Control de acceso con IAM

Cloud Composer 3 | Cloud Composer 2 | Cloud Composer 1

En esta página, se describen las opciones de control de acceso disponibles en Cloud Composer y se explica cómo otorgar roles.

Para obtener información sobre cómo otorgar funciones, consulta Administración del acceso a proyectos, carpetas y organizaciones.

Con el control de acceso de la IU de Airflow, puedes controlar los permisos de la IU de Airflow y de la IU de DAG, además de habilitar o inhabilitar el acceso a ella.

Acerca de Identity and Access Management en Cloud Composer

de Cloud Composer usa Identity and Access Management (IAM) para el control de acceso.

Para controlar el acceso a diferentes funciones de Cloud Composer, otorga roles y permisos para las cuentas de servicio de IAM y las cuentas de usuario en tu Google Cloud proyecto.

Cloud Composer usa dos tipos de cuentas de servicio de IAM:

• Cuenta de agente de servicio de Cloud Composer
• Cuenta de servicio del entorno

Además de estos dos tipos de cuentas de servicio, el agente de servicio de las APIs de Google ejecuta procesos internos de Google en tu nombre.

Otorga roles a la cuenta del agente de servicio de Cloud Composer

En tu Google Cloud proyecto, el servicio de Cloud Composer crea un agente de servicio, el agente de servicio de Cloud Composer, para administrar los recursos relacionados con Cloud Composer.

El agente de servicio de Cloud Composer se usa para todos los entornos de tu proyecto. De forma predeterminada, la cuenta del agente de servicio de Cloud Composer solo tiene el rol de Agente de servicio de la API de Cloud Composer. Mantén este rol en esta cuenta de servicio.

Nota: La cuenta de agente de servicio de las APIs de Google (también conocida como cuenta de servicio de los servicios en la nube) ejecuta procesos internos de Google en tu nombre. Te recomendamos que mantengas los permisos predeterminados en esta cuenta de agente de servicio, que es el rol de editor de proyecto.

Otorga roles a la cuenta de servicio de un entorno

Advertencia: Antes de especificar una cuenta de servicio para un entorno, asegúrate de familiarizarte con todas las consideraciones de seguridad que se aplican a las cuentas de servicio del entorno.

Cuando creas un entorno, especificas una cuenta de servicio. Esta cuenta de servicio se denomina cuenta de servicio del entorno. No puedes cambiar la cuenta de servicio especificada después de crear un entorno.

Tu entorno usa esta cuenta de servicio para realizar la mayoría de las operaciones, por ejemplo:

• Ejecutar pods con diferentes componentes de entorno, como trabajadores y programadores de Airflow, en el clúster de tu entorno

• Ejecutar DAG en nombre de esta cuenta de servicio Por ejemplo, si un DAG accede a otro servicio de Google, esto se hace en nombre de la cuenta de servicio.

• Compila las imágenes de los componentes de Airflow cuando se instalan paquetes de PyPI personalizados en el entorno.

• Lee y escribe objetos en el bucket del entorno. Por ejemplo, cuando se sincronizan archivos entre el bucket del entorno y los componentes de Airflow.

• Pods en ejecución iniciados a través de KubernetesPodOperator y GKEStartPodOperator

Precaución: Si borras la cuenta de servicio de un entorno, todos los entornos que la usan dejan de funcionar y no se pueden recuperar. Incluso si se vuelve a crear una cuenta de servicio con el mismo nombre, no es posible recuperar los entornos afectados. Aún es posible acceder a los datos almacenados en los buckets del entorno afectado.

Cuentas de servicio existentes y personalizadas para tu entorno

Te recomendamos que configures una cuenta de servicio administrada por el usuario y la uses en los entornos de Cloud Composer. Para ello, deberás hacer lo siguiente:

1. Crea una cuenta de servicio nueva como se describe en la documentación de Identity and Access Management.

2. Otórgale el rol Trabajador de Composer (composer.worker).

3. Si tu entorno usa restricciones de ubicación de recursos o instala paquetes de PyPI desde un repositorio de Artifact Registry o desde un repositorio privado, otorga el rol de usuario de la cuenta de servicio (iam.serviceAccountUser) a la cuenta de servicio administrada por el usuario que ejecuta tu entorno en sí (tanto el principal como el recurso son la misma cuenta de servicio).

4. Para acceder a otros recursos de tu Google Cloud proyecto, otorga permisos adicionales para acceder a esos recursos a esta cuenta de servicio. El rol de trabajador de Composer (composer.worker) proporciona este conjunto requerido de permisos en la mayoría de los casos. Agrega permisos adicionales a esta cuenta de servicio solo cuando sea necesario para el funcionamiento de tus DAG.

Aunque no recomendamos usar este enfoque, si no especificas la cuenta de servicio de un entorno, tu entorno de Cloud Composer usará la cuenta de servicio predeterminada de Compute Engine:

• Por lo general, esta cuenta de servicio tiene el rol básico de Editor, que contiene muchos más permisos que los necesarios para ejecutar Cloud Composer.
• Si tu entorno usa esta cuenta de servicio, no cambies los roles asignados a ella. Esto podría causar problemas con otros servicios deGoogle Cloud .

• Te recomendamos evitar usar la cuenta de servicio predeterminada de Compute Engine debido a sus permisos amplios y a la imposibilidad de reducirlos sin afectar a otros servicios de Google Cloud .

  Próxima baja: A partir del 13 de abril de 2025, los nuevos entornos de Cloud Composer ya no usarán la cuenta de servicio de Compute Engine de forma predeterminada. Se requerirá una cuenta de servicio especificada de forma explícita cuando [crees un entorno][cc-create]. Asegúrate de que se especifique en tus secuencias de comandos y otras herramientas de automatización y administración de configuración. Para obtener más información sobre este cambio, consulta las [notas de la versión](/composer/docs/release-notes#January_15_2025).

Consideraciones de seguridad para las cuentas de servicio del entorno

Advertencia: La cuenta de servicio de tu entorno puede tener permisos demasiado amplios en tu proyecto. Debido a que tu entorno ejecuta DAG en nombre de la cuenta de servicio de tu entorno, los usuarios que pueden agregar y modificar DAG y otros archivos en el bucket de tu entorno pueden ejecutar su código en nombre de la cuenta de servicio del entorno y ejercer todos los permisos de esta cuenta.

• Te recomendamos encarecidamente que configures una cuenta de servicio administrada por el usuario para los entornos de Cloud Composer que tenga solo el conjunto de permisos necesarios para ejecutar el entorno y realizar las operaciones definidas en tus DAG. El rol de trabajador de Composer (composer.worker) proporciona este conjunto de permisos obligatorios en la mayoría de los casos. Agrega permisos adicionales a esta cuenta de servicio solo cuando sea necesario para el funcionamiento de tus DAG.

• Es posible crear entornos de Cloud Composer que usen la cuenta de servicio predeterminada de Compute Engine. Por lo general, esta cuenta tiene más permisos que los necesarios para ejecutar DAG o entornos de Cloud Composer. Debido a que tu entorno ejecuta DAG en nombre de su cuenta de servicio, esto crea un riesgo de que los DAG usen permisos más amplios de lo previsto. Al mismo tiempo, a menudo no es posible reducir los permisos de esta cuenta de servicio sin afectar a otros servicios que podrían usarla en tu proyecto. En su lugar, configura una cuenta de servicio administrada por el usuario.

• Asegúrate de otorgar acceso de lectura y escritura al bucket de tu entorno solo a los usuarios de confianza.

  Debido a que la cuenta de servicio del entorno se usa para ejecutar DAG, los usuarios que pueden agregar y modificar DAG (o bien otros objetos, como dependencias de Python) en el bucket del entorno pueden ejecutar su código en nombre de la cuenta de servicio del entorno y obtener acceso a todos sus permisos a través de la implementación de sus propias versiones de DAG. Esto puede suceder incluso si sus cuentas de usuario no tienen roles y permisos relacionados con Cloud Composer explícitos que permitan tales acciones.

• Asegúrate de permitir que solo los usuarios de confianza actualicen los entornos de tu proyecto.

  El permiso composer.environments.update se puede usar más allá de aplicar cambios de configuración. Proporciona un control amplio sobre los recursos de Cloud Composer, incluida la ejecución de código en nombre de la cuenta de servicio del entorno, que puede ejercer todos los permisos que tiene esta cuenta de servicio. Por ejemplo, la instalación de paquetes de PyPI implica ejecutar código de Python desde el paquete. Como otro ejemplo, las variables de entorno se pueden usar para almacenar el código que ejecutará un DAG o para apuntar a una ubicación con ese código.

• Asegúrate de permitir que solo los usuarios de confianza ejecuten comandos de la CLI de Airflow en tu proyecto.

  El permiso composer.environment.executeairflowcommand se puede usar para ejecutar el código de Python disponible para los componentes de Airflow en nombre de la cuenta de servicio del entorno.

Otorga roles a los usuarios

Para activar una operación de entorno, un usuario debe tener los permisos necesarios. Por ejemplo, si deseas crear un entorno nuevo, debes tener el permiso composer.environments.create.

Para Cloud Composer, los permisos individuales se agrupan en roles predefinidos. Puedes otorgar estos roles a las principales.

Nota: Para obtener una lista de los permisos en los roles predefinidos de Cloud Composer, consulta Roles.

Si tu cuenta de usuario tiene el rol de editor del proyecto, puedes ejecutar todas las operaciones del entorno. Sin embargo, esta función tiene permisos amplios. Para los usuarios que trabajan con entornos, recomendamos usar roles que son específicos de Cloud Composer. De esta manera, puedes reducir el alcance de los permisos y proporcionar diferentes niveles de acceso a diferentes cuentas principales. Por ejemplo, un usuario puede tener permisos para crear, actualizar, borrar y mejorar entornos, mientras que otro usuario solo puede ver los entornos y acceder a la interfaz web de Airflow.

Según el nivel de acceso que desees proporcionar a los entornos de Cloud Composer, otorga los siguientes permisos a las cuentas principales.

Administra entornos y depósitos de entornos

Para un usuario que pueda ver, crear, actualizar, mejorar y borrar entornos, administrar objetos (como archivos DAG) en los depósitos de entorno, acceder a la interfaz web de Airflow, ejecutar comandos de la CLI de Airflow, ver y activar DAG desde la IU de DAG:

1. Otorga el rol de Administrador de objetos de almacenamiento y entorno (composer.environmentAndStorageObjectAdmin).

2. Otorga el rol de Usuario de cuenta de servicio (iam.serviceAccountUser).

   Para limitar los permisos de un usuario, otorga este rol solo en la cuenta de servicio de tu entorno. Para obtener más información, consulta Otorga o revoca un solo rol.

3. Otorga el permiso iam.serviceAccounts.actAs en la cuenta de servicio de tu entorno.

Administra entornos

Para un usuario que pueda ver, crear, actualizar, mejorar y borrar entornos, acceder a la interfaz web de Airflow, ejecutar comandos de la CLI de Airflow, ver y activar DAG desde la IU de DAG, haz lo siguiente:

1. Otórgale el rol de Administrador de Composer (composer.admin).

2. Otorga el rol de Usuario de cuenta de servicio (iam.serviceAccountUser).

   Para limitar los permisos de un usuario, otorga este rol solo en la cuenta de servicio de tu entorno. Para obtener más información, consulta Otorga o revoca un solo rol.

3. Otorga el permiso iam.serviceAccounts.actAs en la cuenta de servicio de tu entorno.

Visualiza entornos y administra depósitos de entornos

Para un usuario que pueda ver entornos, acceder a la interfaz web de Airflow, ver y activar DAG desde la IU de DAG, y administrar objetos en los depósitos del entorno (por ejemplo, para subir archivos nuevos de DAG):

1. Otorga el rol de Usuario de entorno y Visualizador de objetos de almacenamiento (composer.environmentAndStorageObjectViewer).

2. Otorga el rol de Administrador de objetos de almacenamiento (storage.objectAdmin).

Visualización de los entornos y los depósitos del entorno

Para un usuario que pueda ver entornos, acceder a la interfaz web de Airflow, ver y activar DAG desde la IU de DAG y ver objetos en depósitos de entornos, otorga el rol Usuario de entorno y Visualizador de objetos de almacenamiento (composer.environmentAndStorageObjectViewer).

Visualización de entornos

Para un usuario que pueda ver entornos, ver y activar DAG desde la IU de DAG y acceder a la interfaz web de Airflow, otorga el rol de Usuario de Composer (composer.user).

