Compute Engine IAM 역할 및 권한

프로젝트에 새 구성원을 추가할 때 ID 및 액세스 관리(IAM) 정책을 사용하여 해당 구성원에게 하나 이상의 IAM 역할을 부여할 수 있습니다. 각 IAM 역할에는 구성원에게 특정 리소스에 대한 액세스 권한을 부여하는 권한이 포함됩니다.

Compute Engine에는 이 페이지에서 설명하는 사전 정의된 IAM 역할 집합이 있습니다. 요구사항에 맞는 권한 하위 집합이 포함된 커스텀 역할을 만들 수도 있습니다.

각 방식에 필요한 권한을 알아보려면 Compute Engine API 참조 문서를 확인하세요.

액세스 권한 부여에 대한 자세한 내용은 다음 페이지를 참조하세요.

시작하기 전에

  • IAM 문서를 읽어봅니다.

IAM이란?

Google Cloud는 사용자가 특정 Google Cloud 리소스에 대한 세부적인 액세스 권한을 부여하고 다른 리소스에 대한 무단 액세스를 방지할 수 있는 IAM을 제공합니다. IAM은 최소 권한의 보안 원칙을 채택하여 리소스에 대해 필요한 액세스 권한만 부여할 수 있게 해줍니다.

IAM을 사용하면 IAM 정책을 설정하여 누가(ID) 어떤 리소스에 무슨(역할) 권한을 갖는지를 제어할 수 있습니다. IAM 정책은 프로젝트 구성원에게 특정 역할을 부여하고 ID 관련 권한을 제공합니다. 예를 들어 프로젝트와 같은 특정 리소스에 대한 roles/compute.networkAdmin 역할을 Google 계정에 할당하면 해당 계정이 프로젝트에 있는 네트워크 관련 리소스는 제어할 수 있어도 인스턴스 및 디스크와 같은 다른 리소스는 관리할 수 없습니다. IAM을 사용하여 프로젝트 팀 구성원에게 부여된 Cloud Console의 기존 역할을 관리할 수도 있습니다.

serviceAccountUser 역할

roles/compute.instanceAdmin.v1roles/iam.serviceAccountUser 역할을 함께 부여받은 구성원은 서비스 계정을 사용하는 인스턴스를 만들고 관리할 수 있습니다. 구체적으로 roles/iam.serviceAccountUserroles/compute.instanceAdmin.v1 역할을 함께 부여받은 구성원에게는 다음 작업을 수행할 수 있는 권한이 제공됩니다.

  • 서비스 계정으로 실행되는 인스턴스를 만들 수 있습니다.
  • 서비스 계정으로 실행되는 인스턴스에 영구 디스크를 연결할 수 있습니다.
  • 서비스 계정으로 실행되는 인스턴스에서 인스턴스 메타데이터를 설정할 수 있습니다.
  • SSH를 사용하여 서비스 계정으로 실행되는 인스턴스에 연결할 수 있습니다.
  • 인스턴스가 서비스 계정으로 실행되도록 다시 구성할 수 있습니다.

다음 2가지 방법 중 하나로 roles/iam.serviceAccountUser를 부여할 수 있습니다.

  • 권장사항. 특정 서비스 계정의 구성원에게 역할을 부여합니다. 이렇게 하면 이 구성원은 iam.serviceAccountUser 역할을 부여받은 서비스 계정에는 액세스할 수 있지만, iam.serviceAccountUser 역할을 부여받지 않은 다른 서비스 계정에는 액세스할 수 없습니다.

  • 프로젝트 수준에서 구성원에게 역할을 부여합니다. 구성원은 이후에 생성되는 서비스 계정을 포함하여 해당 프로젝트의 모든 서비스 계정에 액세스할 수 있습니다.

서비스 계정에 대해 잘 모른다면 서비스 계정에 대해 자세히 알아보세요.

Google Cloud Console 권한

Google Cloud Console을 사용하여 Compute Engine 리소스에 액세스하려면 프로젝트에 대해 다음 권한을 갖는 역할이 할당되어 있어야 합니다.

compute.projects.get

인스턴스에 instanceAdmin으로 연결

roles/compute.instanceAdmin.v1 역할을 부여받은 프로젝트 구성원은 gcloud CLI 또는 SSH-in-browser와 같은 표준 Google Cloud 도구를 사용하여 가상 머신(VM) 인스턴스에 연결할 수 있습니다.

