Identity and Access Management (IAM) lets you manage access to Cloud Scheduler resources by granting specific permissions to principals, such as users, groups, and service accounts. You can assign predefined or custom roles to control who can view, configure, and run scheduled jobs.
Overview
Cloud Scheduler uses IAM for access control.
For an introduction to IAM and its features, see the IAM overview. To learn how to grant and revoke access, see Manage access to projects, folders, and organizations.
For lists of the permissions and roles that Cloud Scheduler supports, see the following sections.
Enable the Cloud Scheduler API
To view and assign IAM roles for Cloud Scheduler, you must enable the Cloud Scheduler API for your project. You won't be able to see the Cloud Scheduler roles in the Google Cloud console until you enable the API.
Roles required to enable APIs
To enable APIs, you need the serviceusage.services.enable permission. If you
created the project, then you likely already have this permission through the
Owner role (roles/owner). Otherwise, you can get this permission through the
Service Usage Admin role (roles/serviceusage.serviceUsageAdmin).
Learn how to grant roles.
Predefined roles
The following table lists the Cloud Scheduler predefined IAM roles with a corresponding list of all the permissions each role includes.
The predefined roles address most typical use cases. If your use case isn't covered by the predefined roles, you can create an IAM custom role.
Cloud Scheduler roles
| Role | Permissions |
|---|---|
Cloud Scheduler Admin( Full access to jobs and executions. Note that a Cloud Scheduler Admin (or any custom role with the permission cloudscheduler.jobs.create) can create jobs that publish to any Pub/Sub topics within the project. Lowest-level resources where you can grant this role:
|
|
Cloud Scheduler Viewer( Get and list access to jobs, executions, and locations. Lowest-level resources where you can grant this role:
|
|
Cloud Scheduler Job Runner( Access to run jobs. Lowest-level resources where you can grant this role:
|
|
Service agent roles
Service agent roles should only be granted to service agents.
| Role | Permissions |
|---|---|
Cloud Scheduler Service Agent( Grants Cloud Scheduler Service Account access to manage resources. |
|
Project-level IAM management
At the project level, or through inheritance from a folder or organization, you can grant, change, and revoke IAM roles using the Google Cloud console, the IAM API, or the Google Cloud CLI. For more information, see Manage access to projects, folders, and organizations.
Cloud Scheduler doesn't support resource-level IAM policies or IAM Conditions resource attributes on individual jobs. Any Cloud Scheduler role granted to a principal applies to all jobs in the project:
To restrict which principals can view, modify, or run specific jobs, create those jobs in separate projects.
To restrict which target resources an individual HTTP target job can invoke when it runs, configure the job with a dedicated user-managed service account that has only the permissions needed for that target. Principals who create or update the job must also have the
iam.serviceAccounts.actAspermission on that service account, which you can grant on individual service accounts using the Service Account User role (roles/iam.serviceAccountUser).