Google Cloud Identity and Access Management (IAM) service is a critical gateway for the entire platform. One of Cloud IAM’s primary features is the ability to assign a range of roles, which determine the permissions available for targeted resources. There are a large number of pre-defined roles, with set permissions, available as well as the capability to create custom roles.
In this hands-on lab, you’ll add a new member to the team with a pre-defined role of Compute Network Admin. Then, you’ll expand that member’s responsibilities to administering firewall rules by creating a custom role. Next, I’ll show you how to combine both pre-defined and custom roles into a single custom role. Finally, you’ll log in as the new member to verify the IAM permissions are working as expected.
Learning Objectives
Successfully complete this lab by achieving the following learning objectives:
- Add IAM member to project.
- From the Google Cloud console’s main navigation, choose IAM & admin > IAM.
- Click Add Member.
- In the Add Members panel, enter the email address for the secondary user for this hands-on lab.
- In the Select a role field, enter
Compute Network
and choose Compute Network Admin. - Click Save.
- Create a custom IAM role.
- From the IAM navigation, choose Roles.
- Click Create Role.
- On the Create Role page, enter the following:
- Title:
Firewall Admin
- ID:
FirewallAdmin
- Role launch stage:
Beta
- Title:
- Click Add Permissions.
- In the Add Permissions dialog, click Filter Table and enter firewalls; press Return.
- Select all permissions beginning with
compute.firewalls
. - Click Add.
- Click Create.
- Assign custom role.
- From the IAM navigation, choose IAM.
- In the row of the newly added member, click Edit (the pencil icon).
- Click Add Another Role.
- In the Select a role field, enter Firewall and select Firewall Admin.
- Click Save.
- Create a new custom role
- From the IAM navigation, choose Roles.
- In the Filter table field, enter Compute Network and choose Compute Network Admin.
- Click OR.
- In the Filter table field, enter Firewall and choose Firewall Admin.
- Select the checkboxes next to the two roles.
- Choose Create Role from Selection.
- On the Create Role page, enter the following:
- Title: Compute Network and Firewall Admin
- ID: ComputeNetworkAndFirewallAdmin
- Role launch stage: Beta
- Click Create.
- Assign the new role.
- From the IAM navigation, choose IAM.
- In the row of the newly added member, click Edit (the pencil icon).
- In the Edit Permissions panel, click the Trashcan icon next to the Firewall Admin role.
- Click in the Compute Network Admin role field.
- Select Custom and then Compute Network and Firewall Admin.
- Click Save.
- Verify Permissions
- From the main Google Cloud navigation, choose Compute Engine > VM Instances.
- Choose Create.
- Leave all the values at their defaults.
- In the Firewall section, select both options.
- Click Create.
- Log out of the Google Cloud console.
- Copy the username for the secondary user.
- Open a new browser window for the lab.
- Log in as the secondary user.
- From the Google Cloud console’s main navigation, choose IAM & admin > IAM.
- Note that you do not have permission to view this page.
- From the main Google Cloud navigation, choose Compute Engine > VM Instances.
- Note the recently created instance.
- From the main Google Cloud navigation, choose VPC Networks > VPC Networks.
- Note the full admin capabilities here.
- From the VPC Network menu, choose Firewall rules.
- Note the full admin capabilities here.
- Select and delete the HTTPS firewall rule.