Configure access control for Producer Portal users

This page describes the Identity and Access Management (IAM) roles and permissions that you'll need to grant to members of your team who use Producer Portal.

Note: IAM basic roles, such as the Project Editor role (roles/editor), might enable users to perform necessary tasks, but we recommend that you only grant the minimal necessary roles. You shouldn't grant basic roles in a production environment, although you can grant them in a development or test environment.

For more information about granting access to roles and resources, see the IAM documentation on Granting, changing, and revoking access to resources. If you don't have the permissions you need to grant roles, contact your organization's administrator and request access.

Access control for managing projects

For users to manage your Google Cloud Partner Network account and your organization-level settings, grant them one of the following two roles:

• Commerce Business Enablement Configuration Admin (roles/commercebusinessenablement.admin)

• Commerce Business Enablement Configuration Viewer (roles/commercebusinessenablement.viewer)

Access control for viewing product listings

For users to view in-progress product listings that you create in Producer Portal, grant them the Commerce Producer Viewer role.

Access control for creating and managing product listings

For users to create and manage product listings in Producer Portal, grant them the following roles:

• Commerce Producer Admin
• Service Management API Administrator

Note: The Commerce Producer Admin role provides full access to all resources for your products.

Additional roles for software as a service (SaaS) products

For SaaS products, where you need to create a service account to interact with the Cloud Commerce Consumer Procurement API and report usage to us, grant your users the Service Account Admin role.

Additional roles for virtual machine (VM) and Kubernetes products

For VM or Kubernetes products, grant your users the Compute Cloud Storage Admin role.

VM guided configuration to create your VM product's deployment package, grant your users the following roles for the Cloud Storage bucket where you store your product's deployment package:

• Cloud Storage Object Viewer
• Cloud Storage Object Creator

Access control for previewing products

If you want users to be able to preview your product's listing as your customers see it in Cloud Marketplace, you must grant them the following role:

• Service Management API Consumer

Manage private offers

For users to create and manage private offers in the Private offers tab of Producer Portal, grant them the following roles:

• Commerce Price Management Private Offers Admin
• Commerce Producer Viewer

View key events for private offers

For users to view the history of an offer that your organization has published, grant them the Commerce Price Management Events Viewer role.

Manage disbursements and payments

For users to create payment profiles to manage disbursement and payment settings in the Payments tab of Producer Portal, grant them the following roles:

• Commerce Business Enablement PaymentConfig Admin
• Commerce Producer Viewer

Note: These roles enable users to create payment profiles. To add users to an existing payment profile, see Controlling access to payment profiles.

Access control for reselling

If you've allowed resellers to resell your Cloud Marketplace products, you can refer to the following guidelines for granting roles within your Google Cloud organization.

View allowed and disallowed resellers

For users to view which resellers are allowed to resell your Cloud Marketplace products, or which resellers have been disallowed from reselling your products, grant them one of the following roles:

• Commerce Business Enablement Configuration Viewer (roles/commercebusinessenablement.viewer)
• Commerce Business Enablement Configuration Admin (roles/commercebusinessenablement.admin)

Manage allowed resellers

For users to manage which resellers are allowed to resell your Cloud Marketplace products, grant them the Commerce Business Enablement Configuration Admin (roles/commercebusinessenablement.admin) role.

View reseller discounts

For users to view resources and configurations related to reseller discounts in Producer Portal, grant them the following roles:

• Commerce Business Enablement Reseller Discount Viewer (roles/commercebusinessenablement.resellerDiscountViewer)

• Commerce Price Management Viewer (roles/commercepricemanagement.viewer)

Manage discounts

For users to create and manage resources and configurations related to reseller discounts in Producer Portal, grant them the following roles:

• Commerce Business Enablement Reseller Discount Admin (roles/commercebusinessenablement.resellerDiscountAdmin)

• Commerce Price Management Viewer (roles/commercepricemanagement.viewer)

Manage analytics and reports

To let users manage analytics, test accounts, sales lead management, and reports for your products in the Analytics, Test billing accounts, Sales lead management, and Reports tabs of Producer Portal, grant them the following roles:

• Commerce Business Enablement Configuration Admin (roles/commercebusinessenablement.admin)

• Commerce Producer Viewer (roles/commerceproducer.viewer)

• Project Viewer (roles/viewer)

List of IAM roles and permissions

You can grant users one or more of the following IAM roles.

