Identity and Access Management (IAM) lets you manage access to Cloud Scheduler
resources by granting specific permissions to principals, such as users,
groups, and service accounts. You can assign predefined or custom roles to
control who can view, configure, and run scheduled jobs.

## Overview

Cloud Scheduler uses IAM for access control.

For an introduction to IAM and its features, see the
[IAM overview](https://docs.cloud.google.com/iam/docs/overview.md.txt). To learn how to grant and
revoke access, see
[Manage access to projects, folders, and organizations](https://docs.cloud.google.com/iam/docs/granting-changing-revoking-access.md.txt).

For lists of the permissions and roles that Cloud Scheduler
supports, see the following sections.

## Enable the Cloud Scheduler API

To view and assign IAM roles for Cloud Scheduler,
you must enable the Cloud Scheduler API for your project. You won't be able to
see the Cloud Scheduler roles in the Google Cloud console
until you enable the API.

<br />

**Roles required to enable APIs**


To enable APIs, you need the `serviceusage.services.enable` permission. If you
created the project, then you likely already have this permission through the
Owner role (`roles/owner`). Otherwise, you can get this permission through the
Service Usage Admin role (`roles/serviceusage.serviceUsageAdmin`).
[Learn how to grant roles](https://docs.cloud.google.com/iam/docs/granting-changing-revoking-access.md.txt).

[Enable the API](https://console.cloud.google.com/apis/enableflow?apiid=cloudscheduler.googleapis.com&redirect=https://console.cloud.google.com)

## Predefined roles

The following table lists the Cloud Scheduler predefined
IAM roles with a corresponding list of all the permissions each
role includes.

The predefined roles address most typical use cases. If your use case isn't
covered by the predefined roles, you can
[create an IAM custom role](https://docs.cloud.google.com/iam/docs/understanding-custom-roles).

### Cloud Scheduler roles

| Role | Permissions |
|---|---|
| #### Cloud Scheduler Admin (`roles/cloudscheduler.admin`) Full access to jobs and executions. Note that a Cloud Scheduler Admin (or any custom role with the permission cloudscheduler.jobs.create) can create jobs that publish to any Pub/Sub topics within the project. Lowest-level resources where you can grant this role: - Project | `appengine.applications.get` `cloudscheduler.*` - `cloudscheduler.jobs.create` - `cloudscheduler.jobs.delete` - `cloudscheduler.jobs.enable` - `cloudscheduler.jobs.fullView` - `cloudscheduler.jobs.get` - `cloudscheduler.jobs.list` - `cloudscheduler.jobs.pause` - `cloudscheduler.jobs.run` - `cloudscheduler.jobs.update` - `cloudscheduler.locations.get` - `cloudscheduler.locations.list` `resourcemanager.projects.get` `resourcemanager.projects.list` `serviceusage.catalogs.listMembers` `serviceusage.consumerpolicy.analyze` `serviceusage.consumerpolicy.get` `serviceusage.effectivepolicy.get` `serviceusage.groups.*` - `serviceusage.groups.list` - `serviceusage.groups.listExpandedMembers` - `serviceusage.groups.listMembers` `serviceusage.services.get` `serviceusage.services.list` `serviceusage.services.listApis` `serviceusage.services.listDependentServices` `serviceusage.values.test` |
| #### Cloud Scheduler Viewer (`roles/cloudscheduler.viewer`) Get and list access to jobs, executions, and locations. Lowest-level resources where you can grant this role: - Project | `appengine.applications.get` `cloudscheduler.jobs.fullView` `cloudscheduler.jobs.get` `cloudscheduler.jobs.list` `cloudscheduler.locations.*` - `cloudscheduler.locations.get` - `cloudscheduler.locations.list` `resourcemanager.projects.get` `resourcemanager.projects.list` `serviceusage.catalogs.listMembers` `serviceusage.consumerpolicy.analyze` `serviceusage.consumerpolicy.get` `serviceusage.effectivepolicy.get` `serviceusage.groups.*` - `serviceusage.groups.list` - `serviceusage.groups.listExpandedMembers` - `serviceusage.groups.listMembers` `serviceusage.services.get` `serviceusage.services.list` `serviceusage.services.listApis` `serviceusage.services.listDependentServices` `serviceusage.values.test` |
| #### Cloud Scheduler Job Runner (`roles/cloudscheduler.jobRunner`) Access to run jobs. Lowest-level resources where you can grant this role: - Project | `appengine.applications.get` `cloudscheduler.jobs.fullView` `cloudscheduler.jobs.run` `resourcemanager.projects.get` `resourcemanager.projects.list` `serviceusage.catalogs.listMembers` `serviceusage.consumerpolicy.analyze` `serviceusage.consumerpolicy.get` `serviceusage.effectivepolicy.get` `serviceusage.groups.*` - `serviceusage.groups.list` - `serviceusage.groups.listExpandedMembers` - `serviceusage.groups.listMembers` `serviceusage.services.get` `serviceusage.services.list` `serviceusage.services.listApis` `serviceusage.services.listDependentServices` `serviceusage.values.test` |

### Service agent roles


Service agent roles should only be granted to [service agents](https://docs.cloud.google.com/iam/docs/service-agents.md.txt).

| Role | Permissions |
|---|---|
| #### Cloud Scheduler Service Agent (`roles/cloudscheduler.serviceAgent`) Grants Cloud Scheduler Service Account access to manage resources. > [!WARNING] > **Warning:** Do not grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents.md.txt). | `iam.serviceAccounts.getAccessToken` `iam.serviceAccounts.getOpenIdToken` `logging.logEntries.create` `logging.logEntries.route` `pubsub.topics.publish` |

## Project-level IAM management

At the project level, or through inheritance from a folder or organization, you
can grant, change, and revoke IAM roles using the
Google Cloud console, the IAM API, or the Google Cloud CLI. For
more information, see
[Manage access to projects, folders, and organizations](https://docs.cloud.google.com/iam/docs/granting-changing-revoking-access.md.txt).

Cloud Scheduler doesn't support resource-level IAM
policies or
[IAM Conditions resource attributes](https://docs.cloud.google.com/iam/docs/conditions-resource-attributes.md.txt)
on individual jobs. Any Cloud Scheduler role granted to a principal
applies to all jobs in the project:

- To restrict which principals can view, modify, or run specific jobs, create
  those jobs in separate projects.

- To restrict which target resources an individual HTTP target job can invoke
  when it runs, configure the job with a dedicated
  [user-managed service account](https://docs.cloud.google.com/scheduler/docs/http-target-auth.md.txt#set-up-sa)
  that has only the permissions needed for that target. Principals who create
  or update the job must also have the `iam.serviceAccounts.actAs` permission
  on that service account, which you can grant on individual service accounts
  using the
  [Service Account User](https://docs.cloud.google.com/iam/docs/roles-permissions/iam.md.txt#iam.serviceAccountUser)
  role (`roles/iam.serviceAccountUser`).