Access control with Identity and Access Management

This document describes the access control options available to you in Pub/Sub.

Overview

Pub/Sub uses Identity and Access Management (IAM) for access control.

IAM allows you to grant specific roles to users, groups, and service accounts, giving them the necessary permissions to perform their tasks. You can grant these IAM roles using the Google Cloud console or the IAM API.

In Pub/Sub, access control can be configured at the project level and at the individual resource level. Here are some examples for using Pub/Sub access control:

  • Grant access on a per-resource basis, rather than for the whole Cloud project.

  • Grant access with limited capabilities, such as to only publish messages to a topic, or to only consume messages from a subscription, but not to delete the topic or subscription.

  • Grant access to all Pub/Sub resources within a project to a group of developers.

If you have view-only access to a single resource such as a topic or a subscription, you cannot view the resource using the Google Cloud console. Instead, you can use Google Cloud CLI to view the resource.

For a detailed description of IAM and its features, see the IAM documentation. In particular, see Granting, changing, and revoking access to resources.

Types of roles in Pub/Sub

Similar to other Google Cloud products, Pub/Sub supports three types of roles:

  • Basic roles: Basic roles are highly permissive roles that existed prior to the introduction of IAM. For more information about basic roles, see Basic roles.

  • Predefined roles: Predefined roles give granular access to specific Google Cloud resources. For more information about predefined roles, see Predefined roles. The Pub/Sub predefined roles are included in a later part of this section.

  • Custom roles: Custom roles help you enforce the principle of least privilege. For more information about custom roles, see Custom roles.

Required Pub/Sub permissions

The following sections list Pub/Sub permissions required for accessing different Pub/Sub resources.

Required permissions for topics

The following table outlines the required permissions for each Pub/Sub API method related to topics. It shows which IAM permission is needed to call each method, along with a description of what the method does.

Method Description Required permission
projects.topics.create Creates the given topic with the given name. pubsub.topics.create on the containing Cloud project
projects.topics.delete Deletes the topic with the given name. pubsub.topics.delete on the requested topic
projects.topics.get Gets the configuration of a topic. pubsub.topics.get on the requested topic
projects.topics.getIamPolicy Gets the IAM access control policy for a topic. pubsub.topics.getIamPolicy on the requested topic
projects.topics.list Lists all topics. pubsub.topics.list on the requested Cloud project
projects.topics.patch Updates an existing topic. pubsub.topics.update on the requested topic
projects.topics.publish Adds one or more messages to the topic. pubsub.topics.publish on the requested topic
projects.topics.setIamPolicy Sets the IAM access control policy for a topic. pubsub.topics.setIamPolicy on the requested topic
projects.topics.testIamPermissions Returns permissions that a caller has on the specified resource. None

Required permissions for subscriptions

The following table outlines the required permissions for each Pub/Sub API method related to subscriptions. It shows which IAM permission is needed to call each method, along with a description of what the method does.

Method Description Required permission
projects.subscriptions.acknowledge Acknowledges the messages associated with the ack_ids in the AcknowledgeRequest. pubsub.subscriptions.consume on the requested subscription
projects.subscriptions.create Creates a subscription to a given topic. pubsub.subscriptions.create on the containing Cloud project and pubsub.topics.attachSubscription on the requested topic. For creating a Subscription S in Project A that is attached to a Topic T in Project B, the appropriate permissions must be granted on both Project A and on Topic T. In this case, user identity info can be captured in Project B's audit logs.
projects.subscriptions.delete Deletes an existing subscription. pubsub.subscriptions.delete on the requested subscription
projects.subscriptions.detach Detaches a subscription from a topic. pubsub.topics.detachSubscription on the topic that the subscription is attached to.
projects.subscriptions.get Gets the configuration details of a subscription. pubsub.subscriptions.get on the requested subscription
projects.subscriptions.getIamPolicy Gets the IAM access control policy for a subscription. pubsub.subscriptions.getIamPolicy on the requested subscription
projects.subscriptions.list Lists matching subscriptions. pubsub.subscriptions.list on the requested Cloud project
projects.subscriptions.modifyAckDeadline Modifies the ack deadline for a specific message. pubsub.subscriptions.consume on the requested subscription
projects.subscriptions.modifyPushConfig Modifies the pushConfig for a specified subscription. pubsub.subscriptions.update on the requested subscription
projects.subscriptions.patch Updates an existing subscription. pubsub.subscriptions.update on the requested subscription
projects.subscriptions.pull Pulls messages from the server. pubsub.subscriptions.consume on the requested subscription
projects.subscriptions.seek Seeks an existing subscription to a point in time or a snapshot. pubsub.subscriptions.consume on the requested subscription and pubsub.snapshots.seek on the requested snapshot, if any.
projects.subscriptions.setIamPolicy Sets the IAM access control policy for a subscription. pubsub.subscriptions.setIamPolicy on the requested subscription
projects.subscriptions.testIamPermissions Returns permissions that a caller has on the specified resource. None

