create custom roles for application integration service accounts

[dareenhamdy]

I want to create a custom role with only required permissions, and that I don’t want to use wild roles like Connectors.admin or SQL admin for the following connectors Pub/sub , cloud sql , and Cloud storage.

what are the list of ONLY actually needed permissions not the generic full list as mentioned in the documentation ?

https://cloud.google.com/integration-connectors/docs/connectors/cloudstorage/configure
https://cloud.google.com/integration-connectors/docs/connectors/cloudsqlforsqlserver/configure
https://cloud.google.com/integration-connectors/docs/connectors/pubsub/configure

[AldoMeneses86]

Hello @dareenhamdy 

You can create a custom role: https://cloud.google.com/integration-connectors/docs/connectors-access-permissions#iam-roles-for-int...

You can learn more in this excellent article from my colleague @kurtkanaskie. Is for apigee but can applies for Application Integration.

Best.

[dareenhamdy]

thank you for refencing to that but that still does not list the permissions specific list.
that's not my part , Devops team would like a specific roles list,

[vpagar]

Hello @dareenhamdy 
Could you please provide clarity on which specific entities or actions you intend to use for these connectors
Pub/sub , cloud sql , and Cloud storage ?

[vpagar]

Hi @dareenhamdy . Please follow the below information and let us know how it goes.
1] For the Pub/Sub connector, no specific role needs to be assigned explicitly. However, the permission pubsub.topics.publish is required to allow the connector to publish messages to the designated topic.

2] For the Cloud SQL – SQL Server connector, the permissions cloudsql.instances.connect and cloudsql.instances.get are essential. These enable the connector to establish a connection to the Cloud SQL instance and retrieve necessary instance metadata. With these permissions in place, the connector can execute custom queries and perform CRUD (Create, Read, Update, Delete) operations on the database.

3] In the case of the Cloud Storage connector, the following permissions are necessary: storage.buckets.list, storage.objects.get, storage.objects.create, storage.objects.delete. These permissions support various actions such as DownloadObject,UploadObject,CopyObject,MoveObject,DeleteObject,SignURL and entities[with CRUD] such as Bucket and Object.