Skip to content

googleProjectIamCustomRole

Allows management of a customized Cloud IAM project role. For more information see the official documentation and API.

\~> Warning: Note that custom roles in GCP have the concept of a soft-delete. There are two issues that may arise from this and how roles are propagated. 1) creating a role may involve undeleting and then updating a role with the same name, possibly causing confusing behavior between undelete and update. 2) A deleted role is permanently deleted after 7 days, but it can take up to 30 more days (i.e. between 7 and 37 days after deletion) before the role name is made available again. This means a deleted role that has been deleted for more than 7 days cannot be changed at all by Terraform, and new roles cannot share that name.

Example Usage

This snippet creates a customized IAM role.

/*Provider bindings are generated by running cdktf get.
See https://cdk.tf/provider-generation for more details.*/
import * as google from "./.gen/providers/google";
/*The following providers are missing schema information and might need manual adjustments to synthesize correctly: google.
For a more precise conversion please use the --provider flag in convert.*/
new google.projectIamCustomRole.ProjectIamCustomRole(this, "my-custom-role", {
  description: "A description",
  permissions: ["iam.roles.list", "iam.roles.create", "iam.roles.delete"],
  role_id: "myCustomRole",
  title: "My Custom Role",
});

Argument Reference

The following arguments are supported:

  • roleId - (Required) The camel case role id to use for this role. Cannot contain - characters.

  • title - (Required) A human-readable title for the role.

  • permissions (Required) The names of the permissions this role grants when bound in an IAM policy. At least one permission must be specified.

  • project - (Optional) The project that the service account will be created in. Defaults to the provider project configuration.

  • stage - (Optional) The current launch stage of the role. Defaults to ga. List of possible stages is here.

  • description - (Optional) A human-readable description for the role.

Attributes Reference

In addition to the arguments listed above, the following computed attributes are exported:

  • deleted - (Optional) The current deleted state of the role.

  • id - an identifier for the resource with the format projects/{{project}}/roles/{{roleId}}

  • name - The name of the role in the format projects/{{project}}/roles/{{roleId}}. Like id, this field can be used as a reference in other resources such as IAM role bindings.

Import

Custom Roles can be imported using any of these accepted formats:

$ terraform import google_project_iam_custom_role.default projects/{{project}}/roles/{{role_id}}
$ terraform import google_project_iam_custom_role.default {{project}}/{{role_id}}
$ terraform import google_project_iam_custom_role.default {{role_id}}