RBAC roles and permissions

This page describes the roles and permissions used by Cloud Data Fusion instances with role-based access control (RBAC) enabled.

For fine-grained access enforcement at the namespace level and lower, use these data plane resources and permissions with RBAC.

Resource hierarchy

Cloud Data Fusion resources have the following resource hierarchy:

This figure shows the resource hierarchy in descending order (broadest to narrowest): Google Cloud project, location, Cloud Data Fusion instance, and namespaces. Below namespaces, in no order, are connections, secure keys, pipelines, artifacts (such as plugins, drivers, and applications), and compute profiles.

The following resources are Cloud Data Fusion data plane resources that you control with the REST API or in the Cloud Data Fusion Studio: namespaces, connections, secure keys, pipelines, artifacts, and compute profiles.

Predefined roles for RBAC

Cloud Data Fusion RBAC includes several predefined roles that you can use:

Instance Access role ( datafusion.accessor )

Grants the principal access to a Cloud Data Fusion instance, but not to any resources within the instance. Use this role in combination with other namespace-specific roles to provide fine-grained access to namespace.

Viewer role ( datafusion.viewer )

Grants access to a principal on a namespace to view pipelines, but not to author or run pipelines.

Operator role ( datafusion.operator )

Grants access to a principal on a namespace to access and run pipelines, change the compute profile, create compute profiles, or upload artifacts. Can perform the same actions as a developer, with the exception of previewing pipelines.

Developer role ( datafusion.developer )

Grants access to a principal on a namespace to create and modify limited resources, such as pipelines, within the namespace.

Editor role ( datafusion.editor )

Grants the principal full access to all Cloud Data Fusion resources under a namespace within a Cloud Data Fusion instance. This role must be granted in addition to the Instance Accessor role to the principal. With this role, the principal can create, delete, and modify resources in the namespace.

Instance Admin role ( datafusion.admin )

Grants access to all resources within a Cloud Data Fusion instance. Assigned through IAM. Not assigned at the namespace level through RBAC.

For a complete list of permissions included in Cloud Data Fusion's predefined role, see Cloud Data Fusion predefined roles .

Custom roles for RBAC

Some use cases cannot be implemented using the predefined roles for Cloud Data Fusion. In these cases, create a custom role .

Examples

The following examples describe how to create custom roles for RBAC:

• To create a custom role that only gives access to the secure keys within a namespace, create a custom role with the datafusion.namespaces.get and datafusion.secureKeys.* permissions.

• To create a custom role that gives read-only access to secure keys, create a custom role with the datafusion.namespaces.get , datafusion.secureKeys.getSecret , and datafusion.secureKeys.list permissions.

Permissions for common actions

A single, predefined permission might not be sufficient to perform the corresponding action. For example, to update namespace properties, you might also need datafusion.namespaces.get permission. The following table describes common actions performed within a Cloud Data Fusion instance and the required IAM permissions:

What's next

• Learn more about RBAC in Cloud Data Fusion.