Stay organized with collections
Save and categorize content based on your preferences.
This page provides instructions about how to set up specific read, write, or
administrator Identity and Access Management (IAM) permissions for different managed
zones under the same project.
To perform this task, you must have been granted the following permissions
or the following IAM roles.
Permissions
dns.managedZones.setIamPolicy for the setIamPolicy method
dns.managedZones.getIamPolicy for the getIamPolicy method
dns.managedZones.list for the testIamPermission method
Roles
roles/iam.securityAdmin
roles/dns.admin
This procedure assumes that you have created a managed zone in a project. For
instructions about how to create a managed zone, see Create, modify, and delete
zones.
Set IAM policy for a managed zone
To set the IAM policy on a specific managed zone,
follow these steps.
Console
In the Google Cloud console, go to the Cloud DNS zones page.
Select one or more zones for which you want to add access control
permissions.
On the Permissions to resources page, click Add principal.
On the Grant access to resource page, under New principals, add
the email address of the user, group, domain, or service account that you
want to add as the new principal.
From the Assign roles list, select the role that you want to
assign to the principal.
To assign additional roles, click Add another role.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-08-29 UTC."],[[["\u003cp\u003eThis guide outlines the process for configuring Identity and Access Management (IAM) permissions for read, write, or administrator access across different managed zones within a single project.\u003c/p\u003e\n"],["\u003cp\u003eSetting IAM policies for a managed zone can be achieved using the Google Cloud console, the \u003ccode\u003egcloud\u003c/code\u003e command-line tool, or the API, each with its specific steps and required parameters.\u003c/p\u003e\n"],["\u003cp\u003eRetrieving the current IAM policy for a managed zone is possible through the \u003ccode\u003egcloud\u003c/code\u003e command or the API, allowing users to view the existing permissions.\u003c/p\u003e\n"],["\u003cp\u003eTo check a managed zones IAM permissions you can use the API and by sending a \u003ccode\u003ePOST\u003c/code\u003e request.\u003c/p\u003e\n"],["\u003cp\u003eSpecific permissions, such as \u003ccode\u003edns.managedZones.setIamPolicy\u003c/code\u003e, \u003ccode\u003edns.managedZones.getIamPolicy\u003c/code\u003e, and \u003ccode\u003edns.managedZones.list\u003c/code\u003e, or roles like \u003ccode\u003eroles/iam.securityAdmin\u003c/code\u003e and \u003ccode\u003eroles/dns.admin\u003c/code\u003e, are necessary to perform IAM policy actions on managed zones.\u003c/p\u003e\n"]]],[],null,["# Set and manage IAM policies for managed zones\n\nThis page provides instructions about how to set up specific read, write, or\nadministrator Identity and Access Management (IAM) permissions for different managed\nzones under the same project.\n\nFor detailed information about IAM policies, see [Understanding\nallow policies](/iam/docs/policies). For information about the IAM\npolicy API, see [`Policy`](/iam/docs/reference/rest/v1/Policy). To learn how to\ncreate IAM custom roles that you can use on your managed zones,\nsee [Understanding IAM custom\nroles](/iam/docs/understanding-custom-roles).\n\n#### Permissions required for this task\n\nTo perform this task, you must have been granted the following permissions\n*or* the following IAM roles.\n\n**Permissions**\n\n- `dns.managedZones.setIamPolicy` for the `setIamPolicy` method\n- `dns.managedZones.getIamPolicy` for the `getIamPolicy` method\n- `dns.managedZones.list` for the `testIamPermission` method\n\n**Roles**\n\n- `roles/iam.securityAdmin`\n- `roles/dns.admin`\n\nThis procedure assumes that you have created a managed zone in a project. For\ninstructions about how to create a managed zone, see [Create, modify, and delete\nzones](/dns/docs/zones).