Funciones

Role	Permissions
Cloud Composer v2 API Service Agent Extension (roles/composer.ServiceAgentV2Ext) Cloud Composer v2 API Service Agent Extension is a supplementary role required to manage Composer v2 environments.	iam.serviceAccounts.getIamPolicy iam.serviceAccounts.setIamPolicy
Composer Administrator (roles/composer.admin) Provides full control of Cloud Composer resources. Lowest-level resources where you can grant this role: Project	composer.* composer.dags.execute composer.dags.get composer.dags.getSourceCode composer.dags.list composer.environments.create composer.environments.delete composer.environments.executeAirflowCommand composer.environments.get composer.environments.list composer.environments.update composer.imageversions.list composer.operations.delete composer.operations.get composer.operations.list composer.userworkloadsconfigmaps.create composer.userworkloadsconfigmaps.delete composer.userworkloadsconfigmaps.get composer.userworkloadsconfigmaps.list composer.userworkloadsconfigmaps.update composer.userworkloadssecrets.create composer.userworkloadssecrets.delete composer.userworkloadssecrets.get composer.userworkloadssecrets.list composer.userworkloadssecrets.update serviceusage.quotas.get serviceusage.services.get serviceusage.services.list
Environment and Storage Object Administrator (roles/composer.environmentAndStorageObjectAdmin) Provides full control of Cloud Composer resources and of the objects in all project buckets. Lowest-level resources where you can grant this role: Project	composer.* composer.dags.execute composer.dags.get composer.dags.getSourceCode composer.dags.list composer.environments.create composer.environments.delete composer.environments.executeAirflowCommand composer.environments.get composer.environments.list composer.environments.update composer.imageversions.list composer.operations.delete composer.operations.get composer.operations.list composer.userworkloadsconfigmaps.create composer.userworkloadsconfigmaps.delete composer.userworkloadsconfigmaps.get composer.userworkloadsconfigmaps.list composer.userworkloadsconfigmaps.update composer.userworkloadssecrets.create composer.userworkloadssecrets.delete composer.userworkloadssecrets.get composer.userworkloadssecrets.list composer.userworkloadssecrets.update orgpolicy.policy.get resourcemanager.projects.get resourcemanager.projects.list serviceusage.quotas.get serviceusage.services.get serviceusage.services.list storage.folders.* storage.folders.create storage.folders.delete storage.folders.get storage.folders.list storage.folders.rename storage.managedFolders.create storage.managedFolders.delete storage.managedFolders.get storage.managedFolders.list storage.multipartUploads.* storage.multipartUploads.abort storage.multipartUploads.create storage.multipartUploads.list storage.multipartUploads.listParts storage.objects.* storage.objects.create storage.objects.delete storage.objects.get storage.objects.getIamPolicy storage.objects.list storage.objects.overrideUnlockedRetention storage.objects.restore storage.objects.setIamPolicy storage.objects.setRetention storage.objects.update
Environment and Storage Object User (roles/composer.environmentAndStorageObjectUser) Read and use access to Cloud Composer resources and read access to Cloud Storage objects.	composer.dags.* composer.dags.execute composer.dags.get composer.dags.getSourceCode composer.dags.list composer.environments.get composer.environments.list composer.imageversions.list composer.operations.get composer.operations.list composer.userworkloadsconfigmaps.get composer.userworkloadsconfigmaps.list composer.userworkloadssecrets.get composer.userworkloadssecrets.list resourcemanager.projects.get resourcemanager.projects.list serviceusage.quotas.get serviceusage.services.get serviceusage.services.list storage.folders.get storage.folders.list storage.managedFolders.get storage.managedFolders.list storage.objects.get storage.objects.list
Environment and Storage Object Viewer (roles/composer.environmentAndStorageObjectViewer) Provides the permissions necessary to list and get Cloud Composer environments and operations. Provides read-only access to objects in all project buckets. Lowest-level resources where you can grant this role: Project	composer.dags.* composer.dags.execute composer.dags.get composer.dags.getSourceCode composer.dags.list composer.environments.get composer.environments.list composer.imageversions.list composer.operations.get composer.operations.list composer.userworkloadsconfigmaps.get composer.userworkloadsconfigmaps.list composer.userworkloadssecrets.get composer.userworkloadssecrets.list resourcemanager.projects.get resourcemanager.projects.list serviceusage.quotas.get serviceusage.services.get serviceusage.services.list storage.folders.get storage.folders.list storage.managedFolders.get storage.managedFolders.list storage.objects.get storage.objects.list
Composer Shared VPC Agent (roles/composer.sharedVpcAgent) Role that should be assigned to Composer Agent service account in Shared VPC host project	compute.networkAttachments.create compute.networkAttachments.delete compute.networkAttachments.get compute.networkAttachments.update compute.networks.access compute.networks.addPeering compute.networks.get compute.networks.list compute.networks.listPeeringRoutes compute.networks.removePeering compute.networks.updatePeering compute.networks.use compute.networks.useExternalIp compute.projects.get compute.regions.* compute.regions.get compute.regions.list compute.subnetworks.get compute.subnetworks.list compute.subnetworks.use compute.subnetworks.useExternalIp compute.zones.* compute.zones.get compute.zones.list dns.managedZones.get dns.managedZones.list dns.networks.targetWithPeeringZone
Composer User (roles/composer.user) Provides the permissions necessary to list and get Cloud Composer environments and operations. Lowest-level resources where you can grant this role: Project	composer.dags.* composer.dags.execute composer.dags.get composer.dags.getSourceCode composer.dags.list composer.environments.get composer.environments.list composer.imageversions.list composer.operations.get composer.operations.list composer.userworkloadsconfigmaps.get composer.userworkloadsconfigmaps.list composer.userworkloadssecrets.get composer.userworkloadssecrets.list serviceusage.quotas.get serviceusage.services.get serviceusage.services.list
Composer Worker (roles/composer.worker) Provides the permissions necessary to run a Cloud Composer environment VM. Intended for service accounts. Lowest-level resources where you can grant this role: Project	artifactregistry.* artifactregistry.aptartifacts.create artifactregistry.attachments.create artifactregistry.attachments.delete artifactregistry.attachments.get artifactregistry.attachments.list artifactregistry.dockerimages.get artifactregistry.dockerimages.list artifactregistry.files.delete artifactregistry.files.download artifactregistry.files.get artifactregistry.files.list artifactregistry.files.update artifactregistry.files.upload artifactregistry.kfpartifacts.create artifactregistry.locations.get artifactregistry.locations.list artifactregistry.mavenartifacts.get artifactregistry.mavenartifacts.list artifactregistry.npmpackages.get artifactregistry.npmpackages.list artifactregistry.packages.delete artifactregistry.packages.get artifactregistry.packages.list artifactregistry.packages.update artifactregistry.projectsettings.get artifactregistry.projectsettings.update artifactregistry.pythonpackages.get artifactregistry.pythonpackages.list artifactregistry.repositories.create artifactregistry.repositories.createOnPush artifactregistry.repositories.createTagBinding artifactregistry.repositories.delete artifactregistry.repositories.deleteArtifacts artifactregistry.repositories.deleteTagBinding artifactregistry.repositories.downloadArtifacts artifactregistry.repositories.get artifactregistry.repositories.getIamPolicy artifactregistry.repositories.list artifactregistry.repositories.listEffectiveTags artifactregistry.repositories.listTagBindings artifactregistry.repositories.readViaVirtualRepository artifactregistry.repositories.setIamPolicy artifactregistry.repositories.update artifactregistry.repositories.uploadArtifacts artifactregistry.rules.create artifactregistry.rules.delete artifactregistry.rules.get artifactregistry.rules.list artifactregistry.rules.update artifactregistry.tags.create artifactregistry.tags.delete artifactregistry.tags.get artifactregistry.tags.list artifactregistry.tags.update artifactregistry.versions.delete artifactregistry.versions.get artifactregistry.versions.list artifactregistry.versions.update artifactregistry.yumartifacts.create cloudbuild.builds.create cloudbuild.builds.get cloudbuild.builds.list cloudbuild.builds.update cloudbuild.operations.* cloudbuild.operations.get cloudbuild.operations.list cloudbuild.workerpools.use composer.environments.get container.* container.apiServices.create container.apiServices.delete container.apiServices.get container.apiServices.getStatus container.apiServices.list container.apiServices.update container.apiServices.updateStatus container.auditSinks.create container.auditSinks.delete container.auditSinks.get container.auditSinks.list container.auditSinks.update container.backendConfigs.create container.backendConfigs.delete container.backendConfigs.get container.backendConfigs.list container.backendConfigs.update container.bindings.create container.bindings.delete container.bindings.get container.bindings.list container.bindings.update container.certificateSigningRequests.approve container.certificateSigningRequests.create container.certificateSigningRequests.delete container.certificateSigningRequests.get container.certificateSigningRequests.getStatus container.certificateSigningRequests.list container.certificateSigningRequests.update container.certificateSigningRequests.updateStatus container.clusterRoleBindings.create container.clusterRoleBindings.delete container.clusterRoleBindings.get container.clusterRoleBindings.list container.clusterRoleBindings.update container.clusterRoles.bind container.clusterRoles.create container.clusterRoles.delete container.clusterRoles.escalate container.clusterRoles.get container.clusterRoles.list container.clusterRoles.update container.clusters.connect container.clusters.create container.clusters.createTagBinding container.clusters.delete container.clusters.deleteTagBinding container.clusters.get container.clusters.getCredentials container.clusters.impersonate container.clusters.list container.clusters.listEffectiveTags container.clusters.listTagBindings container.clusters.update container.componentStatuses.get container.componentStatuses.list container.configMaps.create container.configMaps.delete container.configMaps.get container.configMaps.list container.configMaps.update container.controllerRevisions.create container.controllerRevisions.delete container.controllerRevisions.get container.controllerRevisions.list container.controllerRevisions.update container.cronJobs.create container.cronJobs.delete container.cronJobs.get container.cronJobs.getStatus container.cronJobs.list container.cronJobs.update container.cronJobs.updateStatus container.csiDrivers.create container.csiDrivers.delete container.csiDrivers.get container.csiDrivers.list container.csiDrivers.update container.csiNodeInfos.create container.csiNodeInfos.delete container.csiNodeInfos.get container.csiNodeInfos.list container.csiNodeInfos.update container.csiNodes.create container.csiNodes.delete container.csiNodes.get container.csiNodes.list container.csiNodes.update container.customResourceDefinitions.create container.customResourceDefinitions.delete container.customResourceDefinitions.get container.customResourceDefinitions.getStatus container.customResourceDefinitions.list container.customResourceDefinitions.update container.customResourceDefinitions.updateStatus container.daemonSets.create container.daemonSets.delete container.daemonSets.get container.daemonSets.getStatus container.daemonSets.list container.daemonSets.update container.daemonSets.updateStatus container.deployments.create container.deployments.delete container.deployments.get container.deployments.getScale container.deployments.getStatus container.deployments.list container.deployments.rollback container.deployments.update container.deployments.updateScale container.deployments.updateStatus container.endpointSlices.create container.endpointSlices.delete container.endpointSlices.get container.endpointSlices.list container.endpointSlices.update container.endpoints.create container.endpoints.delete container.endpoints.get container.endpoints.list container.endpoints.update container.events.create container.events.delete container.events.get container.events.list container.events.update container.frontendConfigs.create container.frontendConfigs.delete container.frontendConfigs.get container.frontendConfigs.list container.frontendConfigs.update container.horizontalPodAutoscalers.create container.horizontalPodAutoscalers.delete container.horizontalPodAutoscalers.get container.horizontalPodAutoscalers.getStatus container.horizontalPodAutoscalers.list container.horizontalPodAutoscalers.update container.horizontalPodAutoscalers.updateStatus container.hostServiceAgent.use container.ingresses.create container.ingresses.delete container.ingresses.get container.ingresses.getStatus container.ingresses.list container.ingresses.update container.ingresses.updateStatus container.initializerConfigurations.create container.initializerConfigurations.delete container.initializerConfigurations.get container.initializerConfigurations.list container.initializerConfigurations.update container.jobs.create container.jobs.delete container.jobs.get container.jobs.getStatus container.jobs.list container.jobs.update container.jobs.updateStatus container.leases.create container.leases.delete container.leases.get container.leases.list container.leases.update container.limitRanges.create container.limitRanges.delete container.limitRanges.get container.limitRanges.list container.limitRanges.update container.localSubjectAccessReviews.create container.localSubjectAccessReviews.list container.managedCertificates.create container.managedCertificates.delete container.managedCertificates.get container.managedCertificates.list container.managedCertificates.update container.mutatingWebhookConfigurations.create container.mutatingWebhookConfigurations.delete container.mutatingWebhookConfigurations.get container.mutatingWebhookConfigurations.list container.mutatingWebhookConfigurations.update container.namespaces.create container.namespaces.delete container.namespaces.finalize container.namespaces.get container.namespaces.getStatus container.namespaces.list container.namespaces.update container.namespaces.updateStatus container.networkPolicies.create container.networkPolicies.delete container.networkPolicies.get container.networkPolicies.list container.networkPolicies.update container.nodes.create container.nodes.delete container.nodes.get container.nodes.getStatus container.nodes.list container.nodes.proxy container.nodes.update container.nodes.updateStatus container.operations.get container.operations.list container.persistentVolumeClaims.create container.persistentVolumeClaims.delete container.persistentVolumeClaims.get container.persistentVolumeClaims.getStatus container.persistentVolumeClaims.list container.persistentVolumeClaims.update container.persistentVolumeClaims.updateStatus container.persistentVolumes.create container.persistentVolumes.delete container.persistentVolumes.get container.persistentVolumes.getStatus container.persistentVolumes.list container.persistentVolumes.update container.persistentVolumes.updateStatus container.petSets.create container.petSets.delete container.petSets.get container.petSets.list container.petSets.update container.petSets.updateStatus container.podDisruptionBudgets.create container.podDisruptionBudgets.delete container.podDisruptionBudgets.get container.podDisruptionBudgets.getStatus container.podDisruptionBudgets.list container.podDisruptionBudgets.update container.podDisruptionBudgets.updateStatus container.podPresets.create container.podPresets.delete container.podPresets.get container.podPresets.list container.podPresets.update container.podSecurityPolicies.create container.podSecurityPolicies.delete container.podSecurityPolicies.get container.podSecurityPolicies.list container.podSecurityPolicies.update container.podSecurityPolicies.use container.podTemplates.create container.podTemplates.delete container.podTemplates.get container.podTemplates.list container.podTemplates.update container.pods.attach container.pods.create container.pods.delete container.pods.evict container.pods.exec container.pods.get container.pods.getLogs container.pods.getStatus container.pods.initialize container.pods.list container.pods.portForward container.pods.proxy container.pods.update container.pods.updateStatus container.priorityClasses.create container.priorityClasses.delete container.priorityClasses.get container.priorityClasses.list container.priorityClasses.update container.replicaSets.create container.replicaSets.delete container.replicaSets.get container.replicaSets.getScale container.replicaSets.getStatus container.replicaSets.list container.replicaSets.update container.replicaSets.updateScale container.replicaSets.updateStatus container.replicationControllers.create container.replicationControllers.delete container.replicationControllers.get container.replicationControllers.getScale container.replicationControllers.getStatus container.replicationControllers.list container.replicationControllers.update container.replicationControllers.updateScale container.replicationControllers.updateStatus container.resourceQuotas.create container.resourceQuotas.delete container.resourceQuotas.get container.resourceQuotas.getStatus container.resourceQuotas.list container.resourceQuotas.update container.resourceQuotas.updateStatus container.roleBindings.create container.roleBindings.delete container.roleBindings.get container.roleBindings.list container.roleBindings.update container.roles.bind container.roles.create container.roles.delete container.roles.escalate container.roles.get container.roles.list container.roles.update container.runtimeClasses.create container.runtimeClasses.delete container.runtimeClasses.get container.runtimeClasses.list container.runtimeClasses.update container.scheduledJobs.create container.scheduledJobs.delete container.scheduledJobs.get container.scheduledJobs.list container.scheduledJobs.update container.scheduledJobs.updateStatus container.secrets.create container.secrets.delete container.secrets.get container.secrets.list container.secrets.update container.selfSubjectAccessReviews.create container.selfSubjectAccessReviews.list container.selfSubjectRulesReviews.create container.serviceAccounts.create container.serviceAccounts.createToken container.serviceAccounts.delete container.serviceAccounts.get container.serviceAccounts.list container.serviceAccounts.update container.services.create container.services.delete container.services.get container.services.getStatus container.services.list container.services.proxy container.services.update container.services.updateStatus container.statefulSets.create container.statefulSets.delete container.statefulSets.get container.statefulSets.getScale container.statefulSets.getStatus container.statefulSets.list container.statefulSets.update container.statefulSets.updateScale container.statefulSets.updateStatus container.storageClasses.create container.storageClasses.delete container.storageClasses.get container.storageClasses.list container.storageClasses.update container.storageStates.create container.storageStates.delete container.storageStates.get container.storageStates.getStatus container.storageStates.list container.storageStates.update container.storageStates.updateStatus container.storageVersionMigrations.create container.storageVersionMigrations.delete container.storageVersionMigrations.get container.storageVersionMigrations.getStatus container.storageVersionMigrations.list container.storageVersionMigrations.update container.storageVersionMigrations.updateStatus container.subjectAccessReviews.create container.subjectAccessReviews.list container.thirdPartyObjects.create container.thirdPartyObjects.delete container.thirdPartyObjects.get container.thirdPartyObjects.list container.thirdPartyObjects.update container.thirdPartyResources.create container.thirdPartyResources.delete container.thirdPartyResources.get container.thirdPartyResources.list container.thirdPartyResources.update container.tokenReviews.create container.updateInfos.create container.updateInfos.delete container.updateInfos.get container.updateInfos.list container.updateInfos.update container.validatingWebhookConfigurations.create container.validatingWebhookConfigurations.delete container.validatingWebhookConfigurations.get container.validatingWebhookConfigurations.list container.validatingWebhookConfigurations.update container.volumeAttachments.create container.volumeAttachments.delete container.volumeAttachments.get container.volumeAttachments.getStatus container.volumeAttachments.list container.volumeAttachments.update container.volumeAttachments.updateStatus container.volumeSnapshotClasses.create container.volumeSnapshotClasses.delete container.volumeSnapshotClasses.get container.volumeSnapshotClasses.list container.volumeSnapshotClasses.update container.volumeSnapshotContents.create container.volumeSnapshotContents.delete container.volumeSnapshotContents.get container.volumeSnapshotContents.getStatus container.volumeSnapshotContents.list container.volumeSnapshotContents.update container.volumeSnapshotContents.updateStatus container.volumeSnapshots.create container.volumeSnapshots.delete container.volumeSnapshots.get container.volumeSnapshots.getStatus container.volumeSnapshots.list container.volumeSnapshots.update container.volumeSnapshots.updateStatus containeranalysis.occurrences.create containeranalysis.occurrences.delete containeranalysis.occurrences.get containeranalysis.occurrences.list containeranalysis.occurrences.update datalineage.events.create datalineage.processes.create datalineage.processes.get datalineage.processes.update datalineage.runs.create datalineage.runs.get datalineage.runs.update logging.logEntries.create logging.logEntries.list logging.logEntries.route logging.views.access monitoring.metricDescriptors.create monitoring.metricDescriptors.get monitoring.metricDescriptors.list monitoring.monitoredResourceDescriptors.* monitoring.monitoredResourceDescriptors.get monitoring.monitoredResourceDescriptors.list monitoring.timeSeries.* monitoring.timeSeries.create monitoring.timeSeries.list orgpolicy.policy.get pubsub.schemas.attach pubsub.schemas.commit pubsub.schemas.create pubsub.schemas.delete pubsub.schemas.get pubsub.schemas.list pubsub.schemas.listRevisions pubsub.schemas.rollback pubsub.schemas.validate pubsub.snapshots.create pubsub.snapshots.delete pubsub.snapshots.get pubsub.snapshots.list pubsub.snapshots.seek pubsub.snapshots.update pubsub.subscriptions.consume pubsub.subscriptions.create pubsub.subscriptions.delete pubsub.subscriptions.get pubsub.subscriptions.list pubsub.subscriptions.update pubsub.topics.attachSubscription pubsub.topics.create pubsub.topics.delete pubsub.topics.detachSubscription pubsub.topics.get pubsub.topics.list pubsub.topics.publish pubsub.topics.update pubsub.topics.updateTag recommender.containerDiagnosisInsights.* recommender.containerDiagnosisInsights.get recommender.containerDiagnosisInsights.list recommender.containerDiagnosisInsights.update recommender.containerDiagnosisRecommendations.* recommender.containerDiagnosisRecommendations.get recommender.containerDiagnosisRecommendations.list recommender.containerDiagnosisRecommendations.update recommender.locations.* recommender.locations.get recommender.locations.list recommender.networkAnalyzerGkeConnectivityInsights.* recommender.networkAnalyzerGkeConnectivityInsights.get recommender.networkAnalyzerGkeConnectivityInsights.list recommender.networkAnalyzerGkeConnectivityInsights.update recommender.networkAnalyzerGkeIpAddressInsights.* recommender.networkAnalyzerGkeIpAddressInsights.get recommender.networkAnalyzerGkeIpAddressInsights.list recommender.networkAnalyzerGkeIpAddressInsights.update remotebuildexecution.blobs.get resourcemanager.projects.get resourcemanager.projects.list serviceusage.quotas.get serviceusage.services.get serviceusage.services.list source.repos.get source.repos.list storage.buckets.create storage.buckets.get storage.buckets.list storage.folders.* storage.folders.create storage.folders.delete storage.folders.get storage.folders.list storage.folders.rename storage.managedFolders.create storage.managedFolders.delete storage.managedFolders.get storage.managedFolders.list storage.multipartUploads.* storage.multipartUploads.abort storage.multipartUploads.create storage.multipartUploads.list storage.multipartUploads.listParts storage.objects.* storage.objects.create storage.objects.delete storage.objects.get storage.objects.getIamPolicy storage.objects.list storage.objects.overrideUnlockedRetention storage.objects.restore storage.objects.setIamPolicy storage.objects.setRetention storage.objects.update

