IAM Security

Common IAM roles for Spanner and security best practices.

Cloud Spanner Admin (roles/spanner.admin): Full control over all Spanner resources.
Cloud Spanner Database Admin (roles/spanner.databaseAdmin): Full control over databases, backups, and operations.
Cloud Spanner Database Reader (roles/spanner.databaseReader): Can read data and execute queries.
Cloud Spanner Database User (roles/spanner.databaseUser): Can read and write data.
Cloud Spanner Viewer (roles/spanner.viewer): Can view Spanner resources but cannot access data.

Principle of Least Privilege: Grant only the minimum necessary permissions to users and service accounts.
Use Service Accounts: For applications, use service accounts instead of personal user accounts.
VPC Service Controls: Use VPC Service Controls to help mitigate data exfiltration risks.
CMEK: Use Customer-Managed Encryption Keys (CMEK) if required by your security policy.

[!CAUTION] Granting roles/spanner.admin gives full access to all Spanner resources in the project. Use with caution.

Third-party checks

No alerts10d3 checks · Risk SAFE

Gen Agent Trust Hub10d
This skill is designed to assist with Google Cloud Spanner administration and development. It provides standard workflows for schema design, SQL querying, and resource management using official Google tools and libraries. It includes appropriate safety guardrails requiring user confirmation for destructive database operations.
Socket10d
No alerts
Snyk10d
Risk: LOW · No issues

/spanner-basics