IAM roles and permissions for AlloyDB

This page lists the Identity and Access Management (IAM) predefined roles and permissions for AlloyDB for PostgreSQL. For a complete list of IAM roles and permissions for AlloyDB, see AlloyDB for PostgreSQL roles and permissions.

To assign these roles and permissions to an IAM principal, complete the following prerequisites:

  • The Cloud Resource Manager API must be enabled in the Google Cloud project.

    Enable the API

  • You must have the Owner (roles/owner) basic IAM role in the Google Cloud project, or a role that grants these permissions:
    • resourcemanager.projects.get
    • resourcemanager.projects.getIamPolicy
    • resourcemanager.projects.setIamPolicy

    To gain these permissions while following the principle of least privilege, ask your administrator to grant you the Project IAM Admin (roles/resourcemanager.projectIamAdmin) role.

Predefined AlloyDB IAM roles

The following table lists the predefined roles available for AlloyDB, along with their AlloyDB permissions:

Predefined role name Description
AlloyDB permissions
roles/alloydb.admin
AlloyDB Admin

Full control for all AlloyDB resources.

alloydb.
roles/alloydb.editor
AlloyDB Editor

Read-write access to AlloyDB resources, without permission to manage tag bindings or Backup and DR Service backup plans.

alloydb.backups.create
alloydb.backups.delete
alloydb.backups.get
alloydb.backups.list
alloydb.backups.listEffectiveTags
alloydb.backups.listTagBindings
alloydb.backups.update
alloydb.clusters.create
alloydb.clusters.delete
alloydb.clusters.export
alloydb.clusters.generateClientCertificate
alloydb.clusters.get
alloydb.clusters.import
alloydb.clusters.list
alloydb.clusters.listEffectiveTags
alloydb.clusters.listTagBindings
alloydb.clusters.promote
alloydb.clusters.switchover
alloydb.clusters.update
alloydb.clusters.upgrade
alloydb.databases.
alloydb.instances.
alloydb.locations.
alloydb.operations.
alloydb.supportedDatabaseFlags.
alloydb.users.
roles/alloydb.client
AlloyDB Client

Connectivity access to AlloyDB instances for principals running the AlloyDB Auth Proxy or AlloyDB Language Connectors.

alloydb.clusters.generateClientCertificate
alloydb.clusters.get
alloydb.instances.connect
alloydb.instances.get
roles/alloydb.databaseUser
AlloyDB Database User

IAM-based database user login access to AlloyDB instances and query execution access in AlloyDB Studio.

alloydb.clusters.get
alloydb.instances.executeSql
alloydb.instances.executeSqlReadOnly
alloydb.instances.get
alloydb.users.login
roles/alloydb.viewer
AlloyDB Viewer

Read-only access to all AlloyDB resources.

alloydb.backups.get
alloydb.backups.list
alloydb.backups.listEffectiveTags
alloydb.backups.listTagBindings
alloydb.clusters.export
alloydb.clusters.get
alloydb.clusters.list
alloydb.clusters.listEffectiveTags
alloydb.clusters.listTagBindings
alloydb.databases.get
alloydb.databases.list
alloydb.instances.executeSqlReadOnly
alloydb.instances.get
alloydb.instances.list
alloydb.locations.
alloydb.operations.get
alloydb.operations.list
alloydb.supportedDatabaseFlags.*
alloydb.users.get
alloydb.users.list
roles/alloydb.backupDrAdmin
AlloyDB Admin for BackupDR

Access to manage AlloyDB cluster backups and restores using Backup and DR.

alloydb.clusters.create
alloydb.clusters.get
alloydb.clusters.list
alloydb.instances.create
alloydb.instances.get
alloydb.instances.list
alloydb.operations.get

Required permissions for common tasks

The following table lists the key IAM permissions and predefined roles required for common AlloyDB connection, authentication, and administration tasks:

Task Required AlloyDB permissions Predefined roles that include these permissions
Connect through the AlloyDB Auth Proxy or AlloyDB Language Connectors (required for the principal running the proxy or connector) alloydb.clusters.generateClientCertificate
alloydb.clusters.get
alloydb.instances.connect
alloydb.instances.get		 AlloyDB Client (roles/alloydb.client)
AlloyDB Editor (roles/alloydb.editor)
AlloyDB Admin (roles/alloydb.admin)
Authenticate as an IAM-based database user (IAM_BASED or IAM_GROUP) alloydb.instances.get
alloydb.users.login		 AlloyDB Database User (roles/alloydb.databaseUser)
AlloyDB Editor (roles/alloydb.editor)
AlloyDB Admin (roles/alloydb.admin)
Run SQL queries in AlloyDB Studio alloydb.clusters.get
alloydb.instances.executeSql
alloydb.instances.executeSqlReadOnly
alloydb.instances.get		 AlloyDB Database User (roles/alloydb.databaseUser)
AlloyDB Editor (roles/alloydb.editor)
AlloyDB Admin (roles/alloydb.admin)
Create, update, or delete clusters and instances alloydb.clusters.create
alloydb.clusters.update
alloydb.clusters.delete
alloydb.instances.create
alloydb.instances.update
alloydb.instances.delete
alloydb.operations.get		 AlloyDB Editor (roles/alloydb.editor)
AlloyDB Admin (roles/alloydb.admin)
Create, view, or delete on-demand backups alloydb.backups.create
alloydb.backups.get
alloydb.backups.list
alloydb.backups.delete
alloydb.operations.get		 AlloyDB Editor (roles/alloydb.editor)
AlloyDB Admin (roles/alloydb.admin)
Import or export data between AlloyDB and Cloud Storage alloydb.clusters.import
alloydb.clusters.export
alloydb.operations.get		 AlloyDB Editor (roles/alloydb.editor)
AlloyDB Admin (roles/alloydb.admin)

AlloyDB IAM permissions and their roles

The following table lists each permission that AlloyDB supports and the predefined AlloyDB roles that include it.

