# Easily Manage IAM Policies for Serverless REST Applications in GCP with Goblet

DevFeed: [Easily Manage IAM Policies for Serverless REST Applications in GCP with Goblet](<https://devfeed.tech/articles/easily-manage-iam-policies-for-serverless-rest-applications-in-gcp-with-goblet-23877.md>)

Original publisher: [Read original article](<https://engineering.premise.com/easily-manage-iam-policies-for-serverless-rest-applications-in-gcp-with-goblet-f1580a97b74?source=rss----c5fada0a103d---4>)

Author: Austen Novis

Published: 2023-07-10T20:09:55Z

Content type: tutorial

Language: en

Sources: [Engineering at Premise - Medium](<https://devfeed.tech/sources/engineering-at-premise-medium.md>)

Topics: [Google Cloud Platform (GCP)](<https://devfeed.tech/topics/google-cloud.md>), [IAM](<https://devfeed.tech/topics/iam.md>), [Serverless](<https://devfeed.tech/topics/serverless.md>), [Authorization](<https://devfeed.tech/topics/authorization.md>), [Python](<https://devfeed.tech/topics/python.md>), [Framework](<https://devfeed.tech/topics/framework.md>), [API](<https://devfeed.tech/topics/api.md>)

Tags: [api](<https://devfeed.tech/tags/api.md>), [cloud-computing](<https://devfeed.tech/tags/cloud-computing.md>), [deployment](<https://devfeed.tech/tags/deployment.md>), [framework](<https://devfeed.tech/tags/framework.md>), [gcp](<https://devfeed.tech/tags/gcp.md>), [goblet](<https://devfeed.tech/tags/goblet.md>), [google-cloud-platform](<https://devfeed.tech/tags/google-cloud-platform.md>), [iam](<https://devfeed.tech/tags/iam.md>), [identity-and-access](<https://devfeed.tech/tags/identity-and-access.md>), [permission](<https://devfeed.tech/tags/permission.md>), [python](<https://devfeed.tech/tags/python.md>), [serverless](<https://devfeed.tech/tags/serverless.md>), [tutorial](<https://devfeed.tech/tags/tutorial.md>)

## AI overview

This tutorial explains how the Goblet Python framework automates IAM policy management for serverless REST applications on Google Cloud Platform. It covers identifying deployment permissions, enabling required APIs, creating custom roles and service accounts, and adding invoker bindings for connected services.

## Source excerpt

By Austen Novis, Staff Software Engineer Photo by Akhilesh Sharma on Unsplash Writing and deploying serverless applications has never been easier, especially on Google Cloud Platform (GCP). With a few clicks developers are able to deploy their application to the cloud and then trigger calls in a variety of ways from Cloud Schedulers and Pubsub Subscriptions to API Gateways. Deploying your resources to GCP seems straightforward until you get a 403 error, permission denied. This error causes frustration as the root cause can be a number of issues, and often the solution requires knowing GCP roles and permissions in an in depth manner. The issue can be caused by the user not having the correct permissions to deploy their services or the services themselves not having the correct permissions to connect to each other. Once you have identified the problem you will need to understand what roles have the required permissions, how to apply those roles, and where to apply them. Instead of application developers wasting their time researching GCP documentation, searching stack overflow, or reaching out to devops teams, IAM access should be as automated as much as possible. Using the Goblet framework, we are now able to view exactly what permissions are needed to deploy our serverless applications, enable required GCP service API's, create a new custom role with these permissions, create a service account with this role, and add the correct invoker bindings so that all serverless services can connect to each other. Goblet is a python framework for writing serverless applications in GCP with the goal of making it as simple as possible to write and deploy REST applications. Goblet uses simple decorators, similar to flask, to create the necessary configurations and automatically deploy the required services and infrastructure. For example, with code below we can deploy a simple cloudfunction that is triggered by a pubsub subscription and a cloud scheduler. Goblet will also take ca