Identity and Access Management
Invite people to your organization, give them a built-in role, and give your applications service accounts instead of shared credentials. Access changes land in the audit log.
- Members & invitations
- Built-in roles & service accounts
- Audit log
One role model for people and machines
Audit log records
- iam.role.assign
- iam.role.revoke
- iam.member.remove
- iam.org_invite.create
- iam.org_invite.revoke
- iam.service_account.create
- iam.service_account.revoke
Features
Control who can do what.
Role-based access control
Assign roles to organization members and to service accounts: the same role model for people and machines.
Six built-in roles
Owner, Viewer, IAM Editor and three billing roles, assigned org-wide or for one project. You can’t create your own roles.
Audit log
Role grants and revocations, member removals, invitations and service-account events are recorded with who, what and when.
Use cases
In practice.
Separate duties
Owner holds no billing permission and the billing roles hold nothing else, so finance and engineering get exactly what they need.
Team collaboration
Invite a contractor with a limited role, and revoke the invitation or the role when the work ends.
Application integration
Give CI and applications service accounts for API access, to launch instances or create volumes without a personal login.
IAM is live today, in open beta.
The IAM docs cover the access model, roles, service accounts and the audit log, with GraphQL API and CLI examples, readable without an account.