Skip to content

GAM with minimal GCP rights

Jump to bottom
Ross Scroggs edited this page May 9, 2023 · 2 revisions

GAM setup with minimal GCP permissions.

  • GCP Admin can create a project for the Workspace / GAM admin.

  • GAM admin needs following permissions on the created project resource:

clientauthconfig.brands.create
clientauthconfig.brands.update
clientauthconfig.clients.create
clientauthconfig.clients.createSecret
clientauthconfig.clients.delete
clientauthconfig.clients.get
clientauthconfig.clients.getWithSecret
clientauthconfig.clients.list
clientauthconfig.clients.listWithSecrets
clientauthconfig.clients.update
iam.serviceAccountKeys.create
iam.serviceAccounts.create
iam.serviceAccounts.list
iam.serviceAccounts.setIamPolicy
oauthconfig.testusers.get
oauthconfig.verification.get
resourcemanager.projects.get
serviceusage.services.enable
serviceusage.services.get
serviceusage.services.list

Reasons for permission by service:

Service(s) Reason
clientauthconfig and oauthconfig Manage the OAuth Consent Page
iam Manage service accounts and their keys
serviceusage Enable Google API services
resourcemanager Read basic project info
  • Once GAM admin has rights to the new project they can complete setup with:
gam use project

admin will be prompted for the project ID.

Need more help? Ask on the GAM Discussion Group

Update History

Installation

Configuration

Notes and Information

Definitions

Command Processing

Collections

Client Access

Special Service Account Access

Service Account Access

Clone this wiki locally