Google IoT Core多租户支持咨询：同一项目下用户能否仅查看自有资源

Absolutely! You can set up multi-tenant access for Google IoT Core within a single project—so different users share the same project but only see their own device registries, devices, and related resources. The key to making this work is leveraging Google Cloud Identity and Access Management (IAM) to enforce granular resource isolation. Here’s how to implement it:

Core Strategy: Isolate via Device Registries #

First, structure your resources so each tenant gets their own dedicated device registry (or a set of registries if they need multiple environments). Registries are the natural boundary for IoT Core resource isolation, so this keeps each tenant’s devices, configurations, and telemetry data separate by default.

Granular IAM Permissions #

Instead of assigning broad project-level roles, use IAM to grant tenant-specific permissions limited to their registries:

• Use predefined roles (simpler option): Assign roles like roles/cloudiot.registryViewer (read-only access to a registry and its devices) or roles/cloudiot.deviceAdmin (full control over devices in a registry) — but restrict these roles to the tenant’s specific registry(s).
• Create custom roles (for fine-tuned control): If predefined roles are too broad, build a custom IAM role with exactly the permissions the tenant needs (e.g., only permission to list devices and send commands, not modify registry settings).

Enforce Isolation with IAM Conditions #

To make permissions even more precise, use IAM Conditions to limit access to specific resources. For example, when assigning a role to a user, add a condition like:

resource.name.startsWith("projects/[YOUR_PROJECT_ID]/locations/[REGION]/registries/[TENANT_A_REGISTRY]")

This ensures the user can only interact with resources under their assigned registry, even if they have a role that would otherwise apply to the entire project.

Service Accounts for Non-Human Users #

If your tenants are applications (rather than individual users), create dedicated service accounts for each tenant. Assign the same registry-specific permissions to these service accounts, then have the tenant’s app authenticate using the service account’s credentials. This avoids sharing personal user accounts and makes permission management cleaner.

Verify Isolation #

After setting up permissions, test to ensure tenants can’t access each other’s resources:

• Have a tenant user run the gcloud iot registries list command in their project — they should only see their own registry.
• Try to access another tenant’s device via the IoT Core UI or API; it should return a "permission denied" error.

Key Best Practices #

• Follow the principle of least privilege: Only grant tenants the minimum permissions they need to do their work (e.g., don’t give roles/cloudiot.admin unless they need to create new registries).
• Audit access regularly: Use Cloud Audit Logs to monitor who’s accessing which resources, and adjust permissions if needed.

内容的提问来源于stack exchange，提问作者Rahul Agrawal