Apigee Hybrid roles and permission

[aramkrishna6]

Hi,

Per link lists the Apigee Hybrid roles 

1) Do we any additional list of Roles  (Predefined Roles) other than "Analytics Editor", "API Admin", "Analytics Viewer" , "Environment Admin" , "Developer Admin" "Read Only Admin" and "Org Admin" to be configured for Identity and Access Managment ?  to cover the predefined role for Apigee Hybrid

Let me know, any additional link. which should be additionally configured ?. 

2) Listed Roles link did not list  permission for "Api Roles" and "permission" for "Read Only Admin" and "Org Admin", where do we find such information ? 

@dino   @Former Community Member @API-Evangelist  

[miguelmendoza]

@aramkrishna6 

1) There are some roles that are needed by the Apigee hybrid components. The docs list what roles are needed by the Service Accounts used by these components here:

https://cloud.google.com/apigee/docs/hybrid/v1.8/sa-about#recommended-sas

(There is a tool included in the Apigee hybrid installer tar ball that creates these Service Accounts for you, and assigns the necessary roles)

2) The API Admin, Org Admin, and Read-Only Admin roles are in the docs list, see:

https://cloud.google.com/iam/docs/understanding-roles#apigee.apiAdminV2

https://cloud.google.com/iam/docs/understanding-roles#apigee.admin

https://cloud.google.com/iam/docs/understanding-roles#apigee.readOnlyAdmin

Another source to look at the actual permissions contained in a specific role, is to use the Google Cloud Console itself, see:

https://console.cloud.google.com/iam-admin/roles/details/roles%3Capigee.apiAdminV2
https://console.cloud.google.com/iam-admin/roles/details/roles%3Capigee.admin
https://console.cloud.google.com/iam-admin/roles/details/roles%3Capigee.readOnlyAdmin

[aramkrishna6]

@miguelmendoza  Thanks for details.

1) When I review below information for Service Account understand that Roles is assigned by tool which I believe will make sure necessary permission is also given to listed service Account ?  

https://cloud.google.com/apigee/docs/hybrid/v1.8/sa-about#recommended-sas

(There is a tool included in the Apigee hybrid installer tar ball that creates these Service Accounts for you, and assigns the necessary roles)

2) Reason of missing Org Admin, and Read-Only Admin  was I believe it named as "Apigee Organization Admin" instead of OrgAdmin and "ApigeeReadOnlyAdmin" instead of ReadOnlyAdmin, in documentation. Now its clarified

[dchiesa1]

Reason of missing Org Admin, and Read-Only Admin was I believe it named as "Apigee Organization Admin" instead of OrgAdmin and "ApigeeReadOnlyAdmin" instead of ReadOnlyAdmin, in documentation. Now its clarified

Can you clarify, where did you see "OrgAdmin" and "ReadOnlyAdmin" in the Apigee documentation? I'd like to get that corrected.

[aramkrishna6]

@dino  When I compare details listed in  Apigee Roles which has a column named "Apigee roles" with Apigee Specific Roles  "Curated Role Name" Colum name. I see some of listed items missing but has additional Apigee attached to it in the name.

[aramkrishna6]

@miguelmendoza  Does  Listed Link for Apigee Roles and Permission in IAM basic and predefined roles reference  |  IAM Documentation  |  Google Cloud is enough for installation and configuration  of Apigee Control Plane?.