\n\nSet IAM policy for a managed zone\n---------------------------------\n\nTo set the IAM policy on a specific managed zone,\nfollow these steps. \n\n### Console\n\n1. In the Google Cloud console, go to the **Cloud DNS zones** page.\n\n [Go to Cloud DNS zones](https://console.cloud.google.com/net-services/dns/zones)\n2. Select one or more zones for which you want to add access control\n permissions.\n\n3. On the **Permissions to resources** page, click **Add principal**.\n\n4. On the **Grant access to resource** page, under **New principals**, add\n the email address of the user, group, domain, or service account that you\n want to add as the new principal.\n\n5. From the **Assign roles** list, select the role that you want to\n assign to the principal.\n\n6. To assign additional roles, click **Add another role**.\n\n7. Click **Save**.\n\n### gcloud\n\nRun the\n[`gcloud dns managed-zones set-iam-policy`\ncommand](/sdk/gcloud/reference/dns/managed-zones/set-iam-policy): \n\n```\ngcloud dns managed-zones set-iam-policy NAME \\\n --policy-file=POLICY-FILE\n```\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003eNAME\u003c/var\u003e: the name of the managed zone for which you want to set the IAM permission\n- \u003cvar translate=\"no\"\u003ePOLICY-FILE\u003c/var\u003e: the file that contains the IAM policy that you want to specify for the managed zone. For an example policy file, see [Policy](/iam/docs/reference/rest/v1/Policy)\n\nIf this command runs successfully, it returns the IAM policy.\nOtherwise it returns an error message specifying the error.\n\n### API\n\nSend a `POST` request by using the\n[`managedZone.setIamPolicy`](/dns/docs/reference/v1/managedZones/setiampolicy)\nmethod: \n\n```\nPOST https://dns.googleapis.com/dns/v1/projects/PROJECT_ID/managedZones/MANAGED_ZONE:setIamPolicy\n```\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: the name or ID of the project\n- \u003cvar translate=\"no\"\u003eMANAGED_ZONE\u003c/var\u003e: the name of the managed zone for which you want to set the IAM permission\n\nFor detailed information on this API call, see\n[Binding](/iam/docs/reference/rest/v1/Policy#binding) on the\nIAM `Policy` API page.\n\nGet IAM policy for a managed zone\n---------------------------------\n\nTo get the IAM policy for a specific managed zone,\nfollow these steps. \n\n### gcloud\n\nRun the\n[`gcloud dns managed-zones get-iam-policy`\ncommand](/sdk/gcloud/reference/dns/managed-zones/get-iam-policy): \n\n```\ngcloud dns managed-zones get-iam-policy NAME\n```\n\nReplace \u003cvar translate=\"no\"\u003eNAME\u003c/var\u003e with the name of the managed zone for which\nyou want to get the IAM policy.\n\nIf this command runs successfully, it returns the IAM policy.\nOtherwise it returns an error message specifying the error.\n\n### API\n\nSend a `POST` request by using the\n[`managedZone.getIamPolicy`](/dns/docs/reference/v1/managedZones/getiampolicy)\nmethod: \n\n```\nPOST https://dns.googleapis.com/dns/v1/projects/PROJECT_ID/managedZones/ManagedZone:getIamPolicy\n```\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: the name or ID of the project\n- \u003cvar translate=\"no\"\u003eMANAGED_ZONE\u003c/var\u003e: the name of the managed zone for which you want to set the IAM permission\n\nCheck IAM permissions for a managed zone\n----------------------------------------\n\nSend a `POST` request by using the\n[`managedZone.testIamPermissions`](/dns/docs/reference/v1/managedZones/testiampermissions)\nmethod: \n\n```\nPOST https://dns.googleapis.com/dns/v1/projects/PROJECT_ID/managedZones/ManagedZone:testIamPermissions\n```\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: the name or ID of the project\n- \u003cvar translate=\"no\"\u003eMANAGED_ZONE\u003c/var\u003e: the name of the managed zone for which you want to check the IAM permission\n\nWhat's next\n-----------\n\n- To work with managed zones, see [Create, modify, and delete zones](/dns/docs/zones).\n- To find solutions for common issues that you might encounter when using Cloud DNS, see [Troubleshooting](/dns/docs/troubleshooting).\n- To get an overview of Cloud DNS, see [Cloud DNS overview](/dns/docs/overview)."]]
