Associate Cloud Engineer

Access Approval requires the roles/accessapproval.approver IAM role to grant users permission to approve or dismiss access requests from Google support/engineering staff. Google's IAM best practices recommend managing access through Google Groups rather than assigning roles directly to individual user accounts, because groups simplify access management, provide easier auditing, and reduce administrative overhead as team membership changes. Therefore, the correct approach is to add the SREs to a Google group and grant that group the roles/accessapproval.approver role. The roles/iam.roleAdmin role is unrelated to Access Approval—it only controls the ability to create and manage custom IAM roles—so it does not enable approval of support access requests.