Permissions and roles

This page lists the predefined IAM roles and permissions available for fine-grained access. It includes 20 predefined roles and 154 unique permissions.

Permissions use the format service.resource.action. You grant permissions by assigning predefined roles to users or service accounts; permissions aren't granted directly.

Use the roles API to retrieve role definitions programmatically:

Get an access token for the API examples:

TOKEN="$(evroc iam get-access-token)"
curl -H "Authorization: Bearer $TOKEN" \
  https://api.evroc.com/iam/v1beta1/roles

evroc's API responds with 404 Not Found when the caller doesn't have permissions to access a resource.

Action names

Action	Meaning
`list`	List resources of a type.
`read`	View details for one resource.
`create`	Create a resource.
`update`	Change a resource.
`delete`	Delete a resource.
`use`	Reference or attach a resource when creating or updating another resource.
`actAs`	Use a service account as the identity for a workload or operation.

Some services also define resource-specific actions, such as start and stop (Think instances) or setRetentionPolicy, setLegalHold, and enableVersioning (storage).

Predefined roles

Role	Scope	Description	Permissions
`/iam/roles/cicdInfrastructureManager`	project	Provision and manage infrastructure for CI/CD pipelines.	43
`/iam/roles/computeOperator`	project	Create, manage, and operate compute resources within a project.	27
`/iam/roles/computeViewer`	project	Read-only access to compute resources (virtual machines, disks, placement groups).	11
`/iam/roles/loadBalancerOperator`	project	Create, manage, and operate load balancer resources within a project.	21
`/iam/roles/loadBalancerViewer`	project	Read-only access to load balancer resources.	9
`/iam/roles/networkingOperator`	project	Create, manage, and operate networking resources within a project.	25
`/iam/roles/networkingUser`	project	Consume shared networking resources (public IPs, security groups, VPCs, subnets) without managing them.	3
`/iam/roles/networkingViewer`	project	Read-only access to networking resources.	9
`/iam/roles/organizationAccessAdministrator`	organization	Manages role bindings, invitations, and users within an organization.	19
`/iam/roles/organizationOwner`	organization	Full control over an organization, its projects, and all access management.	23
`/iam/roles/organizationProjectCreator`	organization	Can create and view projects within an organization.	7
`/iam/roles/organizationViewer`	organization	Read-only access to an organization and its projects.	7
`/iam/roles/projectAccessAdministrator`	project	Manages role bindings within a project.	19
`/iam/roles/projectContributor`	project	Create and manage service resources within a project; no access management.	135
`/iam/roles/projectOwner`	project	Full control over a project, including all service resources and access management.	141
`/iam/roles/quotaViewer`	project	Read-only access to project quotas.	4
`/iam/roles/securityIncidentResponder`	project	Read access for incident response across compute and networking.	31
`/iam/roles/storageOperator`	project	Manage storage buckets, their configuration and their contents.	28
`/iam/roles/thinkOperator`	project	Create, manage, and operate Think instances, API keys, and chats.	23
`/iam/roles/thinkViewer`	project	Read-only access to Think instances, API keys, and chats.	13

Permissions by service

Compute permissions

Permission	Description
`compute.disks.create`	Create disks.
`compute.disks.delete`	Delete disks.
`compute.disks.list`	List disks.
`compute.disks.read`	View disks.
`compute.disks.update`	Update disks.
`compute.disks.use`	Use disks when creating or updating another resource.
`compute.hotswapDiskAttachments.create`	Create hotswap disk attachments.
`compute.hotswapDiskAttachments.delete`	Delete hotswap disk attachments.
`compute.hotswapDiskAttachments.list`	List hotswap disk attachments.
`compute.hotswapDiskAttachments.read`	View hotswap disk attachments.
`compute.hotswapDiskAttachments.update`	Update hotswap disk attachments.
`compute.placementGroups.create`	Create placement groups.
`compute.placementGroups.delete`	Delete placement groups.
`compute.placementGroups.list`	List placement groups.
`compute.placementGroups.read`	View placement groups.
`compute.placementGroups.update`	Update placement groups.
`compute.snapshots.create`	Create snapshots.
`compute.snapshots.delete`	Delete snapshots.
`compute.snapshots.list`	List snapshots.
`compute.snapshots.read`	View snapshots.
`compute.snapshots.update`	Update snapshots.
`compute.virtualMachines.create`	Create VMs.
`compute.virtualMachines.delete`	Delete VMs.
`compute.virtualMachines.list`	List VMs.
`compute.virtualMachines.read`	View VMs.
`compute.virtualMachines.update`	Update VMs.

