IAM Roles in Google Cloud, and Which One to Actually Use

An IAM role is a bundle of permissions you grant to a user, group, or service account, rather than assigning individual permissions one at a time. Google Cloud gives you three kinds of role to choose from, and picking the right one is most of what role based best practice actually comes down to. This walks through that choice first, then creating, disabling, enabling, and deleting a custom role, for the situations where a custom role genuinely is the right call.

The Three Types of IAM Roles

• Basic roles, originally called primitive roles, are Owner, Editor, and Viewer. Each is extremely broad, an Editor can modify almost anything in a project, and they predate IAM entirely. Current guidance limits these to testing and sandbox environments, not production, since a compromised account holding a basic role has a very large blast radius.
• Predefined roles, maintained by Google for each specific service, are the recommended default for real work. Google’s own product teams define these based on the permissions a given job actually needs, and they update automatically as a service evolves, without you having to maintain anything yourself.
• Custom roles, which you build yourself from individual permissions, exist for the cases a predefined role does not cover precisely, either too broad or missing something specific. They take real ongoing maintenance, since Google does not update them for you as services change.

The order to actually check them in is predefined first, custom only if nothing predefined truly fits, and basic roles reserved for throwaway testing.

Step byStep Process of Creating IAM Roles

Step 1: Open Roles

Open the console, then

Open Menu > IAM & Admin > Roles

Step 2: Create a Custom Role

Click Create Role.

Step 3: Name It and Set Its Launch Stage

Give the role a title, a unique ID, and choose a launch stage, then click Add Permissions.

Step 4: Add Permissions

Filter permissions by service or role to find what you need. A single custom role can include as many permissions as it genuinely needs.

Select the Permissions. Click OK

Step 4: Confirm and Create

Click Add.

The permission will be added to the custom role. Click Create.

Step 6: Ready to Use

The custom role is created and ready to assign.

Step 7: Disabling a Custom Role

Tick the checkbox next to the role you want to disable, then click Disable.

It will be disabled.

Step 8: Enabling a Disabled Role

Click the three dots next to the role you want to enable again.

Step 9: Deleting a Custom Role

Select the role you want to delete, then click Delete.

It will be deleted after a particular time.

What Actually Happens When You Delete a Custom Role

Deleting a custom role does not erase it immediately. It becomes soft deleted, and you have 7 days to undelete it if you change your mind, during which any existing bindings to it stop working but the role definition itself is still recoverable. After 7 days, it is permanently deleted and cannot be recovered, and any remaining bindings to it are removed entirely. Even after that, the specific role ID cannot be reused for a new role until roughly 30 days beyond the permanent deletion point, so if you need the exact same ID again soon, expect to wait.

Common Mistakes to Avoid

• Reaching for a custom role before checking whether a predefined one already covers the need. Predefined roles update automatically as a service changes, a custom role does not.
• Using basic roles like Editor or Owner in a production project out of convenience. Reserve them for testing and sandbox use, where the broad access they grant matters less.
• Deleting a custom role and expecting to immediately recreate one with the same ID. The ID stays locked for a period well beyond the role’s own permanent deletion.
• Forgetting that a disabled role’s existing bindings stop working right away, even though the role itself still exists and can be re-enabled.

That covers the three types of IAM role and when to use each, along with creating and managing a custom role. To go further, explore Prwatech’s Google Cloud training program, which includes placement assistance.