Roles (basic, predefined, custom) in GCP - Step-by-Step Execution

Process Flow - Roles (basic, predefined, custom)

Start: Need to control access

↓

Choose Role Type

↓

Basic

↓

Assign Permissions

↓

Grant Role to User/Group

↓

Access Controlled

This flow shows how you start with access control needs, choose a role type (basic, predefined, or custom), assign permissions, and then grant the role to users or groups to control access.

Execution Sample

GCP

gcloud projects add-iam-policy-binding my-project \
  --member='user:[e-mail]' \
  --role='roles/viewer'

This command assigns the basic Viewer role to user Alice on the project.

Process Table

Step	Action	Role Type	Permissions Assigned	Result
1	Identify access need	N/A	N/A	Decide who needs access and what
2	Choose role type	Basic	View, Edit, Owner sets	Simple broad roles
3	Assign role	Basic	roles/viewer	Read-only access granted
4	Grant role to user	Basic	roles/viewer	User [e-mail] can view resources
5	Choose role type	Predefined	Specific permissions for service	More precise control
6	Assign role	Predefined	roles/storage.objectAdmin	Manage storage objects
7	Grant role to group	Predefined	roles/storage.objectAdmin	Group can manage storage objects
8	Choose role type	Custom	User-defined permissions	Tailored access
9	Create custom role	Custom	permissions: compute.instances.start, compute.instances.stop	Custom role created
10	Grant role to user	Custom	Custom role	User can start/stop instances
11	End	N/A	N/A	Access controlled as needed

💡 All roles assigned and granted to users/groups to control access

Status Tracker

Variable	Start	After Step 3	After Step 6	After Step 9	Final
Role Type	None	Basic	Predefined	Custom	Custom
Permissions	None	View only	Storage object admin	Start/Stop instances	Start/Stop instances
Assigned To	None	User [e-mail]	Group storage-admins	User [e-mail]	User [e-mail]

Key Moments - 3 Insights

Why choose a predefined role instead of a basic role?

Predefined roles give more precise permissions for specific services, unlike basic roles which are broad. See execution_table rows 5-7.

What is the benefit of a custom role?

Custom roles let you pick exact permissions needed, avoiding extra access. See execution_table rows 8-10.

Can a user have multiple roles?

Yes, users can have multiple roles combined to grant needed permissions. This is implied by assigning different roles in execution_table.

Visual Quiz - 3 Questions

Look at the execution table, what permissions does the basic role 'roles/viewer' grant at step 3?

A Full control over all resources

B Manage storage objects

C Read-only access to resources

D Start and stop compute instances

💡 Hint

Check the 'Permissions Assigned' column at step 3 in the execution_table

At which step is a custom role created with specific permissions?

A Step 6

B Step 9

C Step 3

D Step 10

💡 Hint

Look for 'Create custom role' action in the execution_table

If you want to give a group permission to manage storage objects, which role type and step should you refer to?

A Predefined role at step 7

B Basic role at step 3

C Custom role at step 9

D Basic role at step 6

💡 Hint

Check the 'Assign role' and 'Grant role to group' actions in the execution_table

Concept Snapshot

Roles control access in GCP.
Basic roles: broad sets like Viewer, Editor, Owner.
Predefined roles: specific to services with fine permissions.
Custom roles: user-defined permissions for tailored access.
Assign roles to users/groups to grant access.

Full Transcript

This visual execution shows how GCP roles control access. First, you identify who needs access and what. Then you pick a role type: basic for broad access, predefined for service-specific permissions, or custom for exact permissions you choose. You assign the role and grant it to users or groups. The execution table traces steps assigning roles like Viewer, Storage Object Admin, and a custom role for starting/stopping instances. Variables track role types, permissions, and assignees. Key moments clarify why to pick predefined or custom roles. The quiz tests understanding of role permissions and assignment steps.

Practice

1. Which type of Google Cloud role provides broad access across all services with simple permissions like Owner, Editor, and Viewer?

easy

A. Predefined roles

B. Basic roles

C. Custom roles

D. Service accounts

Solution

1. Step 1: Understand role categories

   Google Cloud has three main role types: basic, predefined, and custom.

2. Step 2: Identify broad access roles

   Basic roles like Owner, Editor, and Viewer provide broad access across all services.

