Access control with IAM

Stay organized with collections Save and categorize content based on your preferences.

This page describes the Identity and Access Management (IAM) roles and permissions that you need to purchase and manage commercial products on Cloud Marketplace.

With IAM, you manage access control by defining who (identity) has what access (role) for which resource. For commercial apps on Cloud Marketplace, users in your Google Cloud organization require IAM roles to sign up for Cloud Marketplace plans, and to make changes to billing plans.

• Learn about managing billing for Cloud Marketplace products.
• Learn about factors that affect your bill.
• Learn about the basic concepts of IAM.
• Learn about the hierarchy of Google Cloud resources.

Before you begin

• To grant Cloud Marketplace roles and permissions using gcloud, install the gcloud CLI. Otherwise, you can grant roles using the Google Cloud console.

IAM roles for purchasing and managing products

We recommend that you assign the Billing Account Administrator IAM role to users who are purchasing services from Cloud Marketplace.

Users who want to access the services must have the Viewer role, at a minimum.

For more granular control over users' permissions, you can create custom roles with the permissions that you want to grant.

Product-specific requirements

To use the following services in a Google Cloud project, you must have the Project Editor role:

• Google Cloud Dataprep by Trifacta
• Neo4j Aura Professional

List of IAM roles and permissions

You can grant users one or more of the following IAM roles. Depending on the role you are granting to users, you must also assign the role to a Google Cloud billing account, organization, or project. For details, see the section on Granting IAM roles to users.

Granting IAM roles to users

From the roles in the table above, the consumerprocurement.orderAdmin and consumerprocurement.orderViewer roles must be assigned at the billing account or organization level, and the consumerprocurement.entitlementManager and consumerprocurement.entitlementViewer roles must be assigned at the project or organization level.

To grant roles to users using gcloud, run one of the following commands:

gcloud organizations add-iam-policy-binding organization-id \
--member=member --role=role-id

gcloud beta billing accounts set-iam-policy account-id \
policy-file

gcloud projects add-iam-policy-binding project-id \
--member=member --role=role-id

To grant roles to users using the Google Cloud console, see the IAM documentation on Granting, changing, and revoking access for users.

Using custom roles with Cloud Marketplace

If you want granular control over the permissions you grant users, you can create custom roles with the permissions that you want to grant.

If you're creating a custom role for users who purchase services from Cloud Marketplace, the role must include these permissions for the billing account they use to purchase services:

• billing.accounts.get, which is typically granted with the roles/consumerprocurement.orderAdmin role.
• consumerprocurement.orders.get, which is typically granted with the roles/consumerprocurement.orderAdmin role.
• consumerprocurement.orders.list, which is typically granted with the roles/consumerprocurement.orderAdmin role.
• consumerprocurement.orders.place, which is typically granted with the roles/consumerprocurement.orderAdmin role.
• consumerprocurement.accounts.get, which is typically granted with the roles/consumerprocurement.orderAdmin role.
• consumerprocurement.accounts.list, which is typically granted with the roles/consumerprocurement.orderAdmin role.
• consumerprocurement.accounts.create, which is typically granted with the roles/consumerprocurement.orderAdmin role.

Accessing partner websites with Single Sign-on (SSO)

Certain Marketplace products support Single Sign-on (SSO) to a partner's external website. Authorized users within the organization have access to a "MANAGE ON PROVIDER" button on the product details page. This button directs users to the partner's website. In some cases, users are prompted to "Sign in with Google". In other cases, users are signed in a shared account context.

In order to access the SSO capability, users navigate to the product details page, and select an appropriate project. The project must be linked to a billing account where the plan has been purchased. For details about Marketplace plan management, see Managing billing plans.

Additionally, the user must have sufficient IAM permissions within the selected project. For most products, the roles/consumerprocurement.entitlementManager (or roles/editor basic role) is currently required.

Minimal permissions for specific products

The following products can operate on a different set of permissions to access SSO capabilities:

• Apache Kafka on Confluent Cloud
• DataStax Astra for Apache Cassandra
• Elastic Cloud
• Neo4j Aura Professional
• Redis Enterprise Cloud

For these products, you can use the following minimal permissions:

• consumerprocurement.entitlements.get
• consumerprocurement.entitlements.list
• serviceusage.services.get
• serviceusage.services.list
• resourcemanager.projects.get

These permissions are typically granted with the roles/consumerprocurement.entitlementManager or roles/consumerprocurement.entitlementViewer roles.