Access control with IAM

This page describes the Identity and Access Management (IAM) roles you can use to configure Secret Manager. Roles limit a principal's ability to access resources. Always grant the minimum set of permissions required to perform a given task.

Secret Manager roles

Following are the IAM roles that are associated with Secret Manager. To learn how to grant, change, or revoke access to resources using IAM roles, see Granting, changing, and revoking access to resources.

Role Permissions

(roles/secretmanager.admin)

Full access to administer Secret Manager resources.

Lowest-level resources where you can grant this role:

  • Secret

cloudkms.keyHandles.*

  • cloudkms.keyHandles.create
  • cloudkms.keyHandles.get
  • cloudkms.keyHandles.list

cloudkms.operations.get

cloudkms.projects.showEffectiveAutokeyConfig

resourcemanager.projects.get

resourcemanager.projects.list

secretmanager.*

  • secretmanager.locations.get
  • secretmanager.locations.list
  • secretmanager.secrets.create
  • secretmanager.secrets.createTagBinding
  • secretmanager.secrets.delete
  • secretmanager.secrets.deleteTagBinding
  • secretmanager.secrets.enableManagedRotation
  • secretmanager.secrets.get
  • secretmanager.secrets.getIamPolicy
  • secretmanager.secrets.list
  • secretmanager.secrets.listEffectiveTags
  • secretmanager.secrets.listTagBindings
  • secretmanager.secrets.rotate
  • secretmanager.secrets.setIamPolicy
  • secretmanager.secrets.update
  • secretmanager.versions.access
  • secretmanager.versions.add
  • secretmanager.versions.destroy
  • secretmanager.versions.disable
  • secretmanager.versions.enable
  • secretmanager.versions.get
  • secretmanager.versions.list

(roles/secretmanager.editor)

Editor role for secretmanager

resourcemanager.projects.get

resourcemanager.projects.list

secretmanager.locations.*

  • secretmanager.locations.get
  • secretmanager.locations.list

secretmanager.secrets.create

secretmanager.secrets.delete

secretmanager.secrets.enableManagedRotation

secretmanager.secrets.get

secretmanager.secrets.getIamPolicy

secretmanager.secrets.list

secretmanager.secrets.listEffectiveTags

secretmanager.secrets.listTagBindings

secretmanager.secrets.rotate

secretmanager.secrets.update

secretmanager.versions.add

secretmanager.versions.destroy

secretmanager.versions.disable

secretmanager.versions.enable

secretmanager.versions.get