PermissionSets to RoleBindings
Important: PermissionSets are deprecated. Use role bindings to manage access instead.
Permission sets have been deprecated in favor of role bindings, a more powerful way to grant fine grained permissions. This page explains what changed and how permission set concepts map to role bindings.
What changed
Permission sets were a simple mechanism to grant access: a subject was either an admin or they weren't. Role bindings replace this with a finer-grained model based on predefined roles and permissions.
| Permission sets | Role bindings |
|---|---|
Binary admin flag | One or more predefined roles, each with granular permissions |
| Subject identified by email | Principal identified by FQID |
| Access to every resource in the scope | Optional resource-limited roles that grants access to specific resources |
Role bindings provide:
- Granular roles: grant roles that bundle specific permissions, such as
compute.virtualMachines.start. - Resource-limited access: restrict a role to specific resources using FQID patterns with
*wildcards. - Additive roles: a principal can hold several roles on the same scope and receives the union of their permissions.
Learn more
- Fine-grained access - Understand roles, permissions, principals, and role bindings
- Manage role bindings - Grant and revoke access with role bindings
- Permissions and roles - Review predefined roles and permission descriptions