Roles (basic, predefined, custom) in GCP - Mini Project: Build & Apply

Creating and Assigning GCP Roles: Basic, Predefined, and Custom

📖 Scenario: You are managing access control in a Google Cloud Platform (GCP) project. You want to understand how to create and assign different types of roles: basic roles, predefined roles, and custom roles.This project will guide you step-by-step to create a custom role, assign a basic role, and assign a predefined role to a user in your GCP project.

🎯 Goal: Build a simple GCP IAM configuration that includes:A variable holding the project ID.A variable holding the user email to assign roles.A custom role definition with specific permissions.Assignments of a basic role, a predefined role, and the custom role to the user.

📋 What You'll Learn

Create a variable called project_id with the exact value "my-gcp-project".

Create a variable called user_email with the exact value "[e-mail]".

Define a custom role called customRole with the title "Custom Viewer" and the permission "storage.buckets.get".

Assign the basic role roles/viewer to the user.

Assign the predefined role roles/storage.objectViewer to the user.

Assign the custom role customRole to the user.

💡 Why This Matters

🌍 Real World

Managing access control in GCP projects is essential for security and proper resource management. This project simulates how to define and assign roles to users.

💼 Career

Cloud engineers and administrators often create and assign roles to control who can do what in cloud environments. Understanding roles is key to secure cloud infrastructure.

1

Set up project and user variables

Create a variable called project_id and set it to "my-gcp-project". Also create a variable called user_email and set it to "[e-mail]".

GCP

# Create variables project_id and user_email
# Your code here

Hint

Use simple variable assignments with exact string values.

2

Define a custom role

Define a dictionary called customRole with keys title set to "Custom Viewer" and permissions set to a list containing "storage.buckets.get".

GCP

project_id = "my-gcp-project"
user_email = "[e-mail]"
# Define the customRole dictionary here
# Your code here

Hint

Use a dictionary with exact keys and values as specified.

3

Assign basic and predefined roles to the user

Create a list called role_assignments containing three dictionaries. The first dictionary assigns the basic role roles/viewer to user_email. The second dictionary assigns the predefined role roles/storage.objectViewer to user_email. The third dictionary will be added in the next step.

GCP

project_id = "my-gcp-project"
user_email = "[e-mail]"
customRole = {
    "title": "Custom Viewer",
    "permissions": ["storage.buckets.get"]
}
# Create role_assignments list with basic and predefined roles assigned to user_email
# Your code here

Hint

Use a list of dictionaries with exact keys role and member. Use f-strings for member values.

4

Add custom role assignment to the user

Add a third dictionary to the role_assignments list that assigns the custom role customRole to user_email. Use the role name "projects/my-gcp-project/roles/customRole" exactly.

GCP

project_id = "my-gcp-project"
user_email = "[e-mail]"
customRole = {
    "title": "Custom Viewer",
    "permissions": ["storage.buckets.get"]
}
role_assignments = [
    {"role": "roles/viewer", "member": f"user:{user_email}"},
    {"role": "roles/storage.objectViewer", "member": f"user:{user_email}"}
]
# Add custom role assignment dictionary to role_assignments list
# Your code here

Hint

Append the custom role assignment dictionary exactly as shown.

Practice

1. Which type of Google Cloud role provides broad access across all services with simple permissions like Owner, Editor, and Viewer?

easy

A. Predefined roles

B. Basic roles

C. Custom roles

D. Service accounts

Solution

1. Step 1: Understand role categories

   Google Cloud has three main role types: basic, predefined, and custom.

2. Step 2: Identify broad access roles

   Basic roles like Owner, Editor, and Viewer provide broad access across all services.

