Interviewers ask, "Basic vs predefined vs custom roles - which do you use and when?" because they want to know: Do you apply least privilege, and do you know the maintenance cost of custom roles? This post gives you a ready 30-second answer, the concept in plain English, common mistakes and tips for different roles. It is question 3 of the top 10 GCP resource hierarchy and IAM interview questions.

Short answer (30 seconds): Basic roles like Owner, Editor and Viewer are very broad, so I avoid them in production. Predefined roles are my default because Google maintains them and updates permissions as services change. I create custom roles only when a predefined role gives too much and I need an exact set of permissions. Custom roles add maintenance work, so I keep them few and manage them in code.


GCP interview question 3: Role Types - model answer slide

 

What is the interviewer really asking?

Do you apply least privilege, and do you know the maintenance cost of custom roles?

Role Types in plain English

  • Basic (Owner/Editor/Viewer) = too broad for production
  • Predefined = default choice, Google maintains them
  • Custom = only when predefined is too wide; you maintain it

Easy picture: Roles are job badges. A basic role is a master badge (opens too much). A predefined role is a standard staff badge. A custom role is a special badge you design - and you must keep updating it.

Detailed explanation

  • Basic roles (Owner, Editor, Viewer) were created before fine-grained IAM. Editor alone has thousands of permissions across most services. They are fine for a personal sandbox, not for shared production.
  • Predefined roles are service-specific and created by Google, e.g. roles/bigquery.dataViewer. When a service adds a new feature, Google updates the role. This is a benefit and a small risk: review changes for sensitive roles.
  • Custom roles are defined by you from a list of permissions at organization or project level. Some permissions cannot be used in custom roles, and you must update them yourself when a service adds new permissions.
  • Practical order of choice: smallest predefined role → combination of two predefined roles → custom role. Use the IAM Recommender to find over-granted roles.

Example commands

gcloud iam roles describe roles/bigquery.dataViewer
gcloud iam roles create customDeployer --organization=ORG_ID --file=role.yaml
gcloud recommender recommendations list --recommender=google.iam.policy.Recommender --project=PROJECT_ID --location=global

Replace ORG_ID, FOLDER_ID and PROJECT_ID with your own values. Check gcloud help for current flags before you use a command.

Common mistakes

  • Giving roles/editor to a service account because 'it just works'.
  • Creating dozens of custom roles that nobody owns or updates.
  • Assuming a custom role updates itself when a service adds permissions. It does not.

Follow-up questions to expect

  • How do you find unused permissions? (IAM Recommender, based on usage history.)
  • Org-level or project-level custom roles? (Org level if reused across projects.)

How the answer changes by role

Role What to emphasise
Architect Define a small catalog of approved roles per persona.
Data Engineer Know the BigQuery roles well: dataViewer, dataEditor, jobUser, user.
DevOps Engineer Pipelines get narrow deploy roles, never Editor.
Platform Engineer Publish role bundles (via groups) as part of the platform contract.

Senior tip

Name one real predefined role and one real reason you would build a custom one.

Practice

  1. Say the 30-second answer aloud without reading it, and time yourself.
  2. Draw the diagram from memory on paper.
  3. Explain it once to a junior engineer and once to a CTO.

Keep learning

Disclaimer: This blog is independent and not affiliated with or endorsed by Google. Google Cloud features, limits and commands change, so always check the current documentation. Official references: Resource hierarchy, IAM policy types, IAM quotas and limits.