Identity and Access Management (IAM)

Google Cloud offers Identity and Access Management (IAM), which lets you give more granular access to specific Google Cloud resources and prevents unwanted access to other resources. This page describes the Firestore in Datastore mode IAM roles. For a detailed description of IAM, read the IAM documentation .

IAM lets you adopt the security principle of least privilege , so you grant only the necessary access to your resources.

IAM lets you control who (users)has what (roles)permission to whichresources by setting IAM policies. IAM policies grant specific role(s) to a user, giving the user certain permissions. For example, you can grant the datastore.indexAdmin role to a user and the user can create, modify, delete, list, or view indexes.

Permissions and Roles

This section summarizes the permissions and roles Firestore in Datastore mode supports.

Permissions

The following table lists the permissions that Firestore in Datastore mode supports.

Predefined roles

With IAM, every Datastore API method requires that the account making the API request has the appropriate permissions to use the resource. Permissions are granted by setting policies that grant roles to a user, group, or service account. In addition to the basic roles, Owner, Editor, and Viewer , you can grant Firestore in Datastore mode roles to the users of your project.

The following table lists the Firestore in Datastore mode IAM roles. You can grant multiple roles to a user, group, or service account.

Custom roles

If the predefined roles don't address your business requirements, you can define your own custom roles with permissions that you specify:

• Learn about custom roles.
• Create and manage custom roles.

Required roles to create and manage tags

If any tag is represented in create or restore actions, some roles are required. See Creating and managing tags for more details on creating tag key-value pairs before associate them to the database resources.

The following listed permissions are required.

View tags

• datastore.databases.listTagBindings
• datastore.databases.listEffectiveTags

Manage tags on resources

The following permission is required for the database resource you're attaching the tag value.

• datastore.databases.createTagBinding

Required Permissions for API methods

The following table lists the permissions that the caller must have to call each method:

Required Permissions for Metadata and Statistics

The following table lists permissions that the caller must have to call methods on Metadata and Statistics .

Required roles to create a Datastore mode database instance

To create a new Datastore mode database instance, you require either the Owner role or the Datastore Owner role .

Datastore mode databases requires an active App Engine application. If the project doesn't have an application, Firestore in Datastore mode creates one for you. In that case, you require the appengine.applications.create permission from the Owner role or from an IAM custom role containing the permission.

Role change latency

Firestore in Datastore mode caches IAM permissions for 5 minutes, so it will take up to 5 minutes for a role change to become effective.

Managing IAM

You can get and set IAM policies using the Google Cloud console, the IAM methods, or the Google Cloud CLI.

• For the Google Cloud console, see Access control using the Google Cloud console .
• For the IAM methods, see Access control using the API .
• For the gcloud CLI, see Access control using the gcloud tool .

Configure conditional access permissions

You can use IAM Conditions to define and enforce conditional access control.

For example, the following condition assigns a principal the datastore.user role up until a specified date:

  { 
  
 "role" 
 : 
  
 "roles/datastore.user" 
 , 
  
 "members" 
 : 
  
 [ 
  
 "user:travis@example.com" 
  
 ], 
  
 "condition" 
 : 
  
 { 
  
 "title" 
 : 
  
 "Expires_December_1_2023" 
 , 
  
 "description" 
 : 
  
 "Expires on December 1, 2023" 
 , 
  
 "expression" 
 : 
  
 "request.time < timestamp('2023-12-01T00:00:00.000Z')" 
  
 } 
 } 
 

To learn how to define IAM Conditions for temporary access, see Configure temporary access .

To learn how to configure IAM Conditions for access to one or more databases, see Configure database access conditions .

What's next

• Learn more about IAM .
• Grant IAM roles .