IAM roles and permissions for AlloyDB

This page lists the Identity and Access Management (IAM) predefined roles and permissions for AlloyDB for PostgreSQL. For a complete list of IAM roles and permissions for AlloyDB, see AlloyDB for PostgreSQL roles and permissions.

To assign these roles and permissions to an IAM principal, complete the following prerequisites:

• The Cloud Resource Manager API must be enabled in the Google Cloud project.

  Enable the API

• You must have the Owner (roles/owner) basic IAM role in the Google Cloud project, or a role that grants these permissions:
  • resourcemanager.projects.get
  • resourcemanager.projects.getIamPolicy
  • resourcemanager.projects.setIamPolicy

  To gain these permissions while following the principle of least privilege, ask your administrator to grant you the Project IAM Admin (roles/resourcemanager.projectIamAdmin) role.

Predefined AlloyDB IAM roles

The following table lists the predefined roles available for AlloyDB, along with their AlloyDB permissions:

Predefined role name	Description AlloyDB permissions
roles/alloydb.admin AlloyDB Admin	Full control for all AlloyDB resources. alloydb.
roles/alloydb.editor AlloyDB Editor	Read-write access to AlloyDB resources, without permission to manage tag bindings or Backup and DR Service backup plans. alloydb.backups.create alloydb.backups.delete alloydb.backups.get alloydb.backups.list alloydb.backups.listEffectiveTags alloydb.backups.listTagBindings alloydb.backups.update alloydb.clusters.create alloydb.clusters.delete alloydb.clusters.export alloydb.clusters.generateClientCertificate alloydb.clusters.get alloydb.clusters.import alloydb.clusters.list alloydb.clusters.listEffectiveTags alloydb.clusters.listTagBindings alloydb.clusters.promote alloydb.clusters.switchover alloydb.clusters.update alloydb.clusters.upgrade alloydb.databases. alloydb.instances. alloydb.locations. alloydb.operations. alloydb.supportedDatabaseFlags. alloydb.users.
roles/alloydb.client AlloyDB Client	Connectivity access to AlloyDB instances for principals running the AlloyDB Auth Proxy or AlloyDB Language Connectors. alloydb.clusters.generateClientCertificate alloydb.clusters.get alloydb.instances.connect alloydb.instances.get
roles/alloydb.databaseUser AlloyDB Database User	IAM-based database user login access to AlloyDB instances and query execution access in AlloyDB Studio. alloydb.clusters.get alloydb.instances.executeSql alloydb.instances.executeSqlReadOnly alloydb.instances.get alloydb.users.login
roles/alloydb.viewer AlloyDB Viewer	Read-only access to all AlloyDB resources. alloydb.backups.get alloydb.backups.list alloydb.backups.listEffectiveTags alloydb.backups.listTagBindings alloydb.clusters.export alloydb.clusters.get alloydb.clusters.list alloydb.clusters.listEffectiveTags alloydb.clusters.listTagBindings alloydb.databases.get alloydb.databases.list alloydb.instances.executeSqlReadOnly alloydb.instances.get alloydb.instances.list alloydb.locations. alloydb.operations.get alloydb.operations.list alloydb.supportedDatabaseFlags.* alloydb.users.get alloydb.users.list
roles/alloydb.backupDrAdmin AlloyDB Admin for BackupDR	Access to manage AlloyDB cluster backups and restores using Backup and DR. alloydb.clusters.create alloydb.clusters.get alloydb.clusters.list alloydb.instances.create alloydb.instances.get alloydb.instances.list alloydb.operations.get

Required permissions for common tasks

The following table lists the key IAM permissions and predefined roles required for common AlloyDB connection, authentication, and administration tasks:

Task	Required AlloyDB permissions	Predefined roles that include these permissions
Connect through the AlloyDB Auth Proxy or AlloyDB Language Connectors (required for the principal running the proxy or connector)	alloydb.clusters.generateClientCertificate alloydb.clusters.get alloydb.instances.connect alloydb.instances.get	AlloyDB Client (roles/alloydb.client) AlloyDB Editor (roles/alloydb.editor) AlloyDB Admin (roles/alloydb.admin)
Authenticate as an IAM-based database user (IAM_BASED or IAM_GROUP)	alloydb.instances.get alloydb.users.login	AlloyDB Database User (roles/alloydb.databaseUser) AlloyDB Editor (roles/alloydb.editor) AlloyDB Admin (roles/alloydb.admin)
Run SQL queries in AlloyDB Studio	alloydb.clusters.get alloydb.instances.executeSql alloydb.instances.executeSqlReadOnly alloydb.instances.get	AlloyDB Database User (roles/alloydb.databaseUser) AlloyDB Editor (roles/alloydb.editor) AlloyDB Admin (roles/alloydb.admin)
Create, update, or delete clusters and instances	alloydb.clusters.create alloydb.clusters.update alloydb.clusters.delete alloydb.instances.create alloydb.instances.update alloydb.instances.delete alloydb.operations.get	AlloyDB Editor (roles/alloydb.editor) AlloyDB Admin (roles/alloydb.admin)
Create, view, or delete on-demand backups	alloydb.backups.create alloydb.backups.get alloydb.backups.list alloydb.backups.delete alloydb.operations.get	AlloyDB Editor (roles/alloydb.editor) AlloyDB Admin (roles/alloydb.admin)
Import or export data between AlloyDB and Cloud Storage	alloydb.clusters.import alloydb.clusters.export alloydb.operations.get	AlloyDB Editor (roles/alloydb.editor) AlloyDB Admin (roles/alloydb.admin)

AlloyDB IAM permissions and their roles

The following table lists each permission that AlloyDB supports and the predefined AlloyDB roles that include it.