Roles de los agentes de servicio

Rol

Permisos

Agente de servicios de la API de Cloud Composer (roles/composer.serviceAgent) El agente de servicios de la API de Cloud Composer puede administrar entornos. Advertencia: No otorgues funciones de agente de servicio a ninguna principal, excepto los agentes de servicio.

appengine.applications.get appengine.applications.listRuntimes appengine.applications.update appengine.instances.* appengine.instances.delete appengine.instances.enableDebug appengine.instances.get appengine.instances.list appengine.memcache.addKey appengine.memcache.flush appengine.memcache.get appengine.memcache.update appengine.operations.* appengine.operations.get appengine.operations.list appengine.runtimes.actAsAdmin appengine.services.* appengine.services.delete appengine.services.get appengine.services.list appengine.services.update appengine.versions.create appengine.versions.delete appengine.versions.get appengine.versions.list appengine.versions.update artifactregistry.projectsettings.get artifactregistry.repositories.create artifactregistry.repositories.delete artifactregistry.repositories.get artifactregistry.repositories.list artifactregistry.repositories.update backupdr.backupPlanAssociations.createForComputeInstance backupdr.backupPlanAssociations.deleteForComputeInstance backupdr.backupPlanAssociations.list backupdr.backupPlanAssociations.triggerBackupForComputeInstance backupdr.backupPlans.get backupdr.backupPlans.list backupdr.backupPlans.useForComputeInstance backupdr.backupVaults.get backupdr.backupVaults.list backupdr.locations.list backupdr.operations.get backupdr.operations.list backupdr.serviceConfig.initialize cloudaicompanion.companions.* cloudaicompanion.companions.generateChat cloudaicompanion.companions.generateCode cloudaicompanion.entitlements.get cloudaicompanion.instances.completeCode cloudaicompanion.instances.generateCode cloudnotifications.activities.list cloudsql.* cloudsql.backupRuns.create cloudsql.backupRuns.delete cloudsql.backupRuns.get cloudsql.backupRuns.list cloudsql.databases.create cloudsql.databases.delete cloudsql.databases.get cloudsql.databases.list cloudsql.databases.update cloudsql.instances.addServerCa cloudsql.instances.addServerCertificate cloudsql.instances.clone cloudsql.instances.connect cloudsql.instances.create cloudsql.instances.createTagBinding cloudsql.instances.delete cloudsql.instances.deleteTagBinding cloudsql.instances.demoteMaster cloudsql.instances.executeSql cloudsql.instances.export cloudsql.instances.failover cloudsql.instances.get cloudsql.instances.getDiskShrinkConfig cloudsql.instances.import cloudsql.instances.list cloudsql.instances.listEffectiveTags cloudsql.instances.listServerCas cloudsql.instances.listServerCertificates cloudsql.instances.listTagBindings cloudsql.instances.login cloudsql.instances.manageEncryption cloudsql.instances.migrate cloudsql.instances.performDiskShrink cloudsql.instances.promoteReplica cloudsql.instances.reencrypt cloudsql.instances.resetReplicaSize cloudsql.instances.resetSslConfig cloudsql.instances.restart cloudsql.instances.restoreBackup cloudsql.instances.rotateServerCa cloudsql.instances.rotateServerCertificate cloudsql.instances.startReplica cloudsql.instances.stopReplica cloudsql.instances.truncateLog cloudsql.instances.update cloudsql.schemas.view cloudsql.sslCerts.create cloudsql.sslCerts.delete cloudsql.sslCerts.get cloudsql.sslCerts.list cloudsql.users.create cloudsql.users.delete cloudsql.users.get cloudsql.users.list cloudsql.users.update composer.dags.get composer.environments.get compute.acceleratorTypes.* compute.acceleratorTypes.get compute.acceleratorTypes.list compute.addresses.* compute.addresses.create compute.addresses.createInternal compute.addresses.createTagBinding compute.addresses.delete compute.addresses.deleteInternal compute.addresses.deleteTagBinding compute.addresses.get compute.addresses.list compute.addresses.listEffectiveTags compute.addresses.listTagBindings compute.addresses.setLabels compute.addresses.use compute.addresses.useInternal compute.autoscalers.* compute.autoscalers.create compute.autoscalers.delete compute.autoscalers.get compute.autoscalers.list compute.autoscalers.update compute.backendBuckets.* compute.backendBuckets.addSignedUrlKey compute.backendBuckets.create compute.backendBuckets.createTagBinding compute.backendBuckets.delete compute.backendBuckets.deleteSignedUrlKey compute.backendBuckets.deleteTagBinding compute.backendBuckets.get compute.backendBuckets.getIamPolicy compute.backendBuckets.list compute.backendBuckets.listEffectiveTags compute.backendBuckets.listTagBindings compute.backendBuckets.setIamPolicy compute.backendBuckets.setSecurityPolicy compute.backendBuckets.update compute.backendBuckets.use compute.backendServices.* compute.backendServices.addSignedUrlKey compute.backendServices.create compute.backendServices.createTagBinding compute.backendServices.delete compute.backendServices.deleteSignedUrlKey compute.backendServices.deleteTagBinding compute.backendServices.get compute.backendServices.getIamPolicy compute.backendServices.list compute.backendServices.listEffectiveTags compute.backendServices.listTagBindings compute.backendServices.setIamPolicy compute.backendServices.setSecurityPolicy compute.backendServices.update compute.backendServices.use compute.diskTypes.* compute.diskTypes.get compute.diskTypes.list compute.disks.* compute.disks.addResourcePolicies compute.disks.create compute.disks.createSnapshot compute.disks.createTagBinding compute.disks.delete compute.disks.deleteTagBinding compute.disks.get compute.disks.getIamPolicy compute.disks.list compute.disks.listEffectiveTags compute.disks.listTagBindings compute.disks.removeResourcePolicies compute.disks.resize compute.disks.setIamPolicy compute.disks.setLabels compute.disks.startAsyncReplication compute.disks.stopAsyncReplication compute.disks.stopGroupAsyncReplication compute.disks.update compute.disks.use compute.disks.useReadOnly compute.externalVpnGateways.* compute.externalVpnGateways.create compute.externalVpnGateways.createTagBinding compute.externalVpnGateways.delete compute.externalVpnGateways.deleteTagBinding compute.externalVpnGateways.get compute.externalVpnGateways.list compute.externalVpnGateways.listEffectiveTags compute.externalVpnGateways.listTagBindings compute.externalVpnGateways.setLabels compute.externalVpnGateways.use compute.firewallPolicies.get compute.firewallPolicies.list compute.firewallPolicies.listEffectiveTags compute.firewallPolicies.listTagBindings compute.firewallPolicies.use compute.firewalls.get compute.firewalls.list compute.firewalls.listEffectiveTags compute.firewalls.listTagBindings compute.forwardingRules.* compute.forwardingRules.create compute.forwardingRules.createTagBinding compute.forwardingRules.delete compute.forwardingRules.deleteTagBinding compute.forwardingRules.get compute.forwardingRules.list compute.forwardingRules.listEffectiveTags compute.forwardingRules.listTagBindings compute.forwardingRules.pscCreate compute.forwardingRules.pscDelete compute.forwardingRules.pscSetLabels compute.forwardingRules.pscSetTarget compute.forwardingRules.pscUpdate compute.forwardingRules.setLabels compute.forwardingRules.setTarget compute.forwardingRules.update compute.forwardingRules.use compute.globalAddresses.* compute.globalAddresses.create compute.globalAddresses.createInternal compute.globalAddresses.createTagBinding compute.globalAddresses.delete compute.globalAddresses.deleteInternal compute.globalAddresses.deleteTagBinding compute.globalAddresses.get compute.globalAddresses.list compute.globalAddresses.listEffectiveTags compute.globalAddresses.listTagBindings compute.globalAddresses.setLabels compute.globalAddresses.use compute.globalForwardingRules.* compute.globalForwardingRules.create compute.globalForwardingRules.createTagBinding compute.globalForwardingRules.delete compute.globalForwardingRules.deleteTagBinding compute.globalForwardingRules.get compute.globalForwardingRules.list compute.globalForwardingRules.listEffectiveTags compute.globalForwardingRules.listTagBindings compute.globalForwardingRules.pscCreate compute.globalForwardingRules.pscDelete compute.globalForwardingRules.pscGet compute.globalForwardingRules.pscSetLabels compute.globalForwardingRules.pscSetTarget compute.globalForwardingRules.pscUpdate compute.globalForwardingRules.setLabels compute.globalForwardingRules.setTarget compute.globalForwardingRules.update compute.globalNetworkEndpointGroups.* compute.globalNetworkEndpointGroups.attachNetworkEndpoints compute.globalNetworkEndpointGroups.create compute.globalNetworkEndpointGroups.createTagBinding compute.globalNetworkEndpointGroups.delete compute.globalNetworkEndpointGroups.deleteTagBinding compute.globalNetworkEndpointGroups.detachNetworkEndpoints compute.globalNetworkEndpointGroups.get compute.globalNetworkEndpointGroups.list compute.globalNetworkEndpointGroups.listEffectiveTags compute.globalNetworkEndpointGroups.listTagBindings compute.globalNetworkEndpointGroups.use compute.globalOperations.get compute.globalOperations.list compute.globalPublicDelegatedPrefixes.delete compute.globalPublicDelegatedPrefixes.get compute.globalPublicDelegatedPrefixes.list compute.globalPublicDelegatedPrefixes.updatePolicy compute.healthChecks.* compute.healthChecks.create compute.healthChecks.createTagBinding compute.healthChecks.delete compute.healthChecks.deleteTagBinding compute.healthChecks.get compute.healthChecks.list compute.healthChecks.listEffectiveTags compute.healthChecks.listTagBindings compute.healthChecks.update compute.healthChecks.use compute.healthChecks.useReadOnly compute.httpHealthChecks.* compute.httpHealthChecks.create compute.httpHealthChecks.createTagBinding compute.httpHealthChecks.delete compute.httpHealthChecks.deleteTagBinding compute.httpHealthChecks.get compute.httpHealthChecks.list compute.httpHealthChecks.listEffectiveTags compute.httpHealthChecks.listTagBindings compute.httpHealthChecks.update compute.httpHealthChecks.use compute.httpHealthChecks.useReadOnly compute.httpsHealthChecks.* compute.httpsHealthChecks.create compute.httpsHealthChecks.createTagBinding compute.httpsHealthChecks.delete compute.httpsHealthChecks.deleteTagBinding compute.httpsHealthChecks.get compute.httpsHealthChecks.list compute.httpsHealthChecks.listEffectiveTags compute.httpsHealthChecks.listTagBindings compute.httpsHealthChecks.update compute.httpsHealthChecks.use compute.httpsHealthChecks.useReadOnly compute.images.* compute.images.create compute.images.createTagBinding compute.images.delete compute.images.deleteTagBinding compute.images.deprecate compute.images.get compute.images.getFromFamily compute.images.getIamPolicy compute.images.list compute.images.listEffectiveTags compute.images.listTagBindings compute.images.setIamPolicy compute.images.setLabels compute.images.update compute.images.useReadOnly compute.instanceGroupManagers.* compute.instanceGroupManagers.create compute.instanceGroupManagers.createTagBinding compute.instanceGroupManagers.delete compute.instanceGroupManagers.deleteTagBinding compute.instanceGroupManagers.get compute.instanceGroupManagers.list compute.instanceGroupManagers.listEffectiveTags compute.instanceGroupManagers.listTagBindings compute.instanceGroupManagers.update compute.instanceGroupManagers.use compute.instanceGroups.* compute.instanceGroups.create compute.instanceGroups.createTagBinding compute.instanceGroups.delete compute.instanceGroups.deleteTagBinding compute.instanceGroups.get compute.instanceGroups.list compute.instanceGroups.listEffectiveTags compute.instanceGroups.listTagBindings compute.instanceGroups.update compute.instanceGroups.use compute.instanceSettings.* compute.instanceSettings.get compute.instanceSettings.update compute.instanceTemplates.* compute.instanceTemplates.create compute.instanceTemplates.delete compute.instanceTemplates.get compute.instanceTemplates.getIamPolicy compute.instanceTemplates.list compute.instanceTemplates.setIamPolicy compute.instanceTemplates.useReadOnly compute.instances.* compute.instances.addAccessConfig compute.instances.addResourcePolicies compute.instances.attachDisk compute.instances.create compute.instances.createTagBinding compute.instances.delete compute.instances.deleteAccessConfig compute.instances.deleteTagBinding compute.instances.detachDisk compute.instances.get compute.instances.getEffectiveFirewalls compute.instances.getGuestAttributes compute.instances.getIamPolicy compute.instances.getScreenshot compute.instances.getSerialPortOutput compute.instances.getShieldedInstanceIdentity compute.instances.getShieldedVmIdentity compute.instances.list compute.instances.listEffectiveTags compute.instances.listReferrers compute.instances.listTagBindings compute.instances.osAdminLogin compute.instances.osLogin compute.instances.pscInterfaceCreate compute.instances.removeResourcePolicies compute.instances.reset compute.instances.resume compute.instances.sendDiagnosticInterrupt compute.instances.setDeletionProtection compute.instances.setDiskAutoDelete compute.instances.setIamPolicy compute.instances.setLabels compute.instances.setMachineResources compute.instances.setMachineType compute.instances.setMetadata compute.instances.setMinCpuPlatform compute.instances.setName compute.instances.setScheduling compute.instances.setSecurityPolicy compute.instances.setServiceAccount compute.instances.setShieldedInstanceIntegrityPolicy compute.instances.setShieldedVmIntegrityPolicy compute.instances.setTags compute.instances.simulateMaintenanceEvent compute.instances.start compute.instances.startWithEncryptionKey compute.instances.stop compute.instances.suspend compute.instances.update compute.instances.updateAccessConfig compute.instances.updateDisplayDevice compute.instances.updateNetworkInterface compute.instances.updateSecurity compute.instances.updateShieldedInstanceConfig compute.instances.updateShieldedVmConfig compute.instances.use compute.instances.useReadOnly compute.instantSnapshots.