[IAM (Identity and Access Management)](https://cloud.google.com/pubsub/access_control) allows you to set permissions on individual resources and offers a wider range of roles: editor, owner, publisher, subscriber, and viewer. This gives you greater flexibility and allows you to set more fine-grained access control.
For example: * Grant access on a per-topic or per-subscription basis, rather than for the whole Cloud project. * Grant access with limited capabilities, such as to only publish messages to a topic, or to only to consume messages from a subscription, but not to delete the topic or subscription.
*The IAM access control features described in this document are Beta, including the API methods to get and set IAM policies, and to test IAM permissions. Cloud Pub/Sub's use of IAM features is not covered by any SLA or deprecation policy, and may be subject to backward-incompatible changes.*
const{PubSub}=require('@google-cloud/pubsub');constpubsub=newPubSub();consttopic=pubsub.topic('my-topic');constsubscription=topic.subscription('my-subscription');topic.iam.getPolicy(function(err,policy,apiResponse){});subscription.iam.getPolicy(function(err,policy,apiResponse){});//-// If the callback is omitted, we'll return a Promise.//-topic.iam.getPolicy().then(function(data){constpolicy=data[0];constapiResponse=data[1];});
const{PubSub}=require('@google-cloud/pubsub');constpubsub=newPubSub();consttopic=pubsub.topic('my-topic');constsubscription=topic.subscription('my-subscription');constmyPolicy={bindings:[{role:'roles/pubsub.subscriber',members:['serviceAccount:myotherproject@appspot.gserviceaccount.com']}]};topic.iam.setPolicy(myPolicy,function(err,policy,apiResponse){});subscription.iam.setPolicy(myPolicy,function(err,policy,apiResponse){});//-// If the callback is omitted, we'll return a Promise.//-topic.iam.setPolicy(myPolicy).then(function(data){constpolicy=data[0];constapiResponse=data[1];});
const{PubSub}=require('@google-cloud/pubsub');constpubsub=newPubSub();consttopic=pubsub.topic('my-topic');constsubscription=topic.subscription('my-subscription');//-// Test a single permission.//-consttest='pubsub.topics.update';topic.iam.testPermissions(test,function(err,permissions,apiResponse){console.log(permissions);// {// "pubsub.topics.update": true// }});//-// Test several permissions at once.//-consttests=['pubsub.subscriptions.consume','pubsub.subscriptions.update'];subscription.iam.testPermissions(tests,function(err,permissions){console.log(permissions);// {// "pubsub.subscriptions.consume": true,// "pubsub.subscriptions.update": false// }});//-// If the callback is omitted, we'll return a Promise.//-topic.iam.testPermissions(test).then(function(data){constpermissions=data[0];constapiResponse=data[1];});
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-09-04 UTC."],[],[],null,[]]
