Database Migration Service IAM roles and permissions for AlloyDB for PostgreSQL

Database Migration Service uses IAM (IAM) roles and permissions to manage access to your migration resources.

Accounts involved in data migration

When you perform homogeneous PostgreSQL migrations to AlloyDB for PostgreSQL with Database Migration Service, the following accounts are involved in the migration process:

User account that performs the migration
This is the Google Account that you sign in with to create connection profiles, create and run the migration job, and manage destination AlloyDB for PostgreSQL resources.
Database Migration Service service account
This is the service account that is created for you when you enable the Database Migration Service API. The email address associated with this account is generated automatically and can't be changed. This email address uses the following format: 
service-PROJECT_NUMBER@gcp-sa-datamigration.iam.gserviceaccount.com

Each account involved in the data migration process requires a specific set of roles and permissions.

Permissions and roles

To get the permissions that you need to perform continuous migrations to AlloyDB for PostgreSQL with Database Migration Service, ask your administrator to grant the required IAM roles on your project for the following accounts:

For more information about granting roles, see Manage access.

These predefined roles contain the permissions required to perform homogeneous PostgreSQL migrations to AlloyDB for PostgreSQL with Database Migration Service. To see the exact permissions that are required, expand the Required permissions section:

Required permissions

The following permissions are required to perform homogeneous PostgreSQL migrations to AlloyDB for PostgreSQL with Database Migration Service:

  • User account that performs the migration:
    • datamigration.*
    • resourcemanager.projects.get
    • resourcemanager.projects.list
    • alloydb.operations.get
    • alloydb.clusters.create
    • alloydb.clusters.get
    • alloydb.clusters.list
    • alloydb.clusters.update
    • alloydb.clusters.delete
    • alloydb.instances.create
    • alloydb.instances.get
    • alloydb.instances.list
    • alloydb.instances.update
    • alloydb.instances.delete
    • alloydb.users.list
    • alloydb.users.get
    • alloydb.users.create
    • alloydb.users.update
    • alloydb.users.delete
    • compute.networks.get
    • compute.networks.list
    • compute.subnetworks.get
    • compute.subnetworks.list
  • Database Migration Service service account:
    • datamigration.*
    • resourcemanager.projects.get
    • resourcemanager.projects.list
    • alloydb.clusters.create
    • alloydb.clusters.get
    • alloydb.clusters.list
    • alloydb.clusters.update
    • alloydb.instances.create
    • alloydb.instances.get
    • alloydb.instances.list
    • alloydb.instances.update
    • alloydb.instances.executeSql
    • alloydb.operations.get

You might also be able to get these permissions with custom roles or other predefined roles.