How is fine-grained access control implemented in Spanner?

Beyond project-level IAM roles, which grant or deny access to an entire instance or database, Spanner supports database roles that restrict access down to individual tables, columns, or views inside a single database.

CREATE ROLE analyst;
GRANT SELECT(CustomerId, OrderDate) ON TABLE Orders TO ROLE analyst;
GRANT ROLE analyst TO 'user:jane@example.com';

A database role is defined with standard GRANT/REVOKE DDL, and IAM is used to grant a Cloud Identity principal the ability to act under that database role via the spanner.databaseRole.user permission. This two-layer model lets a team give broad IAM access to an application's service account while still restricting exactly which columns that account, or specific human users, can query, which matters for masking sensitive fields like PII from analysts who only need aggregate data.

Invest now in Acorns!!! 🚀
Join Acorns and get your $5 bonus!

Acorns is a micro-investing app that automatically invests your "spare change" from daily purchases into diversified, expert-built portfolios of ETFs. It is designed for beginners, allowing you to start investing with as little as $5. The service automates saving and investing. Disclosure: I may receive a referral bonus.

Invest now!!! Get Free equity stock (US, UK only)!

Use Robinhood app to invest in stocks. It is safe and secure. Use the Referral link to claim your free stock when you sign up!.

The Robinhood app makes it easy to trade stocks, crypto and more.

Webull! Receive free stock by signing up using the link: Webull signup.