Required permissions for schemas

The following table outlines the required permissions for each Pub/Sub API method related to schemas. It shows which IAM permission is needed to call each method, along with a description of what the method does.

Method Description Required permission
projects.schemas.commit Commits a new schema revision. pubsub.schemas.commit on the requested schema
projects.schemas.create Creates a schema. pubsub.schemas.create on the containing Cloud project
projects.schemas.delete Deletes a schema. pubsub.schemas.delete on the requested schema
projects.schemas.deleteRevision Deletes a specific schema revision. pubsub.schemas.delete on the requested schema
projects.schemas.get Gets a schema. pubsub.schemas.get on the requested schema
projects.schemas.getIamPolicy Gets the IAM access control policy for a schema. pubsub.schemas.getIamPolicy on the requested schema
projects.schemas.list Lists schemas in a project. pubsub.schemas.list on the requested Cloud project
projects.schemas.listRevisions Lists all schema revisions for the named schema. pubsub.schemas.listRevisions on the requested schema
projects.schemas.rollback Creates a new schema revision from a previous revision. pubsub.schemas.rollback on the requested schema
projects.schemas.validate Validates a schema definition. pubsub.schemas.validate on the containing Cloud project
projects.schemas.validateMessage Validates a message against a schema. pubsub.schemas.validate on the containing Cloud project

Required permissions for snapshots

The following table outlines the required permissions for each Pub/Sub API method related to snapshots. It shows which IAM permission is needed to call each method, along with a description of what the method does.

REST method Description Required permission
projects.snapshots.create Creates a snapshot from the requested subscription. pubsub.snapshots.create on the containing Cloud project and pubsub.subscriptions.consume permission on the source subscription.
projects.snapshots.delete Removes an existing snapshot. pubsub.snapshots.delete on the requested snapshot
projects.snapshots.getIamPolicy Gets the IAM access control policy for a snapshot. pubsub.snapshots.getIamPolicy on the requested snapshot
projects.snapshots.list Lists the existing snapshots. pubsub.snapshots.list on the requested Cloud project
projects.snapshots.patch Updates an existing snapshot. pubsub.snapshots.update on the requested snapshot
projects.snapshots.setIamPolicy Sets the IAM access control policy for a snapshot. pubsub.snapshots.setIamPolicy on the requested snapshot
projects.snapshots.testIamPermissions Returns permissions that a caller has on the specified resource. None

Available Pub/Sub roles

The following table lists all Pub/Sub roles and the permissions associated with each role:

Role Permissions

(roles/pubsub.admin)

Provides full access to topics and subscriptions.

Lowest-level resources where you can grant this role:

  • Schema
  • Snapshot
  • Subscription
  • Topic

cloudkms.keyHandles.*

  • cloudkms.keyHandles.create
  • cloudkms.keyHandles.get
  • cloudkms.keyHandles.list

cloudkms.operations.get

cloudkms.projects.showEffectiveAutokeyConfig

pubsub.*

  • pubsub.messageTransforms.validate
  • pubsub.schemas.attach
  • pubsub.schemas.commit
  • pubsub.schemas.create
  • pubsub.schemas.delete
  • pubsub.schemas.get
  • pubsub.schemas.getIamPolicy
  • pubsub.schemas.list
  • pubsub.schemas.listRevisions
  • pubsub.schemas.rollback
  • pubsub.schemas.setIamPolicy
  • pubsub.schemas.validate
  • pubsub.snapshots.create
  • pubsub.snapshots.createTagBinding
  • pubsub.snapshots.delete
  • pubsub.snapshots.deleteTagBinding
  • pubsub.snapshots.get
  • pubsub.snapshots.getIamPolicy
  • pubsub.snapshots.list
  • pubsub.snapshots.listEffectiveTags
  • pubsub.snapshots.listTagBindings