All courses
Resource hub
Featured resource
Tech Upskilling Playbook 2025
Tech Upskilling Playbook

Build future-ready tech teams and hit key business milestones with seven proven plays from industry leaders.

Learn more
Hamburger Icon
  • Labs icon Lab
  • Cloud
  • Security
Labs

Creating and Manage IAM Roles on Google Cloud

Google Cloud Identity and Access Management (IAM) service is a critical gateway for the entire platform. One of Cloud IAM's primary features is the ability to assign a range of roles, which determine the permissions available for targeted resources. There are a large number of pre-defined roles, with set permissions, available as well as the capability to create custom roles. In this hands-on lab, you'll add a new member to the team with a pre-defined role of Compute Network Admin. Then, you'll expand that member's responsibilities to administering firewall rules by creating a custom role. Next, I'll show you how to combine both pre-defined and custom roles into a single custom role. Finally, you'll log in as the new member to verify the IAM permissions are working as expected.

Get started Contact sales
Labs

Path Info

Level
Clock icon Beginner
Duration
Clock icon 45m
Last updated
Clock icon Sep 02, 2025

Contact sales

By filling out this form and clicking submit, you acknowledge our privacy policy.

Table of Contents

  1. Challenge

    Add IAM member to project.

    1. From the Google Cloud console's main navigation, choose IAM & admin > IAM.
    2. Click GRANT ACCESS.
    3. In the Add Princippals panel, enter the email address for the secondary user for this hands-on lab.
    4. In the Select a role field, enter Compute Network and choose Compute Network Admin.
    5. Click Save.

  2. Challenge

    Create a custom IAM role.

    1. From the IAM navigation, choose Roles.
    2. Click Create Role.
    3. On the Create Role page, enter the following:
    • Title: Firewall Admin
    • ID: FirewallAdmin
    • Role launch stage: Beta
    1. Click Add Permissions.
    2. In the Add Permissions dialog, click Filter Table and enter firewalls; press Return.
    3. Select all permissions beginning with compute.firewalls.
    4. Click Add.
    5. Click Create.

  3. Challenge

    Assign custom role.

    1. From the IAM navigation, choose IAM.
    2. In the row of the newly added member, click Edit (the pencil icon).
    3. Click Add Another Role.
    4. In the Select a role field, enter Firewall and select Firewall Admin.
    5. Click Save.

  4. Challenge

    Create a new custom role

    1. From the IAM navigation, choose Roles.
    2. In the Filter table field, enter Compute Network and choose Compute Network Admin.
    3. Click OR.
    4. In the Filter table field, enter Firewall and choose Firewall Admin.
    5. Select the checkboxes next to the two roles.
    6. Choose Create Role from Selection.
    7. On the Create Role page, enter the following:
    • Title: Compute Network and Firewall Admin
    • ID: ComputeNetworkAndFirewallAdmin
    • Role launch stage: Beta
    1. Click Create.

  5. Challenge

    Assign the new role.

    1. From the IAM navigation, choose IAM.
    2. In the row of the newly added member, click Edit (the pencil icon).
    3. In the Edit Permissions panel, click the Trashcan icon next to the Firewall Admin role.
    4. Click in the Compute Network Admin role field.
    5. Select Custom and then Compute Network and Firewall Admin.
    6. Click Save.

  6. Challenge

    Verify Permissions

    1. From the main Google Cloud navigation, choose Compute Engine > VM Instances.
    2. Choose Create.
    3. Leave all the values at their defaults.
    4. In the Firewall section, select both options.
    5. Click Create.
    6. Log out of the Google Cloud console.
    7. Copy the username for the secondary user.
    8. Open a new browser window for the lab.
    9. Log in as the secondary user.
    10. From the Google Cloud console's main navigation, choose IAM & admin > IAM.
    11. Note that you do not have permission to view this page.
    12. From the main Google Cloud navigation, choose Compute Engine > VM Instances.
    13. Note the recently created instance.
    14. From the main Google Cloud navigation, choose VPC Networks > VPC Networks.
    15. Note the full admin capabilities here.
    16. From the VPC Network menu, choose Firewall rules.
    17. Note the full admin capabilities here.
    18. Select and delete the HTTPS firewall rule.
Pluralsight Skills - Labs - Pluralsight
Author
Pluralsight Skills

Pluralsight Skills gives leaders confidence they have the skills needed to execute technology strategy. Technology teams can benchmark expertise across roles, speed up release cycles and build reliable, secure products. By leveraging our expert content, skill assessments and one-of-a-kind analytics, keep up with the pace of change, put the right people on the right projects and boost productivity. It's the most effective path to developing tech skills at scale.

What's a lab?

Hands-on Labs are real environments created by industry experts to help you learn. These environments help you gain knowledge and experience, practice without compromising your system, test without risk, destroy without fear, and let you learn from your mistakes. Hands-on Labs: practice your skills before delivering in the real world.

Provided environment for hands-on practice

We will provide the credentials and environment necessary for you to practice right within your browser.

Guided walkthrough

Follow along with the author’s guided walkthrough and build something new in your provided environment!

Did you know?

On average, you retain 75% more of your learning if you get time for practice.
Ready to get started?
View individual plans View team plans