This page describes access control with Identity and Access Management (IAM) in
Secure Source Manager.

## Overview

IAM [permissions](https://docs.cloud.google.com/iam/docs/overview#permissions) and
[roles](https://docs.cloud.google.com/iam/docs/overview#roles) determine your ability to create, view,
edit, or delete data in a Secure Source Manager instance.

A role is a collection of permissions. You can't grant a principal permissions
directly; instead, you grant them a role. When you grant a role to a principal,
you grant them all the permissions that the role contains. You can grant
multiple roles to the same principal.

## Grant predefined Secure Source Manager roles

Every Secure Source Manager API method requires that the principal (user,
group, or service account) making the request has the required permissions to
use the resource. Permissions are given to principals by setting policies that
grant the principal a predefined role on the resource.

Secure Source Manager roles are not visible in the Google Cloud console
until you have assigned each role to a principal. For information on granting
roles on Secure Source Manager instance and repository resources, see
[Grant and revoke IAM roles](https://docs.cloud.google.com/secure-source-manager/docs/grant-iam-roles).

## Secure Source Manager Permissions

To view all available Secure Source Manager permissions, search the
[IAM permissions reference](https://docs.cloud.google.com/iam/docs/roles-permissions) for
`securesourcemanager.`.

## IAM levels of access

You can grant IAM roles at different levels of the resource
hierarchy:

- **Project level**: Grants access to all Secure Source Manager instances and repositories within the project. You can grant project-level roles using the Google Cloud console IAM page.
- **Instance level**: Grants access to a specific Secure Source Manager instance. You must use the gcloud CLI tool or the API to grant instance-level roles. These bindings don't appear in the project-level Google Cloud console IAM page.
- **Repository level**: Grants access to a specific repository. You can grant repository-level roles using the Secure Source Manager web interface, the gcloud CLI tool, or the API.

## Secure Source Manager predefined roles

In addition to the project and folder level, Secure Source Manager
IAM roles can be granted on the instance and repository
resources.

To view all predefined Secure Source Manager roles and the permissions
available in each role, see the [IAM basic and predefined roles reference](https://docs.cloud.google.com/iam/docs/roles-permissions/securesourcemanager).

### Instance Roles

Instance roles give principals permissions on the Secure Source Manager
instance. Repository roles are granted separately.

### Repository Roles

Repository roles give principals permissions on Secure Source Manager
repositories.

## Custom roles

In addition to the predefined roles, Secure Source Manager also supports
custom roles. For more information, see
[Creating and managing custom roles](https://docs.cloud.google.com/iam/docs/creating-custom-roles) in the
IAM documentation.

## Repository role management

The following sections describe required roles for common repository actions.

### Manage repositories


To get the permissions that
you need to create, delete, and add users to a Secure Source Manager repository,

ask your administrator to grant you the
following IAM roles:

- [Secure Source Manager Instance Repository creator](https://docs.cloud.google.com/iam/docs/roles-permissions/securesourcemanager#securesourcemanager.instanceRepositoryCreator) (`roles/securesourcemanager.instanceRepositoryCreator`) on the Secure Source Manager instance
- [Repo Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/securesourcemanager#securesourcemanager.repoAdmin) (`roles/securesourcemanager.repoAdmin`) on the repositories you want to manage


### Create repositories


To get the permissions that
you need to create repositories in a Secure Source Manager instance,

ask your administrator to grant you the
following IAM roles:

- [Secure Source Manager Instance Repository creator](https://docs.cloud.google.com/iam/docs/roles-permissions/securesourcemanager#securesourcemanager.instanceRepositoryCreator) (`roles/securesourcemanager.instanceRepositoryCreator`) on the Secure Source Manager instance
- [Secure Source Manager Repo Creator](https://docs.cloud.google.com/iam/docs/roles-permissions/securesourcemanager#securesourcemanager.repoCreator) (`roles/securesourcemanager.repoCreator`) on the Google Cloud project


### View a repository


To get the permissions that
you need to view a repository,

ask your administrator to grant you the
following IAM roles:

- [Secure Source Manager Instance Accessor](https://docs.cloud.google.com/iam/docs/roles-permissions/securesourcemanager#securesourcemanager.instanceAccessor) (`roles/securesourcemanager.instanceAccessor`) on the Secure Source Manager instance
- [Secure Source Manager Repo Reader](https://docs.cloud.google.com/iam/docs/roles-permissions/securesourcemanager#securesourcemanager.repoReader) (`roles/securesourcemanager.repoReader`) on the repository


### Use a repository and create issues and pull requests


To get the permissions that
you need to push to and pull from a repository, create issues and pull requests,

ask your administrator to grant you the
following IAM roles:

- [Secure Source Manager Instance Accessor](https://docs.cloud.google.com/iam/docs/roles-permissions/securesourcemanager#securesourcemanager.instanceAccessor) (`roles/securesourcemanager.instanceAccessor`) on the Secure Source Manager instance
- [Secure Source Manager Repo Writer](https://docs.cloud.google.com/iam/docs/roles-permissions/securesourcemanager#securesourcemanager.repoWriter) (`roles/securesourcemanager.repoWriter`) on the repository


## What's next

- Learn more about managing access in Google Cloud with the [IAM overview](https://docs.cloud.google.com/iam/docs/overview).
- [Grant Secure Source Manager IAM roles](https://docs.cloud.google.com/secure-source-manager/docs/grant-iam-roles).
- [Authenticate to Secure Source Manager](https://docs.cloud.google.com/secure-source-manager/docs/authentication) programmatically.