This page describes the Identity and Access Management (IAM) roles and permissions needed to use Network Connectivity Center.
At a high level, you need the following:
- Predefined Network Connectivity Center permissions, which are described in Predefined roles.
- Additional permissions as follows:
- To create spokes, you need permission to read the relevant spoke resource types, as described in Permission to create a spoke.
- To work with Network Connectivity Center in the Google Cloud console, you need permission to view certain Virtual Private Cloud (VPC) network resources, as described in Permission to use Network Connectivity Center in the Google Cloud console.
Be aware that if you need to work with Network Connectivity Center in a Shared VPC network, you must have all needed permissions in the host project. A hub, its spokes, and all related resources must be in the host project.
For information about how to grant permissions, see the IAM overview.
Predefined roles
The following table describes Network Connectivity Center's predefined roles.
| Role | Permissions |
|---|---|
Service Automation Consumer Network Admin( Service Automation Consumer Network Admin is responsible for setting up ServiceConnectionPolicies. |
|
Group User( Enables use access on group resources |
|
Hub & Spoke Admin( Enables full access to hub and spoke resources. Lowest-level resources where you can grant this role:
|
|
Hub & Spoke Viewer( Enables read-only access to hub and spoke resources. Lowest-level resources where you can grant this role:
|
|
Regional Endpoint Admin( Full access to all Regional Endpoint resources. |
|
Regional Endpoint Viewer( Read-only access to all Regional Endpoint resources. |
|
Service Class User( Service Class User uses a ServiceClass |
|
Service Automation Service Producer Admin( Service Automation Producer Admin uses information from a consumer request to manage ServiceClasses and ServiceConnectionMaps |
|
Spoke Admin( Enables full access to spoke resources and read-only access to hub resources. Lowest-level resources where you can grant this role:
|
|
Additional required permissions
Depending on what actions you need to take in Network Connectivity Center, you might need the permissions described in the following sections.
Permission to create a spoke
To create a spoke, you must have permission to read the spoke's resource type. For example:
- For VPN tunnel spokes, VLAN attachment spokes, and Router appliance
spokes, you need
compute.routers.get. - To create Router appliance spokes, you need
compute.instances.get. Also, before you can use a Router appliance spoke, you must set up peering between the Cloud Router and the router appliance instance. To establish peering, you need the following permissions:compute.instances.usecompute.routers.update
- To create VLAN attachment spokes, you need
compute.interconnectAttachments.get. - To create VPN tunnel spokes, you need
compute.vpnTunnels.get. To create VPC spokes, you need the following permissions:
compute.networks.usecompute.networks.get
To create VPC spokes in a different project from the hub that it is associated with, you need
networkconnectivity.groups.use.
Permission to use Network Connectivity Center in the Google Cloud console
To use Network Connectivity Center in the Google Cloud console, you need
a role—such as
Compute Network Viewer
(roles/compute.networkViewer)—that includes the permissions described
in the following table. To use these permissions, you must first
create a custom role.
Task |
Required permissions |
|---|---|
| Access the Network Connectivity Center page |
|
| Access and use the Add spokes page |
|
| Add a VLAN attachment spoke |
|
| Add a VPN tunnel spoke |
|
| Add a Router appliance spoke |
|
| Add a VPC spoke |
|
Protecting resources with VPC Service Controls
To further secure your Network Connectivity Center resources, use VPC Service Controls.
VPC Service Controls provides your resources with additional security to help mitigate the risk of data exfiltration. By using VPC Service Controls, you can place Network Connectivity Center resources within service perimeters. VPC Service Controls then protects these resources from requests that originate outside the perimeter.
To learn more about service perimeters, see the Service perimeter configuration page of the VPC Service Controls documentation.
What's next
For more information about project roles and Google Cloud resources, see the following documentation:
- To understand IAM roles and permissions, see Access control for projects using IAM.
- To understand role types, see Identity and Access Management basic and predefined roles reference.
- To learn about predefined roles, see Compute Engine IAM roles and permissions.
- To learn about Network Connectivity Center, see Network Connectivity Center overview.
- To learn how to manage hubs and spokes, see Work with hubs and spokes.