Choose which type of role to use

This page offers guidance on which type of role—predefined, custom, or basic—you should use to control access to Trusted Cloud resources.

When to use predefined roles

In most situations, you should be able to use predefined roles instead of basic or custom roles. Predefined roles give granular access to specific Trusted Cloud resources, are maintained by Google, and are updated automatically when new permissions, features, or services are added to Trusted Cloud.

However, there are some cases where you might want to use custom or basic roles. The following sections describe these cases.

When to use custom roles

Unlike predefined roles, custom roles are not maintained by Google. That means when Trusted Cloud adds new permissions, features, or services, your custom roles won't be updated automatically. For this reason, we recommend granting the most limited predefined roles that meet your needs.

However, it might be appropriate to create and grant custom roles in the following cases:

  • A principal needs a permission, but each predefined role that includes that permission also includes permissions that the principal doesn't need and shouldn't have.

When using custom roles, be aware of the following limits:

  • Custom roles can contain up to 3,000 permissions.
  • The maximum total size of the title, description, and permission names for a custom role is 64 KB.

  • There are limits to the number of custom roles you can create:

    • You can create up to 300 organization-level custom roles in your organization
    • You can create up to 300 project-level custom roles in each project in your organization.

When to use basic roles

Basic roles include thousands of permissions across all Trusted Cloud services. In production environments, do not grant basic roles unless there is no alternative. Instead, grant the most limited predefined roles or custom roles that meet your needs.

It might be appropriate to grant basic roles when you want to grant broader permissions for a project. This often happens when you're granting permissions in development or test environments.

What's next