Apply IAM roles
This page describes how to grant Spanner Identity and Access Management (IAM)permissions to an account for a Google Cloud project, instance, database, orbackup.
For information on Google Cloud roles, seeUnderstanding roles, and for more information onSpanner roles, seeAccess control: roles.
Note: If your account doesn't have sufficient permissions, you won't be ableto view some of the items in the following directions. In this case, ask yourproject's owner to grant you additional permissions.Project-level permissions
You can grant IAM permissions for an entire Google Cloud project toan account in theIAM page of the Google Cloud console. Adding permissionsat the project level grants the IAM permissions to an account forall Spanner instances, databases, and backups in the project.
Verify that you can add permissions
Before you attempt to apply project-level permissions, check that you havesufficient permissions to apply roles to another account. You need permissionsat the project level.
Go to your project'sIAM page.
SelectPrincipals as theView by option.
Find your account in the list. If your account is listed asOwner orEditor in theRole column, you have sufficient permissions.
If you don't have sufficient permissions at the project level, ask theproject's owner to grant you additional permissions.
Grant permissions to principals
Go to your project'sIAM page.
SelectPrincipals as theView by option.
Find the account in the list and clickEdit
.On theEdit permissions page, clickAdd Another Role.
Select a role in the drop-down list.
ClickSave.
Add principals to the project
Go to your project'sIAM page.
Click theAdd button below the toolbar.
In theNew principals box, enter the email for the account that you wantto add.
Select a role in the drop-down list.
ClickSave.
For more information, seeGranting, changing, and revoking access.
Instance-level permissions
You can grant instance-level IAM permissions to an account in theIAM page of the Google Cloud console.
Verify that you can add permissions
Before you attempt to apply instance-level permissions at the instance level,check that you have sufficient permissions to apply roles to another account.You need permissions at the project or instance level.
Go to your project'sIAM page.
SelectPrincipals as theView by option.
Find your account in the list. If your account is listed asOwner,Editor, orCloud Spanner Admin in theRole column,you have sufficient permissions. If not, continue to the next step.
Go to the SpannerInstances page.
Select the checkbox for the instance.
In thePermissions tab of theInfo panel, expand the principal listsand find your account. If your account is listed asOwner,Editor, orSpanner Admin, you havesufficient permissions.
If you don't have sufficient permissions at the project or instance level, askthe project's owner to grant you additional permissions.
Add instance-level permissions
Use the following steps to apply roles for Spanner to an instancein a project.
Go to the SpannerInstances page.
Select the checkbox for the instance.
Click thePermissions tab in theInfo panel.
In theAdd principals box in theInfo panel, enter the email addressfor the account that you want to add.
Select one or more roles in the drop-down list.
ClickAdd.
Database-level permissions
You can grant database-level IAM permissions to an account in theIAM page of the Google Cloud console.
Verify that you can add permissions
Before you attempt to apply database-level permissions, check that you havesufficient permissions to apply roles to another account. You need permissionsat the project, instance, or database level.
Go to your project'sIAM page.
SelectPrincipals as theView by option.
Find your account in the list. If your account is listed asOwner,Editor,Cloud Spanner Admin, orCloud Spanner Database Admin in theRole column, you have sufficient permissions. If not, continue to the next step.
Go to the SpannerInstances page.
Select the checkbox for the instance that contains your database.
In thePermissions tab of theInfo panel, expand the principal listsand find your account. If your account is listed asOwner,Editor,Spanner Admin orSpanner Database Admin,you have sufficient permissions. If not, continue to the next step.
Click the instance name to go to theInstance details page.
ClickShow Info panel.
In theOverview tab of the page, select the checkbox for your database.
In thePermissions tab of theInfo panel, expand the principal listsand find your account. If your account is listed asOwner,Editor,Spanner Admin, orSpannerDatabase Admin, you have sufficient permissions.
If you don't have sufficient permissions at the project, instance, or databaselevel, ask the project's owner to grant you additional permissions.
Add database-level permissions
Follow these steps to grant access to database-level roles for a principal.
Go to the SpannerInstances page.
Click the name of the instance that contains your database to go to theInstance details page.
In theOverview tab, select the checkbox for your database.
TheInfopanel appears.ClickAdd principal.
In theAdd principals panel, inNew principals, enter the emailaddress for the account that you want to add.
Select one or more roles in the drop-down list.
ClickSave.
Remove database-level permissions
Follow these steps to remove database-level roles from a principal.
Note: This procedure assumes that you know the role that you want to remove froma principal. If you don't know which roles a principal has, use theIAM Google Cloud console to first view the roles that a principalhas, and then revoke the roles. For details, seeRevoke a single role.Go to the SpannerInstances page.
Click the name of the instance that contains your database to go to theInstance details page.
In theOverview tab, select the checkbox for your database.
TheInfopanel appears.In theInfo panel, underRole/Principal, locate the database-levelrole that you want to remove, and expand it.
A list of principals who have this role is shown.
Click the trash icon adjacent to the principal from whom you want to removethe role.
In the confirmation dialog, select the checkbox and clickREMOVE.
Backup-level permissions
You can grant backup-level IAM permissions to an account in theIAM page of the Google Cloud console.
Verify that you can add permissions
Before you attempt to apply backup-level permissions, check that you havesufficient permissions to apply roles to another account. You need permissionsat the project, instance, or backup.
Go to your project'sIAM page.
SelectPrincipals as theView by option.
Find your account in the list. If your account is listed asOwner,Editor,Cloud Spanner Admin,Cloud Spanner Backup Admin in theRole column, you have sufficient permissions. If not, continue to thnext step.
Go to the SpannerInstances page.
Select the checkbox for the instance that contains your backup.
In thePermissions tab of theInfo panel, expand the principal lists andfind your account. If your account is listed asOwner,Editor,Spanner Admin orSpanner Backup Admin,you have sufficient permissions. If not, continue to the next step.
Click the instance name to go to theInstance details page.
Click theBackup/Restore tab and select your backup from theBackup table.
ClickShow Info Panel.
In theInfo Panel find your account. If your account is listed asOwner,Editor,Cloud Spanner Admin, orCloud Spanner Backup Admin intheRole column, you have sufficient permissions.
If you don't have sufficient permissions at the project or instancelevel, ask the project's owner to grant you additional permissions.
Add backup-level permissions
Use the following steps to apply roles for Spanner to an individualbackup in a project.
Go to the SpannerInstances page.
Click the name of the instance that contains your backup to go to theInstance details page.
In theBackup/Restore tab, select your backup.
TheInfopanel appears.Click thePermissions tab in theInfo panel.
In theAdd principals box in theInfo panel, enter the email address forthe account that you want to add.
Select one or more roles in the drop-down list.
ClickAdd.
Except as otherwise noted, the content of this page is licensed under theCreative Commons Attribution 4.0 License, and code samples are licensed under theApache 2.0 License. For details, see theGoogle Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.
Last updated 2026-02-19 UTC.