구성원이 gcloud CLI 또는 브라우저에서 SSH를 통해 연결 기능을 사용하면 도구에서 공개 키/비공개 키 쌍을 자동으로 생성하여 공개 키를 프로젝트 메타데이터에 추가합니다. 구성원에게 프로젝트 메타데이터를 수정할 권한이 없으면 구성원의 공개 키가 인스턴스 메타데이터에 자동으로 추가됩니다.

구성원에게 사용하려는 키 쌍이 이미 있는 경우에는 공개 키를 인스턴스의 메타데이터에 직접 추가할 수 있습니다. 인스턴스에 SSH 키를 추가하는 방법에 대해 자세히 알아보세요.

서비스 계정과 IAM

새로운 커스텀 서비스 계정을 만들고 서비스 계정에 IAM 역할을 부여하여 인스턴스의 액세스 권한을 제한할 수 있습니다. 커스텀 서비스 계정과 함께 IAM 역할을 사용하면 다음을 수행할 수 있습니다.

  • 세분화된 IAM 역할을 사용하여 Google Cloud APIs에 대한 인스턴스의 액세스 권한을 제한할 수 있습니다.
  • 각 인스턴스 또는 인스턴스 집합에 고유한 ID를 제공할 수 있습니다.
  • 기본 서비스 계정의 액세스 권한을 제한할 수 있습니다.

서비스 계정에 대해 자세히 알아보세요.

관리형 인스턴스 그룹 및 IAM

관리형 인스턴스 그룹(MIG)은 직접 사용자 상호작용 없이 사용자 대신 작업을 수행하는 리소스입니다. 예를 들어 MIG는 그룹에서 VM을 추가 및 삭제할 수 있습니다.

MIG의 일부로 Compute Engine에서 수행되는 모든 작업은 프로젝트의 Google API 서비스 에이전트에서 수행됩니다. 이 프로젝트에는 PROJECT_ID@cloudservices.gserviceaccount.com과 같은 이메일 주소가 있습니다.

기본적으로 Google API 서비스 에이전트에는 프로젝트 수준에서 편집자 역할(roles/editor)이 부여되어 MIG의 구성에 따라 리소스를 만들 수 있는 충분한 권한이 부여됩니다. Google API 서비스 에이전트에 대한 액세스를 맞춤설정하는 경우 Compute 인스턴스 관리자(v1) 역할(roles/compute.instanceAdmin.v1), 그리고 필요한 경우 서비스 계정 사용자 역할(roles/iam.serviceAccountUser)을 부여하고, MIG가 서비스 계정으로 실행될 수 있는 VM을 만드는 경우에만 서비스 계정 사용자 역할이 필요합니다.

Google API 서비스 에이전트는 Deployment Manager를 비롯한 다른 프로세스에서도 사용됩니다.

MIG를 만들거나 해당 인스턴스 템플릿을 업데이트할 때 Compute Engine은 Google API 서비스 에이전트에 다음 역할 및 권한이 있는지 확인합니다.

  • 서비스 계정으로 실행될 수 있는 인스턴스를 만들려는 경우 중요한 서비스 계정 사용자 역할
  • 이미지, 디스크, VPC 네트워크, 서브넷 등 인스턴스 템플릿에서 참조되는 모든 리소스에 대한 권한이 있는지 여부

사전 정의된 Compute Engine IAM 역할

IAM을 사용할 때 Compute Engine API의 모든 API 메서드를 사용하려면 API 요청을 실행하는 ID에 해당 리소스를 사용하는 데 필요한 적절한 권한이 있어야 합니다. 권한을 부여하기 위해서는 프로젝트의 구성원(사용자, 그룹 또는 서비스 계정)에게 역할을 부여하는 정책을 설정하면 됩니다.

기본 역할(소유자, 편집자, 뷰어)과 커스텀 역할 외에도 다음과 같은 사전 정의된 Compute Engine 역할을 프로젝트 구성원에게 할당할 수 있습니다.

한 프로젝트 구성원에게 동일한 리소스에 대한 여러 역할을 부여할 수 있습니다. 예를 들어 네트워킹팀에서 방화벽 규칙도 관리하는 경우 네트워킹팀의 Google 그룹roles/compute.networkAdminroles/compute.securityAdmin 역할을 모두 부여할 수 있습니다.