3. Final Answer:

   Basic roles -> Option B

4. Quick Check:

   Broad access = Basic roles [OK]

Hint: Basic roles cover broad access across all services [OK]

Common Mistakes:

• Confusing predefined roles with basic roles
• Thinking custom roles are broad by default
• Mixing service accounts with roles

2. Which of the following is the correct way to create a custom role in Google Cloud IAM?

easy

A. Use the gcloud CLI with 'gcloud iam roles create' and specify permissions

B. Assign a predefined role to a user

C. Use the Google Cloud Console to assign a basic role

D. Create a service account with custom permissions

Solution

1. Step 1: Identify how to create custom roles

   Custom roles require specifying exact permissions and are created via CLI or console.

2. Step 2: Match correct command

   The 'gcloud iam roles create' command is used to create custom roles with specific permissions.

3. Final Answer:

   Use the gcloud CLI with 'gcloud iam roles create' and specify permissions -> Option A

4. Quick Check:

   Create custom role = gcloud iam roles create [OK]

Hint: Custom roles need explicit creation with permissions via CLI [OK]

Common Mistakes:

• Confusing assigning roles with creating roles
• Using service accounts to create roles
• Assigning basic roles instead of creating custom ones

3. Given this snippet assigning roles to a user:

gcloud projects add-iam-policy-binding my-project \
  --member='user:[e-mail]' \
  --role='roles/storage.objectViewer'

What type of role is 'roles/storage.objectViewer'?

medium

A. Basic role

B. Custom role

C. Service account role

D. Predefined role

Solution

1. Step 1: Analyze the role name format

   The role name 'roles/storage.objectViewer' follows the predefined role naming pattern.

2. Step 2: Understand role types

   Predefined roles are specific to services and have names like 'roles/serviceName.roleName'.

3. Final Answer:

   Predefined role -> Option D

4. Quick Check:

   roles/storage.objectViewer = Predefined role [OK]

Hint: Predefined roles have service-specific names like roles/service.role [OK]

Common Mistakes:

• Thinking all roles starting with 'roles/' are basic
• Confusing custom roles with predefined roles
• Assuming service accounts have roles

4. A user tries to create a custom role but gets an error. The command used is:

gcloud iam roles create myCustomRole --project=my-project --permissions=storage.buckets.list,compute.instances.create

What is the likely cause of the error?

medium

A. The command is missing the role title and description

B. Permissions must be comma-separated without spaces

C. The project ID is incorrect

D. Custom roles cannot include permissions from multiple services

Solution

1. Step 1: Review required parameters for custom role creation

   Creating a custom role requires a title and description along with permissions.

2. Step 2: Check the command for missing parameters

   The command lacks '--title' and '--description' flags, causing the error.

3. Final Answer:

   The command is missing the role title and description -> Option A

4. Quick Check:

   Missing title/description causes create role error [OK]

Hint: Always include title and description when creating custom roles [OK]

Common Mistakes:

• Assuming permissions from multiple services are invalid
• Ignoring required flags like title and description
• Mistaking project ID errors for permission errors

5. You want to give a team member permission to manage only Compute Engine instances but no other services. Which role type should you assign and why?

hard

A. Custom role with all permissions, to cover all possible needs

B. Basic role Editor, because it covers all services including Compute Engine

C. Predefined Compute Engine Admin role, because it limits permissions to Compute Engine only

D. Basic role Viewer, because it allows managing instances

Solution

1. Step 1: Understand the requirement

   The team member needs permissions only for Compute Engine, not other services.

2. Step 2: Evaluate role types

   Basic roles are broad and cover all services; custom roles require manual permission selection; predefined roles offer service-specific permissions.

3. Step 3: Choose the best fit

   The predefined Compute Engine Admin role grants full Compute Engine permissions without extra access.

4. Final Answer:

   Predefined Compute Engine Admin role, because it limits permissions to Compute Engine only -> Option C

5. Quick Check:

   Service-specific access = Predefined role [OK]

Hint: Use predefined roles for service-specific permissions [OK]

Common Mistakes:

• Using broad basic roles instead of specific predefined roles
• Assigning Viewer role expecting management permissions
• Creating unnecessary custom roles without need