* compute.instantSnapshots.create compute.instantSnapshots.delete compute.instantSnapshots.export compute.instantSnapshots.get compute.instantSnapshots.getIamPolicy compute.instantSnapshots.list compute.instantSnapshots.setIamPolicy compute.instantSnapshots.setLabels compute.instantSnapshots.useReadOnly compute.interconnectAttachments.* compute.interconnectAttachments.create compute.interconnectAttachments.createTagBinding compute.interconnectAttachments.delete compute.interconnectAttachments.deleteTagBinding compute.interconnectAttachments.get compute.interconnectAttachments.list compute.interconnectAttachments.listEffectiveTags compute.interconnectAttachments.listTagBindings compute.interconnectAttachments.setLabels compute.interconnectAttachments.update compute.interconnectAttachments.use compute.interconnectLocations.* compute.interconnectLocations.get compute.interconnectLocations.list compute.interconnectRemoteLocations.* compute.interconnectRemoteLocations.get compute.interconnectRemoteLocations.list compute.interconnects.* compute.interconnects.create compute.interconnects.createTagBinding compute.interconnects.delete compute.interconnects.deleteTagBinding compute.interconnects.get compute.interconnects.getMacsecConfig compute.interconnects.list compute.interconnects.listEffectiveTags compute.interconnects.listTagBindings compute.interconnects.setLabels compute.interconnects.update compute.interconnects.use compute.licenseCodes.* compute.licenseCodes.get compute.licenseCodes.getIamPolicy compute.licenseCodes.list compute.licenseCodes.setIamPolicy compute.licenseCodes.update compute.licenses.* compute.licenses.create compute.licenses.delete compute.licenses.get compute.licenses.getIamPolicy compute.licenses.list compute.licenses.setIamPolicy compute.machineImages.* compute.machineImages.create compute.machineImages.delete compute.machineImages.get compute.machineImages.getIamPolicy compute.machineImages.list compute.machineImages.setIamPolicy compute.machineImages.useReadOnly compute.machineTypes.* compute.machineTypes.get compute.machineTypes.list compute.multiMig.* compute.multiMig.create compute.multiMig.delete compute.multiMig.get compute.multiMig.list compute.networkAttachments.* compute.networkAttachments.create compute.networkAttachments.createTagBinding compute.networkAttachments.delete compute.networkAttachments.deleteTagBinding compute.networkAttachments.get compute.networkAttachments.getIamPolicy compute.networkAttachments.list compute.networkAttachments.listEffectiveTags compute.networkAttachments.listTagBindings compute.networkAttachments.setIamPolicy compute.networkAttachments.update compute.networkEndpointGroups.* compute.networkEndpointGroups.attachNetworkEndpoints compute.networkEndpointGroups.create compute.networkEndpointGroups.createTagBinding compute.networkEndpointGroups.delete compute.networkEndpointGroups.deleteTagBinding compute.networkEndpointGroups.detachNetworkEndpoints compute.networkEndpointGroups.get compute.networkEndpointGroups.list compute.networkEndpointGroups.listEffectiveTags compute.networkEndpointGroups.listTagBindings compute.networkEndpointGroups.use compute.networkProfiles.* compute.networkProfiles.get compute.networkProfiles.list compute.networks.* compute.networks.access compute.networks.addPeering compute.networks.create compute.networks.createTagBinding compute.networks.delete compute.networks.deleteTagBinding compute.networks.get compute.networks.getEffectiveFirewalls compute.networks.getRegionEffectiveFirewalls compute.networks.list compute.networks.listEffectiveTags compute.networks.listPeeringRoutes compute.networks.listTagBindings compute.networks.mirror compute.networks.removePeering compute.networks.setFirewallPolicy compute.networks.switchToCustomMode compute.networks.update compute.networks.updatePeering compute.networks.updatePolicy compute.networks.use compute.networks.useExternalIp compute.packetMirrorings.get compute.packetMirrorings.list compute.packetMirrorings.listEffectiveTags compute.packetMirrorings.listTagBindings compute.projects.get compute.projects.setCommonInstanceMetadata compute.publicDelegatedPrefixes.delete compute.publicDelegatedPrefixes.get compute.publicDelegatedPrefixes.list compute.publicDelegatedPrefixes.listEffectiveTags compute.publicDelegatedPrefixes.listTagBindings compute.publicDelegatedPrefixes.update compute.publicDelegatedPrefixes.updatePolicy compute.regionBackendServices.* compute.regionBackendServices.create compute.regionBackendServices.createTagBinding compute.regionBackendServices.delete compute.regionBackendServices.deleteTagBinding compute.regionBackendServices.get compute.regionBackendServices.getIamPolicy compute.regionBackendServices.list compute.regionBackendServices.listEffectiveTags compute.regionBackendServices.listTagBindings compute.regionBackendServices.setIamPolicy compute.regionBackendServices.setSecurityPolicy compute.regionBackendServices.update compute.regionBackendServices.use compute.regionFirewallPolicies.get compute.regionFirewallPolicies.list compute.regionFirewallPolicies.listEffectiveTags compute.regionFirewallPolicies.listTagBindings compute.regionFirewallPolicies.use compute.regionHealthCheckServices.* compute.regionHealthCheckServices.create compute.regionHealthCheckServices.delete compute.regionHealthCheckServices.get compute.regionHealthCheckServices.list compute.regionHealthCheckServices.update compute.regionHealthCheckServices.use compute.regionHealthChecks.* compute.regionHealthChecks.create compute.regionHealthChecks.createTagBinding compute.regionHealthChecks.delete compute.regionHealthChecks.deleteTagBinding compute.regionHealthChecks.get compute.regionHealthChecks.list compute.regionHealthChecks.listEffectiveTags compute.regionHealthChecks.listTagBindings compute.regionHealthChecks.update compute.regionHealthChecks.use compute.regionHealthChecks.useReadOnly compute.regionNetworkEndpointGroups.* compute.regionNetworkEndpointGroups.attachNetworkEndpoints compute.regionNetworkEndpointGroups.create compute.regionNetworkEndpointGroups.createTagBinding compute.regionNetworkEndpointGroups.delete compute.regionNetworkEndpointGroups.deleteTagBinding compute.regionNetworkEndpointGroups.detachNetworkEndpoints compute.regionNetworkEndpointGroups.get compute.regionNetworkEndpointGroups.list compute.regionNetworkEndpointGroups.listEffectiveTags compute.regionNetworkEndpointGroups.listTagBindings compute.regionNetworkEndpointGroups.use compute.regionNotificationEndpoints.* compute.regionNotificationEndpoints.create compute.regionNotificationEndpoints.delete compute.regionNotificationEndpoints.get compute.regionNotificationEndpoints.list compute.regionNotificationEndpoints.update compute.regionNotificationEndpoints.use compute.regionOperations.get compute.regionOperations.list compute.regionSecurityPolicies.get compute.regionSecurityPolicies.list compute.regionSecurityPolicies.listEffectiveTags compute.regionSecurityPolicies.listTagBindings compute.regionSecurityPolicies.use compute.regionSslCertificates.get compute.regionSslCertificates.list compute.regionSslCertificates.listEffectiveTags compute.regionSslCertificates.listTagBindings compute.regionSslPolicies.* compute.regionSslPolicies.create compute.regionSslPolicies.createTagBinding compute.regionSslPolicies.delete compute.regionSslPolicies.deleteTagBinding compute.regionSslPolicies.get compute.regionSslPolicies.list compute.regionSslPolicies.listAvailableFeatures compute.regionSslPolicies.listEffectiveTags compute.regionSslPolicies.listTagBindings compute.regionSslPolicies.update compute.regionSslPolicies.use compute.regionTargetHttpProxies.* compute.regionTargetHttpProxies.create compute.regionTargetHttpProxies.createTagBinding compute.regionTargetHttpProxies.delete compute.regionTargetHttpProxies.deleteTagBinding compute.regionTargetHttpProxies.get compute.regionTargetHttpProxies.list compute.regionTargetHttpProxies.listEffectiveTags compute.regionTargetHttpProxies.listTagBindings compute.regionTargetHttpProxies.setUrlMap compute.regionTargetHttpProxies.use compute.regionTargetHttpsProxies.* compute.regionTargetHttpsProxies.create compute.regionTargetHttpsProxies.createTagBinding compute.regionTargetHttpsProxies.delete compute.regionTargetHttpsProxies.deleteTagBinding compute.regionTargetHttpsProxies.get compute.regionTargetHttpsProxies.list compute.regionTargetHttpsProxies.listEffectiveTags compute.regionTargetHttpsProxies.listTagBindings compute.regionTargetHttpsProxies.setSslCertificates compute.regionTargetHttpsProxies.setUrlMap compute.regionTargetHttpsProxies.update compute.regionTargetHttpsProxies.use compute.regionTargetTcpProxies.* compute.regionTargetTcpProxies.create compute.regionTargetTcpProxies.createTagBinding compute.regionTargetTcpProxies.delete compute.regionTargetTcpProxies.deleteTagBinding compute.regionTargetTcpProxies.get compute.regionTargetTcpProxies.list compute.regionTargetTcpProxies.listEffectiveTags compute.regionTargetTcpProxies.listTagBindings compute.regionTargetTcpProxies.use compute.regionUrlMaps.* compute.regionUrlMaps.create compute.regionUrlMaps.createTagBinding compute.regionUrlMaps.delete compute.regionUrlMaps.deleteTagBinding compute.regionUrlMaps.get compute.regionUrlMaps.invalidateCache compute.regionUrlMaps.list compute.regionUrlMaps.listEffectiveTags compute.regionUrlMaps.listTagBindings compute.regionUrlMaps.update compute.regionUrlMaps.use compute.regionUrlMaps.validate compute.regions.* compute.regions.get compute.regions.list compute.reservationBlocks.get compute.reservationBlocks.list compute.reservations.get compute.reservations.list compute.resourcePolicies.* compute.resourcePolicies.create compute.resourcePolicies.delete compute.resourcePolicies.get compute.resourcePolicies.getIamPolicy compute.resourcePolicies.list compute.resourcePolicies.setIamPolicy compute.resourcePolicies.update compute.resourcePolicies.use compute.resourcePolicies.useReadOnly compute.routers.* compute.routers.create compute.routers.createTagBinding compute.routers.delete compute.routers.deleteRoutePolicy compute.routers.deleteTagBinding compute.routers.get compute.routers.getRoutePolicy compute.routers.list compute.routers.listBgpRoutes compute.routers.listEffectiveTags compute.routers.listRoutePolicies compute.routers.listTagBindings compute.routers.update compute.routers.updateRoutePolicy compute.routers.use compute.routes.* compute.routes.create compute.routes.createTagBinding compute.routes.delete compute.routes.deleteTagBinding compute.routes.get compute.routes.list compute.routes.listEffectiveTags compute.routes.listTagBindings compute.securityPolicies.get compute.securityPolicies.list compute.securityPolicies.listEffectiveTags compute.securityPolicies.listTagBindings compute.securityPolicies.use compute.serviceAttachments.* compute.serviceAttachments.create compute.serviceAttachments.createTagBinding compute.serviceAttachments.delete compute.serviceAttachments.deleteTagBinding compute.serviceAttachments.get compute.serviceAttachments.getIamPolicy compute.serviceAttachments.list compute.serviceAttachments.listEffectiveTags compute.serviceAttachments.listTagBindings compute.serviceAttachments.setIamPolicy compute.serviceAttachments.update compute.serviceAttachments.use compute.snapshots.* compute.snapshots.create compute.snapshots.createTagBinding compute.snapshots.delete compute.snapshots.deleteTagBinding compute.snapshots.get compute.snapshots.getIamPolicy compute.snapshots.list compute.snapshots.listEffectiveTags compute.snapshots.listTagBindings compute.snapshots.setIamPolicy compute.snapshots.setLabels compute.snapshots.useReadOnly compute.spotAssistants.get compute.sslCertificates.get compute.sslCertificates.list compute.sslCertificates.listEffectiveTags compute.sslCertificates.listTagBindings compute.sslPolicies.* compute.sslPolicies.create compute.sslPolicies.createTagBinding compute.sslPolicies.delete compute.sslPolicies.deleteTagBinding compute.sslPolicies.get compute.sslPolicies.list compute.sslPolicies.listAvailableFeatures compute.sslPolicies.listEffectiveTags compute.sslPolicies.listTagBindings compute.sslPolicies.update compute.sslPolicies.use compute.storagePools.get compute.storagePools.list compute.storagePools.use compute.subnetworks.* compute.subnetworks.create compute.subnetworks.createTagBinding compute.subnetworks.delete compute.subnetworks.deleteTagBinding compute.subnetworks.expandIpCidrRange compute.subnetworks.get compute.subnetworks.getIamPolicy compute.subnetworks.list compute.subnetworks.listEffectiveTags compute.subnetworks.listTagBindings compute.subnetworks.mirror compute.subnetworks.setIamPolicy compute.subnetworks.setPrivateIpGoogleAccess compute.subnetworks.update compute.subnetworks.use compute.subnetworks.useExternalIp compute.subnetworks.usePeerMigration compute.targetGrpcProxies.