Bigtable access control with IAM
This page describes the access control options in Bigtable.
Overview
Bigtable uses Identity and Access Management (IAM) for access control. To control who has what access to which resources, set IAM policies on the resources.
Bigtable resources are organized in a hierarchy. A Google Cloud project is the parent of a Bigtable instance, which is the parent of its clusters and tables. A table is the parent of its authorized views while a cluster is the parent of its backups. You can configure access control at each level.
If you have permissions at a level, then you automatically have permissions below that level. For example, if you have access at the project level, then you have access to the instances, clusters, tables, authorized views, continuous materialized views in that project. If you are granted access to an authorized view or a continuous materialized view, then you don't automatically have access to higher-level resources that are parents of the authorized view or continuous materialized view, such as the table and instance. This behavior is called policy inheritance.
For more information about the IAM hierarchy, see IAM policy inheritance.
Here are some examples of using access control at the project level:
- Allow a user to read from, but not write to, any table within the project.
- Allow a user to read from and write to any table within the project, but not manage instances.
- Allow a user to read from and write to any table within the project, and manage instances.
Examples of using access control at the instance level include the following:
- Allow a user to read from any table in only one instance in a project that has multiple instances.
- Allow a user to manage only one instance in a project that has multiple instances.
Examples of using access control at the table level include the following:
- Allow a user to write to a table but not read from the table.
- Allow a user to read from a table but not write to the table.
Examples of using access control at the backup level include the following:
- Prevent a user from deleting a backup.
- Prevent a user from restoring from the backup.
Examples of using access control at the authorized view level include the following:
- Let a user read an authorized view but not modify it.
- Let a user view data from only one of multiple authorized views of a table.
Examples of using access control at the continuous materialized view level include the following:
- Let a user read from a continuous materialized view but not modify the underlying table.
For more information about IAM and its features, see the IAM developer's guide. In particular, see Granting, Changing, and Revoking Access.
In Bigtable, you cannot grant access to the following types of principals:
For lists of the permissions and roles that Bigtable supports, see the following sections.
Enabling the Bigtable API
To view and assign Bigtable IAM roles, you must enable the Bigtable API for your project. Until you enable the API, the Bigtable roles don't appear in the Google Cloud console.
Roles required to enable APIs
To enable APIs, you need the serviceusage.services.enable permission. If you
created the project, then you likely already have this permission through the
Owner role (roles/owner). Otherwise, you can get this permission through the
Service Usage Admin role (roles/serviceusage.serviceUsageAdmin).
Learn how to grant roles.
Permissions
This section summarizes the permissions that Bigtable supports.
Permissions allow users to perform specific actions on Bigtable
resources. For example, the bigtable.instances.list permissions allows users
to list all of the Bigtable instances within a project. You don't
grant permissions to users directly; instead, you assign each user a predefined
role or custom role, which grants one or more
permissions.
The following tables list the IAM permissions that are associated with Bigtable:
| App profile permission name | Description |
|---|---|
bigtable.appProfiles.create |
Create a Bigtable app profile. |
bigtable.appProfiles.delete |
Delete a Bigtable app profile. |
bigtable.appProfiles.get |
Get information about a Bigtable app profile. |
bigtable.appProfiles.list |
List an instance's Bigtable app profiles. |
bigtable.appProfiles.update |
Update the settings for a Bigtable app profile. |
| Backups permission name | Description |
|---|---|
bigtable.backups.create |
Create a Bigtable backup. |
bigtable.backups.delete |
Delete a Bigtable backup. |
bigtable.backups.get |
Get information about a Bigtable backup. |
bigtable.backups.getIamPolicy |
Get a backup's IAM policy. |
bigtable.backups.list |
List Bigtable backups. |
bigtable.backups.restore |
Restore from a Bigtable backup. |
bigtable.backups.testIamPermissions |
Get the caller's permissions on a specified backup. |
bigtable.backups.read |
Read from a Bigtable backup. |
bigtable.backups.setIamPolicy |
Update backup ACLs. |
bigtable.backups.update |
Modify the expiration of a Bigtable backup. |
| Cluster permission name | Description |
|---|---|
bigtable.clusters.create |
Create a Bigtable cluster. |
bigtable.clusters.delete |
Delete a Bigtable cluster. |
bigtable.clusters.get |
Get information about a Bigtable cluster. |
bigtable.clusters.list |
List an instance's Bigtable clusters. |
bigtable.clusters.update |
Update the settings for a Bigtable cluster. |
| Hot tablets permission name | Description |
|---|---|
bigtable.hotTablets.list |
List hot tablets for a cluster. |
| In-memory tier (Preview) permission name | Description |
|---|---|
bigtable.memoryLayer.get |
View information about a Bigtable in-memory tier. |
bigtable.memoryLayer.list |
List Bigtable in-memory tiers. |
bigtable.memoryLayer.update |
Enable, deactivate, or resize Bigtable in-memory tier. |
| Instance permission name | Description |
|---|---|
bigtable.instances.create |
Create a Bigtable instance. |
bigtable.instances.createTagBinding |
Create a tag. |
bigtable.instances.delete |
Delete a Bigtable instance. |
bigtable.instances.deleteTagBinding |
Delete a tag. |
bigtable.instances.get |
Get information about a Bigtable instance. |
bigtable.instances.getIamPolicy |
Get an instance's IAM policy. |
