Identity and Access Management (IAM)

IAM lets you adopt the security principle of least privilege, so you grant only the necessary access to your resources.

IAM lets you control who (user) has what (role) permission for which resources by setting IAM policies. IAM policies grant one or more roles to a user, giving the user certain permissions. For example, you can grant the datastore.indexAdmin role to a user, which allows the user to create, modify, delete, list, or view indexes.

Permissions and roles

This section summarizes the permissions and roles that Firestore supports.

Required permissions for API methods

The following table lists the permissions that the caller must have to perform each action:

Predefined roles

With IAM, every API method in Firestore requires that the account making the API request has the appropriate permissions to use the resource. Permissions are granted by setting policies that grant roles to a user, group, or service account. In addition to the primitive roles, owner, editor, and viewer, you can grant Firestore roles to the users of your project.

The following table lists the Firestore IAM roles. You can grant multiple roles to a user, group, or service account.

Custom roles

If the predefined roles do not address your business requirements, you can define your own custom roles with permissions that you specify:

• Learn about custom roles.
• Create and manage custom roles.

Permissions

The following table lists the permissions that Firestore supports.

Role change latency

Firestore caches IAM permissions for 5 minutes, so it takes up to 5 minutes for a role change to become effective.

Managing Firestore IAM

You can get and set IAM policies using the Google Cloud console, the IAM API, or the gcloud command-line tool. See Granting, Changing, and Revoking Access to Project Members for details.

Configure conditional access permissions

You can use IAM Conditions to define and enforce conditional access control.

For example, the following condition assigns a principal the datastore.user role up until a specified date:

{
  "role": "roles/datastore.user",
  "members": [
    "user:travis@example.com"
  ],
  "condition": {
    "title": "Expires_December_1_2023",
    "description": "Expires on December 1, 2023",
    "expression":
      "request.time < timestamp('2023-12-01T00:00:00.000Z')"
  }
}

To learn how to define IAM Conditions for temporary access, see Configure temporary access.

To learn how to configure IAM Conditions for access to one or more databases, see Configure database access conditions.

What's next

• Learn more about IAM.
• Grant IAM roles.
• Learn about authentication.