Grant access to your project with IAM

1. Before you begin

This codelab shows you how to set up an OAuth client and how to use the Google Cloud Console to grant Identity and Access Management (IAM) roles to principals for your project.

Prerequisites

• Ability to navigate the Cloud Console.

What you'll learn

• How to set up your app as an OAuth client.
• How to restrict access to your app with Identity and Access Management (IAM).

What you'll need

• A modern web browser, such as Google Chrome.
• A Google Account, such as a Gmail account or a Google Workspace account.
• Access to a Cloud BIlling account or a credit card to use to sign up for a free trial.

2. Create a Google Cloud project and set up a billing account

Note: If you have already set up a project and billing account that you want to reuse, you can skip this section.

1. Sign in to the Cloud Console.

Warning: If you reuse a project and complete this codelab, you may enable some users to access resources in that project if they are not turned off when you're done.

2. Go to the project- selector page.
3. Click Create project.
4. Name your project and then make a note of the generated project ID.
5. Edit the other fields as needed.

Note: If you use a Gmail account, you can leave the default location set to No organization. If you use a Google Workspace account, choose a location that makes sense for your organization.

6. Click Create.
7. If you haven't already, enable billing in the Cloud Console to use Google Cloud resources.

Although this codelab shouldn't cost much, if anything, follow the instructions in the Clean up section to shut down resources and avoid costs beyond this codelab. Note that new users of Google Cloud are eligible for the US$300 free trial.

3. Grant access with IAM

IAM lets you grant role-based access to users for your project and resources. In this section, you use IAM to grant a user access to a couple of roles for your project.

Enable the IAM and Resource Manager APIs

1. In the navigation menu in the Cloud Console, click APIs & Services.

2. Select ENABLE APIS AND SERVICES.

3. Search for the IAM API and then enable it.
4. Search for Resource Manager API and then enable it.

Grant a role with IAM

1. Go to the IAM page.

The name of your project appears in the project selector. The project selector tells you what project you're in.

If you don't see the name of your project, use the project selector to select it.

2. Click Add.
3. Enter the email address of a principal.
4. From the Select a role drop-down menu, select Logging > Logs Viewer > Save.

5. Verify that the principal and the role are listed on the IAM page.

That's it—you granted an identity and access management role to a principal!

Observe the effects of identity and access management roles

In this section, you verify that the principal to whom you granted a role can access the expected Cloud Console pages:

1. Send this URL to the principal to whom you granted the role:

https://console.cloud.google.com/logs?project=PROJECT_ID

2. Verify that the principal can access and view the URL.

The principal can't access a Cloud Console page for which they haven't been granted the appropriate role. Instead, they see an error message like this example:

You don't have permissions to view logs.

Grant other roles to the same principal

Caution: Basic roles include thousands of permissions across all Google Cloud services. In production environments, don't grant basic roles unless there's no alternative. Instead, grant the most limited predefined roles or custom roles that meet your needs.

1. In the Cloud Console, go to the IAM page.
2. Locate the principal to whom you want to grant another role and then click Edit .
3. In the Edit permissions pane, click Add another role.

4. In the Select a role drop-down menu, click Project > Viewer > Save.

The principal now has a second identity and access management role.

Revoke the roles granted to the principal

1. Locate the principal whose role you want to revoke and then click Edit .
2. In the Edit permissions pane, click next to both roles that you previously granted to the principal.
3. Click Save.

You removed the principal from both of the roles. If this person tries to view any of the pages that they could previously access, they see an error message.

4. Clean up

To avoid charges to your Google Cloud account for the resources used in this codelab:

Caution: When you delete a project:

• Everything in the project is deleted. If you used an existing project for this tutorial, you also delete any other work that you did in the project.
• Custom project IDs are lost. When you created this project, you might have created a custom project ID that you want to use in the future. To preserve the URLs that use the project ID, such as an appspot.com URL, delete the selected resources inside the project instead of the whole project.

If you plan to explore multiple codelabs or quickstarts, you can reuse projects to stay within project quota limits.

1. In the Cloud Console, go to the Manage resources page.
2. In the project list, select the project that you want to delete and then click Delete.
3. In the dialog, type the project ID and then click Shut down to delete the project.

5. Congratulations

Congratulations! You learned how to set up an OAuth client and use the Cloud Console to grant identity and access management roles to principals for your project.