Skip to content

Contact sales

By filling out this form and clicking submit, you acknowledge our privacy policy.
  • Labs icon Lab
  • A Cloud Guru
Labs

Creating and Manage IAM Roles on Google Cloud

Google Cloud Identity and Access Management (IAM) service is a critical gateway for the entire platform. One of Cloud IAM's primary features is the ability to assign a range of roles, which determine the permissions available for targeted resources. There are a large number of pre-defined roles, with set permissions, available as well as the capability to create custom roles. In this hands-on lab, you'll add a new member to the team with a pre-defined role of Compute Network Admin. Then, you'll expand that member's responsibilities to administering firewall rules by creating a custom role. Next, I'll show you how to combine both pre-defined and custom roles into a single custom role. Finally, you'll log in as the new member to verify the IAM permissions are working as expected.

Try for free Contact sales
Labs

Path Info

Level
Clock icon Beginner
Duration
Clock icon 45m
Published
Clock icon Mar 06, 2020

Contact sales

By filling out this form and clicking submit, you acknowledge our privacy policy.

Table of Contents

  1. Challenge

    Add IAM member to project.

    1. From the Google Cloud console's main navigation, choose IAM & admin > IAM.
    2. Click GRANT ACCESS.
    3. In the Add Princippals panel, enter the email address for the secondary user for this hands-on lab.
    4. In the Select a role field, enter Compute Network and choose Compute Network Admin.
    5. Click Save.

  2. Challenge

    Create a custom IAM role.

    1. From the IAM navigation, choose Roles.
    2. Click Create Role.
    3. On the Create Role page, enter the following:
    • Title: Firewall Admin
    • ID: FirewallAdmin
    • Role launch stage: Beta
    1. Click Add Permissions.
    2. In the Add Permissions dialog, click Filter Table and enter firewalls; press Return.
    3. Select all permissions beginning with compute.firewalls.
    4. Click Add.
    5. Click Create.

  3. Challenge

    Assign custom role.

    1. From the IAM navigation, choose IAM.
    2. In the row of the newly added member, click Edit (the pencil icon).
    3. Click Add Another Role.
    4. In the Select a role field, enter Firewall and select Firewall Admin.
    5. Click Save.

  4. Challenge

    Create a new custom role

    1. From the IAM navigation, choose Roles.
    2. In the Filter table field, enter Compute Network and choose Compute Network Admin.
    3. Click OR.
    4. In the Filter table field, enter Firewall and choose Firewall Admin.
    5. Select the checkboxes next to the two roles.
    6. Choose Create Role from Selection.
    7. On the Create Role page, enter the following:
    • Title: Compute Network and Firewall Admin
    • ID: ComputeNetworkAndFirewallAdmin
    • Role launch stage: Beta
    1. Click Create.

  5. Challenge

    Assign the new role.

    1. From the IAM navigation, choose IAM.
    2. In the row of the newly added member, click Edit (the pencil icon).
    3. In the Edit Permissions panel, click the Trashcan icon next to the Firewall Admin role.
    4. Click in the Compute Network Admin role field.
    5. Select Custom and then Compute Network and Firewall Admin.
    6. Click Save.

  6. Challenge

    Verify Permissions

    1. From the main Google Cloud navigation, choose Compute Engine > VM Instances.
    2. Choose Create.
    3. Leave all the values at their defaults.
    4. In the Firewall section, select both options.
    5. Click Create.
    6. Log out of the Google Cloud console.
    7. Copy the username for the secondary user.
    8. Open a new browser window for the lab.
    9. Log in as the secondary user.
    10. From the Google Cloud console's main navigation, choose IAM & admin > IAM.
    11. Note that you do not have permission to view this page.
    12. From the main Google Cloud navigation, choose Compute Engine > VM Instances.
    13. Note the recently created instance.
    14. From the main Google Cloud navigation, choose VPC Networks > VPC Networks.
    15. Note the full admin capabilities here.
    16. From the VPC Network menu, choose Firewall rules.
    17. Note the full admin capabilities here.
    18. Select and delete the HTTPS firewall rule.
A Cloud Guru - Labs - Creating and Manage IAM Roles on Google Cloud
Author
A Cloud Guru

The Cloud Content team comprises subject matter experts hyper focused on services offered by the leading cloud vendors (AWS, GCP, and Azure), as well as cloud-related technologies such as Linux and DevOps. The team is thrilled to share their knowledge to help you build modern tech solutions from the ground up, secure and optimize your environments, and so much more!

What's a lab?

Hands-on Labs are real environments created by industry experts to help you learn. These environments help you gain knowledge and experience, practice without compromising your system, test without risk, destroy without fear, and let you learn from your mistakes. Hands-on Labs: practice your skills before delivering in the real world.

Provided environment for hands-on practice

We will provide the credentials and environment necessary for you to practice right within your browser.

Guided walkthrough

Follow along with the author’s guided walkthrough and build something new in your provided environment!

Did you know?

On average, you retain 75% more of your learning if you get time for practice.

Start learning by doing today

View Plans