Roles (basic, predefined, custom) in GCP - Step-by-Step Execution

Process Flow - Roles (basic, predefined, custom)

Start: Need to control access

↓

Choose Role Type

↓

Basic

↓

Assign Permissions

↓

Grant Role to User/Group

↓

Access Controlled

This flow shows how you start with access control needs, choose a role type (basic, predefined, or custom), assign permissions, and then grant the role to users or groups to control access.

Execution Sample

GCP

gcloud projects add-iam-policy-binding my-project \
  --member='user:[e-mail]' \
  --role='roles/viewer'

This command assigns the basic Viewer role to user Alice on the project.

Process Table

Step	Action	Role Type	Permissions Assigned	Result
1	Identify access need	N/A	N/A	Decide who needs access and what
2	Choose role type	Basic	View, Edit, Owner sets	Simple broad roles
3	Assign role	Basic	roles/viewer	Read-only access granted
4	Grant role to user	Basic	roles/viewer	User [e-mail] can view resources
5	Choose role type	Predefined	Specific permissions for service	More precise control
6	Assign role	Predefined	roles/storage.objectAdmin	Manage storage objects
7	Grant role to group	Predefined	roles/storage.objectAdmin	Group can manage storage objects
8	Choose role type	Custom	User-defined permissions	Tailored access
9	Create custom role	Custom	permissions: compute.instances.start, compute.instances.stop	Custom role created
10	Grant role to user	Custom	Custom role	User can start/stop instances
11	End	N/A	N/A	Access controlled as needed

💡 All roles assigned and granted to users/groups to control access

Status Tracker

Variable	Start	After Step 3	After Step 6	After Step 9	Final
Role Type	None	Basic	Predefined	Custom	Custom
Permissions	None	View only	Storage object admin	Start/Stop instances	Start/Stop instances
Assigned To	None	User [e-mail]	Group storage-admins	User [e-mail]	User [e-mail]

Key Moments - 3 Insights

Why choose a predefined role instead of a basic role?

Predefined roles give more precise permissions for specific services, unlike basic roles which are broad. See execution_table rows 5-7.

What is the benefit of a custom role?

Custom roles let you pick exact permissions needed, avoiding extra access. See execution_table rows 8-10.

Can a user have multiple roles?

Yes, users can have multiple roles combined to grant needed permissions. This is implied by assigning different roles in execution_table.

Visual Quiz - 3 Questions

Look at the execution table, what permissions does the basic role 'roles/viewer' grant at step 3?

A Full control over all resources

B Manage storage objects

C Read-only access to resources

D Start and stop compute instances

💡 Hint

Check the 'Permissions Assigned' column at step 3 in the execution_table

At which step is a custom role created with specific permissions?

A Step 6

B Step 9

C Step 3

D Step 10

💡 Hint

Look for 'Create custom role' action in the execution_table

If you want to give a group permission to manage storage objects, which role type and step should you refer to?

A Predefined role at step 7

B Basic role at step 3

C Custom role at step 9

D Basic role at step 6

💡 Hint

Check the 'Assign role' and 'Grant role to group' actions in the execution_table

Concept Snapshot

Roles control access in GCP.
Basic roles: broad sets like Viewer, Editor, Owner.
Predefined roles: specific to services with fine permissions.
Custom roles: user-defined permissions for tailored access.
Assign roles to users/groups to grant access.

Full Transcript

This visual execution shows how GCP roles control access. First, you identify who needs access and what. Then you pick a role type: basic for broad access, predefined for service-specific permissions, or custom for exact permissions you choose. You assign the role and grant it to users or groups. The execution table traces steps assigning roles like Viewer, Storage Object Admin, and a custom role for starting/stopping instances. Variables track role types, permissions, and assignees. Key moments clarify why to pick predefined or custom roles. The quiz tests understanding of role permissions and assignment steps.