IAM Scope — Referência Multi-Cloud de IAM

Tier

Admin

Categoria

IAM

Escopo

project

Privilégios

Role IDroles/iam.roleAdmin

Esta é uma role privilegiada — concede capacidades de controle elevado. Aplique o princípio do menor privilégio e monitore atribuições via Cloud Audit Logs.

Admin

Administrative control over a service, may include IAM

Descrição

Full control of all custom roles defined in the project.

Privilégios / Capacidades(2)

Create, update, and delete custom roles at project level

List all roles

Permissions(7)

iam.roles.create

iam.roles.delete

iam.roles.get

iam.roles.list

iam.roles.update

iam.roles.undelete

resourcemanager.projects.getIamPolicy

Role Definition (JSON)

{
  "name": "roles/iam.roleAdmin",
  "title": "Role Admin",
  "description": "Full control of all custom roles defined in the project.",
  "stage": "GA",
  "includedPermissions": [
    "iam.roles.create",
    "iam.roles.delete",
    "iam.roles.get",
    "iam.roles.list",
    "iam.roles.update",
    "iam.roles.undelete",

Roles relacionadasIAM

Project Owner

Full control of all GCP resources including IAM policies, billing, and all services.

Project Editor

Full edit access to all resources, excluding IAM policy management and billing.

Project Viewer

Read-only access to all resources. Cannot create, modify, or delete.

IAM Admin

Full administrative access to IAM service accounts, roles, and policies.

Security Admin

Can get and set any IAM policy. Used by security teams to audit and configure access.

Docs GCP