Custom roles creation in GCP - Commands & Configuration

Introduction

Sometimes, the default permissions in cloud services are too broad or too narrow. Custom roles let you create a set of permissions tailored exactly to what your team or app needs, improving security and control.

When you want to give a developer access to only specific actions in your cloud project without full admin rights

When a team needs permission to manage only certain resources, like storage buckets but not compute instances

When you want to limit a service account’s permissions to just what it needs to run a specific job

When you want to follow the principle of least privilege by avoiding overly broad default roles

When you want to audit and control exactly what actions are allowed in your cloud environment

Config File - custom_role.yaml

custom_role.yaml

title: Custom Storage Viewer
description: Custom role to view storage buckets and objects
stage: GA
includedPermissions:
  - storage.buckets.get
  - storage.buckets.list
  - storage.objects.get
  - storage.objects.list

This YAML file defines a custom role named 'Custom Storage Viewer'.

title: The name of the role.

description: Explains what the role is for.

stage: The release stage of the role, here 'GA' means generally available.

includedPermissions: Lists the exact permissions this role grants, here for viewing storage buckets and objects.

Commands

This command creates a new custom role named 'customStorageViewer' in the project 'my-gcp-project' using the permissions defined in the 'custom_role.yaml' file.

Terminal

gcloud iam roles create customStorageViewer --project=my-gcp-project --file=custom_role.yaml

Expected Output

Created role [projects/my-gcp-project/roles/customStorageViewer].

→

--project - Specifies the GCP project where the custom role is created.

→

--file - Points to the YAML file that defines the custom role permissions.

This command shows the details of the custom role 'customStorageViewer' to verify it was created correctly.

Terminal

gcloud iam roles describe customStorageViewer --project=my-gcp-project

Expected Output

name: projects/my-gcp-project/roles/customStorageViewer

title: Custom Storage Viewer

description: Custom role to view storage buckets and objects

stage: GA

includedPermissions:

- storage.buckets.get

- storage.buckets.list

- storage.objects.get

- storage.objects.list

→

--project - Specifies the project where the role exists.

This command assigns the custom role 'customStorageViewer' to the user '[e-mail]' in the project, giving her the permissions defined in the role.

Terminal

gcloud projects add-iam-policy-binding my-gcp-project --member=user:[e-mail] --role=projects/my-gcp-project/roles/customStorageViewer

Expected Output

Updated IAM policy for project [my-gcp-project].

→

--member - Specifies the user or service account to assign the role.

→

--role - Specifies the full name of the custom role to assign.

This command retrieves the current IAM policy for the project to confirm the custom role assignment.

Terminal

gcloud projects get-iam-policy my-gcp-project

Expected Output

bindings:

- members:

  - user:[e-mail]

  role: projects/my-gcp-project/roles/customStorageViewer

etag: BwWWja0YfJA=

version: 1

Key Concept

If you remember nothing else from this pattern, remember: custom roles let you give exactly the permissions needed, no more and no less.

Common Mistakes

Trying to create a custom role without specifying the project flag

The command will fail or create the role in the wrong project, causing confusion or errors.

Always include the --project flag with your project ID when creating or managing custom roles.

Assigning a custom role without using the full role name including the project path

The assignment will fail because the role name is incomplete and not recognized.

Use the full role name format: projects/PROJECT_ID/roles/ROLE_NAME when assigning custom roles.

Including permissions in the YAML file that do not exist or are misspelled

The role creation will fail with an error about invalid permissions.

Check the exact permission names in the GCP documentation before adding them to the role definition.

Summary

Create a custom role by defining permissions in a YAML file and running gcloud iam roles create.

Verify the role details with gcloud iam roles describe to ensure correct permissions.

Assign the custom role to users or service accounts with gcloud projects add-iam-policy-binding.

Check the IAM policy with gcloud projects get-iam-policy to confirm role assignments.

Practice

1. What is the main purpose of creating a custom role in Google Cloud Platform?

easy

A. To create virtual machines quickly

B. To automatically assign all permissions to a user

C. To delete existing predefined roles

D. To tailor permissions specifically for your project needs

Solution

1. Step 1: Understand role customization

   Custom roles allow you to pick specific permissions instead of using broad predefined roles.

2. Step 2: Identify the purpose of custom roles

   They help tailor access to exactly what is needed, improving security and management.

