Configure IAM for Bare Metal Solution

When you want a principal, such as a Google Cloud project user or service account, to gain access to the resources in your Bare Metal Solution environment, you need to grant them appropriate roles and permissions. To grant access, you can create an Identity and Access Management (IAM) policy and grant predefined roles specific to Bare Metal Solution.

Grant roles with enough permissions for your principals to be able do their job but no more, so that you can follow the Google Cloud security principle of least privilege.

Predefined roles for Bare Metal Solution

Each IAM role for Bare Metal Solution contains permissions that give the principal access to specific resources as shown in the following table.

Role Permissions

(roles/baremetalsolution.admin)

Administrator of Bare Metal Solution resources

baremetalsolution.instancequotas.list

baremetalsolution.instances.*

  • baremetalsolution.instances.attachNetwork
  • baremetalsolution.instances.attachVolume
  • baremetalsolution.instances.create
  • baremetalsolution.instances.detachLun
  • baremetalsolution.instances.detachNetwork
  • baremetalsolution.instances.detachVolume
  • baremetalsolution.instances.disableInteractiveSerialConsole
  • baremetalsolution.instances.enableInteractiveSerialConsole
  • baremetalsolution.instances.get
  • baremetalsolution.instances.list
  • baremetalsolution.instances.rename
  • baremetalsolution.instances.reset
  • baremetalsolution.instances.start
  • baremetalsolution.instances.stop
  • baremetalsolution.instances.update

baremetalsolution.luns.*

  • baremetalsolution.luns.create
  • baremetalsolution.luns.delete
  • baremetalsolution.luns.evict
  • baremetalsolution.luns.get
  • baremetalsolution.luns.list
  • baremetalsolution.luns.update

baremetalsolution.maintenanceevents.*

  • baremetalsolution.maintenanceevents.addProposal
  • baremetalsolution.maintenanceevents.approve
  • baremetalsolution.maintenanceevents.get
  • baremetalsolution.maintenanceevents.list

baremetalsolution.networkquotas.list

baremetalsolution.networks.*

  • baremetalsolution.networks.create
  • baremetalsolution.networks.delete
  • baremetalsolution.networks.get
  • baremetalsolution.networks.list
  • baremetalsolution.networks.rename
  • baremetalsolution.networks.update

baremetalsolution.nfsshares.*

  • baremetalsolution.nfsshares.create
  • baremetalsolution.nfsshares.delete
  • baremetalsolution.nfsshares.get
  • baremetalsolution.nfsshares.list
  • baremetalsolution.nfsshares.rename
  • baremetalsolution.nfsshares.update

baremetalsolution.operations.get

baremetalsolution.osimages.list

baremetalsolution.pods.list

baremetalsolution.procurements.get

baremetalsolution.procurements.list

baremetalsolution.skus.list

baremetalsolution.snapshotschedulepolicies.*

  • baremetalsolution.snapshotschedulepolicies.create
  • baremetalsolution.snapshotschedulepolicies.delete
  • baremetalsolution.snapshotschedulepolicies.get
  • baremetalsolution.snapshotschedulepolicies.list
  • baremetalsolution.snapshotschedulepolicies.update

baremetalsolution.sshKeys.*

  • baremetalsolution.sshKeys.create
  • baremetalsolution.sshKeys.delete
  • baremetalsolution.sshKeys.list

baremetalsolution.storageaggregatepools.list

baremetalsolution.volumequotas.list

baremetalsolution.volumes.*

  • baremetalsolution.volumes.create
  • baremetalsolution.volumes.delete
  • baremetalsolution.volumes.evict
  • baremetalsolution.volumes.get
  • baremetalsolution.volumes.list
  • baremetalsolution.volumes.rename
  • baremetalsolution.volumes.resize
  • baremetalsolution.volumes.update

baremetalsolution.volumesnapshots.*

  • baremetalsolution.volumesnapshots.create
  • baremetalsolution.volumesnapshots.delete
  • baremetalsolution.volumesnapshots.get
  • baremetalsolution.volumesnapshots.list
  • baremetalsolution.volumesnapshots.restore

resourcemanager.projects.get

resourcemanager.projects.list

(roles/baremetalsolution.editor)