* compute.targetGrpcProxies.create compute.targetGrpcProxies.createTagBinding compute.targetGrpcProxies.delete compute.targetGrpcProxies.deleteTagBinding compute.targetGrpcProxies.get compute.targetGrpcProxies.list compute.targetGrpcProxies.listEffectiveTags compute.targetGrpcProxies.listTagBindings compute.targetGrpcProxies.update compute.targetGrpcProxies.use compute.targetHttpProxies.* compute.targetHttpProxies.create compute.targetHttpProxies.createTagBinding compute.targetHttpProxies.delete compute.targetHttpProxies.deleteTagBinding compute.targetHttpProxies.get compute.targetHttpProxies.list compute.targetHttpProxies.listEffectiveTags compute.targetHttpProxies.listTagBindings compute.targetHttpProxies.setUrlMap compute.targetHttpProxies.update compute.targetHttpProxies.use compute.targetHttpsProxies.* compute.targetHttpsProxies.create compute.targetHttpsProxies.createTagBinding compute.targetHttpsProxies.delete compute.targetHttpsProxies.deleteTagBinding compute.targetHttpsProxies.get compute.targetHttpsProxies.list compute.targetHttpsProxies.listEffectiveTags compute.targetHttpsProxies.listTagBindings compute.targetHttpsProxies.setCertificateMap compute.targetHttpsProxies.setQuicOverride compute.targetHttpsProxies.setSslCertificates compute.targetHttpsProxies.setSslPolicy compute.targetHttpsProxies.setUrlMap compute.targetHttpsProxies.update compute.targetHttpsProxies.use compute.targetInstances.* compute.targetInstances.create compute.targetInstances.createTagBinding compute.targetInstances.delete compute.targetInstances.deleteTagBinding compute.targetInstances.get compute.targetInstances.list compute.targetInstances.listEffectiveTags compute.targetInstances.listTagBindings compute.targetInstances.setSecurityPolicy compute.targetInstances.use compute.targetPools.* compute.targetPools.addHealthCheck compute.targetPools.addInstance compute.targetPools.create compute.targetPools.createTagBinding compute.targetPools.delete compute.targetPools.deleteTagBinding compute.targetPools.get compute.targetPools.list compute.targetPools.listEffectiveTags compute.targetPools.listTagBindings compute.targetPools.removeHealthCheck compute.targetPools.removeInstance compute.targetPools.setSecurityPolicy compute.targetPools.update compute.targetPools.use compute.targetSslProxies.* compute.targetSslProxies.create compute.targetSslProxies.createTagBinding compute.targetSslProxies.delete compute.targetSslProxies.deleteTagBinding compute.targetSslProxies.get compute.targetSslProxies.list compute.targetSslProxies.listEffectiveTags compute.targetSslProxies.listTagBindings compute.targetSslProxies.setBackendService compute.targetSslProxies.setCertificateMap compute.targetSslProxies.setProxyHeader compute.targetSslProxies.setSslCertificates compute.targetSslProxies.setSslPolicy compute.targetSslProxies.update compute.targetSslProxies.use compute.targetTcpProxies.* compute.targetTcpProxies.create compute.targetTcpProxies.createTagBinding compute.targetTcpProxies.delete compute.targetTcpProxies.deleteTagBinding compute.targetTcpProxies.get compute.targetTcpProxies.list compute.targetTcpProxies.listEffectiveTags compute.targetTcpProxies.listTagBindings compute.targetTcpProxies.update compute.targetTcpProxies.use compute.targetVpnGateways.* compute.targetVpnGateways.create compute.targetVpnGateways.createTagBinding compute.targetVpnGateways.delete compute.targetVpnGateways.deleteTagBinding compute.targetVpnGateways.get compute.targetVpnGateways.list compute.targetVpnGateways.listEffectiveTags compute.targetVpnGateways.listTagBindings compute.targetVpnGateways.setLabels compute.targetVpnGateways.use compute.urlMaps.* compute.urlMaps.create compute.urlMaps.createTagBinding compute.urlMaps.delete compute.urlMaps.deleteTagBinding compute.urlMaps.get compute.urlMaps.invalidateCache compute.urlMaps.list compute.urlMaps.listEffectiveTags compute.urlMaps.listTagBindings compute.urlMaps.update compute.urlMaps.use compute.urlMaps.validate compute.vpnGateways.* compute.vpnGateways.create compute.vpnGateways.createTagBinding compute.vpnGateways.delete compute.vpnGateways.deleteTagBinding compute.vpnGateways.get compute.vpnGateways.list compute.vpnGateways.listEffectiveTags compute.vpnGateways.listTagBindings compute.vpnGateways.setLabels compute.vpnGateways.use compute.vpnTunnels.* compute.vpnTunnels.create compute.vpnTunnels.createTagBinding compute.vpnTunnels.delete compute.vpnTunnels.deleteTagBinding compute.vpnTunnels.get compute.vpnTunnels.list compute.vpnTunnels.listEffectiveTags compute.vpnTunnels.listTagBindings compute.vpnTunnels.setLabels compute.zoneOperations.get compute.zoneOperations.list compute.zones.* compute.zones.get compute.zones.list container.* container.apiServices.create container.apiServices.delete container.apiServices.get container.apiServices.getStatus container.apiServices.list container.apiServices.update container.apiServices.updateStatus container.auditSinks.create container.auditSinks.delete container.auditSinks.get container.auditSinks.list container.auditSinks.update container.backendConfigs.create container.backendConfigs.delete container.backendConfigs.get container.backendConfigs.list container.backendConfigs.update container.bindings.create container.bindings.delete container.bindings.get container.bindings.list container.bindings.update container.certificateSigningRequests.approve container.certificateSigningRequests.create container.certificateSigningRequests.delete container.certificateSigningRequests.get container.certificateSigningRequests.getStatus container.certificateSigningRequests.list container.certificateSigningRequests.update container.certificateSigningRequests.updateStatus container.clusterRoleBindings.create container.clusterRoleBindings.delete container.clusterRoleBindings.get container.clusterRoleBindings.list container.clusterRoleBindings.update container.clusterRoles.bind container.clusterRoles.create container.clusterRoles.delete container.clusterRoles.escalate container.clusterRoles.get container.clusterRoles.list container.clusterRoles.update container.clusters.connect container.clusters.create container.clusters.createTagBinding container.clusters.delete container.clusters.deleteTagBinding container.clusters.get container.clusters.getCredentials container.clusters.impersonate container.clusters.list container.clusters.listEffectiveTags container.clusters.listTagBindings container.clusters.update container.componentStatuses.get container.componentStatuses.list container.configMaps.create container.configMaps.delete container.configMaps.get container.configMaps.list container.configMaps.update container.controllerRevisions.create container.controllerRevisions.delete container.controllerRevisions.get container.controllerRevisions.list container.controllerRevisions.update container.cronJobs.create container.cronJobs.delete container.cronJobs.get container.cronJobs.getStatus container.cronJobs.list container.cronJobs.update container.cronJobs.updateStatus container.csiDrivers.create container.csiDrivers.delete container.csiDrivers.get container.csiDrivers.list container.csiDrivers.update container.csiNodeInfos.create container.csiNodeInfos.delete container.csiNodeInfos.get container.csiNodeInfos.list container.csiNodeInfos.update container.csiNodes.create container.csiNodes.delete container.csiNodes.get container.csiNodes.list container.csiNodes.update container.customResourceDefinitions.create container.customResourceDefinitions.delete container.customResourceDefinitions.get container.customResourceDefinitions.getStatus container.customResourceDefinitions.list container.customResourceDefinitions.update container.customResourceDefinitions.updateStatus container.daemonSets.create container.daemonSets.delete container.daemonSets.get container.daemonSets.getStatus container.daemonSets.list container.daemonSets.update container.daemonSets.updateStatus container.deployments.create container.deployments.delete container.deployments.get container.deployments.getScale container.deployments.getStatus container.deployments.list container.deployments.rollback container.deployments.update container.deployments.updateScale container.deployments.updateStatus container.endpointSlices.create container.endpointSlices.delete container.endpointSlices.get container.endpointSlices.list container.endpointSlices.update container.endpoints.create container.endpoints.delete container.endpoints.get container.endpoints.list container.endpoints.update container.events.create container.events.delete container.events.get container.events.list container.events.update container.frontendConfigs.create container.frontendConfigs.delete container.frontendConfigs.get container.frontendConfigs.list container.frontendConfigs.update container.horizontalPodAutoscalers.create container.horizontalPodAutoscalers.delete container.horizontalPodAutoscalers.get container.horizontalPodAutoscalers.getStatus container.horizontalPodAutoscalers.list container.horizontalPodAutoscalers.update container.horizontalPodAutoscalers.updateStatus container.hostServiceAgent.use container.ingresses.create container.ingresses.delete container.ingresses.get container.ingresses.getStatus container.ingresses.list container.ingresses.update container.ingresses.updateStatus container.initializerConfigurations.create container.initializerConfigurations.delete container.initializerConfigurations.get container.initializerConfigurations.list container.initializerConfigurations.update container.jobs.create container.jobs.delete container.jobs.get container.jobs.getStatus container.jobs.list container.jobs.update container.jobs.updateStatus container.leases.create container.leases.delete container.leases.get container.leases.list container.leases.update container.limitRanges.create container.limitRanges.delete container.limitRanges.get container.limitRanges.list container.limitRanges.update container.localSubjectAccessReviews.create container.localSubjectAccessReviews.list container.managedCertificates.create container.managedCertificates.delete container.managedCertificates.get container.managedCertificates.list container.managedCertificates.update container.mutatingWebhookConfigurations.create container.mutatingWebhookConfigurations.delete container.mutatingWebhookConfigurations.get container.mutatingWebhookConfigurations.list container.mutatingWebhookConfigurations.update container.namespaces.create container.namespaces.delete container.namespaces.finalize container.namespaces.get container.namespaces.getStatus container.namespaces.list container.namespaces.update container.namespaces.updateStatus container.networkPolicies.create container.networkPolicies.delete container.networkPolicies.get container.networkPolicies.list container.networkPolicies.update container.nodes.create container.nodes.delete container.nodes.get container.nodes.getStatus container.nodes.list container.nodes.proxy container.nodes.update container.nodes.updateStatus container.operations.get container.operations.list container.persistentVolumeClaims.create container.persistentVolumeClaims.delete container.persistentVolumeClaims.get container.persistentVolumeClaims.getStatus container.persistentVolumeClaims.list container.persistentVolumeClaims.update container.persistentVolumeClaims.updateStatus container.persistentVolumes.create container.persistentVolumes.delete container.persistentVolumes.get container.persistentVolumes.getStatus container.persistentVolumes.list container.persistentVolumes.update container.persistentVolumes.updateStatus container.petSets.create container.petSets.delete container.petSets.get container.petSets.list container.petSets.update container.petSets.updateStatus container.podDisruptionBudgets.create container.podDisruptionBudgets.delete container.podDisruptionBudgets.get container.podDisruptionBudgets.getStatus container.podDisruptionBudgets.list container.podDisruptionBudgets.update container.podDisruptionBudgets.updateStatus container.podPresets.create container.podPresets.delete container.podPresets.get container.podPresets.list container.podPresets.update container.podSecurityPolicies.create container.podSecurityPolicies.delete container.podSecurityPolicies.get container.podSecurityPolicies.list container.podSecurityPolicies.update container.podSecurityPolicies.use container.podTemplates.create container.podTemplates.delete container.podTemplates.get container.podTemplates.list container.podTemplates.update container.pods.attach container.pods.create container.pods.delete container.pods.evict container.pods.exec container.pods.get container.pods.getLogs container.pods.getStatus container.pods.initialize container.pods.list container.pods.portForward container.pods.proxy container.pods.update container.pods.updateStatus container.priorityClasses.create container.priorityClasses.delete container.priorityClasses.get container.priorityClasses.list container.priorityClasses.update container.replicaSets.create container.replicaSets.delete container.replicaSets.get container.replicaSets.getScale container.replicaSets.getStatus container.replicaSets.list container.replicaSets.update container.replicaSets.updateScale container.replicaSets.updateStatus container.replicationControllers.create container.replicationControllers.delete container.replicationControllers.get container.replicationControllers.getScale container.replicationControllers.getStatus container.replicationControllers.list container.replicationControllers.update container.replicationControllers.updateScale container.replicationControllers.updateStatus container.resourceQuotas.create container.resourceQuotas.delete