Custom roles creation in GCP - Deep Dive

Overview - Custom roles creation

What is it?

Custom roles creation in Google Cloud Platform (GCP) means making your own set of permissions tailored to your needs. Instead of using predefined roles that might be too broad or too narrow, you pick exactly what actions a user or service can perform. This helps control access tightly and safely. Custom roles are like personalized keys that open only the doors you want.

Why it matters

Without custom roles, you might give too much access or too little, causing security risks or blocking work. Custom roles solve this by letting you grant just the right permissions. This keeps your cloud environment safer and your teams more productive. Imagine giving someone a key that opens only their office, not the whole building.

Where it fits

Before learning custom roles, you should understand basic GCP roles and permissions. After mastering custom roles, you can explore advanced identity and access management (IAM) strategies, like condition-based access or organization policies.

Mental Model

Core Idea

Custom roles are personalized permission sets that let you control exactly what actions users or services can perform in GCP.

Think of it like...

It's like making a custom key that opens only specific doors in a building, instead of giving a master key or a generic key that opens too many or too few doors.

┌─────────────────────────────┐
│       GCP Project            │
│ ┌───────────────┐           │
│ │ Predefined    │           │
│ │ Roles (keys)  │           │
│ └───────────────┘           │
│                             │
│ ┌───────────────┐           │
│ │ Custom Roles  │◄───┐      │
│ │ (custom keys) │    │      │
│ └───────────────┘    │      │
│                      │      │
│ Users & Services ────┘      │
└─────────────────────────────┘

Build-Up - 7 Steps

1

Foundation

Understanding GCP IAM Basics

Concept: Learn what IAM is and how roles and permissions work in GCP.

IAM stands for Identity and Access Management. It controls who can do what in your cloud. Roles are collections of permissions. Permissions allow actions like reading data or creating resources. GCP has predefined roles that group common permissions for convenience.

Result

You know that roles control access and that permissions are the building blocks of roles.

Understanding IAM basics is essential because custom roles build directly on these concepts.

2

Foundation

Difference Between Predefined and Custom Roles

Concept: Recognize why predefined roles might not fit all needs and when custom roles help.

Predefined roles are made by Google and cover common job functions. But sometimes they are too broad or too narrow. Custom roles let you pick exactly which permissions to include, making access more precise.

Result

You see why custom roles exist and when to use them instead of predefined roles.

Knowing the limits of predefined roles motivates the need for custom roles.

3

Intermediate

Creating a Custom Role in GCP Console

🤔Before reading on: Do you think creating a custom role requires coding or can it be done via the console? Commit to your answer.

Concept: Learn the step-by-step process to create a custom role using the GCP Console interface.

1. Open the IAM & Admin page in GCP Console. 2. Select 'Roles' and click 'Create Role'. 3. Give the role a name, title, and description. 4. Add permissions by searching and selecting them. 5. Save the role. 6. Assign the role to users or service accounts.

Result

You can create a custom role with specific permissions without writing code.

Knowing how to create roles via the console makes custom roles accessible to beginners.

4

Intermediate

Using gcloud CLI to Manage Custom Roles

🤔Before reading on: Can you create and update custom roles using command-line tools? Commit to your answer.

Concept: Learn how to create, update, and delete custom roles using the gcloud command-line tool.

Use commands like: - Create: gcloud iam roles create ROLE_ID --project=PROJECT_ID --title="Title" --permissions=perm1,perm2 - Update: gcloud iam roles update ROLE_ID --project=PROJECT_ID --add-permissions=perm3 - Delete: gcloud iam roles delete ROLE_ID --project=PROJECT_ID This allows automation and scripting of role management.

Result

You can manage custom roles efficiently from the command line.

Using CLI enables automation and integration into deployment pipelines.

5

Intermediate

Selecting Permissions for Custom Roles

🤔Before reading on: Is it better to add all permissions you think might be needed or only the minimum required? Commit to your answer.

Concept: Learn the principle of least privilege when choosing permissions for custom roles.

Only add permissions that are necessary for the user's tasks. Avoid adding extra permissions to reduce security risks. Use GCP documentation to understand what each permission allows.

Result

Custom roles are precise and secure, granting only needed access.

Applying least privilege reduces attack surface and accidental misuse.

6

Advanced

Versioning and Updating Custom Roles Safely

🤔Before reading on: Do you think updating a custom role immediately affects all users assigned to it? Commit to your answer.

Concept: Understand how changes to custom roles propagate and how to manage updates without disruption.

When you update a custom role, changes apply to all users with that role. To avoid breaking access, plan updates carefully. Use role versioning by creating new roles for major changes. Test changes in a staging environment before production.

Result

You can update roles without unexpected access issues.

Knowing update impact prevents accidental permission loss or escalation.

7

Expert

Custom Roles in Large Organizations and Automation

🤔Before reading on: Can custom roles be managed at the organization level and automated across projects? Commit to your answer.

Concept: Explore managing custom roles centrally and automating their deployment in complex environments.

In large organizations, custom roles can be created at the organization level for consistency. Use Infrastructure as Code tools like Terraform or Deployment Manager to automate role creation and assignment. This ensures roles are consistent, auditable, and repeatable across projects.

