Custom roles creation in GCP - Step-by-Step Execution

Process Flow - Custom roles creation

Define role permissions

↓

Create role with name & description

↓

Submit role creation request

↓

GCP validates permissions

↓

Role created and stored

↓

Role available for assignment

This flow shows how you define permissions, create a custom role, submit it to GCP, and then the role becomes available for use.

Execution Sample

GCP

gcloud iam roles create customRoleName \
  --project=my-project \
  --title="Custom Role" \
  --description="Role with specific permissions" \
  --permissions=storage.buckets.get,storage.objects.list \
  --stage=GA

This command creates a custom role in a GCP project with specific storage permissions.

Process Table

Step	Action	Input/Command	GCP Response	Result
1	Define role name and permissions	customRoleName, storage.buckets.get, storage.objects.list	N/A	Role details prepared
2	Run gcloud create role command	gcloud iam roles create customRoleName --project=my-project --permissions=storage.buckets.get,storage.objects.list	Validates permissions	Permissions checked
3	GCP validates permissions	Permissions list	Permissions valid	Proceed to create role
4	Role creation request sent	Role details	Role created successfully	Role stored in project
5	Role availability	N/A	Role listed in project roles	Role ready for assignment
6	Exit	N/A	N/A	Process complete

💡 Role created and available for assignment in the project

Status Tracker

Variable	Start	After Step 1	After Step 2	After Step 4	Final
roleName	undefined	customRoleName	customRoleName	customRoleName	customRoleName
permissions	undefined	storage.buckets.get, storage.objects.list	storage.buckets.get, storage.objects.list	storage.buckets.get, storage.objects.list	storage.buckets.get, storage.objects.list
roleStatus	undefined	defined	validated	created	available

Key Moments - 3 Insights

Why do we need to validate permissions before creating the role?

GCP checks if the permissions you list are valid and allowed. This prevents creating roles with invalid or unsupported permissions, as shown in step 3 of the execution_table.

Can we create a role without specifying a project?

No, custom roles are created within a specific project or organization. The project flag is required to know where to store the role, as seen in step 2.

What happens if the permissions list is empty?

GCP will reject the role creation because a role must have at least one permission. This would fail validation in step 3.

Visual Quiz - 3 Questions

Look at the execution_table, what is the roleStatus after step 2?

A validated

B undefined

C defined

D created

💡 Hint

Check variable_tracker row for roleStatus after Step 2

At which step does GCP confirm the permissions are valid?

A Step 1

B Step 2

C Step 3

D Step 4

💡 Hint

Look at execution_table row describing permission validation

If you omit the --project flag, what will happen?

A Role will be created in default project

B GCP will reject the command

C Role will be created globally

D Permissions will be ignored

💡 Hint

Refer to key_moments about project requirement and step 2 in execution_table

Concept Snapshot

Custom roles let you bundle specific permissions.
Use gcloud iam roles create with role name, permissions, and project.
GCP validates permissions before creating the role.
Role is stored in the project and ready to assign.
Always specify project and valid permissions.

Full Transcript

Creating a custom role in GCP involves defining the role name and permissions, then running a gcloud command to create it in a specific project. GCP checks the permissions to ensure they are valid. Once validated, the role is created and stored in the project. The role then becomes available for assignment to users or service accounts. This process ensures you only create roles with valid permissions and within the correct project scope.

Practice

1. What is the main purpose of creating a custom role in Google Cloud Platform?

easy

A. To create virtual machines quickly

B. To automatically assign all permissions to a user

C. To delete existing predefined roles

D. To tailor permissions specifically for your project needs

Solution

1. Step 1: Understand role customization

   Custom roles allow you to pick specific permissions instead of using broad predefined roles.

2. Step 2: Identify the purpose of custom roles

   They help tailor access to exactly what is needed, improving security and management.

