Cloud Deployment Manager reached end of support on March 31, 2026. If you currently use Deployment Manager, please migrate to Infrastructure Manager or an alternative deployment technology.
Access control with IAM
Stay organized with collections
Save and categorize content based on your preferences.
By default, all Google Cloud console projects come with a single user:
the original project creator. No other users have access to the project, and
therefore, access to Google Cloud resources, until a user is added as
a project team member. This page describes the different ways you can add new
users to your project.
It also describes how Deployment Manager authenticates to other
Google Cloud APIs on your behalf to create resources.
To give your users access to your project so they can create configurations and
deployments, add your users as a project team member and grant them the
appropriate Identity and Access Management (IAM) roles.
For information on how to add team members, read the
documentation for adding team members.
Deployment Manager roles
Role
Permissions
Deployment Manager Admin
(roles/deploymentmanager.admin)
Admin role for Deployment Manager.
deploymentmanager.*
deploymentmanager.compositeTypes.create
deploymentmanager.compositeTypes.delete
deploymentmanager.compositeTypes.get
deploymentmanager.compositeTypes.list
deploymentmanager.compositeTypes.update
deploymentmanager.deployments.cancelPreview
deploymentmanager.deployments.create
deploymentmanager.deployments.delete
deploymentmanager.deployments.get
deploymentmanager.deployments.getIamPolicy
deploymentmanager.deployments.list
deploymentmanager.deployments.setIamPolicy
deploymentmanager.deployments.stop
deploymentmanager.deployments.update
deploymentmanager.manifests.get
deploymentmanager.manifests.list
deploymentmanager.operations.get
deploymentmanager.operations.list
deploymentmanager.resources.get
deploymentmanager.resources.list
deploymentmanager.typeProviders.create
deploymentmanager.typeProviders.delete
deploymentmanager.typeProviders.get
deploymentmanager.typeProviders.getType
deploymentmanager.typeProviders.list
deploymentmanager.typeProviders.listTypes
deploymentmanager.typeProviders.update
deploymentmanager.types.create
deploymentmanager.types.delete
deploymentmanager.types.get
deploymentmanager.types.list
deploymentmanager.types.update
resourcemanager.projects.get
resourcemanager.projects.list
serviceusage.consumerpolicy.analyze
serviceusage.consumerpolicy.get
serviceusage.effectivepolicy.get
serviceusage.groups.*
serviceusage.groups.list
serviceusage.groups.listExpandedMembers
serviceusage.groups.listMembers
serviceusage.quotas.get
serviceusage.services.get
serviceusage.services.list
serviceusage.values.test
Deployment Manager Editor
(roles/deploymentmanager.editor)
Provides the permissions necessary to create and manage deployments.
Lowest-level resources where you can grant this role:
Project
deploymentmanager.compositeTypes.*
deploymentmanager.compositeTypes.create
deploymentmanager.compositeTypes.delete
deploymentmanager.compositeTypes.get
deploymentmanager.compositeTypes.list
deploymentmanager.compositeTypes.update
deploymentmanager.deployments.cancelPreview
deploymentmanager.deployments.create
deploymentmanager.deployments.delete
deploymentmanager.deployments.get
deploymentmanager.deployments.list
deploymentmanager.deployments.stop
deploymentmanager.deployments.update
deploymentmanager.manifests.*
deploymentmanager.manifests.get
deploymentmanager.manifests.list
deploymentmanager.operations.*
deploymentmanager.operations.get
deploymentmanager.operations.list
deploymentmanager.resources.*
deploymentmanager.resources.get
deploymentmanager.resources.list
deploymentmanager.typeProviders.*
deploymentmanager.typeProviders.create
deploymentmanager.typeProviders.delete
deploymentmanager.typeProviders.get
deploymentmanager.typeProviders.getType
deploymentmanager.typeProviders.list
deploymentmanager.typeProviders.listTypes
deploymentmanager.typeProviders.update
deploymentmanager.types.*
deploymentmanager.types.create
deploymentmanager.types.delete
deploymentmanager.types.get
deploymentmanager.types.list
deploymentmanager.types.update
resourcemanager.projects.get
resourcemanager.projects.list
serviceusage.consumerpolicy.analyze
serviceusage.consumerpolicy.get
serviceusage.effectivepolicy.get
serviceusage.groups.*
serviceusage.groups.list
serviceusage.groups.listExpandedMembers
serviceusage.groups.listMembers
serviceusage.quotas.get
serviceusage.services.get
serviceusage.services.list
serviceusage.values.test
Deployment Manager Viewer
(roles/deploymentmanager.viewer)
Provides read-only access to all Deployment Manager-related
resources.
Lowest-level resources where you can grant this role:
Project
deploymentmanager.compositeTypes.get
deploymentmanager.compositeTypes.list
deploymentmanager.deployments.get
deploymentmanager.deployments.list
deploymentmanager.manifests.*
deploymentmanager.manifests.get
deploymentmanager.manifests.list
deploymentmanager.operations.*
deploymentmanager.operations.get
deploymentmanager.operations.list
deploymentmanager.resources.*
deploymentmanager.resources.get
deploymentmanager.resources.list
deploymentmanager.typeProviders.get
deploymentmanager.typeProviders.getType
deploymentmanager.typeProviders.list
deploymentmanager.typeProviders.listTypes
deploymentmanager.types.get
deploymentmanager.types.list
resourcemanager.projects.get
resourcemanager.projects.list
serviceusage.consumerpolicy.analyze
serviceusage.consumerpolicy.get
serviceusage.effectivepolicy.get
serviceusage.groups.*
serviceusage.groups.list
serviceusage.groups.listExpandedMembers
serviceusage.groups.listMembers
serviceusage.quotas.get
serviceusage.services.get
serviceusage.services.list
serviceusage.values.test
Deployment Manager Type Editor
(roles/deploymentmanager.typeEditor)
Provides read and write access to all Type Registry resources.
Lowest-level resources where you can grant this role:
