This page describes Application Design Center roles and permissions. To control access to App Design Center, use Identity and Access Management (IAM) to assign roles to users, groups, and service accounts.
Predefined Application Design Center roles
To grant access to specific Google Cloud resources and prevent unauthorized access to other resources, assign App Design Center's predefined roles on the app-enabled folder or management project:.
Use the following IAM roles to manage spaces and author templates:
- Application Design Center Admin (
roles/designcenter.admin) - Application Design Center User (
roles/designcenter.user) - Application Design Center Viewer (
roles/designcenter.viewer)
Use the following IAM roles to create application configurations and manage deployment lifecycles:
- Application Admin (
roles/designcenter.applicationAdmin) - Application Editor (
roles/designcenter.applicationEditor) - Application Viewer (
roles/designcenter.applicationViewer)
Application Design Center role descriptions
The following table describes App Design Center roles and their typical responsibilities.
Role
Description
Purpose
Application Design Center Admin
Ability to create and manage all App Design Center artifacts, and delegate application control to other users.
- To manage the full lifecycle of an application.
- Typically Platform Admins, who generally have administrative permissions and full visibility of the end-to-end architecture.
Application Design Center User
Ability to create and update application templates.
- To scale the capability to create, update, or delete application templates to ease the effort of Platform Admins.
- Typically a Platform Engineer who needs to create and manage application templates.
Application Design Center Viewer
Ability to view spaces, catalogs, templates, applications, and their attributes.
- To enable basic visibility across spaces, catalogs and applications, and their dependencies.
- Typically most personnel in the organization. To get the most value, grant all App Design Center users this role.
Application Admin
Ability to create, manage and deploy applications, and delegate application control to other application developers.
- To manage application drafts and deployments, as well as the ability to attach service projects required to store individual resources.
- Typically administrators and developers who are responsible for application creation.
Application Editor
Ability to create, manage, and deploy applications.
- To scale the capability to manage drafts and deployments to ease the effort of application administrators.
- Typically an application operator who has a good understanding of deployments.
Application User
Ability to view applications.
- To enable basic visibility across templates and applications, and their dependencies.
- Typically most personnel in the organization. To get the most value, grant all Application Design Center users this role.
General Application Design Center permissions
The following table describes general App Design Center permissions and the IAM roles that have these permissions.
| Permissions |
Description |
Application Design Center Admin |
Application Design Center User |
Application Design Center Viewer |
|---|---|---|---|---|
| cloudresourcemanager.projects.get |
Get projects. |
✔ |
✔ |
✔ |
| cloudresourcemanager.projects.list |
List projects. |
✔ |
✔ |
✔ |
| designcenter.operations.get |
Get operations. |
✔ |
✔ |
✔ |
| designcenter.operations.list |
List operations. |
✔ |
✔ |
✔ |
| designcenter.operations.delete |
Delete operations. |
✔ |
||
| designcenter.operations.cancel |
Cancel operations. |
✔ |
||
| designcenter.locations.get |
Get an application location. |
✔ |
✔ |
✔ |
| designcenter.locations.list |
List application locations. |
✔ |
✔ |
✔ |
| designcenter.spaces.create |
Add a space. |
✔ |
||
| designcenter.spaces.get |
Get a space. |
✔ |
✔ |
✔ |
| designcenter.spaces.delete |
Delete a space. |
✔ |
||
| designcenter.spaces.update |
Update a space. |
✔ |
||
| designcenter.spaces.list |
List spaces. |
✔ |
✔ |
✔ |
| designcenter.spaces.setIAMPolicy |
Set IAM policies on spaces. |
✔ |
||
| designcenter.spaces.getIAMPolicy |
List IAM policies for spaces. |
✔ |
✔ |
✔ |
| designcenter.applications.create |
Create an application. |
✔ |
||
| designcenter.applications.get |
Get an application. |
✔ |
✔ |
✔ |
| designcenter.applications.delete |
Delete an application. |
✔ |
||
| designcenter.applications.update |
Update an application. |
✔ |
||
| designcenter.applications.list |
List applications. |
✔ |
✔ |
✔ |
| designcenter.applicationtemplates.create |
Add an application template to a space. |
✔ |
✔ |
|
| designcenter.applicationtemplates.get |
Get an application template from a space. |
✔ |
✔ |
✔ |
| designcenter.applicationtemplates.delete |
Delete an application template from a space. |
✔ |
✔ |
|
| designcenter.applicationtemplates.update |
Update an application template from a space. |
✔ |
✔ |
|
| designcenter.applicationtemplates.list |
List application templates in a space. |
✔ |
✔ |
✔ |
| designcenter.applicationtemplaterevisions.get |
Get application template revisions. |
✔ |
✔ |
✔ |
| designcenter.applicationtemplaterevisions.delete |
Delete application template revisions. |
✔ |
✔ |
|
| designcenter.applicationtemplaterevisions.list |
List application template revisions. |
✔ |
✔ |
✔ |
| designcenter.elements.create |
Create an element in a template. |
✔ |
✔ |
|
| designcenter.elements.get |
Get an element in a template. |
✔ |
✔ |
✔ |
| designcenter.elements.delete |
Delete an element from a template. |
✔ |
✔ |
|
| designcenter.elements.update |
Update an element in a template. |
✔ |
✔ |
|
| designcenter.elements.list |
List elements in a template. |
✔ |
✔ |
✔ |
| designcenter.components.create |
Create a component in a template. |
✔ |
✔ |
|
| designcenter.component.get |
Get a component in a template. |
✔ |
✔ |
✔ |
| designcenter.component.delete |
Delete a component in a template. |
✔ |
✔ |
|
| designcenter.component.update |
Update a component in a template. |
✔ |
✔ |
|
| designcenter.component.list |
List components in a template. |
✔ |
✔ |
✔ |
| designcenter.connections.create |
Add a connection between two elements in a template. |
✔ |
✔ |
|
| designcenter.connections.get |
Get element connections in a template. |
✔ |
✔ |
✔ |
| designcenter.connections.delete |
Delete an element connection in a template. |
✔ |
✔ |
|
| designcenter.connections.update |
Update a element connection in a template. |
✔ |
✔ |
|
| designcenter.connections.list |
List element connections in a template. |
✔ |
✔ |
✔ |
| designcenter.catalogs.create |
Add a catalog. |
✔ |
||
| designcenter.catalogs.get |
Get a catalog. |
✔ |
✔ |
✔ |
| designcenter.catalogs.delete |
Delete a catalog. |
✔ |
||
| designcenter.catalogs.update |
Update a catalog. |
✔ |
||
| designcenter.catalogs.list |
List catalogs. |
✔ |
✔ |
✔ |
| designcenter.catalogtemplates.create |
Add a template to a catalog. |
✔ |
||
| designcenter.catalogtemplates.get |
Get a template from a catalog. |
✔ |
✔ |
✔ |
| designcenter.catalogtemplates.delete |
Delete a template from a catalog. |
✔ |
||
| designcenter.catalogtemplates.update |
Update a template in a catalog. |
✔ |
||
| designcenter.catalogtemplates.list |
List templates in a catalog. |
✔ |
✔ |
✔ |
| designcenter.catalogtemplaterevisions.create |
Add a template revision to a catalog. |
✔ |
||
| designcenter.catalogtemplaterevisions.get |
Get a template revision from a catalog. |
✔ |
✔ |
✔ |
| designcenter.catalogtemplaterevisions.delete |
Delete a template revision from a catalog. |
✔ |
||
| designcenter.catalogtemplaterevisions.list |
List template revisions in a catalog. |
✔ |
✔ |
✔ |
| designcenter.shares.get |
Get a catalog share. |
✔ |
✔ |
✔ |
| designcenter.shares.delete |
Delete a catalog share. |
✔ |
||
| designcenter.shares.update |
Update a catalog share. |
✔ |
||
| designcenter.shares.list |
List catalog shares. |
✔ |
✔ |
✔ |
| designcenter.sharedTemplates.get |
Get a shared template. |
✔ |
✔ |
✔ |
| designcenter.sharedTemplates.list |
List shared templates. |
✔ |
✔ |
✔ |
| designcenter.sharedTemplateRevisionss.get |
Get a shared template revision. |
✔ |
✔ |
✔ |
| designcenter.sharedTemplateRevisionss.list |
List shared template revisions. |
✔ |
✔ |
✔ |
| storage.googleapis.com/objectUser |
Create, view, list, update, and delete objects, folders, and managed folders, along with their metadata. |
✔ |
||
| storage.googleapis.com/objectViewer |
view objects and their metadata, excluding ACLs. Can also list the objects, folders, and managed folders in a bucket. |
✔ |
✔ |
✔ |
| apphub.serviceProjectAttachments.list |
List App Hub service projects attachments added to host project. |
✔ |
✔ |
Application configuration and deployment permissions
The following table describes application configuration and deployment permissions and the IAM roles that have these permissions.
| Permissions |
Description |
Application Admin |
Application Editor |
Application User |
|---|---|---|---|---|
| cloudresourcemanager.projects.get |
Get projects. |
✔ |
✔ |
✔ |
| cloudresourcemanager.projects.list |
List projects. |
✔ |
✔ |
✔ |
| designcenter.spaces.get |
Get a space. |
✔ |
✔ |
✔ |
| designcenter.spaces.list |
List spaces. |
✔ |
✔ |
✔ |
| designcenter.applications.create |
Author applications in a space. |
✔ |
✔ |
|
| designcenter.applications.get |
Retrieve existing applications from a space. |
✔ |
✔ |
✔ |
| designcenter.applications.delete |
Delete applications from a space. |
✔ |
✔ |
|
| designcenter.applications.update |
Update existing applications in a space. |
✔ |
✔ |
|
| designcenter.applications.list |
View a list of existing applications in a space. |
✔ |
✔ |
✔ |
| designcenter.applications.setIAMPolicy |
Set IAM policies on applications. |
✔ |
||
| designcenter.applications.getIAMPolicy |
Get IAM policies from applications. |
✔ |
✔ |
✔ |
| designcenter.applicationtemplates.get |
Retrieve application templates from a space. |
✔ |
✔ |
✔ |
| designcenter.applicationtemplates.list |
List application templates in a space. |
✔ |
✔ |
✔ |
| designcenter.applicationtemplaterevisions.get |
Retrieve application template revisions from a space. |
✔ |
✔ |
✔ |
| designcenter.applicationtemplaterevisions.list |
List application template revisions in a space. |
✔ |
✔ |
✔ |
| designcenter.shares.get |
Get a catalog share. |
✔ |
✔ |
✔ |
| designcenter.shares.list |
List catalog shares. |
✔ |
✔ |
✔ |
| designcenter.sharedTemplates.get |
Get a shared template. |
✔ |
✔ |
✔ |
| designcenter.sharedTemplates.list |
List shared templates. |
✔ |
✔ |
✔ |
| designcenter.sharedTemplateRevisions.get |
Get a shared template revision. |
✔ |
✔ |
✔ |
| designcenter.sharedTemplateRevisions.list |
List shared template revisions. |
✔ |
✔ |
✔ |
| apphub.applications.create |
Create an App Hub application. |
✔ |
✔ |
|
| apphub.applications.get |
Get details about an App Hub application. |
✔ |
✔ |
✔ |
| apphub.applications.delete |
Delete an App Hub application. |
✔ |
✔ |
|
| apphub.applications.list |
List App Hub applications. |
✔ |
✔ |
✔ |
| apphub.applications.update |
Update App Hub application details or metadata. |
✔ |
✔ |
|
| apphub.locations.get |
Get an App Hub application location. |
✔ |
✔ |
✔ |
| apphub.locations.list |
List App Hub application locations. |
✔ |
✔ |
✔ |
| apphub.serviceProjectAttachments.list |
List App Hub service projects attachments added to host project. |
✔ |
✔ |
|
| Infrastructure Manager Viewer(roles/config.viewer) |
Read deployments, revisions, and IAM policies. |
✔ |
✔ |
✔ |
