Primitive, predefined, custom roles, and IAM conditions

Speaker notes

• Primitive roles (Owner, Editor, Viewer) predate fine-grained IAM and were never redesigned to be narrow — Editor alone grants create/modify access across nearly every service. Predefined roles, scoped to one service and Google-maintained, are the default choice for almost every real grant.
• Custom roles fill the gap when no predefined role fits — but a custom role is not maintained by Google, so a new permission added to a service doesn't automatically appear in it. Give every custom role an explicit owner and a review trigger tied to the workload it serves.
• IAM conditions attach a boolean expression to a binding — a time-bound condition on contractor access expires automatically with no human remembering step, directly solving the 'temporary access that quietly became permanent' pattern that recurs throughout this course.

Deck map