3. Final Answer:

   Basic roles -> Option B

4. Quick Check:

   Broad access = Basic roles [OK]

Hint: Basic roles cover broad access across all services [OK]

Common Mistakes:

• Confusing predefined roles with basic roles
• Thinking custom roles are broad by default
• Mixing service accounts with roles

2. Which of the following is the correct way to create a custom role in Google Cloud IAM?

easy

A. Use the gcloud CLI with 'gcloud iam roles create' and specify permissions

B. Assign a predefined role to a user

C. Use the Google Cloud Console to assign a basic role

D. Create a service account with custom permissions

Solution

1. Step 1: Identify how to create custom roles

   Custom roles require specifying exact permissions and are created via CLI or console.

2. Step 2: Match correct command

   The 'gcloud iam roles create' command is used to create custom roles with specific permissions.

3. Final Answer:

   Use the gcloud CLI with 'gcloud iam roles create' and specify permissions -> Option A

4. Quick Check:

   Create custom role = gcloud iam roles create [OK]

Hint: Custom roles need explicit creation with permissions via CLI [OK]

Common Mistakes:

• Confusing assigning roles with creating roles
• Using service accounts to create roles
• Assigning basic roles instead of creating custom ones

3. Given this snippet assigning roles to a user:

gcloud projects add-iam-policy-binding my-project \
  --member='user:[e-mail]' \
  --role='roles/storage.objectViewer'

What type of role is 'roles/storage.objectViewer'?

medium

A. Basic role

B. Custom role

C. Service account role

D. Predefined role

Solution

1. Step 1: Analyze the role name format

   The role name 'roles/storage.objectViewer' follows the predefined role naming pattern.

2. Step 2: Understand role types

   Predefined roles are specific to services and have names like 'roles/serviceName.roleName'.

3. Final Answer:

   Predefined role -> Option D

4. Quick Check:

   roles/storage.objectViewer = Predefined role [OK]

Hint: Predefined roles have service-specific names like roles/service.role [OK]

Common Mistakes:

• Thinking all roles starting with 'roles/' are basic
• Confusing custom roles with predefined roles
• Assuming service accounts have roles

4. A user tries to create a custom role but gets an error. The command used is:

gcloud iam roles create myCustomRole --project=my-project --permissions=storage.buckets.list,compute.instances.create

What is the likely cause of the error?

medium

A. The command is missing the role title and description

B. Permissions must be comma-separated without spaces

C. The project ID is incorrect

D. Custom roles cannot include permissions from multiple services

Solution

1. Step 1: Review required parameters for custom role creation

   Creating a custom role requires a title and description along with permissions.

2. Step 2: Check the command for missing parameters

   The command lacks '--title' and '--description' flags, causing the error.

3. Final Answer:

   The command is missing the role title and description -> Option A

4. Quick Check:

   Missing title/description causes create role error [OK]

Hint: Always include title and description when creating custom roles [OK]

Common Mistakes:

• Assuming permissions from multiple services are invalid
• Ignoring required flags like title and description
• Mistaking project ID errors for permission errors

5. You want to give a team member permission to manage only Compute Engine instances but no other services. Which role type should you assign and why?

hard

A. Custom role with all permissions, to cover all possible needs

B. Basic role Editor, because it covers all services including Compute Engine

C. Predefined Compute Engine Admin role, because it limits permissions to Compute Engine only

D. Basic role Viewer, because it allows managing instances

Solution

1. Step 1: Understand the requirement

   The team member needs permissions only for Compute Engine, not other services.

2. Step 2: Evaluate role types

   Basic roles are broad and cover all services; custom roles require manual permission selection; predefined roles offer service-specific permissions.

3. Step 3: Choose the best fit

   The predefined Compute Engine Admin role grants full Compute Engine permissions without extra access.

4. Final Answer:

   Predefined Compute Engine Admin role, because it limits permissions to Compute Engine only -> Option C

5. Quick Check:

   Service-specific access = Predefined role [OK]

Hint: Use predefined roles for service-specific permissions [OK]

Common Mistakes:

• Using broad basic roles instead of specific predefined roles
• Assigning Viewer role expecting management permissions
• Creating unnecessary custom roles without need