Access control with IAM

This page describes how Identity and Access Management (IAM) controls access to App Lifecycle Manager. It is intended for platform administrators, security engineers, and operators who configure user access and automated deployment pipelines.

Access control in App Lifecycle Manager involves two primary concepts:

  • IAM roles for principals (users, groups, and service accounts): These standard IAM roles control who can directly interact with App Lifecycle Manager resources (such as SaaS offerings, units, releases, and rollouts) by using the Google Cloud console, the Google Cloud CLI, or the API.
  • Permissions for specialized service accounts: These permissions enable specific service accounts that App Lifecycle Manager uses to perform automated actions on your behalf, such as building artifacts or provisioning infrastructure by using Terraform.

Distinguish between the permissions that you (or another principal) need to manage App Lifecycle Manager itself and the permissions that the underlying service accounts need to execute tasks delegated by App Lifecycle Manager.

User and principal access control

To interact directly with App Lifecycle Manager resources, such as viewing SaaS offerings or managing rollouts, a principal must have the appropriate predefined App Lifecycle Manager IAM roles. A principal can be a user, group, or service account that calls the API.

These roles govern actions taken directly against the App Lifecycle Manager API or in the Google Cloud console.

To view existing App Lifecycle Manager resources (such as SaaS offerings, units, releases, and rollouts), you need only the relevant viewer role, such as the roles/saasservicemgmt.viewer role. You don't need to configure or grant permissions to specialized service accounts for read-only operations.

Permissions for specialized service accounts

Certain automated actions performed by App Lifecycle Manager require specific service accounts with appropriate permissions:

  • App Lifecycle Manager service agent (Google-managed): When you create your first App Lifecycle Manager resource, App Lifecycle Manager automatically provisions a Google-managed service agent. This service agent uses the App Lifecycle Manager Service Agent role (roles/saasservicemgmt.serviceAgent) to perform operations across Google Cloud services on your behalf.
  • Provisioning and managing units (actuation service account, user-managed): When App Lifecycle Manager provisions, updates, or deletes a unit, App Lifecycle Manager uses Infrastructure Manager, which runs by using the user-managed actuation service account to execute the Terraform configuration.
  • Building and uploading artifacts (artifact creation service account, user-managed, optional): When you use an automated build system such as Cloud Build, the user-managed artifact creation service account builds the Terraform OCI artifact and pushes it to Artifact Registry. This service account is optional if you use composite templates or push OCI images manually.

These service accounts, detailed in App Lifecycle Manager service accounts, require specific sets of permissions:

  • Base permissions: The user-managed service accounts require roles to interact with core services such as Artifact Registry, Cloud Storage, Infra Manager, and IAM (for example, the roles/artifactregistry.writer, roles/config.admin, and roles/iam.serviceAccountTokenCreator roles). The required roles for each service account are listed in App Lifecycle Manager service accounts.
  • Terraform resource permissions (actuation service account only): The actuation service account must also have the IAM permissions to create, modify, and delete the specific Google Cloud resources defined in your Terraform configuration. For example, if your Terraform configuration creates Google Kubernetes Engine (GKE) clusters and Cloud SQL instances, the actuation service account needs roles such as the roles/container.admin and roles/cloudsql.admin roles. Grant these roles in the project where those resources are created. These permissions are in addition to the base permissions needed to run Infra Manager.

Granting permissions to these service accounts lets App Lifecycle Manager perform its automated tasks, acting with a distinct identity for infrastructure changes (actuation service account) or artifact management (artifact creation service account). These service account permissions are separate from the permissions that you or other principals need to view or manage App Lifecycle Manager resources.

Predefined App Lifecycle Manager roles

IAM provides predefined roles that grant access to specific Google Cloud resources and prevent unauthorized access to other resources.

The following table lists the App Lifecycle Manager IAM roles and the permissions that they include:

Role Description Permissions
App Lifecycle Manager Admin (roles/saasservicemgmt.admin) Full access to all App Lifecycle Manager resources. saasservicemgmt.rollouts.create
saasservicemgmt.rollouts.update
saasservicemgmt.rollouts.delete
saasservicemgmt.rolloutKinds.create
saasservicemgmt.rolloutKinds.update
saasservicemgmt.rolloutKinds.delete
saasservicemgmt.releases.create
saasservicemgmt.releases.update
saasservicemgmt.releases.delete
saasservicemgmt.units.create
saasservicemgmt.units.update
saasservicemgmt.units.delete
saasservicemgmt.unitKinds.create
saasservicemgmt.unitKinds.update
saasservicemgmt.unitKinds.delete
saasservicemgmt.unitOperations.create
saasservicemgmt.unitOperations.update
saasservicemgmt.unitOperations.delete
saasservicemgmt.tenants.create
saasservicemgmt.tenants.update
saasservicemgmt.tenants.delete
saasservicemgmt.saas.create
saasservicemgmt.saas.update
saasservicemgmt.saas.delete
resourcemanager.projects.get
resourcemanager.projects.list
saasservicemgmt.locations.list
saasservicemgmt.locations.get
saasservicemgmt.rollouts.list
saasservicemgmt.rollouts.get
saasservicemgmt.rolloutKinds.list
saasservicemgmt.rolloutKinds.get
saasservicemgmt.releases.list
saasservicemgmt.releases.get
saasservicemgmt.units.list
saasservicemgmt.units.get
saasservicemgmt.unitKinds.list
saasservicemgmt.unitKinds.get
saasservicemgmt.unitOperations.list
saasservicemgmt.unitOperations.get
saasservicemgmt.tenants.list
saasservicemgmt.tenants.get
saasservicemgmt.saas.list
saasservicemgmt.saas.get
App Lifecycle Manager Viewer (roles/saasservicemgmt.viewer) Read App Lifecycle Manager resources: releases, rollouts, rolloutKinds, units, unitKinds, unitOperations, saas, and tenants. resourcemanager.projects.get
resourcemanager.projects.list
saasservicemgmt.locations.list
saasservicemgmt.locations.get
saasservicemgmt.rollouts.list
saasservicemgmt.rollouts.get
saasservicemgmt.rolloutKinds.list
saasservicemgmt.rolloutKinds.get
saasservicemgmt.releases.list
saasservicemgmt.releases.get
saasservicemgmt.units.list
saasservicemgmt.units.get
saasservicemgmt.unitKinds.list
saasservicemgmt.unitKinds.get
saasservicemgmt.unitOperations.list
saasservicemgmt.unitOperations.get
saasservicemgmt.tenants.list
saasservicemgmt.tenants.get
saasservicemgmt.saas.list
saasservicemgmt.saas.get

Permissions

The permissions that the caller must have to call each method are listed in the REST API reference.

What's next