Dataplex defines several Identity and access management (IAM) roles. Each predefined role contains a set of IAM permissions that allow principals to perform certain actions. You can use an IAM policy to give a principal one or more IAM roles.
IAM also offers the ability to create customized roles. You can create custom IAM roles and assign the role one or more permissions. Then, you can grant the new role to your principals. Use custom roles to create an access control model that maps directly to your needs, alongside the available predefined roles.
This document describes the IAM roles relevant to Dataplex.
For a detailed description of IAM and its features, see the IAM documentation.
About Dataplex roles
Dataplex IAM roles are a bundle of one or more
permissions. You grant roles to principals to allow them to perform actions on
the Dataplex resources in your project. For example, the
Dataplex Viewer role contains the dataplex.*.get and
dataplex.*.list permissions, which allow users to get and list Dataplex
resources in a project. For more information, see
Dataplex permissions.
You can apply Dataplex roles to any resources in the service hierarchy, including projects, lakes, and data zones.
Basic roles
You can assign basic roles at the project level by using the IAM Project roles. The following is the list of permissions associated with IAM Project roles:
| Project Role | Permissions |
|---|---|
| Project Owner | All Project Editor permissions plus permissions to manage access control for the project (get/set IamPolicy) and to set up project billing |
| Project Editor | All Project Viewer permissions plus all project permissions for actions that modify state (create, delete, update, use) |
| Project Viewer | All project permissions for read-only actions that preserve state (get, list) |
Predefined roles for Dataplex
Predefined roles contain the permissions that are needed to perform a task or a group of related tasks.
Note the following:
- The Dataplex Administrator, Dataplex Editor, and Dataplex Viewer roles don't provide access to Dataplex Catalog resources.
- No role grants permissions to add or delete Dataplex Catalog
entries from system-defined entry groups, such as
@bigqueryand@dataplex. - The Dataplex Entry Owner role includes the following:
- Grants full access to entry-related operations.
- Grants permissions to add aspects of some of the system aspect types,
such as
Schema,Generic,Overview, andContacts. - Grants permissions to create entries of the
GenericEntrytype. - This role lets you create an entry with an entry type and aspect type, where the entry type and aspect type are defined in the same project as the entry. Otherwise, additional Dataplex Entry Type User and Dataplex Aspect Type User roles must be granted on the projects where the entry type and aspect type are defined.
- When using the
LookupEntrymethod or theSearchEntriesmethod, this role doesn't grant permissions to read entries that are created from Google Cloud resources outside of Dataplex, such as BigQuery entries. To read these entries, you must be granted permissions on the source system resources. Alternatively, you can read the entries with only the Dataplex Entry Owner role by using theGetEntrymethod.
- To search for entries using the
SearchEntriesmethod, you must be granted at least one of the Dataplex Catalog IAM roles on the project that is used in the API request. Permissions on search results are checked independently of the selected project.
The following table lists the Dataplex predefined roles and the permissions associated with each role:
| Role | Permissions |
|---|---|
Dataplex Administrator( Full access to Dataplex resources, except Dataplex Catalog. |
|
Dataplex Aspect Type Owner( Grants access to creating and managing Aspect Types. Does not give the right to create/modify Entries. |
|
Dataplex Aspect Type User( Grants access to use Aspect Types to create/modify Entries with the corresponding aspects. |
|
Dataplex Binding Administrator( Full access on DataAttribute Bindig resources. |
|
Dataplex Catalog Admin( Has full access to Catalog resources. |
|
Dataplex Catalog Editor( Has write access to Catalog resources. Cannot set IAM policies on resources |
|
Dataplex Catalog Viewer( Has read access to Catalog resources: Entry Groups, Entry Types, Aspect Types, Entry Link Types, Entries and Entry Links. Can view IAM policies on Catalog resources. |
|
Dataplex Data Owner( Owner access to data. To be granted to Dataplex resources Lake, Zone or Asset only. |
|
Dataplex Data Reader( Read only access to data. To be granted to Dataplex resources Lake, Zone or Asset only. |
|
Dataplex DataScan Administrator( Full access to DataScan resources. |
|
Dataplex DataScan Creator( Access to create new DataScan resources. |
|
Dataplex DataScan DataViewer( Read access to DataScan resources and additional contents. |
|
Dataplex DataScan Editor( Write access to DataScan resources. |
|
Dataplex DataScan Viewer( Read access to DataScan resources. |
|
Dataplex Data Writer( Write access to data. To be granted to Dataplex resources Lake, Zone or Asset only. |
|
Dataplex Developer( Allows running data analytics workloads in a lake. |
|
Dataplex Editor( Write access to Dataplex resources. |
|
Dataplex Encryption Admin( Gives user permissions to manage encryption config. |
|
Dataplex Entry Group Exporter( Grants access to export this entry group for Metadata Job processing. |
|
Dataplex Entry Group Importer( Grants access to import this entry group for Metadata Job processing. |
|
Dataplex Entry Group Owner( Owns Entry Groups and Entries inside of them. |
|
Dataplex Entry and EntryLink Owner( Owns Metadata Entries and EntryLinks. |
|
Dataplex Entry Type Owner( Grants access to creating and managing Entry Types. Does not give the right to create/modify Entries. |
|
Dataplex Entry Type User( Grants access to use Entry Types to create/modify Entries of those types. |
|
Dataplex Metadata Job Owner( Grants access to creating and managing Metadata Jobs. Does not give the right to create/modify Entry Groups. |
|
Dataplex Metadata Job Viewer( Read access to Metadata Job resources. |
|
Dataplex Metadata Reader( Read only access to metadata. |
|
Dataplex Metadata Writer( Write and Read access to metadata. |
|
Dataplex Security Administrator( Permissions configure ResourceAccess and DataAccess Specs on Data Attributes. |
|
Dataplex Storage Data Owner( Owner access to data. Should not be used directly. This role is granted by Dataplex to managed resources like Cloud Storage buckets, BigQuery datasets etc. |
|
Dataplex Storage Data Reader( Read only access to data. Should not be used directly. This role is granted by Dataplex to managed resources like Cloud Storage buckets, BigQuery datasets etc. |
|
Dataplex Storage Data Writer( Write access to data. Should not be used directly. This role is granted by Dataplex to managed resources like Cloud Storage buckets, BigQuery datasets etc. |
|
Dataplex Taxonomy Administrator( Full access to DataTaxonomy, DataAttribute resources. |
|
Dataplex Taxonomy Viewer( Read access on DataTaxonomy, DataAttribute resources. |
|
Dataplex Viewer( Read access to Dataplex resources. |
|
Predefined roles for data lineage
To access the lineage for any Dataplex Catalog entry, you need
access to the entry in Dataplex. To access the
Dataplex Catalog entry, you need a viewer role on the corresponding
system resource or the
Dataplex Catalog Viewer role
(roles/dataplex.catalogViewer) on the project that stores the
Dataplex Catalog entry. This section describes roles that are required to
view the lineage.