Editor of Bare Metal Solution resources

baremetalsolution.instancequotas.list

baremetalsolution.instances.*

  • baremetalsolution.instances.attachNetwork
  • baremetalsolution.instances.attachVolume
  • baremetalsolution.instances.create
  • baremetalsolution.instances.detachLun
  • baremetalsolution.instances.detachNetwork
  • baremetalsolution.instances.detachVolume
  • baremetalsolution.instances.disableInteractiveSerialConsole
  • baremetalsolution.instances.enableInteractiveSerialConsole
  • baremetalsolution.instances.get
  • baremetalsolution.instances.list
  • baremetalsolution.instances.rename
  • baremetalsolution.instances.reset
  • baremetalsolution.instances.start
  • baremetalsolution.instances.stop
  • baremetalsolution.instances.update

baremetalsolution.luns.*

  • baremetalsolution.luns.create
  • baremetalsolution.luns.delete
  • baremetalsolution.luns.evict
  • baremetalsolution.luns.get
  • baremetalsolution.luns.list
  • baremetalsolution.luns.update

baremetalsolution.maintenanceevents.*

  • baremetalsolution.maintenanceevents.addProposal
  • baremetalsolution.maintenanceevents.approve
  • baremetalsolution.maintenanceevents.get
  • baremetalsolution.maintenanceevents.list

baremetalsolution.networkquotas.list

baremetalsolution.networks.*

  • baremetalsolution.networks.create
  • baremetalsolution.networks.delete
  • baremetalsolution.networks.get
  • baremetalsolution.networks.list
  • baremetalsolution.networks.rename
  • baremetalsolution.networks.update

baremetalsolution.nfsshares.*

  • baremetalsolution.nfsshares.create
  • baremetalsolution.nfsshares.delete
  • baremetalsolution.nfsshares.get
  • baremetalsolution.nfsshares.list
  • baremetalsolution.nfsshares.rename
  • baremetalsolution.nfsshares.update

baremetalsolution.operations.get

baremetalsolution.osimages.list

baremetalsolution.pods.list

baremetalsolution.procurements.get

baremetalsolution.procurements.list

baremetalsolution.skus.list

baremetalsolution.snapshotschedulepolicies.*

  • baremetalsolution.snapshotschedulepolicies.create
  • baremetalsolution.snapshotschedulepolicies.delete
  • baremetalsolution.snapshotschedulepolicies.get
  • baremetalsolution.snapshotschedulepolicies.list
  • baremetalsolution.snapshotschedulepolicies.update

baremetalsolution.sshKeys.*

  • baremetalsolution.sshKeys.create
  • baremetalsolution.sshKeys.delete
  • baremetalsolution.sshKeys.list

baremetalsolution.storageaggregatepools.list

baremetalsolution.volumequotas.list

baremetalsolution.volumes.*

  • baremetalsolution.volumes.create
  • baremetalsolution.volumes.delete
  • baremetalsolution.volumes.evict
  • baremetalsolution.volumes.get
  • baremetalsolution.volumes.list
  • baremetalsolution.volumes.rename
  • baremetalsolution.volumes.resize
  • baremetalsolution.volumes.update

baremetalsolution.volumesnapshots.*

  • baremetalsolution.volumesnapshots.create
  • baremetalsolution.volumesnapshots.delete
  • baremetalsolution.volumesnapshots.get
  • baremetalsolution.volumesnapshots.list
  • baremetalsolution.volumesnapshots.restore

resourcemanager.projects.get

resourcemanager.projects.list

(roles/baremetalsolution.instancesadmin)

Admin of Bare Metal Solution Instance resources

baremetalsolution.instances.*

  • baremetalsolution.instances.attachNetwork
  • baremetalsolution.instances.attachVolume
  • baremetalsolution.instances.create
  • baremetalsolution.instances.detachLun
  • baremetalsolution.instances.detachNetwork
  • baremetalsolution.instances.detachVolume
  • baremetalsolution.instances.disableInteractiveSerialConsole
  • baremetalsolution.instances.enableInteractiveSerialConsole
  • baremetalsolution.instances.get
  • baremetalsolution.instances.list
  • baremetalsolution.instances.rename
  • baremetalsolution.instances.reset
  • baremetalsolution.instances.start
  • baremetalsolution.instances.stop
  • baremetalsolution.instances.update

baremetalsolution.operations.get

baremetalsolution.osimages.list

baremetalsolution.pods.list

resourcemanager.projects.get

resourcemanager.projects.list

(roles/baremetalsolution.instancesviewer)