Role	Permissions
Commerce Business Enablement Configuration Admin ^Beta (roles/commercebusinessenablement.admin) Admin of Various Provider Configuration resources	bigquery.datasets.create bigquery.datasets.get bigquery.datasets.update commercebusinessenablement.leadgenConfig.* commercebusinessenablement.leadgenConfig.get commercebusinessenablement.leadgenConfig.update commercebusinessenablement.partnerAccounts.* commercebusinessenablement.partnerAccounts.get commercebusinessenablement.partnerAccounts.list commercebusinessenablement.partnerInfo.get commercebusinessenablement.resellerConfig.* commercebusinessenablement.resellerConfig.get commercebusinessenablement.resellerConfig.update commercebusinessenablement.resellerRestrictions.* commercebusinessenablement.resellerRestrictions.list commercebusinessenablement.resellerRestrictions.update resourcemanager.organizations.get resourcemanager.projects.get resourcemanager.projects.list serviceusage.operations.get serviceusage.services.enable serviceusage.services.get
Commerce Business Enablement Configuration Viewer ^Beta (roles/commercebusinessenablement.viewer) Viewer of Various Provider Configuration resource	commercebusinessenablement.leadgenConfig.get commercebusinessenablement.partnerAccounts.* commercebusinessenablement.partnerAccounts.get commercebusinessenablement.partnerAccounts.list commercebusinessenablement.partnerInfo.get commercebusinessenablement.resellerConfig.get commercebusinessenablement.resellerRestrictions.list resourcemanager.organizations.get resourcemanager.projects.get resourcemanager.projects.list
Commerce Business Enablement PaymentConfig Admin ^Beta (roles/commercebusinessenablement.paymentConfigAdmin) Administration of Payment Configuration resource	commercebusinessenablement.partnerInfo.get commercebusinessenablement.paymentConfig.* commercebusinessenablement.paymentConfig.get commercebusinessenablement.paymentConfig.update resourcemanager.projects.get resourcemanager.projects.list
Commerce Business Enablement PaymentConfig Viewer ^Beta (roles/commercebusinessenablement.paymentConfigViewer) Viewer of Payment Configuration resource	commercebusinessenablement.partnerInfo.get commercebusinessenablement.paymentConfig.get resourcemanager.projects.get resourcemanager.projects.list
Commerce Business Enablement Rebates Admin ^Beta (roles/commercebusinessenablement.rebatesAdmin) Provides admin access to rebates	commercebusinessenablement.operations.* commercebusinessenablement.operations.cancel commercebusinessenablement.operations.delete commercebusinessenablement.operations.get commercebusinessenablement.operations.list commercebusinessenablement.partnerInfo.get commercebusinessenablement.refunds.* commercebusinessenablement.refunds.cancel commercebusinessenablement.refunds.create commercebusinessenablement.refunds.delete commercebusinessenablement.refunds.get commercebusinessenablement.refunds.list commercebusinessenablement.refunds.start commercebusinessenablement.refunds.update
Commerce Business Enablement Rebates Viewer ^Beta (roles/commercebusinessenablement.rebatesViewer) Provides read-only access to rebates	commercebusinessenablement.operations.get commercebusinessenablement.operations.list commercebusinessenablement.partnerInfo.get commercebusinessenablement.refunds.get commercebusinessenablement.refunds.list
Commerce Business Enablement Reseller Discount Admin ^Beta (roles/commercebusinessenablement.resellerDiscountAdmin) Provides admin access to reseller discount offers	commercebusinessenablement.partnerAccounts.* commercebusinessenablement.partnerAccounts.get commercebusinessenablement.partnerAccounts.list commercebusinessenablement.partnerInfo.get commercebusinessenablement.resellerConfig.get commercebusinessenablement.resellerDiscountConfig.get commercebusinessenablement.resellerDiscountOffers.* commercebusinessenablement.resellerDiscountOffers.cancel commercebusinessenablement.resellerDiscountOffers.create commercebusinessenablement.resellerDiscountOffers.list commercebusinessenablement.resellerPrivateOfferPlans.* commercebusinessenablement.resellerPrivateOfferPlans.cancel commercebusinessenablement.resellerPrivateOfferPlans.create commercebusinessenablement.resellerPrivateOfferPlans.delete commercebusinessenablement.resellerPrivateOfferPlans.get commercebusinessenablement.resellerPrivateOfferPlans.list commercebusinessenablement.resellerPrivateOfferPlans.publish commercebusinessenablement.resellerPrivateOfferPlans.update resourcemanager.organizations.get resourcemanager.projects.get resourcemanager.projects.list
Commerce Business Enablement Reseller Discount Viewer ^Beta (roles/commercebusinessenablement.resellerDiscountViewer) Provides read-only access to reseller discount offers	commercebusinessenablement.partnerAccounts.* commercebusinessenablement.partnerAccounts.get commercebusinessenablement.partnerAccounts.list commercebusinessenablement.partnerInfo.get commercebusinessenablement.resellerConfig.get commercebusinessenablement.resellerDiscountConfig.get commercebusinessenablement.resellerDiscountOffers.list commercebusinessenablement.resellerPrivateOfferPlans.get commercebusinessenablement.resellerPrivateOfferPlans.list resourcemanager.organizations.get resourcemanager.projects.get resourcemanager.projects.list