Lineage viewer role
The Data Lineage Viewer role
(roles/datalineage.viewer) lets you view Dataplex
lineage in the Google Cloud console and read lineage information using
the Data Lineage API. The
runs, and events for a given process are all stored in the same project as the
process. In the case of automated lineage,
the process, runs, and events
are stored in the project in which the job that generated the lineage was
running. This could be for example the project in which a BigQuery job
was running.
You need different roles to view the lineage between assets and to view metadata
of the assets. For the former, you need the
Data Lineage Viewer role (roles/datalineage.viewer).
For the latter, you need the same roles as used for accessing metadata entries
in Dataplex.
Roles to view lineage between two assets
To view lineage between assets, you need the
Data Lineage Viewer role (roles/datalineage.viewer)
on the following projects:
- The project in which you're viewing lineage (known as active project), that is the project in the drop-down at the top of the Google Cloud console or the project from which API calls are made. This would normally be the project that contains the resources you will create in Dataplex Catalog or access in other Google Cloud systems with the API.
- The projects in which lineage is recorded (known as compute project). Lineage is stored in the project in which the corresponding process was executed, as described earlier. This project can be different from the project that stores the asset that you're viewing lineage for.
For more information about granting roles, see Manage access. You might also be able to get the required permissions through custom roles or other predefined roles.
Depending on the use case, grant the Data Lineage Viewer role (roles/datalineage.viewer)
on the folder or organization level to ensure access to the lineage (see Grant or revoke a single role).
Roles required for data lineage can be granted only through
the Google Cloud CLI.
Roles to view asset metadata when viewing lineage
When metadata about an asset is stored in Dataplex Catalog, you only
get to view that metadata if you have a viewer role on the corresponding
system resource
or the Dataplex Catalog Viewer role (roles/dataplex.catalogViewer)
on the project in which the Dataplex Catalog entry is stored. You
might have access to assets on the lineage graph or list through appropriate
viewer roles but no access to the lineage between them. This is the case when
you don't have the Data Lineage Viewer role (roles/datalineage.viewer)
on the project in which the lineage was recorded. In this case, the
Data Lineage API and Google Cloud console doesn't show the lineage and
doesn't return an error, to prevent leaking information about the existence of
lineage. Therefore, absence of lineage for an asset does not mean that there is
no lineage for that asset, but that you might not have access to that lineage.
Data Lineage Events Producer role
The Data Lineage Events Producer role
(roles/datalineage.producer) lets users manually record lineage
information using the Data Lineage API.
Data Lineage Editor role
The Data Lineage Editor role
(roles/datalineage.editor) lets users manually modify lineage
information using the Data Lineage API.
Data Lineage Administrator role
The Data Lineage Administrator role
(roles/datalineage.admin) lets users perform all lineage operations
listed in this section.
Data roles
Dataplex defines the following IAM roles that are intended to be applied to any resource managed by Dataplex. For more information about the permissions that are associated with each role, see the Predefined roles section of this document.
| Data role | Capabilities | Justification |
|---|---|---|
Dataplex Data Owner (roles/dataplex.dataOwner) |
All permissions on the managed resource. And all permissions on all child resources (regardless of the resource type). | Data owners can update resource metadata, grant higher granularity permissions (for example, on child tables of a BigQuery dataset), and create child resources, in addition to various other permissions. They have complete ownership of the resource. |
Dataplex Data Reader (roles/dataplex.dataReader) |
Ability to read data in the managed resource and its children. And ability to read metadata of the managed resource and its children. | Enables ability to read data and metadata. |
Dataplex Data Writer (roles/dataplex.dataWriter) |
Ability to create/update/delete data (not metadata). | Enables core Dataplex user journeys. |
What's next
- Learn how to create custom IAM roles.
- Learn how to grant and manage roles.
- See the Dataplex IAM permissions mapping.