IAM permissions

Permission	Description
`iam.invitations.create`	Create and send invitations.
`iam.invitations.list`	List invitations.
`iam.invitations.read`	View invitations.
`iam.invitations.revoke`	Revoke invitations.
`iam.organizations.list`	List organizations.
`iam.organizations.read`	View organizations.
`iam.organizations.update`	Update organizations.
`iam.projects.create`	Create projects.
`iam.projects.delete`	Delete projects.
`iam.projects.list`	List projects.
`iam.projects.read`	View projects.
`iam.projects.update`	Update projects.
`iam.roleBindings.create`	Create role bindings.
`iam.roleBindings.delete`	Delete role bindings.
`iam.roleBindings.list`	List role bindings.
`iam.roleBindings.read`	View role bindings.
`iam.roleBindings.update`	Update role bindings.
`iam.roles.list`	List roles.
`iam.roles.read`	View roles.
`iam.serviceAccounts.actAs`	Use a service account as the identity for a workload or operation.
`iam.serviceAccounts.create`	Create service accounts.
`iam.serviceAccounts.delete`	Delete service accounts.
`iam.serviceAccounts.list`	List service accounts.
`iam.serviceAccounts.read`	View service accounts.
`iam.serviceAccounts.update`	Update service accounts.
`iam.users.list`	List users.
`iam.users.remove`	Remove users from an organization.

Load balancer permissions

Permission	Description
`loadbalancer.backendPools.create`	Create backend pools.
`loadbalancer.backendPools.delete`	Delete backend pools.
`loadbalancer.backendPools.list`	List backend pools.
`loadbalancer.backendPools.read`	View backend pools.
`loadbalancer.backendPools.update`	Update backend pools.
`loadbalancer.backendServices.create`	Create backend services.
`loadbalancer.backendServices.delete`	Delete backend services.
`loadbalancer.backendServices.list`	List backend services.
`loadbalancer.backendServices.read`	View backend services.
`loadbalancer.backendServices.update`	Update backend services.
`loadbalancer.l4Routes.create`	Create L4 routes.
`loadbalancer.l4Routes.delete`	Delete L4 routes.
`loadbalancer.l4Routes.list`	List L4 routes.
`loadbalancer.l4Routes.read`	View L4 routes.
`loadbalancer.l4Routes.update`	Update L4 routes.
`loadbalancer.loadBalancers.create`	Create load balancers.
`loadbalancer.loadBalancers.delete`	Delete load balancers.
`loadbalancer.loadBalancers.list`	List load balancers.
`loadbalancer.loadBalancers.read`	View load balancers.
`loadbalancer.loadBalancers.update`	Update load balancers.

