Cloud Tasks uses Identity and Access Management (IAM) for access control.
For an introduction to IAM and its features, see the
[IAM overview](https://docs.cloud.google.com/iam/docs/overview.md.txt). To learn how to grant and
revoke access, see
[Manage access to projects, folders, and organizations](https://docs.cloud.google.com/iam/docs/granting-changing-revoking-access.md.txt).

You can configure access control at the project level and at the queue level.
For example, you might grant a user permission to create and add tasks to a
queue, but not delete the queue. Or you might grant access to all
Cloud Tasks resources within a project to a group of users. For
more information, see
[Secure queue configuration](https://docs.cloud.google.com/tasks/docs/secure-queue-configuration.md.txt).

Every Cloud Tasks method requires the caller to have the necessary
permissions. This page describes the permissions and roles that
Cloud Tasks supports. Permissions are also checked when
[`queue.yaml`](https://docs.cloud.google.com/tasks/docs/queue-yaml.md.txt) (or the legacy `queue.xml` file) is
updated; or when you use the Google Cloud console.

> [!NOTE]
> **Note:** To access and manage tasks using the Google Cloud console, you must also have the `appengine.applications.get` permission. All of the [App Engine predefined roles](https://docs.cloud.google.com/appengine/docs/standard/python3/roles) include this permission.

## Enable the Cloud Tasks API

To view and assign IAM roles for Cloud Tasks,
you must enable the Cloud Tasks API for your project. You won't be able
to see the Cloud Tasks roles in the Google Cloud console
until you enable the API.

### Console


Enable the Cloud Tasks API, if it is not already enabled.


**Roles required to enable APIs**


To enable APIs, you need the `serviceusage.services.enable` permission. If you
created the project, then you likely already have this permission through the
Owner role (`roles/owner`). Otherwise, you can get this permission through the
Service Usage Admin role (`roles/serviceusage.serviceUsageAdmin`).
[Learn how to grant roles](https://docs.cloud.google.com/iam/docs/granting-changing-revoking-access.md.txt).

[Enable the API](https://console.cloud.google.com/apis/enableflow?apiid=cloudtasks.googleapis.com&redirect=https://console.cloud.google.com)

<br />

### gcloud


Enable the Cloud Tasks API, if it is not already enabled:


**Roles required to enable APIs**


To enable APIs, you need the `serviceusage.services.enable` permission. If you
created the project, then you likely already have this permission through the
Owner role (`roles/owner`). Otherwise, you can get this permission through the
Service Usage Admin role (`roles/serviceusage.serviceUsageAdmin`).
[Learn how to grant roles](https://docs.cloud.google.com/iam/docs/granting-changing-revoking-access.md.txt).

```bash
gcloud services enable cloudtasks.googleapis.com
```

<br />

## Predefined roles

The following table lists the Cloud Tasks predefined
IAM roles and their corresponding permissions.

The predefined roles address most typical use cases. If your use case isn't
covered by the predefined roles, you can
[create an IAM custom role](https://docs.cloud.google.com/iam/docs/understanding-custom-roles).

