Manage access to your resources with Identity and Access Management (IAM).IAM lets you give more granular access to specificGoogle Cloudresources and prevents unwanted access to other resources. Thispage describes the IAM permissions and roles forCloud Firestore. For a detailed description of IAM, read theIAM documentation.

IAM lets you adopt thesecurity principle of least privilege,so you grant only the necessary access to your resources.

IAM lets you controlwho (user) haswhat (role)permission forwhich resources by setting IAM policies.IAM policies grant one or more roles to a user, giving theuser certain permissions. For example, you can grant thedatastore.indexAdminrole to a user, which allows the user to create, modify, delete, list, or viewindexes.

Permissions and roles

This section summarizes the permissions and roles thatCloud Firestoresupports.

With IAM, every API method inCloud Firestorerequires that the account making the API request has the appropriate permissionsto use the resource. Permissions are granted by setting policies that grantroles to a user, group, or service account. In addition to the primitive roles,owner, editor, and viewer,you can grantCloud Firestore roles to the users of your project.

The following table lists theCloud Firestore IAMroles. You can grant multiple roles to a user, group, or service account.

Custom roles

If the predefined roles do not address your business requirements,you can define your own custom roles with permissions thatyou specify:

• Learn about custom roles.
• Create and manage custom roles.

Required roles to create and manage tags

If any tag is represented in create or restore actions, some roles are required. SeeCreating and managing tags for more details on creating tag key-value pairs before associate them to the database resources.

The following listed permissions are required.

View tags

• datastore.databases.listTagBindings
• datastore.databases.listEffectiveTags

Manage tags on resources

The following permission is required for the database resource you're attaching the tag value.

• datastore.databases.createTagBinding

Permissions

The following table lists the permissions thatCloud Firestore supports.

Role change latency

Cloud Firestore caches IAM permissions for 5 minutes,so it takes up to 5 minutes for a role change to become effective.

ManagingCloud Firestore IAM

You can get and set IAM policies using the Google Cloud console,the IAM API, or thegcloud command-line tool. SeeGranting, Changing, and Revoking Access to Project Membersfor details.

Configure conditional access permissions

You can useIAM Conditions todefine and enforce conditional access control.

For example, the following condition assigns a principal thedatastore.userrole up until a specified date:

{"role":"roles/datastore.user","members":["user:travis@example.com"],"condition":{"title":"Expires_December_1_2023","description":"Expires on December 1, 2023","expression":"request.time < timestamp('2023-12-01T00:00:00.000Z')"}}

To learn how to define IAM Conditions for temporary access,seeConfigure temporary access.

To learn how to configure IAM Conditions for access to one or moredatabases, seeConfigure database access conditions.

What's next

• Learn more aboutIAM.
• Grant IAM roles.
• Learn aboutauthentication.