Creating a GCP Cloud CDN IAM Member
Overview
You can add your GCP Cloud CDN to IO River and use it with your services. To add Cloud CDN as one of your CDN providers, you need to configure IAM members in your GCP project. The IAM member needs permissions to manage your load balancers in your GCP project.
You can easily create these IAM members using one of the following methods:
- Using gcloud script - Use this script to create the role.
- Using Terraform - Use this code to create the role.
Once you have created the IAM member, you can use your GCP project ID when adding a CDN provider to your account.
Notes:
- The IAM member is associated with the IO River service account and can only be used by it.
- If the role lacks the required permissions, adding Cloud CDN to the CDN providers will fail.
Required Permissions
To add your GCP Cloud CDN account to IO River, a role with the following permissions is required:
| Permission |
|---|
| compute.backendBuckets.create |
| compute.backendBuckets.delete |
| compute.backendBuckets.get |
| compute.backendBuckets.list |
| compute.backendBuckets.update |
| compute.backendBuckets.use |
| compute.backendServices.create |
| compute.backendServices.delete |
| compute.backendServices.get |
| compute.backendServices.list |
| compute.backendServices.update |
| compute.backendServices.use |
| compute.forwardingRules.create |
| compute.forwardingRules.delete |
| compute.forwardingRules.get |
| compute.forwardingRules.list |
| compute.forwardingRules.setTarget |
| compute.globalForwardingRules.create |
| compute.globalForwardingRules.delete |
| compute.globalForwardingRules.get |
| compute.globalForwardingRules.list |
| compute.globalForwardingRules.setTarget |
| compute.globalNetworkEndpointGroups.attachNetworkEndpoints |
| compute.globalNetworkEndpointGroups.create |
| compute.globalNetworkEndpointGroups.delete |
| compute.globalNetworkEndpointGroups.get |
| compute.globalNetworkEndpointGroups.list |
| compute.globalNetworkEndpointGroups.use |
| compute.globalOperations.get |
| compute.networkEndpointGroups.attachNetworkEndpoints |
| compute.networkEndpointGroups.create |
| compute.networkEndpointGroups.delete |
| compute.networkEndpointGroups.get |
| compute.networkEndpointGroups.list |
| compute.networkEndpointGroups.use |
| compute.sslCertificates.create |
| compute.sslCertificates.delete |
| compute.sslCertificates.get |
| compute.sslCertificates.list |
| compute.targetHttpProxies.create |
| compute.targetHttpProxies.delete |
| compute.targetHttpProxies.get |
| compute.targetHttpProxies.list |
| compute.targetHttpProxies.setUrlMap |
| compute.targetHttpProxies.use |
| compute.targetHttpsProxies.create |
| compute.targetHttpsProxies.delete |
| compute.targetHttpsProxies.get |
| compute.targetHttpsProxies.list |
| compute.targetHttpsProxies.setUrlMap |
| compute.targetHttpsProxies.use |
| compute.urlMaps.create |
| compute.urlMaps.delete |
| compute.urlMaps.get |
| compute.urlMaps.list |
| compute.urlMaps.update |
| compute.urlMaps.use |
| logging.sinks.create |
| logging.sinks.delete |
| logging.sinks.get |
| logging.sinks.update |
| pubsub.subscriptions.create |
| pubsub.subscriptions.delete |
| pubsub.subscriptions.get |
| pubsub.topics.create |
| pubsub.topics.delete |
| pubsub.topics.get |
| pubsub.topics.getIamPolicy |
| pubsub.topics.setIamPolicy |