Permission AlloyDB roles
alloydb.backups.create AlloyDB Admin
AlloyDB Editor
alloydb.backups.createTagBinding AlloyDB Admin
alloydb.backups.delete AlloyDB Admin
AlloyDB Editor
alloydb.backups.deleteTagBinding AlloyDB Admin
alloydb.backups.get AlloyDB Admin
AlloyDB Editor
AlloyDB Viewer
alloydb.backups.list AlloyDB Admin
AlloyDB Editor
AlloyDB Viewer
alloydb.backups.listEffectiveTags AlloyDB Admin
AlloyDB Editor
AlloyDB Viewer
alloydb.backups.listTagBindings AlloyDB Admin
AlloyDB Editor
AlloyDB Viewer
alloydb.backups.update AlloyDB Admin
AlloyDB Editor
alloydb.clusters.create AlloyDB Admin
AlloyDB Admin for BackupDR
AlloyDB Editor
alloydb.clusters.createTagBinding AlloyDB Admin
alloydb.clusters.delete AlloyDB Admin
AlloyDB Editor
alloydb.clusters.deleteTagBinding AlloyDB Admin
alloydb.clusters.export AlloyDB Admin
AlloyDB Editor
AlloyDB Viewer
alloydb.clusters.generateClientCertificate AlloyDB Admin
AlloyDB Client
AlloyDB Editor
alloydb.clusters.get AlloyDB Admin
AlloyDB Admin for BackupDR
AlloyDB Client
AlloyDB Database User
AlloyDB Editor
AlloyDB Viewer
alloydb.clusters.import AlloyDB Admin
AlloyDB Editor
alloydb.clusters.list AlloyDB Admin
AlloyDB Admin for BackupDR
AlloyDB Editor
AlloyDB Viewer
alloydb.clusters.listEffectiveTags AlloyDB Admin
AlloyDB Editor
AlloyDB Viewer
alloydb.clusters.listTagBindings AlloyDB Admin
AlloyDB Editor
AlloyDB Viewer
alloydb.clusters.promote AlloyDB Admin
AlloyDB Editor
alloydb.clusters.switchover AlloyDB Admin
AlloyDB Editor
alloydb.clusters.update AlloyDB Admin
AlloyDB Editor
alloydb.clusters.upgrade AlloyDB Admin
AlloyDB Editor
alloydb.databases.create AlloyDB Admin
AlloyDB Editor
alloydb.databases.get AlloyDB Admin
AlloyDB Editor
AlloyDB Viewer
alloydb.databases.list AlloyDB Admin
AlloyDB Editor
AlloyDB Viewer
alloydb.instances.connect AlloyDB Admin
AlloyDB Client
AlloyDB Editor
alloydb.instances.create AlloyDB Admin
AlloyDB Admin for BackupDR
AlloyDB Editor
alloydb.instances.delete AlloyDB Admin
AlloyDB Editor
alloydb.instances.executeSql AlloyDB Admin
AlloyDB Database User
AlloyDB Editor
alloydb.instances.executeSqlReadOnly AlloyDB Admin
AlloyDB Database User
AlloyDB Editor
AlloyDB Viewer
alloydb.instances.failover AlloyDB Admin
AlloyDB Editor
alloydb.instances.get AlloyDB Admin
AlloyDB Admin for BackupDR
AlloyDB Client
AlloyDB Database User
AlloyDB Editor
AlloyDB Viewer
alloydb.instances.injectFault AlloyDB Admin
AlloyDB Editor
alloydb.instances.list AlloyDB Admin
AlloyDB Admin for BackupDR
AlloyDB Editor
AlloyDB Viewer
alloydb.instances.restart AlloyDB Admin
AlloyDB Editor
alloydb.instances.update AlloyDB Admin
AlloyDB Editor
alloydb.locations.get AlloyDB Admin
AlloyDB Editor
AlloyDB Viewer
alloydb.locations.list AlloyDB Admin
AlloyDB Editor
AlloyDB Viewer
alloydb.operations.cancel AlloyDB Admin
AlloyDB Editor
alloydb.operations.delete AlloyDB Admin
AlloyDB Editor
alloydb.operations.get AlloyDB Admin
AlloyDB Admin for BackupDR
AlloyDB Editor
AlloyDB Viewer
alloydb.operations.list AlloyDB Admin
AlloyDB Editor
AlloyDB Viewer
alloydb.supportedDatabaseFlags.get AlloyDB Admin
AlloyDB Editor
AlloyDB Viewer
alloydb.supportedDatabaseFlags.list AlloyDB Admin
AlloyDB Editor
AlloyDB Viewer
alloydb.users.create AlloyDB Admin
AlloyDB Editor
alloydb.users.delete AlloyDB Admin
AlloyDB Editor
alloydb.users.get AlloyDB Admin
AlloyDB Editor
AlloyDB Viewer
alloydb.users.list AlloyDB Admin
AlloyDB Editor
AlloyDB Viewer
alloydb.users.login AlloyDB Admin
AlloyDB Database User
AlloyDB Editor
alloydb.users.update AlloyDB Admin
AlloyDB Editor