GCP uses principle of least privilege – grant no more (and no less) privileges to a user/account than is

required to do the job/task

If you provide too few privileges job cannot be completed and too many privileges is a security concern

GCP has 3 types of IAM roles available –

Primitive roles, which include owner, editor and viewer that are more coarse grained

Predefined roles, which provide granular access for a specific service and are managed by google cloud

Custom roles, which provide granular access according to a user-specified list of permissions

To create a custom role you begin with a predefined role and add or remove access to suit the custom
access requirements

ROLE ACCESS
OWNER Add/Remove members, delete project
EDITOR Deploy applications, modify code, configure services
VIEWER View/Read access
BILLING ADMINISTRATOR Manage Billing, Add/Remove billing admins