Networking permissions

Permission	Description
`networking.publicIPs.create`	Create public IPs.
`networking.publicIPs.delete`	Delete public IPs.
`networking.publicIPs.list`	List public IPs.
`networking.publicIPs.read`	View public IPs.
`networking.publicIPs.update`	Update public IPs.
`networking.publicIPs.use`	Use public IPs when creating or updating another resource.
`networking.securityGroups.create`	Create security groups.
`networking.securityGroups.delete`	Delete security groups.
`networking.securityGroups.list`	List security groups.
`networking.securityGroups.read`	View security groups.
`networking.securityGroups.update`	Update security groups.
`networking.securityGroups.use`	Use security groups when creating or updating another resource.
`networking.subnets.create`	Create subnets.
`networking.subnets.delete`	Delete subnets.
`networking.subnets.list`	List subnets.
`networking.subnets.read`	View subnets.
`networking.subnets.update`	Update subnets.
`networking.subnets.use`	Use subnets when creating or updating another resource.
`networking.virtualPrivateClouds.create`	Create virtual private clouds.
`networking.virtualPrivateClouds.delete`	Delete virtual private clouds.
`networking.virtualPrivateClouds.list`	List VPCs.
`networking.virtualPrivateClouds.read`	View VPCs.
`networking.virtualPrivateClouds.update`	Update virtual private clouds.
`networking.virtualPrivateClouds.use`	Use VPCs when creating or updating another resource.

Quotas permissions

Permission	Description
`quotas.orgQuotas.read`	View organization quotas.
`quotas.projectQuotas.read`	View project quotas.

Storage permissions

Permission	Description
`storage.bucketServiceAccountSecrets.read`	View bucket service account secrets.
`storage.bucketServiceAccounts.create`	Create bucket service accounts.
`storage.bucketServiceAccounts.delete`	Delete bucket service accounts.
`storage.bucketServiceAccounts.list`	List bucket service accounts.
`storage.bucketServiceAccounts.read`	View bucket service accounts.
`storage.bucketServiceAccounts.update`	Update bucket service accounts.
`storage.buckets.create`	Create buckets.
`storage.buckets.delete`	Delete buckets.
`storage.buckets.enableObjectLock`	Enable object lock on buckets.
`storage.buckets.enableVersioning`	Enable versioning on buckets.
`storage.buckets.list`	List buckets.
`storage.buckets.read`	View buckets.
`storage.buckets.setAccessPolicy`	Set bucket access policies.
`storage.buckets.setEncryptionKey`	Set bucket encryption keys.
`storage.buckets.setRetentionPolicy`	Set bucket retention policies.
`storage.buckets.setTags`	Set tags on buckets or objects.
`storage.buckets.update`	Update buckets.
`storage.fileStores.create`	Create file stores.
`storage.fileStores.delete`	Delete file stores.
`storage.fileStores.list`	List file stores.
`storage.fileStores.read`	View file stores.
`storage.fileStores.update`	Update file stores.
`storage.objects.clearLegalHold`	Clear legal holds from objects.
`storage.objects.clearRetention`	Clear object retention settings.
`storage.objects.create`	Create objects.
`storage.objects.delete`	Delete objects.
`storage.objects.list`	List objects.
`storage.objects.listVersions`	List object versions.
`storage.objects.read`	View objects.
`storage.objects.setLegalHold`	Set legal holds on objects.
`storage.objects.setRetention`	Set object retention settings.
`storage.objects.setTags`	Set tags on buckets or objects.

Think permissions

Permission	Description
`think.apiKeys.create`	Create API keys.
`think.apiKeys.delete`	Delete API keys.
`think.apiKeys.list`	List API keys.
`think.apiKeys.read`	View API keys.
`think.chats.create`	Create chats.
`think.chats.delete`	Delete chats.
`think.chats.list`	List chats.
`think.chats.read`	View chats.
`think.chats.update`	Update chats.
`think.instances.create`	Create Think instances.
`think.instances.delete`	Delete Think instances.
`think.instances.list`	List Think instances.
`think.instances.read`	View Think instances.
`think.instances.start`	Start Think instances.
`think.instances.stop`	Stop Think instances.
`think.instances.update`	Update Think instances.
`think.models.list`	List models.
`think.models.read`	View models.
`think.sharedModels.list`	List shared models.
`think.sharedModels.read`	View shared models.
`think.sizes.list`	List sizes.
`think.sizes.read`	View sizes.

evroc User Documentation