container.resourceQuotas.get container.resourceQuotas.getStatus container.resourceQuotas.list container.resourceQuotas.update container.resourceQuotas.updateStatus container.roleBindings.create container.roleBindings.delete container.roleBindings.get container.roleBindings.list container.roleBindings.update container.roles.bind container.roles.create container.roles.delete container.roles.escalate container.roles.get container.roles.list container.roles.update container.runtimeClasses.create container.runtimeClasses.delete container.runtimeClasses.get container.runtimeClasses.list container.runtimeClasses.update container.scheduledJobs.create container.scheduledJobs.delete container.scheduledJobs.get container.scheduledJobs.list container.scheduledJobs.update container.scheduledJobs.updateStatus container.secrets.create container.secrets.delete container.secrets.get container.secrets.list container.secrets.update container.selfSubjectAccessReviews.create container.selfSubjectAccessReviews.list container.selfSubjectRulesReviews.create container.serviceAccounts.create container.serviceAccounts.createToken container.serviceAccounts.delete container.serviceAccounts.get container.serviceAccounts.list container.serviceAccounts.update container.services.create container.services.delete container.services.get container.services.getStatus container.services.list container.services.proxy container.services.update container.services.updateStatus container.statefulSets.create container.statefulSets.delete container.statefulSets.get container.statefulSets.getScale container.statefulSets.getStatus container.statefulSets.list container.statefulSets.update container.statefulSets.updateScale container.statefulSets.updateStatus container.storageClasses.create container.storageClasses.delete container.storageClasses.get container.storageClasses.list container.storageClasses.update container.storageStates.create container.storageStates.delete container.storageStates.get container.storageStates.getStatus container.storageStates.list container.storageStates.update container.storageStates.updateStatus container.storageVersionMigrations.create container.storageVersionMigrations.delete container.storageVersionMigrations.get container.storageVersionMigrations.getStatus container.storageVersionMigrations.list container.storageVersionMigrations.update container.storageVersionMigrations.updateStatus container.subjectAccessReviews.create container.subjectAccessReviews.list container.thirdPartyObjects.create container.thirdPartyObjects.delete container.thirdPartyObjects.get container.thirdPartyObjects.list container.thirdPartyObjects.update container.thirdPartyResources.create container.thirdPartyResources.delete container.thirdPartyResources.get container.thirdPartyResources.list container.thirdPartyResources.update container.tokenReviews.create container.updateInfos.create container.updateInfos.delete container.updateInfos.get container.updateInfos.list container.updateInfos.update container.validatingWebhookConfigurations.create container.validatingWebhookConfigurations.delete container.validatingWebhookConfigurations.get container.validatingWebhookConfigurations.list container.validatingWebhookConfigurations.update container.volumeAttachments.create container.volumeAttachments.delete container.volumeAttachments.get container.volumeAttachments.getStatus container.volumeAttachments.list container.volumeAttachments.update container.volumeAttachments.updateStatus container.volumeSnapshotClasses.create container.volumeSnapshotClasses.delete container.volumeSnapshotClasses.get container.volumeSnapshotClasses.list container.volumeSnapshotClasses.update container.volumeSnapshotContents.create container.volumeSnapshotContents.delete container.volumeSnapshotContents.get container.volumeSnapshotContents.getStatus container.volumeSnapshotContents.list container.volumeSnapshotContents.update container.volumeSnapshotContents.updateStatus container.volumeSnapshots.create container.volumeSnapshots.delete container.volumeSnapshots.get container.volumeSnapshots.getStatus container.volumeSnapshots.list container.volumeSnapshots.update container.volumeSnapshots.updateStatus deploymentmanager.compositeTypes.* deploymentmanager.compositeTypes.create deploymentmanager.compositeTypes.delete deploymentmanager.compositeTypes.get deploymentmanager.compositeTypes.list deploymentmanager.compositeTypes.update deploymentmanager.deployments.cancelPreview deploymentmanager.deployments.create deploymentmanager.deployments.delete deploymentmanager.deployments.get deploymentmanager.deployments.list deploymentmanager.deployments.stop deploymentmanager.deployments.update deploymentmanager.manifests.* deploymentmanager.manifests.get deploymentmanager.manifests.list deploymentmanager.operations.* deploymentmanager.operations.get deploymentmanager.operations.list deploymentmanager.resources.* deploymentmanager.resources.get deploymentmanager.resources.list deploymentmanager.typeProviders.* deploymentmanager.typeProviders.create deploymentmanager.typeProviders.delete deploymentmanager.typeProviders.get deploymentmanager.typeProviders.getType deploymentmanager.typeProviders.list deploymentmanager.typeProviders.listTypes deploymentmanager.typeProviders.update deploymentmanager.types.* deploymentmanager.types.create deploymentmanager.types.delete deploymentmanager.types.get deploymentmanager.types.list deploymentmanager.types.update dns.managedZones.get dns.managedZones.list dns.networks.targetWithPeeringZone firebase.projects.get iam.serviceAccounts.actAs iam.serviceAccounts.get iam.serviceAccounts.getAccessToken iam.serviceAccounts.getOpenIdToken iam.serviceAccounts.list logging.buckets.create logging.buckets.createTagBinding logging.buckets.delete logging.buckets.deleteTagBinding logging.buckets.get logging.buckets.list logging.buckets.listEffectiveTags logging.buckets.listTagBindings logging.buckets.undelete logging.buckets.update logging.exclusions.* logging.exclusions.create logging.exclusions.delete logging.exclusions.get logging.exclusions.list logging.exclusions.update logging.links.* logging.links.create logging.links.delete logging.links.get logging.links.list logging.locations.* logging.locations.get logging.locations.list logging.logEntries.create logging.logEntries.route logging.logMetrics.* logging.logMetrics.create logging.logMetrics.delete logging.logMetrics.get logging.logMetrics.list logging.logMetrics.update logging.logScopes.* logging.logScopes.create logging.logScopes.delete logging.logScopes.get logging.logScopes.list logging.logScopes.update logging.logServiceIndexes.list logging.logServices.list logging.logs.list logging.notificationRules.* logging.notificationRules.create logging.notificationRules.delete logging.notificationRules.get logging.notificationRules.list logging.notificationRules.update logging.operations.* logging.operations.cancel logging.operations.get logging.operations.list logging.settings.* logging.settings.get logging.settings.update logging.sinks.* logging.sinks.create logging.sinks.delete logging.sinks.get logging.sinks.list logging.sinks.update logging.sqlAlerts.* logging.sqlAlerts.create logging.sqlAlerts.update logging.views.create logging.views.delete logging.views.get logging.views.getIamPolicy logging.views.list logging.views.update monitoring.alertPolicies.get monitoring.alertPolicies.list monitoring.alertPolicies.listEffectiveTags monitoring.alertPolicies.listTagBindings monitoring.dashboards.get monitoring.dashboards.list monitoring.groups.get monitoring.groups.list monitoring.metricDescriptors.create monitoring.metricDescriptors.get monitoring.metricDescriptors.list monitoring.monitoredResourceDescriptors.* monitoring.monitoredResourceDescriptors.get monitoring.monitoredResourceDescriptors.list monitoring.notificationChannelDescriptors.* monitoring.notificationChannelDescriptors.get monitoring.notificationChannelDescriptors.list monitoring.notificationChannels.get monitoring.notificationChannels.list monitoring.services.get monitoring.services.list monitoring.slos.get monitoring.slos.list monitoring.snoozes.get monitoring.snoozes.list monitoring.timeSeries.* monitoring.timeSeries.create monitoring.timeSeries.list monitoring.uptimeCheckConfigs.get monitoring.uptimeCheckConfigs.list networkconnectivity.internalRanges.* networkconnectivity.internalRanges.create networkconnectivity.internalRanges.delete networkconnectivity.internalRanges.get networkconnectivity.internalRanges.getIamPolicy networkconnectivity.internalRanges.list networkconnectivity.internalRanges.setIamPolicy networkconnectivity.internalRanges.update networkconnectivity.locations.* networkconnectivity.locations.get networkconnectivity.locations.list networkconnectivity.operations.* networkconnectivity.operations.cancel networkconnectivity.operations.delete networkconnectivity.operations.get networkconnectivity.operations.list networkconnectivity.policyBasedRoutes.* networkconnectivity.policyBasedRoutes.create networkconnectivity.policyBasedRoutes.delete networkconnectivity.policyBasedRoutes.get networkconnectivity.policyBasedRoutes.getIamPolicy networkconnectivity.policyBasedRoutes.list networkconnectivity.policyBasedRoutes.setIamPolicy networkconnectivity.regionalEndpoints.* networkconnectivity.regionalEndpoints.create networkconnectivity.regionalEndpoints.delete networkconnectivity.regionalEndpoints.get networkconnectivity.regionalEndpoints.list networkconnectivity.serviceClasses.* networkconnectivity.serviceClasses.create networkconnectivity.serviceClasses.delete networkconnectivity.serviceClasses.get networkconnectivity.serviceClasses.list networkconnectivity.serviceClasses.update networkconnectivity.serviceClasses.use networkconnectivity.serviceConnectionMaps.* networkconnectivity.serviceConnectionMaps.create networkconnectivity.serviceConnectionMaps.delete networkconnectivity.serviceConnectionMaps.get networkconnectivity.serviceConnectionMaps.list networkconnectivity.serviceConnectionMaps.update networkconnectivity.serviceConnectionPolicies.* networkconnectivity.serviceConnectionPolicies.create networkconnectivity.serviceConnectionPolicies.delete networkconnectivity.serviceConnectionPolicies.get networkconnectivity.serviceConnectionPolicies.list networkconnectivity.serviceConnectionPolicies.update networkmanagement.connectivitytests.get networkmanagement.connectivitytests.list networksecurity.addressGroups.* networksecurity.addressGroups.create networksecurity.addressGroups.delete networksecurity.addressGroups.get networksecurity.addressGroups.getIamPolicy networksecurity.addressGroups.list networksecurity.addressGroups.setIamPolicy networksecurity.addressGroups.update networksecurity.addressGroups.use networksecurity.authorizationPolicies.* networksecurity.authorizationPolicies.create networksecurity.authorizationPolicies.delete networksecurity.authorizationPolicies.get networksecurity.authorizationPolicies.getIamPolicy networksecurity.authorizationPolicies.list networksecurity.authorizationPolicies.setIamPolicy networksecurity.authorizationPolicies.update networksecurity.authorizationPolicies.use networksecurity.authzPolicies.* networksecurity.authzPolicies.create networksecurity.authzPolicies.delete networksecurity.authzPolicies.get networksecurity.authzPolicies.getIamPolicy networksecurity.authzPolicies.list networksecurity.authzPolicies.setIamPolicy networksecurity.authzPolicies.update networksecurity.clientTlsPolicies.* networksecurity.clientTlsPolicies.create networksecurity.clientTlsPolicies.delete networksecurity.clientTlsPolicies.get networksecurity.clientTlsPolicies.getIamPolicy networksecurity.clientTlsPolicies.list networksecurity.clientTlsPolicies.setIamPolicy networksecurity.clientTlsPolicies.update networksecurity.clientTlsPolicies.use networksecurity.firewallEndpointAssociations.* networksecurity.firewallEndpointAssociations.create networksecurity.firewallEndpointAssociations.delete networksecurity.firewallEndpointAssociations.get networksecurity.firewallEndpointAssociations.list networksecurity.firewallEndpointAssociations.update networksecurity.firewallEndpoints.* networksecurity.firewallEndpoints.create networksecurity.firewallEndpoints.delete networksecurity.firewallEndpoints.get networksecurity.firewallEndpoints.list networksecurity.firewallEndpoints.update networksecurity.firewallEndpoints.use networksecurity.gatewaySecurityPolicies.* networksecurity.gatewaySecurityPolicies.create networksecurity.gatewaySecurityPolicies.delete networksecurity.gatewaySecurityPolicies.get networksecurity.gatewaySecurityPolicies.list networksecurity.gatewaySecurityPolicies.update networksecurity.gatewaySecurityPolicies.use networksecurity.gatewaySecurityPolicyRules.* networksecurity.gatewaySecurityPolicyRules.create networksecurity.gatewaySecurityPolicyRules.delete networksecurity.gatewaySecurityPolicyRules.get networksecurity.gatewaySecurityPolicyRules.list networksecurity.gatewaySecurityPolicyRules.update networksecurity.gatewaySecurityPolicyRules.use networksecurity.locations.* networksecurity.locations.get networksecurity.locations.list networksecurity.operations.* networksecurity.operations.cancel networksecurity.operations.delete networksecurity.operations.get networksecurity.operations.list networksecurity.securityProfileGroups.* networksecurity.securityProfileGroups.create networksecurity.securityProfileGroups.delete networksecurity.securityProfileGroups.get networksecurity.securityProfileGroups.list networksecurity.securityProfileGroups.update networksecurity.securityProfileGroups.use networksecurity.securityProfiles.