Viewing the grantable roles on resources
Stay organized with collections
Save and categorize content based on your preferences.
Before you grant an Identity and Access Management (IAM) role to a user for a
resource, you might want to know what roles are available to grant on a
particular resource.
Before you begin
Enable the IAM API.
Roles required to enable APIs
To enable APIs, you need the serviceusage.services.enable permission. If you
created the project, then you likely already have this permission through the
Owner role (roles/owner). Otherwise, you can get this permission through the
Service Usage Admin role (roles/serviceusage.serviceUsageAdmin).
Learn how to grant roles.
At the bottom of the Google Cloud console, a
Cloud Shell
session starts and displays a command-line prompt. Cloud Shell is a shell environment
with the Google Cloud CLI
already installed and with values already set for
your current project. It can take a few seconds for the session to initialize.
C#
To use the .NET samples on this page in a local development environment, install and
initialize the gcloud CLI, and then set up Application Default Credentials with
your user credentials.
To use the C++ samples on this page in a local development environment, install and
initialize the gcloud CLI, and then set up Application Default Credentials with
your user credentials.
To use the Go samples on this page in a local development environment, install and
initialize the gcloud CLI, and then set up Application Default Credentials with
your user credentials.
To use the Java samples on this page in a local development environment, install and
initialize the gcloud CLI, and then set up Application Default Credentials with
your user credentials.
To use the Python samples on this page in a local development environment, install and
initialize the gcloud CLI, and then set up Application Default Credentials with
your user credentials.
To get the permissions that
you need to list grantable roles,
ask your administrator to grant you the
Security Reviewer (roles/iam.securityReviewer) IAM role on the resource that you want to list grantable roles for.
For more information about granting roles, see Manage access to projects, folders, and organizations.
This role contains the getIamPolicy permissions for all resource types. To
list grantable roles, you need the getIamPolicy permission for the resource
that you want to list grantable roles for—for example, to list grantable
roles for a project, you need the resourcemanager.projects.getIamPolicy
permission.
A role is grantable on or above a resource if it contains any permissions for
that resource type. For example, the storage.admin role grants permissions to
the storage.buckets.get and storage.objects.get APIs, so it is grantable on
the Storage Buckets and Storage Objects resource types.
Roles can also be granted "above" the resource types that their permissions
are defined for. In other words, roles for lower-level resources can be granted
on a resource that is higher in the Google Cloud resource hierarchy. For
example, the storage.admin role can also be granted at the project or
organization levels, in addition to Storage Buckets.
Permissions granted by a role only affect resources at the specified level or
below; they do not affect higher-level or peer resources. Additionally, when a
role is granted on a resource, only permissions applicable to the given resource
are granted, regardless of the role's name, description, or other permissions it
contains. For example, assigning the role resourcemanager.organizationAdmin
(which grants the permission resourcemanager.projects.list) to a user on the
project level only grants them permissions for that specific project. It will
not allow them to list or administer all projects in the organization.
Similarly, assigning the compute.admin role on a specific Compute Engine
instance only grants permissions for that instance, not others in the project.
Listing grantable roles
You can list grantable roles using the Google Cloud console, the Google Cloud CLI,
the IAM API, or the IAM client libraries.
The Google Cloud console always lists all grantable roles for the resource you're
viewing. The Google Cloud CLI, IAM API, and client libraries only list
grantable roles for enabled APIs.
Console
To view grantable roles for a project, folder, or organization, do the
following:
gcloud iam list-grantable-roles full-resource-name
Depending on the desired resource, a large number of roles may be returned.
To limit the results, you can specify a filter expression.
The output will look something like:
description:Full control of all Compute Engine resources.name:roles/compute.admintitle:Compute Admin---description:Full control of Compute Engine instance resources.name:roles/compute.instanceAdmintitle:Compute Instance Admin# Additional results here...
Copy the request body and open the
method reference page.
The APIs Explorer panel opens on the right side of the page.
You can interact with this tool to send requests.
Paste the request body in this tool, complete any other required fields, and click Execute.
You should receive a JSON response similar to the following:
{
"roles": [
{
"name": "roles/compute.admin",
"title": "Compute Admin",
"description": "Full control of all Compute Engine resources."
},
{
"name": "roles/compute.instanceAdmin",
"title": "Compute Instance Admin (beta)",
"description": "Full control of Compute Engine instance resources."
}
]
}
In the examples above, the full resource name is a scheme-less URI
consisting of a DNS-compatible API service name and a resource path.
For example, to return all roles grantable on a project, use:
Lower-level resources have a more detailed fully qualified name. For
example, use the following to return all roles grantable on a Compute Engine
instance:
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2026-07-21 UTC."],[],[]]
