IAM configuration for Data Connect projects

To use Firebase Data Connect, you'll need to assign IAM roles that allow managing connectors, accessing Cloud SQL, and generating SDKs. Make sure the service account running Data Connect has the required permissions.

Granular IAM roles for Data Connect

Firebase basic roles and predefined roles map to lower-level Data Connect roles. Refer to the table for the mapping.

To manage individual IAM role assignments for Data Connect at a more granular level, use the Google Cloud console.

IAM role	Permissions
firebasedataconnect.googleapis.com/admin Firebase Data Connect API Admin This role includes Firebase Data Connect API Viewer. It is equivalent to firebasedataconnect.*. This is provided by the Cloud Owner, Cloud Editor, Firebase Admin and Firebase Develop Admin roles.	Full access to Firebase Data Connect API resources, including data. firebasedataconnect.googleapis.com/operations.delete firebasedataconnect.googleapis.com/operations.cancel firebasedataconnect.googleapis.com/services.create firebasedataconnect.googleapis.com/services.update firebasedataconnect.googleapis.com/services.delete firebasedataconnect.googleapis.com/services.executeGraphql firebasedataconnect.googleapis.com/services.executeGraphqlRead firebasedataconnect.googleapis.com/schemas.create firebasedataconnect.googleapis.com/schemas.update firebasedataconnect.googleapis.com/schemas.delete firebasedataconnect.googleapis.com/schemaRevisions.create firebasedataconnect.googleapis.com/schemaRevisions.delete firebasedataconnect.googleapis.com/connectors.create firebasedataconnect.googleapis.com/connectors.update firebasedataconnect.googleapis.com/connectors.delete firebasedataconnect.googleapis.com/connectorRevisions.create firebasedataconnect.googleapis.com/connectorRevisions.delete
firebasedataconnect.googleapis.com/viewer Firebase Data Connect API Viewer This is provided by the Cloud Owner, Cloud Editor, Cloud Viewer, Firebase Admin, Firebase Viewer, Firebase Develop Admin and Firebase Develop Viewer roles.	Read-only access to Firebase Data Connect API resources. Role does not grant access to data. cloudresourcemanager.googleapis.com/projects.list cloudresourcemanager.googleapis.com/projects.get firebasedataconnect.googleapis.com/operations.list firebasedataconnect.googleapis.com/operations.get firebasedataconnect.googleapis.com/locations.list firebasedataconnect.googleapis.com/locations.get firebasedataconnect.googleapis.com/services.list firebasedataconnect.googleapis.com/services.get firebasedataconnect.googleapis.com/schemas.list firebasedataconnect.googleapis.com/schemas.get firebasedataconnect.googleapis.com/schemaRevisions.list firebasedataconnect.googleapis.com/schemaRevisions.get firebasedataconnect.googleapis.com/connectors.list firebasedataconnect.googleapis.com/connectors.get firebasedataconnect.googleapis.com/connectorRevisions.list firebasedataconnect.googleapis.com/connectorRevisions.get
firebasedataconnect.googleapis.com/dataAdmin Firebase Data Connect API Data Admin This is provided by the Cloud Owner, Cloud Editor, Firebase Admin and Firebase Develop Admin roles.	Full read and write access to data sources. firebasedataconnect.googleapis.com/services.executeGraphql firebasedataconnect.googleapis.com/services.executeGraphqlRead
firebasedataconnect.googleapis.com/dataViewer Firebase Data Connect API Data Viewer This is provided by the Cloud Owner, Cloud Editor, Firebase Admin and Firebase Develop Admin roles.	Read-only access to data sources. firebasedataconnect.googleapis.com/services.executeGraphqlRead