Database Migration Service IAM roles and permissions for PostgreSQL

Database Migration Service uses Identity and Access Management (IAM) roles and permissions to manage access to your migration resources.

Accounts involved in data migration

When you perform homogeneous PostgreSQL migrations with Database Migration Service, the following accounts are involved in the migration process:

User account that performs the migration

This is the Google Account that you sign in with to create the connection profiles, create and run the migration job.

Database Migration Service service account

This is the service account that is created for you when you enable the Database Migration Service API. The email address associated with this account is generated automatically and can't be changed. This email address uses the following format:

service-PROJECT_NUMBER@gcp-sa-datamigration.

Each account involved in the data migration process requires a different set of roles and permissions.

Permissions and roles

To get the permissions that you need to perform homogeneous PostgreSQL migrations with Database Migration Service, ask your administrator to grant the required IAM roles on your project for the following accounts:

• User account that performs the migration:
  • Database Migration Admin (roles/datamigration.admin)
  • Cloud SQL Editor (roles/cloudsql.editor)
• Database Migration Service service account:
  • Database Migration Admin (roles/datamigration.admin)
  • Cloud SQL Editor (roles/cloudsql.editor)
  • Cloud SQL Studio User (roles/cloudsql.studioUser)

For more information about granting roles, see Manage access.

These predefined roles contain the permissions required to perform homogeneous PostgreSQL migrations with Database Migration Service. To see the exact permissions that are required, expand the Required permissions section:

Required permissions

The following permissions are required to perform homogeneous PostgreSQL migrations with Database Migration Service:

• User account that performs the migration:
  • datamigration.*
  • resourcemanager.projects.get
  • resourcemanager.projects.list
  • cloudsql.operations.get
  • cloudsql.instances.create
  • cloudsql.instances.get
  • cloudsql.instances.list
  • cloudsql.databases.get
  • cloudsql.databases.list
  • cloudsql.databases.delete
  • compute.machineTypes.list
  • compute.machineTypes.get
  • compute.projects.get
• Database Migration Service service account:
  • datamigration.*
  • resourcemanager.projects.get
  • resourcemanager.projects.list
  • cloudsql.instances.create
  • cloudsql.instances.get
  • cloudsql.instances.list
  • cloudsql.instances.executeSql

You might also be able to get these permissions with custom roles or other predefined roles.