Viewer of Bare Metal Solution Instance resources

baremetalsolution.instancequotas.list

baremetalsolution.instances.get

baremetalsolution.instances.list

baremetalsolution.operations.get

resourcemanager.projects.get

resourcemanager.projects.list

(roles/baremetalsolution.lunsadmin)

Administrator of Bare Metal Solution Lun resources

baremetalsolution.luns.get

baremetalsolution.luns.list

baremetalsolution.operations.get

(roles/baremetalsolution.lunsviewer)

Viewer of Bare Metal Solution Lun resources

baremetalsolution.luns.get

baremetalsolution.luns.list

baremetalsolution.operations.get

(roles/baremetalsolution.maintenanceeventsadmin)

Administrator of Bare Metal Solution maintenance events resources

baremetalsolution.maintenanceevents.*

  • baremetalsolution.maintenanceevents.addProposal
  • baremetalsolution.maintenanceevents.approve
  • baremetalsolution.maintenanceevents.get
  • baremetalsolution.maintenanceevents.list

(roles/baremetalsolution.maintenanceeventseditor)

Editor of Bare Metal Solution maintenance events resources

baremetalsolution.maintenanceevents.*

  • baremetalsolution.maintenanceevents.addProposal
  • baremetalsolution.maintenanceevents.approve
  • baremetalsolution.maintenanceevents.get
  • baremetalsolution.maintenanceevents.list

(roles/baremetalsolution.maintenanceeventsviewer)

Viewer of Bare Metal Solution maintenance events resources

baremetalsolution.maintenanceevents.get

baremetalsolution.maintenanceevents.list

(roles/baremetalsolution.networksadmin)

Admin of Bare Metal Solution networks resources

baremetalsolution.networkquotas.list

baremetalsolution.networks.*

  • baremetalsolution.networks.create
  • baremetalsolution.networks.delete
  • baremetalsolution.networks.get
  • baremetalsolution.networks.list
  • baremetalsolution.networks.rename
  • baremetalsolution.networks.update

baremetalsolution.operations.get

baremetalsolution.pods.list

(roles/baremetalsolution.nfssharesadmin)

Administrator of Bare Metal Solution NFS Share resources

baremetalsolution.nfsshares.*

  • baremetalsolution.nfsshares.create
  • baremetalsolution.nfsshares.delete
  • baremetalsolution.nfsshares.get
  • baremetalsolution.nfsshares.list
  • baremetalsolution.nfsshares.rename
  • baremetalsolution.nfsshares.update

baremetalsolution.operations.get

baremetalsolution.pods.list

(roles/baremetalsolution.nfsshareseditor)

Editor of Bare Metal Solution NFS Share resources

baremetalsolution.nfsshares.*

  • baremetalsolution.nfsshares.create
  • baremetalsolution.nfsshares.delete
  • baremetalsolution.nfsshares.get
  • baremetalsolution.nfsshares.list
  • baremetalsolution.nfsshares.rename
  • baremetalsolution.nfsshares.update

baremetalsolution.operations.get

baremetalsolution.pods.list

(roles/baremetalsolution.nfssharesviewer)

Viewer of Bare Metal Solution NFS Share resources

baremetalsolution.nfsshares.get

baremetalsolution.nfsshares.list

baremetalsolution.operations.get

(roles/baremetalsolution.osimagesviewer)

Viewer of Bare Metal Solution OS images resources

baremetalsolution.osimages.list

(roles/baremetalsolution.procurementsadmin)

Administrator of Bare Metal Solution Procurements

baremetalsolution.pods.list

baremetalsolution.procurements.*

  • baremetalsolution.procurements.create
  • baremetalsolution.procurements.get
  • baremetalsolution.procurements.list

baremetalsolution.skus.list

(roles/baremetalsolution.procurementseditor)

Editor of Bare Metal Solution Procurements

baremetalsolution.pods.list

baremetalsolution.procurements.*

  • baremetalsolution.procurements.create
  • baremetalsolution.procurements.get
  • baremetalsolution.procurements.list

baremetalsolution.skus.list

(roles/baremetalsolution.procurementsviewer)

Viewer of Bare Metal Solution Procurements

baremetalsolution.procurements.get

baremetalsolution.procurements.list

baremetalsolution.skus.list

(roles/baremetalsolution.serviceAgent)

Gives permission to manage network resources such as interconnect pairing keys, required for Bare Metal Solution.