* networksecurity.securityProfiles.create networksecurity.securityProfiles.delete networksecurity.securityProfiles.get networksecurity.securityProfiles.list networksecurity.securityProfiles.update networksecurity.securityProfiles.use networksecurity.serverTlsPolicies.* networksecurity.serverTlsPolicies.create networksecurity.serverTlsPolicies.delete networksecurity.serverTlsPolicies.get networksecurity.serverTlsPolicies.getIamPolicy networksecurity.serverTlsPolicies.list networksecurity.serverTlsPolicies.setIamPolicy networksecurity.serverTlsPolicies.update networksecurity.serverTlsPolicies.use networksecurity.tlsInspectionPolicies.* networksecurity.tlsInspectionPolicies.create networksecurity.tlsInspectionPolicies.delete networksecurity.tlsInspectionPolicies.get networksecurity.tlsInspectionPolicies.list networksecurity.tlsInspectionPolicies.update networksecurity.tlsInspectionPolicies.use networksecurity.urlLists.* networksecurity.urlLists.create networksecurity.urlLists.delete networksecurity.urlLists.get networksecurity.urlLists.list networksecurity.urlLists.update networksecurity.urlLists.use networkservices.* networkservices.authzExtensions.create networkservices.authzExtensions.delete networkservices.authzExtensions.get networkservices.authzExtensions.list networkservices.authzExtensions.update networkservices.authzExtensions.use networkservices.endpointPolicies.create networkservices.endpointPolicies.delete networkservices.endpointPolicies.get networkservices.endpointPolicies.list networkservices.endpointPolicies.update networkservices.gateways.create networkservices.gateways.delete networkservices.gateways.get networkservices.gateways.list networkservices.gateways.update networkservices.gateways.use networkservices.grpcRoutes.create networkservices.grpcRoutes.delete networkservices.grpcRoutes.get networkservices.grpcRoutes.list networkservices.grpcRoutes.update networkservices.httpFilters.create networkservices.httpFilters.delete networkservices.httpFilters.get networkservices.httpFilters.list networkservices.httpFilters.update networkservices.httpRoutes.create networkservices.httpRoutes.delete networkservices.httpRoutes.get networkservices.httpRoutes.list networkservices.httpRoutes.update networkservices.httpfilters.create networkservices.httpfilters.delete networkservices.httpfilters.get networkservices.httpfilters.getIamPolicy networkservices.httpfilters.list networkservices.httpfilters.setIamPolicy networkservices.httpfilters.update networkservices.httpfilters.use networkservices.lbRouteExtensions.create networkservices.lbRouteExtensions.delete networkservices.lbRouteExtensions.get networkservices.lbRouteExtensions.list networkservices.lbRouteExtensions.update networkservices.lbTrafficExtensions.create networkservices.lbTrafficExtensions.delete networkservices.lbTrafficExtensions.get networkservices.lbTrafficExtensions.list networkservices.lbTrafficExtensions.update networkservices.locations.get networkservices.locations.list networkservices.meshes.create networkservices.meshes.delete networkservices.meshes.get networkservices.meshes.list networkservices.meshes.update networkservices.meshes.use networkservices.operations.cancel networkservices.operations.delete networkservices.operations.get networkservices.operations.list networkservices.route_views.get networkservices.route_views.list networkservices.serviceBindings.create networkservices.serviceBindings.delete networkservices.serviceBindings.get networkservices.serviceBindings.list networkservices.serviceBindings.update networkservices.serviceLbPolicies.create networkservices.serviceLbPolicies.delete networkservices.serviceLbPolicies.get networkservices.serviceLbPolicies.list networkservices.serviceLbPolicies.update networkservices.tcpRoutes.create networkservices.tcpRoutes.delete networkservices.tcpRoutes.get networkservices.tcpRoutes.list networkservices.tcpRoutes.update networkservices.tlsRoutes.create networkservices.tlsRoutes.delete networkservices.tlsRoutes.get networkservices.tlsRoutes.list networkservices.tlsRoutes.update networkservices.wasmPlugins.create networkservices.wasmPlugins.delete networkservices.wasmPlugins.get networkservices.wasmPlugins.list networkservices.wasmPlugins.update networkservices.wasmPlugins.use observability.scopes.get opsconfigmonitoring.resourceMetadata.list orgpolicy.policy.get pubsub.* pubsub.schemas.attach pubsub.schemas.commit pubsub.schemas.create pubsub.schemas.delete pubsub.schemas.get pubsub.schemas.getIamPolicy pubsub.schemas.list pubsub.schemas.listRevisions pubsub.schemas.rollback pubsub.schemas.setIamPolicy pubsub.schemas.validate pubsub.snapshots.create pubsub.snapshots.delete pubsub.snapshots.get pubsub.snapshots.getIamPolicy pubsub.snapshots.list pubsub.snapshots.seek pubsub.snapshots.setIamPolicy pubsub.snapshots.update pubsub.subscriptions.consume pubsub.subscriptions.create pubsub.subscriptions.delete pubsub.subscriptions.get pubsub.subscriptions.getIamPolicy pubsub.subscriptions.list pubsub.subscriptions.setIamPolicy pubsub.subscriptions.update pubsub.topics.attachSubscription pubsub.topics.create pubsub.topics.delete pubsub.topics.detachSubscription pubsub.topics.get pubsub.topics.getIamPolicy pubsub.topics.list pubsub.topics.publish pubsub.topics.setIamPolicy pubsub.topics.update pubsub.topics.updateTag recommender.cloudsqlIdleInstanceRecommendations.* recommender.cloudsqlIdleInstanceRecommendations.get recommender.cloudsqlIdleInstanceRecommendations.list recommender.cloudsqlIdleInstanceRecommendations.update recommender.cloudsqlInstanceActivityInsights.* recommender.cloudsqlInstanceActivityInsights.get recommender.cloudsqlInstanceActivityInsights.list recommender.cloudsqlInstanceActivityInsights.update recommender.cloudsqlInstanceCpuUsageInsights.* recommender.cloudsqlInstanceCpuUsageInsights.get recommender.cloudsqlInstanceCpuUsageInsights.list recommender.cloudsqlInstanceCpuUsageInsights.update recommender.cloudsqlInstanceDiskUsageTrendInsights.* recommender.cloudsqlInstanceDiskUsageTrendInsights.get recommender.cloudsqlInstanceDiskUsageTrendInsights.list recommender.cloudsqlInstanceDiskUsageTrendInsights.update recommender.cloudsqlInstanceMemoryUsageInsights.* recommender.cloudsqlInstanceMemoryUsageInsights.get recommender.cloudsqlInstanceMemoryUsageInsights.list recommender.cloudsqlInstanceMemoryUsageInsights.update recommender.cloudsqlInstanceOomProbabilityInsights.* recommender.cloudsqlInstanceOomProbabilityInsights.get recommender.cloudsqlInstanceOomProbabilityInsights.list recommender.cloudsqlInstanceOomProbabilityInsights.update recommender.cloudsqlInstanceOutOfDiskRecommendations.* recommender.cloudsqlInstanceOutOfDiskRecommendations.get recommender.cloudsqlInstanceOutOfDiskRecommendations.list recommender.cloudsqlInstanceOutOfDiskRecommendations.update recommender.cloudsqlInstancePerformanceInsights.* recommender.cloudsqlInstancePerformanceInsights.get recommender.cloudsqlInstancePerformanceInsights.list recommender.cloudsqlInstancePerformanceInsights.update recommender.cloudsqlInstancePerformanceRecommendations.* recommender.cloudsqlInstancePerformanceRecommendations.get recommender.cloudsqlInstancePerformanceRecommendations.list recommender.cloudsqlInstancePerformanceRecommendations.update recommender.cloudsqlInstanceReliabilityInsights.* recommender.cloudsqlInstanceReliabilityInsights.get recommender.cloudsqlInstanceReliabilityInsights.list recommender.cloudsqlInstanceReliabilityInsights.update recommender.cloudsqlInstanceReliabilityRecommendations.* recommender.cloudsqlInstanceReliabilityRecommendations.get recommender.cloudsqlInstanceReliabilityRecommendations.list recommender.cloudsqlInstanceReliabilityRecommendations.update recommender.cloudsqlInstanceSecurityInsights.* recommender.cloudsqlInstanceSecurityInsights.get recommender.cloudsqlInstanceSecurityInsights.list recommender.cloudsqlInstanceSecurityInsights.update recommender.cloudsqlInstanceSecurityRecommendations.* recommender.cloudsqlInstanceSecurityRecommendations.get recommender.cloudsqlInstanceSecurityRecommendations.list recommender.cloudsqlInstanceSecurityRecommendations.update recommender.cloudsqlInstanceUnderprovisionedCpuUsageInsights.* recommender.cloudsqlInstanceUnderprovisionedCpuUsageInsights.get recommender.cloudsqlInstanceUnderprovisionedCpuUsageInsights.list recommender.cloudsqlInstanceUnderprovisionedCpuUsageInsights.update recommender.cloudsqlInstanceUnderprovisionedMemoryUsageInsights.* recommender.cloudsqlInstanceUnderprovisionedMemoryUsageInsights.get recommender.cloudsqlInstanceUnderprovisionedMemoryUsageInsights.list recommender.cloudsqlInstanceUnderprovisionedMemoryUsageInsights.update recommender.cloudsqlOverprovisionedInstanceRecommendations.* recommender.cloudsqlOverprovisionedInstanceRecommendations.get recommender.cloudsqlOverprovisionedInstanceRecommendations.list recommender.cloudsqlOverprovisionedInstanceRecommendations.update recommender.cloudsqlUnderProvisionedInstanceRecommendations.* recommender.cloudsqlUnderProvisionedInstanceRecommendations.get recommender.cloudsqlUnderProvisionedInstanceRecommendations.list recommender.cloudsqlUnderProvisionedInstanceRecommendations.update recommender.containerDiagnosisInsights.* recommender.containerDiagnosisInsights.get recommender.containerDiagnosisInsights.list recommender.containerDiagnosisInsights.update recommender.containerDiagnosisRecommendations.* recommender.containerDiagnosisRecommendations.get recommender.containerDiagnosisRecommendations.list recommender.containerDiagnosisRecommendations.update recommender.iamPolicyInsights.* recommender.iamPolicyInsights.get recommender.iamPolicyInsights.list recommender.iamPolicyInsights.update recommender.iamPolicyRecommendations.* recommender.iamPolicyRecommendations.get recommender.iamPolicyRecommendations.list recommender.iamPolicyRecommendations.update recommender.locations.* recommender.locations.get recommender.locations.list recommender.networkAnalyzerGkeConnectivityInsights.* recommender.networkAnalyzerGkeConnectivityInsights.get recommender.networkAnalyzerGkeConnectivityInsights.list recommender.networkAnalyzerGkeConnectivityInsights.update recommender.networkAnalyzerGkeIpAddressInsights.* recommender.networkAnalyzerGkeIpAddressInsights.get recommender.networkAnalyzerGkeIpAddressInsights.list recommender.networkAnalyzerGkeIpAddressInsights.update recommender.storageBucketSoftDeleteInsights.* recommender.storageBucketSoftDeleteInsights.get recommender.storageBucketSoftDeleteInsights.list recommender.storageBucketSoftDeleteInsights.update recommender.storageBucketSoftDeleteRecommendations.* recommender.storageBucketSoftDeleteRecommendations.get recommender.storageBucketSoftDeleteRecommendations.list recommender.storageBucketSoftDeleteRecommendations.update resourcemanager.hierarchyNodes.listEffectiveTags resourcemanager.projects.get resourcemanager.projects.getIamPolicy resourcemanager.projects.list servicedirectory.namespaces.create servicedirectory.namespaces.delete servicedirectory.services.create servicedirectory.services.delete servicenetworking.operations.get servicenetworking.services.addPeering servicenetworking.services.createPeeredDnsDomain servicenetworking.services.deleteConnection servicenetworking.services.deletePeeredDnsDomain servicenetworking.services.disableVpcServiceControls servicenetworking.services.enableVpcServiceControls servicenetworking.services.get servicenetworking.services.listPeeredDnsDomains serviceusage.quotas.get serviceusage.services.get serviceusage.services.list stackdriver.projects.get stackdriver.resourceMetadata.list storage.anywhereCaches.* storage.anywhereCaches.create storage.anywhereCaches.disable storage.anywhereCaches.get storage.anywhereCaches.list storage.anywhereCaches.pause storage.anywhereCaches.resume storage.anywhereCaches.update storage.bucketOperations.* storage.bucketOperations.cancel storage.bucketOperations.get storage.bucketOperations.list storage.buckets.* storage.buckets.create storage.buckets.createTagBinding storage.buckets.delete storage.buckets.deleteTagBinding storage.buckets.enableObjectRetention storage.buckets.get storage.buckets.getIamPolicy storage.buckets.getIpFilter storage.buckets.getObjectInsights storage.buckets.list storage.buckets.listEffectiveTags storage.buckets.listTagBindings storage.buckets.relocate storage.buckets.restore storage.buckets.setIamPolicy storage.buckets.setIpFilter storage.buckets.update storage.folders.* storage.folders.create storage.folders.delete storage.folders.get storage.folders.list storage.folders.rename storage.managedFolders.* storage.managedFolders.create storage.managedFolders.delete storage.managedFolders.get storage.managedFolders.getIamPolicy storage.managedFolders.list storage.managedFolders.setIamPolicy storage.managementHubs.* storage.managementHubs.get storage.managementHubs.update storage.multipartUploads.* storage.multipartUploads.abort storage.multipartUploads.create storage.multipartUploads.list storage.multipartUploads.listParts storage.objects.* storage.objects.create storage.objects.delete storage.objects.get storage.objects.getIamPolicy storage.objects.list storage.objects.overrideUnlockedRetention storage.objects.restore storage.objects.setIamPolicy storage.objects.setRetention storage.objects.update trafficdirector.* trafficdirector.networks.getConfigs trafficdirector.networks.reportMetrics

