CODEWITHSUNDEEP
google-cloud-platformgoogle-iamgoogle-cloud-iam
arvindwill
arvindwill

Reputation: 1992

GCP - IAM Restrict Delete access for Admin Role

In Google Cloud Platform for all services as common, Is it possible to provide Admin Access but without deleting access to any resources? So user or service-account can perform read, create, update operations but delete alone will be restricted.

Upvotes: 0

Views: 363

Answers (1)

John Hanley
John Hanley

Reputation: 81416

The quick answer is no.

For some resources create and update are delete operations. You must consider the resource and the data contained by the resource. For example, updating a Cloud Storage object with zero-length content effectively deletes the content of the object.

For most resources, you can create a custom role with specific permissions. However, not all permissions can be assigned to custom roles, which means you must use a predefined role.

Some resources support delete inhibit (Compute Engine, Cloud Storage), but not all do.

Some resources cannot be deleted (KMS key ring, resources, and versions).

You will need to analyze your requirements resource by resource.

Upvotes: 1

Related Questions