Access control with IAM

Overview

The Cloud Healthcare API uses Identity and Access Management (IAM) for access control.

In the Cloud Healthcare API, access control can be configured at the project, dataset, or data store level. For example, you can grant access to all datasets within a project to a group of developers. To learn how to set up and use IAM with the Cloud Healthcare API, see Controlling access and Controlling access to other products.

For a detailed description of IAM and its features, see the IAM documentation. In particular, see the section on managing IAM policies.

Every Cloud Healthcare API method requires the caller to have the necessary permissions. See Permissions and Roles for more information.

Permissions

The following tables list the IAM permissions that are associated with the Cloud Healthcare API. Method names are shortened in the table; each method's full name begins with projects.locations..

Consent store method Required permissions
datasets.consentStores.checkDataAccess healthcare.consentStores.checkDataAccess on the requested consent store.
datasets.consentStores.create healthcare.consentStores.create on the parent dataset.
datasets.consentStores.delete healthcare.consentStores.delete on the requested consent store.
datasets.consentStores.evaluateUserConsents healthcare.consentStores.evaluateUserConsents on the requested consent store.
datasets.consentStores.get healthcare.consentStores.get on the requested consent store.
datasets.consentStores.getIamPolicy healthcare.consentStores.getIamPolicy on the requested consent store.
datasets.consentStores.list healthcare.consentStores.list on the parent dataset.
datasets.consentStores.patch healthcare.consentStores.update on the requested consent store.
datasets.consentStores.queryAccessibleData healthcare.consentStores.queryAccessibleData on the requested consent store.
datasets.consentStores.setIamPolicy healthcare.consentStores.setIamPolicy on the requested consent store.
datasets.consentStores.attributeDefinitions.create healthcare.attributeDefinitions.create on the parent consent store.
datasets.consentStores.attributeDefinitions.delete healthcare.attributeDefinitions.delete on the requested attribute definition resource.
datasets.consentStores.attributeDefinitions.get healthcare.attributeDefinitions.get on the requested attribute definition resource.
datasets.consentStores.attributeDefinitions.list healthcare.attributeDefinitions.list on the parent consent store.
datasets.consentStores.attributeDefinitions.patch healthcare.attributeDefinitions.update on the requested attribute definition resource.
datasets.consentStores.consentArtifacts.create healthcare.consentArtifacts.create on the parent consent store.
datasets.consentStores.consentArtifacts.delete healthcare.consentArtifacts.delete on the requested consent artifact resource.
datasets.consentStores.consentArtifacts.get healthcare.consentArtifacts.get on the requested consent artifact resource.
datasets.consentStores.consentArtifacts.list healthcare.consentArtifacts.list on the parent consent store.
datasets.consentStores.consents.create healthcare.consents.create on the parent consent store.
datasets.consentStores.consents.delete healthcare.consents.delete on the requested consent resource.
datasets.consentStores.consents.get healthcare.consents.get on the requested consent resource.
datasets.consentStores.consents.list healthcare.consents.list on the parent consent store.
datasets.consentStores.consents.patch healthcare.consents.update on the requested consent resource.
datasets.consentStores.consents.revoke healthcare.consents.revoke on the requested consent resource.
datasets.consentStores.userDataMappings.archive healthcare.userDataMappings.archive on the requested user data mapping resource.
datasets.consentStores.userDataMappings.create healthcare.userDataMappings.create on the parent consent store.
datasets.consentStores.userDataMappings.delete healthcare.userDataMappings.delete on the requested user data mapping resource.
datasets.consentStores.userDataMappings.get healthcare.userDataMappings.get on the requested user data mapping resource.
datasets.consentStores.userDataMappings.list healthcare.userDataMappings.list on the parent consent store.
datasets.consentStores.userDataMappings.patch healthcare.userDataMappings.update on the requested user data mapping resource.

Dataset methods

Datasets method Required permissions
datasets.create healthcare.datasets.create on the parent Google Cloud project.
datasets.deidentify
  • healthcare.datasets.deidentify on the source dataset.
  • healthcare.datasets.create on the Google Cloud project containing the destination dataset.
datasets.delete healthcare.datasets.delete on the requested dataset.
datasets.get healthcare.datasets.get on the requested dataset.
datasets.getIamPolicy healthcare.datasets.getIamPolicy on the requested dataset.
datasets.list healthcare.datasets.list on the parent Google Cloud project.