Google Cloud permissions

The set of Google Cloud permissions that is required by R‑Cloud and must be granted to the Google Cloud IAM role that is assigned to the HMSA depends on whether the Google Cloud project is added to R‑Cloud as compute or a source. Some permissions are common to both scenarios, while others are specific to a particular scenario:

Service	Permissions
All services	Required when adding compute or a source: iam.serviceAccounts.actAs iam.serviceAccounts.get resourcemanager.projects.get resourcemanager.projects.list
Cloud Key Management	cloudkms.cryptoKeyVersions.useToEncrypt cloudkms.cryptoKeyVersions.useToDecrypt
Google Cloud Storage (required only when adding a source)	storage.buckets.create storage.buckets.createTagBinding storage.buckets.delete storage.buckets.get storage.buckets.getIamPolicy storage.buckets.list storage.buckets.listTagBindings storage.buckets.setIamPolicy storage.buckets.update storage.objects.create storage.objects.delete storage.objects.get storage.objects.getIamPolicy storage.objects.list storage.objects.setIamPolicy storage.objects.update
Google Compute Engine	Required when adding compute or a source: compute.acceleratorTypes.get compute.disks.create compute.disks.get compute.disks.delete compute.disks.setLabels compute.firewalls.list compute.globalOperations.get compute.instances.create compute.instances.delete compute.instances.get compute.instances.getSerialPortOutput compute.instances.setLabels compute.instances.setMachineType compute.instances.setMetadata compute.instances.setServiceAccount compute.instances.setTags compute.instances.start compute.instances.stop compute.instances.update compute.instances.use compute.machineTypes.get compute.machineTypes.list compute.networks.get compute.networks.list compute.networks.updatePolicy compute.networks.use compute.networks.useExternalIp compute.projects.get compute.regionOperations.get compute.regions.get compute.regions.list compute.subnetworks.get compute.subnetworks.list compute.subnetworks.use compute.subnetworks.useExternalIp compute.zoneOperations.get compute.zones.get compute.zones.list Additionally required when adding a source: compute.addresses.create compute.addresses.createInternal compute.addresses.get compute.addresses.list compute.disks.createSnapshot compute.disks.list compute.disks.use compute.disks.useReadOnly compute.firewalls.get compute.firewalls.update compute.images.getFromFamily compute.images.useReadOnly compute.instances.attachDisk compute.instances.detachDisk compute.instances.list compute.licenses.get compute.machineImages.useReadOnly compute.snapshots.create compute.snapshots.delete compute.snapshots.get compute.snapshots.list compute.snapshots.setLabels compute.snapshots.useReadOnly
Google Kubernetes Engine(required only when adding a source)	container.clusterRoleBindings.list container.clusterRoles.list container.configMaps.list container.controllerRevisions.list container.cronJobs.list container.customResourceDefinitions.list container.daemonSets.list container.deployments.list container.endpoints.list container.jobs.list container.limitRanges.list container.networkPolicies.list container.podTemplates.list container.replicationControllers.list container.resourceQuotas.list container.roleBindings.list container.roles.list container.secrets.list container.statefulSets.list container.thirdPartyObjects.list

Additionally, you must grant the following permissions to the Google Cloud IAM role that is assigned to the HMSA or the custom service account for performing operations on the target that you set up for storing data:

Service	Permissions
Google Cloud Storage	cloudkms.cryptoKeyVersions.useToDecrypt cloudkms.cryptoKeyVersions.useToEncrypt storage.buckets.create storage.buckets.createTagBinding storage.buckets.delete storage.buckets.get storage.buckets.getIamPolicy storage.buckets.listTagBindings storage.buckets.setIamPolicy storage.buckets.update storage.objects.create storage.objects.delete storage.objects.get storage.objects.getIamPolicy storage.objects.list storage.objects.setIamPolicy storage.objects.update

Service

Permissions

Google Cloud Storage

cloudkms.cryptoKeyVersions.useToDecrypt
cloudkms.cryptoKeyVersions.useToEncrypt
storage.buckets.create
storage.buckets.createTagBinding
storage.buckets.delete
storage.buckets.get
storage.buckets.getIamPolicy
storage.buckets.listTagBindings
storage.buckets.setIamPolicy
storage.buckets.update
storage.objects.create
storage.objects.delete
storage.objects.get
storage.objects.getIamPolicy
storage.objects.list
storage.objects.setIamPolicy
storage.objects.update

Using the role template for Google Cloud

You can use the role template to create a custom Google CloudIAM role with the least-privilege permissions required by R‑Cloud.

Prerequisite

Your account must have the iam.roles.create permission. If you are a Google Cloud project or organization owner, you have this permission by default. If you are not an owner, you must have either the Organization Role Administrator or the IAM Role Administrator role assigned.

Procedure

Download the R‑Cloud service role template that contains the role definitions. The template is available at the following location:

https://storage.googleapis.com/hycu-public/custom-role/hycu_service_role.yaml
Create a role and grant it the permissions required by R‑Cloud. To do so, run the following command:
```
gcloud iam roles create <RoleID> --project=<ProjectID> --file=<RoleDefinitionFilePath>
```
In this command, <RoleID> is the name of the role (for example hycuRole), <ProjectID> is the name of your Google Cloud project, and <RoleDefinitionFilePath> is the path to the location of the downloaded template that contains the custom role definition.

For details on creating and managing custom roles, see Google Cloud documentation.