title: Give object-based premissions in GCP IAM
body: <h1>Usecase :</h1>
  
  <p>I have a GCP setup with :</p>
  
  <ul>
  <li>multiple <a href="https://cloud.google.com/kubernetes-engine/docs/" rel="nofollow noreferrer">Google Kubernetes Engine</a> clusters</li>
  <li>multiple <a href="https://cloud.google.com/sql/docs/postgres/" rel="nofollow noreferrer">CloudSQL</a> instances</li>
  <li>multiple <a href="https://cloud.google.com/storage/docs/" rel="nofollow noreferrer">GCS buckets</a></li>
  </ul>
  
  <p>Basically, I'd like to give permissions to users with finer granularity than project-wide (ie user A can only access bucket B, but can access CloudSQL instances C and D)</p>
  
  <h1>Possible solutions :</h1>
  
  <p>For GCS, this is <a href="https://cloud.google.com/storage/docs/access-control/using-iam-permissions" rel="nofollow noreferrer">easy and documented</a>.</p>
  
  <p>However, I couldn't find anything similar for the other two. The CloudSQL documentation even seems to say it is <a href="https://cloud.google.com/sql/docs/mysql/project-access-control" rel="nofollow noreferrer">not possible</a> (<code>All permissions are applied to the project. You cannot apply different permissions based on the instance or other lower-level object.</code>)</p>
  
  <h1>Workarounds explored :</h1>
  
  <ul>
  <li>I tried creating <a href="https://cloud.google.com/iam/docs/creating-custom-roles" rel="nofollow noreferrer">custom IAM roles</a>. I was hoping that there would be some way to filter on objects the role is applied to, in a fashion similar to what AWS IAM <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_controlling.html" rel="nofollow noreferrer">allows with its <code>Resource</code> filter</a>.
  That's apparently not possible here.</li>
  <li>For GKE, I can give every user the <code>Kubernetes Engine Cluster Viewer</code> role (which basically just allows to list clusters and basic info about them, as well as logging on with <code>gcloud</code> cli tool), and then use the <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/" rel="nofollow noreferrer">Kubernetes RBAC</a> engine to give very fine-grained permissions. This works fine, but doesn't allow the user to use the Google web interface, which is extremely handy, especially for a beginner on k8s.</li>
  <li>Similarly, for CloudSQL, I can give the <code>Cloud SQL Client</code> role, and manage my users directly through the postgres access control system. This works fine, but my users are able to connect to other instances (they still need an account on these instances, of course). Moreover, operations such as restoring a backup cannot be allowed only on specific instances.</li>
  </ul>
  
  <p>So, have I missed something obvious, or have anybody found some way to work around these limitations ?</p>