Result

You can manage custom roles at scale with automation and governance.

Centralized and automated role management is key for security and efficiency in enterprises.

Under the Hood

Custom roles are stored as IAM role objects in GCP's IAM system. Each role lists permissions as strings representing allowed API actions. When a user or service tries an action, GCP checks their assigned roles for the required permission. Custom roles are evaluated alongside predefined roles to decide access.

Why designed this way?

GCP designed custom roles to give fine-grained control beyond broad predefined roles. This design balances ease of use with security. Instead of creating many narrowly defined predefined roles, custom roles let users tailor permissions as needed, reducing role explosion and improving security posture.

┌───────────────┐
│   User/Service│
└──────┬────────┘
       │ Request Action
       ▼
┌───────────────┐
│ IAM Role Check │
│ ┌───────────┐ │
│ │Predefined │ │
│ │Roles      │ │
│ └───────────┘ │
│ ┌───────────┐ │
│ │Custom Roles│ │
│ └───────────┘ │
└──────┬────────┘
       │ Permission Allowed?
       ▼
┌───────────────┐
│ Action Allowed │
└───────────────┘

Myth Busters - 4 Common Misconceptions

Quick: Do you think custom roles automatically include all permissions from predefined roles? Commit to yes or no.

Common Belief: Custom roles are just copies of predefined roles with a new name.

Reality: Custom roles must be built by selecting individual permissions; they do not inherit permissions from predefined roles automatically.

Why it matters: Assuming inheritance can lead to missing permissions and unexpected access failures.

Quick: Do you think updating a custom role changes permissions for users immediately? Commit to yes or no.

Common Belief: Changes to custom roles do not affect users until reassigned.

Reality: Updates to custom roles apply instantly to all users assigned that role.

Why it matters: Unplanned updates can cause sudden permission loss or escalation, disrupting workflows.

Quick: Do you think custom roles can be created with any permissions, including those reserved for Google? Commit to yes or no.

Common Belief: You can add any permission to a custom role, even Google-reserved ones.

Reality: Some permissions are reserved and cannot be included in custom roles.

Why it matters: Trying to add reserved permissions causes errors and confusion during role creation.

Quick: Do you think assigning many permissions in a custom role is safer than fewer? Commit to yes or no.

Common Belief: Giving more permissions in a custom role is safer because it avoids access issues.

Reality: Granting more permissions than needed increases security risks and potential misuse.

Why it matters: Over-permissioned roles can lead to data breaches or accidental damage.

Expert Zone

1

Custom roles have a maximum permission count limit (currently 300), which requires careful permission selection in complex environments.

2

Custom roles can be created at project or organization level, affecting their scope and availability across projects.

3

Role permissions are strings tied to specific GCP APIs and versions; changes in APIs can affect role validity.

When NOT to use

Avoid custom roles when predefined roles fully meet your needs, as they are simpler to manage. For dynamic access control, consider IAM Conditions or Access Context Manager instead of static custom roles.

Production Patterns

Enterprises often create a small set of custom roles per team or function, automate role deployment with Terraform, and integrate role audits into security reviews to maintain least privilege.

Connections

Role-Based Access Control (RBAC)

Custom roles in GCP are a form of RBAC, where roles group permissions assigned to users.

Understanding RBAC principles helps grasp why grouping permissions into roles simplifies access management.

Least Privilege Security Principle

Custom roles enable applying the least privilege principle by granting only necessary permissions.

Knowing least privilege guides how to select permissions for custom roles to minimize risk.

Physical Security Key Management

Custom roles are like managing physical keys for doors, controlling who can enter which rooms.

This cross-domain link shows how access control concepts apply both digitally and physically.

Common Pitfalls

#1 Adding too many permissions to a custom role.

Wrong approach:

gcloud iam roles create myRole --project=myProj --title="Too Broad" --permissions=compute.instances.*,storage.buckets.*

Correct approach:

gcloud iam roles create myRole --project=myProj --title="Specific Role" --permissions=compute.instances.get,storage.buckets.list

Root cause:

Misunderstanding that wildcard permissions grant excessive access, violating least privilege.

#2 Trying to add Google-reserved permissions to a custom role.

Wrong approach:

Adding 'resourcemanager.projects.setIamPolicy' permission to a custom role.

Correct approach:

Exclude reserved permissions and use predefined roles for such actions.

Root cause:

Not knowing that some permissions are restricted and cannot be customized.

#3 Updating a custom role without testing impact.

Wrong approach:

Directly removing permissions from a custom role used in production without validation.

Correct approach:

Create a new version of the role, test it in staging, then switch assignments.

Root cause:

Ignoring that role updates affect all users immediately, risking service disruption.

Key Takeaways

Custom roles let you tailor permissions precisely to user needs, improving security and usability.

Always apply the principle of least privilege when selecting permissions for custom roles.

Custom roles can be managed via GCP Console or gcloud CLI, enabling both manual and automated workflows.

Updating custom roles affects all assigned users immediately, so plan and test changes carefully.

In large organizations, centralizing and automating custom role management is key for consistency and security.