Custom roles creation in GCP - Step-by-Step Execution

Process Flow - Custom roles creation

Define role permissions

↓

Create role with name & description

↓

Submit role creation request

↓

GCP validates permissions

↓

Role created and stored

↓

Role available for assignment

This flow shows how you define permissions, create a custom role, submit it to GCP, and then the role becomes available for use.

Execution Sample

GCP

gcloud iam roles create customRoleName \
  --project=my-project \
  --title="Custom Role" \
  --description="Role with specific permissions" \
  --permissions=storage.buckets.get,storage.objects.list \
  --stage=GA

This command creates a custom role in a GCP project with specific storage permissions.

Process Table

Step	Action	Input/Command	GCP Response	Result
1	Define role name and permissions	customRoleName, storage.buckets.get, storage.objects.list	N/A	Role details prepared
2	Run gcloud create role command	gcloud iam roles create customRoleName --project=my-project --permissions=storage.buckets.get,storage.objects.list	Validates permissions	Permissions checked
3	GCP validates permissions	Permissions list	Permissions valid	Proceed to create role
4	Role creation request sent	Role details	Role created successfully	Role stored in project
5	Role availability	N/A	Role listed in project roles	Role ready for assignment
6	Exit	N/A	N/A	Process complete

💡 Role created and available for assignment in the project

Status Tracker

Variable	Start	After Step 1	After Step 2	After Step 4	Final
roleName	undefined	customRoleName	customRoleName	customRoleName	customRoleName
permissions	undefined	storage.buckets.get, storage.objects.list	storage.buckets.get, storage.objects.list	storage.buckets.get, storage.objects.list	storage.buckets.get, storage.objects.list
roleStatus	undefined	defined	validated	created	available

Key Moments - 3 Insights

Why do we need to validate permissions before creating the role?

GCP checks if the permissions you list are valid and allowed. This prevents creating roles with invalid or unsupported permissions, as shown in step 3 of the execution_table.

Can we create a role without specifying a project?

No, custom roles are created within a specific project or organization. The project flag is required to know where to store the role, as seen in step 2.

What happens if the permissions list is empty?

GCP will reject the role creation because a role must have at least one permission. This would fail validation in step 3.

Visual Quiz - 3 Questions

Look at the execution_table, what is the roleStatus after step 2?

A validated

B undefined

C defined

D created

💡 Hint

Check variable_tracker row for roleStatus after Step 2

At which step does GCP confirm the permissions are valid?

A Step 1

B Step 2

C Step 3

D Step 4

💡 Hint

Look at execution_table row describing permission validation

If you omit the --project flag, what will happen?

A Role will be created in default project

B GCP will reject the command

C Role will be created globally

D Permissions will be ignored

💡 Hint

Refer to key_moments about project requirement and step 2 in execution_table

Concept Snapshot

Custom roles let you bundle specific permissions.
Use gcloud iam roles create with role name, permissions, and project.
GCP validates permissions before creating the role.
Role is stored in the project and ready to assign.
Always specify project and valid permissions.

Full Transcript

Creating a custom role in GCP involves defining the role name and permissions, then running a gcloud command to create it in a specific project. GCP checks the permissions to ensure they are valid. Once validated, the role is created and stored in the project. The role then becomes available for assignment to users or service accounts. This process ensures you only create roles with valid permissions and within the correct project scope.