3. Final Answer:

   To tailor permissions specifically for your project needs -> Option D

4. Quick Check:

   Custom roles = tailored permissions [OK]

Hint: Custom roles = pick permissions you want [OK]

Common Mistakes:

• Thinking custom roles give all permissions automatically
• Confusing custom roles with deleting roles
• Assuming custom roles create resources

2. Which of the following is the correct gcloud command syntax to create a custom role named myCustomRole in project my-project with the title "My Role" and permission storage.buckets.list?

easy

A. gcloud iam roles create myCustomRole --project=my-project --title="My Role" --permissions=storage.buckets.list --stage=GA

B. gcloud iam create role myCustomRole --project my-project --title My Role --permissions storage.buckets.list

C. gcloud roles create myCustomRole --project=my-project --title="My Role" --permissions=storage.buckets.list

D. gcloud iam roles add myCustomRole --project=my-project --title="My Role" --permissions=storage.buckets.list

Solution

1. Step 1: Identify correct gcloud command structure

   The correct command to create a custom role is gcloud iam roles create with flags for project, title, permissions, and stage.

2. Step 2: Match syntax with options

   gcloud iam roles create myCustomRole --project=my-project --title="My Role" --permissions=storage.buckets.list --stage=GA matches the correct syntax including --project, --title, --permissions, and --stage flags.

3. Final Answer:

   gcloud iam roles create myCustomRole --project=my-project --title="My Role" --permissions=storage.buckets.list --stage=GA -> Option A

4. Quick Check:

   Correct gcloud create syntax = gcloud iam roles create myCustomRole --project=my-project --title="My Role" --permissions=storage.buckets.list --stage=GA [OK]

Hint: Use 'gcloud iam roles create' with all flags [OK]

Common Mistakes:

• Using 'gcloud iam create role' instead of 'roles create'
• Missing the --stage flag
• Incorrect flag order or missing equal signs

3. Given this command:

gcloud iam roles create dataViewer --project=my-project --title="Data Viewer" --permissions=bigquery.datasets.get,bigquery.tables.list --stage=ALPHA

What will be the effect of this custom role?

medium

A. Allows users to get dataset metadata and list tables in BigQuery

B. Allows users to create and delete BigQuery datasets

C. Grants full admin access to BigQuery

D. Denies all BigQuery permissions

Solution

1. Step 1: Analyze permissions in the command

   The permissions bigquery.datasets.get and bigquery.tables.list allow reading dataset info and listing tables.

2. Step 2: Understand what these permissions enable

   These permissions let users view dataset metadata and see tables but not modify or delete them.

3. Final Answer:

   Allows users to get dataset metadata and list tables in BigQuery -> Option A

4. Quick Check:

   Permissions = read-only BigQuery access [OK]

Hint: Check permissions list for read or write actions [OK]

Common Mistakes:

• Assuming ALPHA stage means full access
• Confusing get/list with create/delete permissions
• Thinking it grants admin rights

4. You tried to create a custom role with this command:

gcloud iam roles create testRole --project=my-project --title="Test Role" --permissions=compute.instances.start,compute.instances.stop

But it failed. What is the most likely reason?

medium

A. Project ID is incorrect

B. Permissions are invalid for custom roles

C. Missing the --stage flag which is required

D. Role ID cannot contain uppercase letters

Solution

1. Step 1: Check required flags for role creation

   The --stage flag is mandatory when creating custom roles to specify the release stage.

2. Step 2: Identify missing flag in the command

   The command lacks the --stage flag, causing failure.

3. Final Answer:

   Missing the --stage flag which is required -> Option C

4. Quick Check:

   --stage flag required = Missing the --stage flag which is required [OK]

Hint: Always include --stage when creating custom roles [OK]

Common Mistakes:

• Ignoring the required --stage flag
• Assuming permissions are invalid
• Mistaking project ID or role ID format

5. You want to create a custom role that allows users to list storage buckets and read objects but not delete them. Which permissions should you include in your custom role?

hard

A. storage.buckets.list, storage.objects.delete

B. storage.buckets.list, storage.objects.get

C. storage.buckets.create, storage.objects.get

D. storage.buckets.delete, storage.objects.get

Solution

1. Step 1: Identify permissions for listing buckets and reading objects

   storage.buckets.list allows listing buckets, and storage.objects.get allows reading objects.

2. Step 2: Exclude delete permissions

   Do not include any delete permissions to prevent deletion.

3. Final Answer:

   storage.buckets.list, storage.objects.get -> Option B

4. Quick Check:

   List + read, no delete = storage.buckets.list, storage.objects.get [OK]

Hint: Include only list and get permissions, exclude delete [OK]

Common Mistakes:

• Including delete permissions by mistake
• Confusing create with list permissions
• Assuming read includes delete