3. Final Answer:

   To tailor permissions specifically for your project needs -> Option D

4. Quick Check:

   Custom roles = tailored permissions [OK]

Hint: Custom roles = pick permissions you want [OK]

Common Mistakes:

• Thinking custom roles give all permissions automatically
• Confusing custom roles with deleting roles
• Assuming custom roles create resources

2. Which of the following is the correct gcloud command syntax to create a custom role named myCustomRole in project my-project with the title "My Role" and permission storage.buckets.list?

easy

A. gcloud iam roles create myCustomRole --project=my-project --title="My Role" --permissions=storage.buckets.list --stage=GA

B. gcloud iam create role myCustomRole --project my-project --title My Role --permissions storage.buckets.list

C. gcloud roles create myCustomRole --project=my-project --title="My Role" --permissions=storage.buckets.list

D. gcloud iam roles add myCustomRole --project=my-project --title="My Role" --permissions=storage.buckets.list

Solution

1. Step 1: Identify correct gcloud command structure

   The correct command to create a custom role is gcloud iam roles create with flags for project, title, permissions, and stage.

2. Step 2: Match syntax with options

   gcloud iam roles create myCustomRole --project=my-project --title="My Role" --permissions=storage.buckets.list --stage=GA matches the correct syntax including --project, --title, --permissions, and --stage flags.

3. Final Answer:

   gcloud iam roles create myCustomRole --project=my-project --title="My Role" --permissions=storage.buckets.list --stage=GA -> Option A

4. Quick Check:

   Correct gcloud create syntax = gcloud iam roles create myCustomRole --project=my-project --title="My Role" --permissions=storage.buckets.list --stage=GA [OK]

Hint: Use 'gcloud iam roles create' with all flags [OK]

Common Mistakes:

• Using 'gcloud iam create role' instead of 'roles create'
• Missing the --stage flag
• Incorrect flag order or missing equal signs

3. Given this command:

gcloud iam roles create dataViewer --project=my-project --title="Data Viewer" --permissions=bigquery.datasets.get,bigquery.tables.list --stage=ALPHA

What will be the effect of this custom role?

medium

A. Allows users to get dataset metadata and list tables in BigQuery

B. Allows users to create and delete BigQuery datasets

C. Grants full admin access to BigQuery

D. Denies all BigQuery permissions

Solution

1. Step 1: Analyze permissions in the command

   The permissions bigquery.datasets.get and bigquery.tables.list allow reading dataset info and listing tables.

2. Step 2: Understand what these permissions enable

   These permissions let users view dataset metadata and see tables but not modify or delete them.

3. Final Answer:

   Allows users to get dataset metadata and list tables in BigQuery -> Option A

4. Quick Check:

   Permissions = read-only BigQuery access [OK]

Hint: Check permissions list for read or write actions [OK]

Common Mistakes:

• Assuming ALPHA stage means full access
• Confusing get/list with create/delete permissions
• Thinking it grants admin rights

4. You tried to create a custom role with this command:

gcloud iam roles create testRole --project=my-project --title="Test Role" --permissions=compute.instances.start,compute.instances.stop

But it failed. What is the most likely reason?

medium

A. Project ID is incorrect

B. Permissions are invalid for custom roles

C. Missing the --stage flag which is required

D. Role ID cannot contain uppercase letters

Solution

1. Step 1: Check required flags for role creation

   The --stage flag is mandatory when creating custom roles to specify the release stage.

2. Step 2: Identify missing flag in the command

   The command lacks the --stage flag, causing failure.

3. Final Answer:

   Missing the --stage flag which is required -> Option C

4. Quick Check:

   --stage flag required = Missing the --stage flag which is required [OK]

Hint: Always include --stage when creating custom roles [OK]

Common Mistakes:

• Ignoring the required --stage flag
• Assuming permissions are invalid
• Mistaking project ID or role ID format

5. You want to create a custom role that allows users to list storage buckets and read objects but not delete them. Which permissions should you include in your custom role?

hard

A. storage.buckets.list, storage.objects.delete

B. storage.buckets.list, storage.objects.get

C. storage.buckets.create, storage.objects.get

D. storage.buckets.delete, storage.objects.get

Solution

1. Step 1: Identify permissions for listing buckets and reading objects

   storage.buckets.list allows listing buckets, and storage.objects.get allows reading objects.

2. Step 2: Exclude delete permissions

   Do not include any delete permissions to prevent deletion.

3. Final Answer:

   storage.buckets.list, storage.objects.get -> Option B

4. Quick Check:

   List + read, no delete = storage.buckets.list, storage.objects.get [OK]

Hint: Include only list and get permissions, exclude delete [OK]

Common Mistakes:

• Including delete permissions by mistake
• Confusing create with list permissions
• Assuming read includes delete