Novice Level

Creating and Manage IAM Roles on Google Cloud

Pricing
45 minutes
  • 6 Learning Objectives

About this Hands-on Lab

Google Cloud Identity and Access Management (IAM) service is a critical gateway for the entire platform. One of Cloud IAM’s primary features is the ability to assign a range of roles, which determine the permissions available for targeted resources. There are a large number of pre-defined roles, with set permissions, available as well as the capability to create custom roles.

In this hands-on lab, you’ll add a new member to the team with a pre-defined role of Compute Network Admin. Then, you’ll expand that member’s responsibilities to administering firewall rules by creating a custom role. Next, I’ll show you how to combine both pre-defined and custom roles into a single custom role. Finally, you’ll log in as the new member to verify the IAM permissions are working as expected.

Learning Objectives

Successfully complete this lab by achieving the following learning objectives:

Add IAM member to project.
  1. From the Google Cloud console’s main navigation, choose IAM & admin > IAM.
  2. Click Add Member.
  3. In the Add Members panel, enter the email address for the secondary user for this hands-on lab.
  4. In the Select a role field, enter Compute Network and choose Compute Network Admin.
  5. Click Save.
Create a custom IAM role.
  1. From the IAM navigation, choose Roles.
  2. Click Create Role.
  3. On the Create Role page, enter the following:
    • Title: Firewall Admin
    • ID: FirewallAdmin
    • Role launch stage: Beta
  4. Click Add Permissions.
  5. In the Add Permissions dialog, click Filter Table and enter firewalls; press Return.
  6. Select all permissions beginning with compute.firewalls.
  7. Click Add.
  8. Click Create.
Assign custom role.
  1. From the IAM navigation, choose IAM.
  2. In the row of the newly added member, click Edit (the pencil icon).
  3. Click Add Another Role.
  4. In the Select a role field, enter Firewall and select Firewall Admin.
  5. Click Save.
Create a new custom role
  1. From the IAM navigation, choose Roles.
  2. In the Filter table field, enter Compute Network and choose Compute Network Admin.
  3. Click OR.
  4. In the Filter table field, enter Firewall and choose Firewall Admin.
  5. Select the checkboxes next to the two roles.
  6. Choose Create Role from Selection.
  7. On the Create Role page, enter the following:
    • Title: Compute Network and Firewall Admin
    • ID: ComputeNetworkAndFirewallAdmin
    • Role launch stage: Beta
  8. Click Create.
Assign the new role.
  1. From the IAM navigation, choose IAM.
  2. In the row of the newly added member, click Edit (the pencil icon).
  3. In the Edit Permissions panel, click the Trashcan icon next to the Firewall Admin role.
  4. Click in the Compute Network Admin role field.
  5. Select Custom and then Compute Network and Firewall Admin.
  6. Click Save.
Verify Permissions
  1. From the main Google Cloud navigation, choose Compute Engine > VM Instances.
  2. Choose Create.
  3. Leave all the values at their defaults.
  4. In the Firewall section, select both options.
  5. Click Create.
  6. Log out of the Google Cloud console.
  7. Copy the username for the secondary user.
  8. Open a new browser window for the lab.
  9. Log in as the secondary user.
  10. From the Google Cloud console’s main navigation, choose IAM & admin > IAM.
  11. Note that you do not have permission to view this page.
  12. From the main Google Cloud navigation, choose Compute Engine > VM Instances.
  13. Note the recently created instance.
  14. From the main Google Cloud navigation, choose VPC Networks > VPC Networks.
  15. Note the full admin capabilities here.
  16. From the VPC Network menu, choose Firewall rules.
  17. Note the full admin capabilities here.
  18. Select and delete the HTTPS firewall rule.
Contact SalesSee Pricing

Additional Resources

As the primary IAM administrator for your organization, you've been asked to add a new team member to the current project. You will also need to assign the new member the initial role of Compute Network Admin with the additional responsibilities of handling firewall administration. You're advised to identify the most efficient way to handle these tasks and confirm their implementation.

You'll need to accomplish the following steps to complete your task:

  1. Add IAM members.
  2. Assign a pre-defined role.
  3. Create a custom role.
  4. Assign the custom role.
  5. Verify permissions.

What are Hands-on Labs

Hands-on Labs are real environments created by industry experts to help you learn. These environments help you gain knowledge and experience, practice without compromising your system, test without risk, destroy without fear, and let you learn from your mistakes. Hands-on Labs: practice your skills before delivering in the real world.

Sign In
Welcome Back!

Psst…this one if you’ve been moved to ACG!

Don't have an account?

Get Started
Who’s going to be learning?
MyselfMy Organization