Funciones básicas

Nota: Los roles básicos de propietario, editor y visualizador incluyen los siguientes permisos para otros Google Cloud servicios. Si otorgas uno de estos roles a una cuenta principal, también proporcionas permisos adicionales para otros Google Cloud servicios.

Los roles básicos funcionan con Cloud Composer de la siguiente manera:

• Propietario (owner): Permite el control total de los recursos de Cloud Composer.
• Editor (editor): Permite el control total de los recursos de Cloud Composer.
• Visualizador (viewer): Permite que un usuario muestre una lista de recursos de Cloud Composer y los obtenga.

Consulta la Referencia de roles básicos y predefinidos de IAM para obtener más información sobre los roles básicos y los permisos de Cloud Composer que se incluyen en ellos.

Permisos para los métodos de API

En la siguiente tabla, se enumeran los permisos que debe tener el emisor para llamar a cada método de la API de Cloud Composer o realizar tareas con las herramientas deGoogle Cloud que usan la API (como Google Cloud Console o Google Cloud CLI).

Puedes crear tus propios roles personalizados que incluyan permisos individuales. Para obtener más información, consulta Cómo crear un rol personalizado.

Método	Permiso
environments.create	composer.environments.create y iam.serviceAccounts.actAs en la cuenta de servicio del entorno.
environments.delete	composer.environments.delete
environments.get	composer.environments.get
environments.list	composer.environments.list
environments.update	composer.environments.update
environments.executeAirflowCommand	composer.environment.executeairflowcommand
environments.stopAirflowCommand	composer.environment.executeairflowcommand
environments.pollAirflowCommand	composer.environment.executeairflowcommand
operations.delete	composer.operations.delete
operations.get	composer.operations.get
operations.list	composer.operations.list

Permisos para usar gcloud CLI con entornos

Para usar gcloud con entornos de Cloud Composer, necesitas los siguientes permisos:

• composer.environments.get
• container.clusters.get
• container.clusters.list
• container.clusters.getCredentials

Si deseas administrar entornos o depósitos de entornos con comandos gcloud composer, también debes tener un rol que tenga suficientes permisos para hacerlo.

Si quieres ejecutar comandos de la CLI de Airflow, necesitas los siguientes permisos adicionales:

• container.namespaces.list
• container.pods.get

• container.pods.list

• container.pods.exec

Permisos para trabajar con DAG desde la consola de Google Cloud

Los siguientes permisos abarcan el trabajo con DAG desde la consola de Google Cloud, a través de la IU de DAG:

Permiso	Descripción
composer.dags.list	Consulta la lista de DAG en la página Detalles del entorno.
composer.dags.get	Obtén información detallada sobre los DAG, las ejecuciones de DAG y las tareas en la página de detalles del DAG.
composer.dags.getSourceCode	Obtén el código fuente de los DAG en la página de detalles de los DAG.
composer.dags.execute	Pausa, reanuda y activa DAGs desde la página de detalles del DAG.

Importante: Estos permisos solo afectan a la consola de Google Cloud.

Puedes usar el control de acceso de la IU de Airflow para controlar mejor los permisos de DAG para las cuentas de usuario. La IU de DAG requiere permisos de IAM y de control de acceso de la IU de Airflow para permitir una acción específica en un DAG. Al mismo tiempo, la IU de Airflow valida el acceso del usuario solo en función de los permisos de control de acceso de la IU de Airflow y omite los permisos de IAM.

Por ejemplo, si un usuario tiene el permiso composer.dags.execute y el rol Viewer de Airflow, no puede activar DAG desde la consola de Google Cloud. Como ejemplo opuesto, si un usuario no tiene el permiso composer.dags.list, este usuario aún puede ver la lista de DAG en la IU de Airflow.

Permisos y roles para las redes de VPC compartidas

La creación de redes de VPC compartidas requiere roles y permisos adicionales para las cuentas de servicio en los proyectos de servicio y host. Para obtener más información sobre cómo configurar estos roles y permisos, consulta Configura las redes de VPC compartidas.

Usa una cuenta de servicio de otro proyecto

Si deseas que un entorno de Cloud Composer en un proyecto use una cuenta de servicio administrada por el usuario de un proyecto diferente, configura la cuenta de servicio administrada por el usuario de la siguiente manera:

1. Asegúrate de que la política de la organización del proyecto en el que se encuentra tu cuenta de servicio administrada por el usuario permita el uso de la identidad temporal como cuenta de servicio en todos los proyectos.

2. Habilita la API de Composer en el proyecto en el que se encuentra tu cuenta de servicio administrada por el usuario. Para obtener más información sobre por qué es necesario, consulta Dónde crear cuentas de servicio.

3. Asigna roles de IAM como se describe en la siguiente tabla.

4. Crea tu entorno con una cuenta de servicio entre proyectos. Puedes usar Google Cloud CLI, la API o Terraform. En la consola de Google Cloud, no es posible seleccionar una cuenta de servicio de un proyecto diferente.

Nota: SERVICE_PROJECT_NUMBER es el número de proyecto de un proyecto en el que creas tu entorno de Cloud Composer.

En la siguiente tabla, se describen los roles y las principales de IAM necesarios para tu cuenta de servicio administrada por el usuario.

Proyecto	Recurso	Principal	Rol
Proyecto en el que se encuentra tu cuenta de servicio administrada por el usuario	Tu cuenta de servicio administrada por el usuario	Cuenta del agente de servicio de Cloud Composer del proyecto en el que se encuentra tu entorno ([e-mail]).	Usuario de cuenta de servicio (iam.serviceAccountUser)
(Solo Cloud Composer 2) Proyecto en el que se encuentra tu cuenta de servicio administrada por el usuario	Tu cuenta de servicio administrada por el usuario	Cuenta del agente de servicio de Cloud Composer del proyecto en el que se encuentra tu entorno ([e-mail]).	Extensión del agente de servicio de la API de Cloud Composer v2 (roles/composer.ServiceAgentV2Ext). Consulta Otorga roles a la cuenta del agente de servicio de Cloud Composer para obtener más información sobre cómo se usa este rol.
Proyecto en el que se encuentra tu cuenta de servicio administrada por el usuario	Tu cuenta de servicio administrada por el usuario	Agente de servicio de Kubernetes Engine del proyecto en el que se encuentra tu entorno ([e-mail])	Usuario de cuenta de servicio (iam.serviceAccountUser)
Proyecto en el que se encuentra tu cuenta de servicio administrada por el usuario	Tu cuenta de servicio administrada por el usuario	Agente de servicio de las APIs de Google del proyecto en el que se encuentra tu entorno ([e-mail])	Usuario de cuenta de servicio (iam.serviceAccountUser)
Proyecto en el que se encuentra tu cuenta de servicio administrada por el usuario	Tu cuenta de servicio administrada por el usuario	Agente de servicio de Compute Engine del proyecto en el que se encuentra tu entorno ([e-mail])	Creador de tokens de cuenta de servicio (roles/iam.serviceAccountTokenCreator)
Proyecto en el que se encuentra tu entorno	Proyecto	Tu cuenta de servicio administrada por el usuario	Otorga los roles necesarios a tu cuenta de servicio administrada por el usuario, como se describe en Otorga roles a una cuenta de servicio administrada por el usuario. Por ejemplo, en una configuración de IP pública, tu cuenta de servicio administrada por el usuario requiere el rol de trabajador de Composer.

¿Qué sigue?

• Crear entornos
• Solución de problemas de creación de entornos