| Role | Permissions |
|---|---|
| #### Cloud Tasks Admin (`roles/cloudtasks.admin`) Full access to queues and tasks. | `cloudtasks.*` - `cloudtasks.cmekConfig.get` - `cloudtasks.cmekConfig.update` - `cloudtasks.locations.get` - `cloudtasks.locations.list` - `cloudtasks.operations.get` - `cloudtasks.queues.create` - `cloudtasks.queues.delete` - `cloudtasks.queues.get` - `cloudtasks.queues.getIamPolicy` - `cloudtasks.queues.list` - `cloudtasks.queues.pause` - `cloudtasks.queues.purge` - `cloudtasks.queues.resume` - `cloudtasks.queues.setIamPolicy` - `cloudtasks.queues.update` - `cloudtasks.tasks.create` - `cloudtasks.tasks.delete` - `cloudtasks.tasks.fullView` - `cloudtasks.tasks.get` - `cloudtasks.tasks.list` - `cloudtasks.tasks.run` `monitoring.timeSeries.list` `resourcemanager.projects.get` `resourcemanager.projects.list` |
| #### Cloud Tasks Editor (`roles/cloudtasks.editor`) Editor role for cloudtasks | `cloudtasks.cmekConfig.get` `cloudtasks.locations.*` - `cloudtasks.locations.get` - `cloudtasks.locations.list` `cloudtasks.operations.get` `cloudtasks.queues.create` `cloudtasks.queues.delete` `cloudtasks.queues.get` `cloudtasks.queues.list` `cloudtasks.queues.pause` `cloudtasks.queues.purge` `cloudtasks.queues.resume` `cloudtasks.queues.update` `cloudtasks.tasks.*` - `cloudtasks.tasks.create` - `cloudtasks.tasks.delete` - `cloudtasks.tasks.fullView` - `cloudtasks.tasks.get` - `cloudtasks.tasks.list` - `cloudtasks.tasks.run` `monitoring.timeSeries.list` `resourcemanager.projects.get` `resourcemanager.projects.list` |
| #### Cloud Tasks Viewer (`roles/cloudtasks.viewer`) Get and list access to tasks, queues, and locations. | `cloudtasks.cmekConfig.get` `cloudtasks.locations.*` - `cloudtasks.locations.get` - `cloudtasks.locations.list` `cloudtasks.operations.get` `cloudtasks.queues.get` `cloudtasks.queues.list` `cloudtasks.tasks.fullView` `cloudtasks.tasks.get` `cloudtasks.tasks.list` `monitoring.timeSeries.list` `resourcemanager.projects.get` `resourcemanager.projects.list` |
| #### Cloud Tasks Enqueuer ^Beta^ (`roles/cloudtasks.enqueuer`) Access to create tasks. | `cloudtasks.operations.get` `cloudtasks.tasks.create` `cloudtasks.tasks.fullView` `resourcemanager.projects.get` `resourcemanager.projects.list` |
| #### Cloud Tasks Queue Admin (`roles/cloudtasks.queueAdmin`) Admin access to queues. | `cloudtasks.locations.*` - `cloudtasks.locations.get` - `cloudtasks.locations.list` `cloudtasks.queues.*` - `cloudtasks.queues.create` - `cloudtasks.queues.delete` - `cloudtasks.queues.get` - `cloudtasks.queues.getIamPolicy` - `cloudtasks.queues.list` - `cloudtasks.queues.pause` - `cloudtasks.queues.purge` - `cloudtasks.queues.resume` - `cloudtasks.queues.setIamPolicy` - `cloudtasks.queues.update` `resourcemanager.projects.get` `resourcemanager.projects.list` |
| #### Cloud Tasks Task Deleter (`roles/cloudtasks.taskDeleter`) Access to delete tasks. | `cloudtasks.tasks.delete` `resourcemanager.projects.get` `resourcemanager.projects.list` |
| #### Cloud Tasks Task Runner ^Beta^ (`roles/cloudtasks.taskRunner`) Access to run tasks. | `cloudtasks.tasks.fullView` `cloudtasks.tasks.run` `resourcemanager.projects.get` `resourcemanager.projects.list` |

### Service agent roles


Service agent roles should only be granted to [service agents](https://docs.cloud.google.com/iam/docs/service-agents.md.txt).

| Role | Permissions |
|---|---|
| #### Cloud Tasks Service Agent (`roles/cloudtasks.serviceAgent`) Grants Cloud Tasks Service Account access to manage resources. > [!WARNING] > **Warning:** Do not grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents.md.txt). | `iam.serviceAccounts.getAccessToken` `iam.serviceAccounts.getOpenIdToken` `logging.logEntries.create` |

## What's next

- [Authenticate to Cloud Tasks](https://docs.cloud.google.com/tasks/docs/authentication.md.txt)