IAM Scope — Referência Multi-Cloud de IAM

Tier

Admin

Categoria

IAM

Escopo

project

Privilégios

Role IDroles/iam.admin

Esta é uma role privilegiada — concede capacidades de controle elevado. Aplique o princípio do menor privilégio e monitore atribuições via Cloud Audit Logs.

Admin

Administrative control over a service, may include IAM

Descrição

Full administrative access to IAM service accounts, roles, and policies.

Privilégios / Capacidades(4)

Create and delete service accounts

Manage IAM policies on all resources

Create and manage custom roles

Manage workforce identity pools

Permissions(14)

iam.serviceAccounts.create

iam.serviceAccounts.delete

iam.serviceAccounts.get

iam.serviceAccounts.list

iam.serviceAccounts.update

iam.roles.create

iam.roles.delete

iam.roles.update

iam.roles.get

iam.roles.list

iam.policies.get

iam.policies.set

resourcemanager.projects.getIamPolicy

resourcemanager.projects.setIamPolicy

Role Definition (JSON)

{
  "name": "roles/iam.admin",
  "title": "IAM Admin",
  "description": "Full administrative access to IAM service accounts, roles, and policies.",
  "stage": "GA",
  "includedPermissions": [
    "iam.serviceAccounts.create",
    "iam.serviceAccounts.delete",
    "iam.serviceAccounts.get",
    "iam.serviceAccounts.list",
    "iam.serviceAccounts.update",
    "iam.roles.create",

Roles relacionadasIAM

Project Owner

Full control of all GCP resources including IAM policies, billing, and all services.

Project Editor

Full edit access to all resources, excluding IAM policy management and billing.

Project Viewer

Read-only access to all resources. Cannot create, modify, or delete.

Security Admin

Can get and set any IAM policy. Used by security teams to audit and configure access.

Security Reviewer

Can get IAM policies and read security configurations. Read-only security auditor.

Docs GCP