Origin Cloud has six built-in roles. You can’t create your own. Each section lists the role’s ID, the URN you pass to role commands, where you can assign it, and every permission it grants. Permission keys have the form <service>.<resource>.<action>; the tables group them by <service>.<resource>. For how roles, scopes and permissions work together, see Access model.
| ID | Name | For |
|---|---|---|
roles/owner | Owner | Full control of the organization, except billing accounts |
roles/viewer | Viewer | Read-only access to everything Owner can change |
roles/iam/editor | IAM Editor | Assigning and revoking roles within its own permissions |
roles/billing/administrator | Billing Account Administrator | Full control of billing accounts |
roles/billing/user | Billing Account User | Billing accounts without deleting them |
roles/billing/viewer | Billing Account Viewer | Read-only access to billing accounts |
roles/owner
Full control of the organization’s projects, resources and access. Owner doesn’t include any billing account permission: an Owner can switch which billing account a project is charged to (admin.project.attach) and manage spend limits, but can’t view, create, change or delete a billing account. For that, assign a billing role; see Billing access.
URN: urn:origin:cloud:iam::::tc/role/roles/owner
Scope: org-wide or one project. Only an org-wide Owner can manage members and service accounts. Because Owner holds no billing permission, an Owner can’t assign or revoke the billing roles unless it also holds roles/billing/administrator.
| Resource | Actions |
|---|---|
admin.organisation | get, list, update, create, delete |
admin.project | get, list, update, create, delete, attach |
admin.resource_quota | get, update |
admin.spend_limit | get, update |
admin.support_case | list, get, create, update |
admin.usage | list |
compute.image | get, list, create, delete, update |
compute.instance | get, list, update, launch, terminate, start, stop, attach, detach |
compute.key_pair | get, list, create, delete |
iam.audit_log | list |
iam.group | get, list, update, create, delete |
iam.member | list, create, revoke |
iam.permission | query |
iam.role | get, list, update, create, delete, assign, revoke |
iam.service_account | list, create, revoke |
network.acl | get, list, create, update, delete |
network.dns_policy | get, list, create, update, set_default, delete, attach |
network.floating_ip | get, list, create, attach, detach, delete |
network.interface | get, list, create, delete, attach |
network.internet_gateway | get, attach, detach |
network.nat_gateway | get, list, create, delete |
network.route_table | get, list, create, update, delete |
network.security_group | get, list, create, update, delete |
network.subnet | get, list, create, update, delete |
network.vpc | get, list, create, delete |
observability.metric | get |
pvs.snapshot | get, list, create, delete, update, protect, unprotect |
pvs.volume | get, list, create, delete, update |
roles/viewer
Read-only access: every get and list permission that Owner holds. A Viewer can list members, pending invites, service accounts and the audit log, but can’t change anything. Viewer includes no billing account permission.
URN: urn:origin:cloud:iam::::tc/role/roles/viewer
Scope: org-wide or one project.
| Resource | Actions |
|---|---|
admin.organisation | get, list |
admin.project | get, list |
admin.resource_quota | get |
admin.spend_limit | get |
admin.support_case | list, get |
admin.usage | list |
compute.image | get, list |
compute.instance | get, list |
compute.key_pair | get, list |
iam.audit_log | list |
iam.group | get, list |
iam.member | list |
iam.role | get, list |
iam.service_account | list |
network.acl | get, list |
network.dns_policy | get, list |
network.floating_ip | get, list |
network.interface | get, list |
network.internet_gateway | get |
network.nat_gateway | get, list |
network.route_table | get, list |
network.security_group | get, list |
network.subnet | get, list |
network.vpc | get, list |
observability.metric | get |
pvs.snapshot | get, list |
pvs.volume | get, list |
roles/iam/editor
Lets a principal list members and roles, and assign and revoke roles in the organization. An IAM Editor can’t invite or remove members or manage service accounts; those need Owner.
An IAM Editor can only hand out what it already has. Like every principal, it can assign or revoke a role only if it holds every permission of that role itself at the scope of the grant; see Who can assign a role. With IAM Editor alone, that is IAM Editor itself. To let it assign Viewer as well, assign it Viewer too. An IAM Editor can never make anyone an Owner, itself included.
URN: urn:origin:cloud:iam::::tc/role/roles/iam/editor
Scope: org-wide. Role operations act on the organization, so a project-scoped IAM Editor can’t use them.
| Resource | Actions |
|---|---|
iam.member | list |
iam.role | get, list, assign, revoke |
roles/billing/administrator
Full control of the organization’s billing accounts: view, create, update and delete them. Whoever creates an organization holds this role org-wide.
URN: urn:origin:cloud:iam::::tc/role/roles/billing/administrator
Scope: org-wide only. Assign it without a project.
| Resource | Actions |
|---|---|
admin.billing_account | get, list, create, update, delete |
roles/billing/user
Everything the Billing Account Administrator can do, except deleting a billing account.
URN: urn:origin:cloud:iam::::tc/role/roles/billing/user
Scope: org-wide only. Assign it without a project.
| Resource | Actions |
|---|---|
admin.billing_account | get, list, create, update |
roles/billing/viewer
Read-only access to the organization’s billing accounts.
URN: urn:origin:cloud:iam::::tc/role/roles/billing/viewer
Scope: org-wide only. Assign it without a project.
| Resource | Actions |
|---|---|
admin.billing_account | get, list |