Access control for organization resources with IAM

Google Cloud offers Identity and Access Management (IAM), which lets you give more granular access to specific Google Cloud resources and prevents unwanted access to other resources. IAM lets you adopt the security principle of least privilege, so you grant only the necessary access to your resources.

IAM lets you control who (users) has what access (roles) to which resources by setting allow policies. Allow policies grant specific roles to a user to give the user certain permissions.

This page explains the IAM roles that are available on the organization resource, and how to create and manage allow policies for organization resources using the Cloud Resource Manager API. For more information, see Manage access to projects, folders, and organizations.

Permissions and roles

To control access to resources, Google Cloud requires that accounts making API requests have appropriate IAM roles. IAM roles include permissions that let users perform specific actions on Google Cloud resources. For example, the resourcemanager.organizations.get permission allows a user to get details about their organization resource.

You don't directly give users permissions; instead, you grant them roles, which have one or more permissions bundled within them.

You can grant one or more roles on the same resource.

Use predefined roles

The following table lists the roles that you can grant to access an organization resource's properties, the description of what the role does, and the permissions bundled within that role.