compute.interconnectAttachments.get

compute.interconnectAttachments.list

compute.interconnects.get

compute.interconnects.list

compute.networks.get

compute.networks.list

compute.projects.get

resourcemanager.projects.get

(roles/baremetalsolution.storageadmin)

Administrator of Bare Metal Solution storage resources

baremetalsolution.luns.*

  • baremetalsolution.luns.create
  • baremetalsolution.luns.delete
  • baremetalsolution.luns.evict
  • baremetalsolution.luns.get
  • baremetalsolution.luns.list
  • baremetalsolution.luns.update

baremetalsolution.nfsshares.*

  • baremetalsolution.nfsshares.create
  • baremetalsolution.nfsshares.delete
  • baremetalsolution.nfsshares.get
  • baremetalsolution.nfsshares.list
  • baremetalsolution.nfsshares.rename
  • baremetalsolution.nfsshares.update

baremetalsolution.operations.get

baremetalsolution.pods.list

baremetalsolution.snapshotschedulepolicies.*

  • baremetalsolution.snapshotschedulepolicies.create
  • baremetalsolution.snapshotschedulepolicies.delete
  • baremetalsolution.snapshotschedulepolicies.get
  • baremetalsolution.snapshotschedulepolicies.list
  • baremetalsolution.snapshotschedulepolicies.update

baremetalsolution.storageaggregatepools.list

baremetalsolution.volumequotas.list

baremetalsolution.volumes.*

  • baremetalsolution.volumes.create
  • baremetalsolution.volumes.delete
  • baremetalsolution.volumes.evict
  • baremetalsolution.volumes.get
  • baremetalsolution.volumes.list
  • baremetalsolution.volumes.rename
  • baremetalsolution.volumes.resize
  • baremetalsolution.volumes.update

baremetalsolution.volumesnapshots.*

  • baremetalsolution.volumesnapshots.create
  • baremetalsolution.volumesnapshots.delete
  • baremetalsolution.volumesnapshots.get
  • baremetalsolution.volumesnapshots.list
  • baremetalsolution.volumesnapshots.restore

resourcemanager.projects.get

resourcemanager.projects.list

(roles/baremetalsolution.viewer)

Viewer of Bare Metal Solution resources

baremetalsolution.instancequotas.list

baremetalsolution.instances.get

baremetalsolution.instances.list

baremetalsolution.luns.get

baremetalsolution.luns.list

baremetalsolution.maintenanceevents.get

baremetalsolution.maintenanceevents.list

baremetalsolution.networkquotas.list

baremetalsolution.networks.get

baremetalsolution.networks.list

baremetalsolution.nfsshares.get

baremetalsolution.nfsshares.list

baremetalsolution.operations.get

baremetalsolution.osimages.list

baremetalsolution.pods.list

baremetalsolution.procurements.get

baremetalsolution.procurements.list

baremetalsolution.skus.list

baremetalsolution.snapshotschedulepolicies.get

baremetalsolution.snapshotschedulepolicies.list

baremetalsolution.sshKeys.list

baremetalsolution.storageaggregatepools.list

baremetalsolution.volumequotas.list

baremetalsolution.volumes.get

baremetalsolution.volumes.list

baremetalsolution.volumesnapshots.get

baremetalsolution.volumesnapshots.list

resourcemanager.projects.get

resourcemanager.projects.list

(roles/baremetalsolution.volumesadmin)

Administrator of Bare Metal Solution volume resources

baremetalsolution.operations.get

baremetalsolution.pods.list

baremetalsolution.volumes.*

  • baremetalsolution.volumes.create
  • baremetalsolution.volumes.delete
  • baremetalsolution.volumes.evict
  • baremetalsolution.volumes.get
  • baremetalsolution.volumes.list
  • baremetalsolution.volumes.rename
  • baremetalsolution.volumes.resize
  • baremetalsolution.volumes.update

(roles/baremetalsolution.volumeseditor)

Editor of Bare Metal Solution volumes resources

baremetalsolution.operations.get

baremetalsolution.pods.list

baremetalsolution.volumequotas.list

baremetalsolution.volumes.create

baremetalsolution.volumes.delete

baremetalsolution.volumes.get

baremetalsolution.volumes.list

baremetalsolution.volumes.rename

baremetalsolution.volumes.resize

baremetalsolution.volumes.update

(roles/baremetalsolution.volumesnapshotsadmin)

