.list spanner.backupSchedules.create spanner.backupSchedules.delete spanner.backupSchedules.get spanner.backupSchedules.getIamPolicy spanner.backupSchedules.list