Permission	AlloyDB roles
alloydb.backups.create	AlloyDB Admin AlloyDB Editor
alloydb.backups.createTagBinding	AlloyDB Admin
alloydb.backups.delete	AlloyDB Admin AlloyDB Editor
alloydb.backups.deleteTagBinding	AlloyDB Admin
alloydb.backups.get	AlloyDB Admin AlloyDB Editor AlloyDB Viewer
alloydb.backups.list	AlloyDB Admin AlloyDB Editor AlloyDB Viewer
alloydb.backups.listEffectiveTags	AlloyDB Admin AlloyDB Editor AlloyDB Viewer
alloydb.backups.listTagBindings	AlloyDB Admin AlloyDB Editor AlloyDB Viewer
alloydb.backups.update	AlloyDB Admin AlloyDB Editor
alloydb.clusters.create	AlloyDB Admin AlloyDB Admin for BackupDR AlloyDB Editor
alloydb.clusters.createTagBinding	AlloyDB Admin
alloydb.clusters.delete	AlloyDB Admin AlloyDB Editor
alloydb.clusters.deleteTagBinding	AlloyDB Admin
alloydb.clusters.export	AlloyDB Admin AlloyDB Editor AlloyDB Viewer
alloydb.clusters.generateClientCertificate	AlloyDB Admin AlloyDB Client AlloyDB Editor
alloydb.clusters.get	AlloyDB Admin AlloyDB Admin for BackupDR AlloyDB Client AlloyDB Database User AlloyDB Editor AlloyDB Viewer
alloydb.clusters.import	AlloyDB Admin AlloyDB Editor
alloydb.clusters.list	AlloyDB Admin AlloyDB Admin for BackupDR AlloyDB Editor AlloyDB Viewer
alloydb.clusters.listEffectiveTags	AlloyDB Admin AlloyDB Editor AlloyDB Viewer
alloydb.clusters.listTagBindings	AlloyDB Admin AlloyDB Editor AlloyDB Viewer
alloydb.clusters.promote	AlloyDB Admin AlloyDB Editor
alloydb.clusters.switchover	AlloyDB Admin AlloyDB Editor
alloydb.clusters.update	AlloyDB Admin AlloyDB Editor
alloydb.clusters.upgrade	AlloyDB Admin AlloyDB Editor
alloydb.databases.create	AlloyDB Admin AlloyDB Editor
alloydb.databases.get	AlloyDB Admin AlloyDB Editor AlloyDB Viewer
alloydb.databases.list	AlloyDB Admin AlloyDB Editor AlloyDB Viewer
alloydb.instances.connect	AlloyDB Admin AlloyDB Client AlloyDB Editor
alloydb.instances.create	AlloyDB Admin AlloyDB Admin for BackupDR AlloyDB Editor
alloydb.instances.delete	AlloyDB Admin AlloyDB Editor
alloydb.instances.executeSql	AlloyDB Admin AlloyDB Database User AlloyDB Editor
alloydb.instances.executeSqlReadOnly	AlloyDB Admin AlloyDB Database User AlloyDB Editor AlloyDB Viewer
alloydb.instances.failover	AlloyDB Admin AlloyDB Editor
alloydb.instances.get	AlloyDB Admin AlloyDB Admin for BackupDR AlloyDB Client AlloyDB Database User AlloyDB Editor AlloyDB Viewer
alloydb.instances.injectFault	AlloyDB Admin AlloyDB Editor
alloydb.instances.list	AlloyDB Admin AlloyDB Admin for BackupDR AlloyDB Editor AlloyDB Viewer
alloydb.instances.restart	AlloyDB Admin AlloyDB Editor
alloydb.instances.update	AlloyDB Admin AlloyDB Editor
alloydb.locations.get	AlloyDB Admin AlloyDB Editor AlloyDB Viewer
alloydb.locations.list	AlloyDB Admin AlloyDB Editor AlloyDB Viewer
alloydb.operations.cancel	AlloyDB Admin AlloyDB Editor
alloydb.operations.delete	AlloyDB Admin AlloyDB Editor
alloydb.operations.get	AlloyDB Admin AlloyDB Admin for BackupDR AlloyDB Editor AlloyDB Viewer
alloydb.operations.list	AlloyDB Admin AlloyDB Editor AlloyDB Viewer
alloydb.supportedDatabaseFlags.get	AlloyDB Admin AlloyDB Editor AlloyDB Viewer
alloydb.supportedDatabaseFlags.list	AlloyDB Admin AlloyDB Editor AlloyDB Viewer
alloydb.users.create	AlloyDB Admin AlloyDB Editor
alloydb.users.delete	AlloyDB Admin AlloyDB Editor
alloydb.users.get	AlloyDB Admin AlloyDB Editor AlloyDB Viewer
alloydb.users.list	AlloyDB Admin AlloyDB Editor AlloyDB Viewer
alloydb.users.login	AlloyDB Admin AlloyDB Database User AlloyDB Editor
alloydb.users.update	AlloyDB Admin AlloyDB Editor