Administrator of Bare Metal Solution snapshots resources

baremetalsolution.operations.get

baremetalsolution.volumesnapshots.*

  • baremetalsolution.volumesnapshots.create
  • baremetalsolution.volumesnapshots.delete
  • baremetalsolution.volumesnapshots.get
  • baremetalsolution.volumesnapshots.list
  • baremetalsolution.volumesnapshots.restore

(roles/baremetalsolution.volumesnapshotseditor)

Editor of Bare Metal Solution snapshots resources

baremetalsolution.operations.get

baremetalsolution.volumesnapshots.create

baremetalsolution.volumesnapshots.delete

baremetalsolution.volumesnapshots.get

baremetalsolution.volumesnapshots.list

(roles/baremetalsolution.volumesnapshotsviewer)

Viewer of Bare Metal Solution snapshots resources

baremetalsolution.operations.get

baremetalsolution.volumesnapshots.get

baremetalsolution.volumesnapshots.list

(roles/baremetalsolution.volumessviewer)

Viewer of Bare Metal Solution volumes resources

baremetalsolution.operations.get

baremetalsolution.volumes.get

baremetalsolution.volumes.list

We recommend applying the roles as follows:

  • Filling out an intake form

    • Bare Metal Solution roles: Admin, Editor, or Instances Admin AND Compute Network Viewer
    • Basic roles: Owner or Editor

  • Restarting a Bare Metal Solution server

    • Bare Metal Solution roles: Admin or Editor
    • Basic roles: Owner or Editor

  • Listing servers or requesting status

    • Bare Metal Solution roles: Viewer or Instances Viewer
    • Basic role: Viewer

  • Managing storage components

    • Bare Metal Solution roles: Admin, Editor, or Storage Admin
    • Basic roles: Owner or Editor

  • Managing networking components

    • Bare Metal Solution roles: Admin, Editor, or Networks Admin
    • Basic roles: Owner or Editor

For a full list of Bare Metal Solution roles, see Predefined roles and enter baremetalsolution. in the search box.

For a full list of Bare Metal Solution permissions, see Search for a permission and enter baremetalsolution. in the search box.

Grant an IAM role

Add an IAM policy to grant a Bare Metal Solution role to a principal. The role contains permissions which enable the principal to perform certain actions. To grant a role:

Console

  1. Make sure that you have a role that contains the proper IAM permissions to grant roles to others, such as Owner, Project IAM Admin, or Security Admin. For more information about this requirement, see Required Roles.

  2. In the Google Cloud console, go to the IAM permissions page.

    Go to IAM

  3. Click Grant access.

  4. Enter the following information:

    • For Add principals, enter your users. You can add individual users, Google groups, service accounts, or Google Workspace domains.

    • For Assign roles, choose a role from the Select a role menu to grant this role to the principals.

    • Click Add another role if you need to assign multiple roles to your principals.

    • Click Save.

    Your principals and their assigned roles appear in the IAM permissions status page.

gcloud

  1. Make sure that you have a role that contains the proper IAM permissions to grant roles to others, such as Owner, Project IAM Admin, or Security Admin. For more information about this requirement, see Required Roles.

  2. Open a Cloud Shell window in your Google Cloud project.

  3. Add your Google Cloud project ID, email address for your principal's Google Cloud account, and the desired Bare Metal Solution role path into the following command:

    gcloud projects add-iam-policy-binding PROJECT_ID \
 --member=user:username@example.com \
 --role=roles/baremetalsolution.admin

  4. Copy the command and paste it into your Cloud Shell window.

  5. Press the Enter or Return key.

  6. In some cases, an Authorize Cloud Shell window opens, requesting you to allow an API call. If you see this, click Authorize.

  7. When you've entered the commands successfully, the output looks like this:

    Updated IAM policy for project [PROJECT_ID].
  bindings:
  - members:
   - user:username@example.com
   role: roles/baremetalsolution.admin
  - members:
   - serviceAccount:service-PROJECT_NUMBER@compute-system.iam.gserviceaccount.com
   role: roles/compute.serviceAgent
  - members:
   - serviceAccount:PROJECT_NUMBER-compute@developer.gserviceaccount.com
   - serviceAccount:PROJECT_NUMBER@cloudservices.gserviceaccount.com
   role: roles/editor
  - members:
   - user:username@example.com
   role: roles/owner
  etag: ETAG_NUMBER
  version: 1

To learn more about IAM, see Identity and Access Management.