IAM roles and permissions for AlloyDB

This page lists the Identity and Access Management (IAM) predefined roles and permissions for AlloyDB. For a complete list of IAM roles and permissions for AlloyDB, see AlloyDB for PostgreSQL roles and permissions.

In order to assign these roles and permissions to an IAM account:

  • The Cloud Resource Manager API must be enabled in the Google Cloud project.

    Enable the API

  • You must have the roles/owner (Owner) basic IAM role in the Google Cloud project, or a role that grants these permissions:
    • resourcemanager.projects.get
    • resourcemanager.projects.getIamPolicy
    • resourcemanager.projects.setIamPolicy

    To gain these permissions while following the principle of least privilege, ask your administrator to grant you the roles/resourcemanager.projectIamAdmin (Project IAM Admin) role.

Predefined AlloyDB IAM roles

The following table lists the predefined roles available for AlloyDB, along with their AlloyDB permissions:

Predefined role name Description
AlloyDB permissions
roles/alloydb.admin
AlloyDB Admin

Full control for all AlloyDB resources.

alloydb.*
roles/alloydb.client
AlloyDB Client

Connectivity access to AlloyDB instances from clients.

alloydb.clusters.generateClientCertificate
alloydb.clusters.get
alloydb.instances.connect
alloydb.instances.get
roles/alloydb.databaseUser
AlloyDB Database User

Authenticated database-user access to AlloyDB instances.

alloydb.clusters.get
alloydb.instances.get
alloydb.users.login
alloydb.instances.executeSql
roles/alloydb.viewer
AlloyDB Viewer

Read-only access to all AlloyDB resources.

alloydb.*.get
alloydb.*.getIamPolicy
alloydb.*.list

AlloyDB IAM permissions and their roles

The following table lists each permission that AlloyDB supports and the predefined AlloyDB roles that include it.

Permission AlloyDB roles
alloydb.backups.create AlloyDB Admin
alloydb.backups.createTagBinding AlloyDB Admin
alloydb.backups.delete AlloyDB Admin
alloydb.backups.deleteTagBinding AlloyDB Admin
alloydb.backups.get AlloyDB Admin
AlloyDB Viewer
alloydb.backups.getIamPolicy AlloyDB Admin
AlloyDB Viewer
alloydb.backups.list AlloyDB Admin
AlloyDB Viewer
alloydb.backups.listTagBindings AlloyDB Admin
AlloyDB Viewer
alloydb.backups.listEffectiveTags AlloyDB Admin
AlloyDB Viewer
alloydb.backups.setIamPolicy AlloyDB Admin
alloydb.backups.update AlloyDB Admin
alloydb.clusters.create AlloyDB Admin
alloydb.clusters.createTagBinding AlloyDB Admin
alloydb.clusters.delete AlloyDB Admin
alloydb.clusters.deleteTagBinding AlloyDB Admin
alloydb.clusters.failover AlloyDB Admin
alloydb.clusters.generateClientCertificate AlloyDB Admin
AlloyDB Client
alloydb.clusters.get AlloyDB Admin
AlloyDB Client
AlloyDB Viewer
alloydb.clusters.getIamPolicy AlloyDB Admin
AlloyDB Viewer
alloydb.clusters.import AlloyDB Admin
alloydb.clusters.list AlloyDB Admin
AlloyDB Viewer
alloydb.clusters.listTagBindings AlloyDB Admin
AlloyDB Viewer
alloydb.clusters.listEffectiveTags AlloyDB Admin
AlloyDB Viewer
alloydb.clusters.setIamPolicy AlloyDB Admin
alloydb.clusters.update AlloyDB Admin
alloydb.databases.list AlloyDB Admin
AlloyDB Viewer
alloydb.instances.connect AlloyDB Admin
AlloyDB Client
alloydb.instances.create AlloyDB Admin
alloydb.instances.delete AlloyDB Admin
alloydb.instances.executeSql AlloyDB Admin
AlloyDB Database User
alloydb.instances.failover AlloyDB Admin
alloydb.instances.get AlloyDB Admin
AlloyDB Client
AlloyDB Database User
AlloyDB Viewer
alloydb.instances.getIamPolicy AlloyDB Admin
AlloyDB Viewer
alloydb.instances.list AlloyDB Admin
AlloyDB Viewer
alloydb.instances.restart AlloyDB Admin
alloydb.instances.setIamPolicy AlloyDB Admin
alloydb.instances.update AlloyDB Admin
alloydb.locations.get AlloyDB Admin
AlloyDB Viewer
alloydb.locations.list AlloyDB Admin
AlloyDB Viewer
alloydb.operations.cancel AlloyDB Admin
alloydb.operations.delete AlloyDB Admin
alloydb.operations.get AlloyDB Admin
AlloyDB Viewer
alloydb.operations.list AlloyDB Admin
AlloyDB Viewer
alloydb.supportedDatabaseFlags.get AlloyDB Admin
AlloyDB Viewer
alloydb.supportedDatabaseFlags.getIamPolicy AlloyDB Admin
AlloyDB Viewer
alloydb.supportedDatabaseFlags.list AlloyDB Admin
AlloyDB Viewer
alloydb.supportedDatabaseFlags.setIamPolicy AlloyDB Admin
alloydb.users.list AlloyDB Admin
AlloyDB Client
alloydb.users.get AlloyDB Admin
AlloyDB Client
alloydb.users.create AlloyDB Admin
alloydb.users.update AlloyDB Admin
alloydb.users.delete AlloyDB Admin
alloydb.users.login AlloyDB Admin
AlloyDB Database User