bigtable.instances.list |
List a project's Bigtable instances. |
bigtable.instances.listEffectiveTagBindings |
List all tags in effect for an instance. |
bigtable.instances.listTagBindings |
List an instance's tags. |
bigtable.instances.ping |
Send channel priming requests. |
bigtable.instances.executeQuery |
Send ExecuteQuery and PrepareQuery requests to an instance. |
bigtable.instances.setIamPolicy |
Update ACLs. |
bigtable.instances.update |
Update the settings for a Bigtable instance. |
| Key Visualizer permission name | Description |
|---|---|
bigtable.keyvisualizer.get |
Get Key Visualizer information about a table, including metadata about access patterns and row key distributions. |
bigtable.keyvisualizer.list |
List available Key Visualizer information for a table. |
| Location permission name | Description |
|---|---|
bigtable.locations.list |
List Bigtable locations. |
| Table permission name | Description |
|---|---|
bigtable.tables.checkConsistency |
Check if a replicated table is up to date. |
bigtable.tables.create |
Create a table. |
bigtable.tables.delete |
Delete a table. |
bigtable.tables.generateConsistencyToken |
Generate token to check if a replicated table is up to date. |
bigtable.tables.get |
Get information about a table, including column families and their individual settings. |
bigtable.tables.getIamPolicy |
Get a table's IAM policy. |
bigtable.tables.list |
List tables in an instance. |
bigtable.tables.mutateRows |
Modify rows within a table, or truncate the table. |
bigtable.tables.readRows |
Read rows from a table. This includes information about the table, such as column families and their individual settings. |
bigtable.tables.sampleRowKeys |
Get a sample of the row keys that are used in a table. |
bigtable.tables.setIamPolicy |
Update table ACLs. |
bigtable.tables.undelete |
Recover a deleted table. |
bigtable.tables.update |
Update the settings for a table, including column families and their individual settings. |
| Location permission name | Description |
|---|---|
bigtable.locations.list |
List Bigtable locations. |
| Authorized view permission name | Description |
|---|---|
bigtable.authorizedViews.create |
Create an authorized view. |
bigtable.authorizedViews.delete |
Delete an authorized view. |
bigtable.authorizedViews.get |
Get information about an authorized view. |
bigtable.authorizedViews.getIamPolicy |
Get an authorized view's IAM policy. |
bigtable.authorizedViews.list |
List authorized views in a table. |
bigtable.authorizedViews.mutateRows |
Modify rows within an authorized view. |
bigtable.authorizedViews.readRows |
Read rows from an authorized view. |
bigtable.authorizedViews.sampleRowKeys |
Get a sample of the row keys that are used in an authorized view. |
bigtable.authorizedViews.setIamPolicy |
Update access control policies for an authorized view. |
bigtable.authorizedViews.update |
Update the settings for an authorized view. |
| Continuous materialized view permission name | Description |
|---|---|
bigtable.materializedViews.create |
Create a continuous materialized view. |
bigtable.materializedViews.delete |
Delete a continuous materialized view. |
bigtable.materializedViews.get |
Get information about a continuous materialized view. |
bigtable.materializedViews.getIamPolicy |
Get a continuous materialized view's IAM policy. |
bigtable.materializedViews.list |
List continuous materialized views in an instance. |
bigtable.materializedViews.readRows |
Read rows from a continuous materialized view. |
bigtable.materializedViews.sampleRowKeys |
Get a sample of the row keys that are used in a continuous materialized view. |
bigtable.materializedViews.setIamPolicy |
Update access control policies for a continuous materialized view. |
bigtable.materializedViews.update |
Update the settings for a continuous materialized view. |
Predefined roles
Each predefined role is a bundle of one or more permissions. For
example, roles/bigtable.reader provides read-only access to information about
Bigtable instances, clusters, tables, and column families, as well
as the data contained within your tables. You assign roles to users or groups,
which allows them to perform actions on the resources in your project.
The following table lists the predefined roles for Bigtable, including a list of the permissions associated with each role:
| Role | Permissions |
|---|---|
Bigtable Administrator( Administers all Bigtable instances within a project, including the data stored within tables. Can create new instances. Intended for project administrators. Lowest-level resources where you can grant this role:
|
|
Bigtable Editor( Editor role for bigtable |
|
Bigtable User( Provides read-write access to the data stored within Bigtable tables. Intended for application developers or service accounts. Lowest-level resources where you can grant this role:
|
|
Bigtable Viewer( Provides no data access. Intended as a minimal set of permissions to access the Google Cloud console for Bigtable. Lowest-level resources where you can grant this role:
|
|
Bigtable Reader( Provides read-only access to the data stored within Bigtable tables. Intended for data scientists, dashboard generators, and other data-analysis scenarios. Lowest-level resources where you can grant this role:
|
|
Custom roles
If the predefined roles for Bigtable don't address your business requirements, you can define your own custom roles with permissions that you specify.
If your custom role needs to support access to the Google Cloud console, you must identify the tasks that users will perform, then ensure that the custom role has the required permissions for each task, as shown in the following table. If a custom role does not have all of the required permissions for a task, and a user tries to perform that task, the Google Cloud console won't work correctly.
| Google Cloud console task | Required permissions |
|---|---|
| Basic access to the Google Cloud console |
|
| Create an instance or cluster |
Basic access permissions, plus:
|
| Modify an instance or cluster |
Basic access permissions, plus:
|
| Manage replication configuration |
Basic access permissions, plus:
|
| Delete an instance or cluster |
Basic access permissions, plus: |