다음 표는 사전 정의된 Compute Engine IAM 역할과 각 역할에 포함된 권한을 설명합니다. 각 역할에는 특정 작업에 적합한 권한 집합이 포함되어 있습니다. 예를 들어 인스턴스 관리자 역할은 인스턴스 관리를 위한 권한을 부여하고, 네트워크 관련 역할에는 네트워크 관련 리소스 관리를 위한 권한이 포함되며, 보안 역할에는 방화벽 및 SSL 인증서와 같은 보안 관련 리소스 관리를 위한 권한이 포함되어 있습니다.

Compute Admin role

Title and name Description Permissions
Compute Admin
(roles/compute.admin)

Full control of all Compute Engine resources.

If the user will be managing virtual machine instances that are configured to run as a service account, you must also grant the roles/iam.serviceAccountUser role.

Lowest-level resources where you can grant this role:

  • Disk
  • Image
  • Instance
  • Instance template
  • Node group
  • Node template
  • Snapshot Beta
  • compute.*
  • resourcemanager.projects.get
  • resourcemanager.projects.list
  • serviceusage.quotas.get
  • serviceusage.services.get
  • serviceusage.services.list

Compute Image User role

Title and name Description Permissions
Compute Image User
(roles/compute.imageUser)

Permission to list and read images without having other permissions on the image. Granting this role at the project level gives users the ability to list all images in the project and create resources, such as instances and persistent disks, based on images in the project.

Lowest-level resources where you can grant this role:

  • ImageBeta
  • compute.images.get
  • compute.images.getFromFamily
  • compute.images.list
  • compute.images.useReadOnly
  • resourcemanager.projects.get
  • resourcemanager.projects.list
  • serviceusage.quotas.get
  • serviceusage.services.get
  • serviceusage.services.list

Compute Instance Admin (beta) role

Title and name Description Permissions
Compute Instance Admin (beta)
(roles/compute.instanceAdmin)

Permissions to create, modify, and delete virtual machine instances. This includes permissions to create, modify, and delete disks, and also to configure Shielded VM settings.

If the user will be managing virtual machine instances that are configured to run as a service account, you must also grant the roles/iam.serviceAccountUser role.

For example, if your company has someone who manages groups of virtual machine instances but does not manage network or security settings and does not manage instances that run as service accounts, you can grant this role on the organization, folder, or project that contains the instances, or you can grant it on individual instances.

Lowest-level resources where you can grant this role:

  • Disk
  • Image
  • Instance
  • Instance template
  • Snapshot Beta
  • compute.acceleratorTypes.*
  • compute.addresses.createInternal
  • compute.addresses.deleteInternal
  • compute.addresses.get
  • compute.addresses.list
  • compute.addresses.use
  • compute.addresses.useInternal
  • compute.autoscalers.*
  • compute.diskTypes.*
  • compute.disks.create
  • compute.disks.createSnapshot
  • compute.disks.delete
  • compute.disks.get
  • compute.disks.list
  • compute.disks.resize
  • compute.disks.setLabels
  • compute.disks.update
  • compute.disks.use
  • compute.disks.useReadOnly
  • compute.globalAddresses.get
  • compute.globalAddresses.list
  • compute.globalAddresses.use
  • compute.globalNetworkEndpointGroups.*
  • compute.globalOperations.get
  • compute.globalOperations.list
  • compute.images.get
  • compute.images.getFromFamily
  • compute.images.list
  • compute.images.useReadOnly
  • compute.instanceGroupManagers.*
  • compute.instanceGroups.*
  • compute.instanceTemplates.*
  • compute.instances.*
  • compute.licenses.get
  • compute.licenses.list
  • compute.machineImages.*
  • compute.machineTypes.*
  • compute.networkEndpointGroups.*
  • compute.networks.get
  • compute.networks.list
  • compute.networks.use
  • compute.networks.useExternalIp
  • compute.projects.get
  • compute.regionNetworkEndpointGroups.*
  • compute.regionOperations.get
  • compute.regionOperations.list
  • compute.regions.*
  • compute.reservations.get
  • compute.reservations.list
  • compute.subnetworks.get
  • compute.subnetworks.list
  • compute.subnetworks.use
  • compute.subnetworks.useExternalIp
  • compute.targetPools.get
  • compute.targetPools.list
  • compute.zoneOperations.get
  • compute.zoneOperations.list
  • compute.zones.*
  • resourcemanager.projects.get
  • resourcemanager.projects.list
  • serviceusage.quotas.get
  • serviceusage.services.get
  • serviceusage.services.list

Compute Instance Admin (v1) role

Title and name Description Permissions
Compute Instance Admin (v1)
(roles/compute.instanceAdmin.v1)

Full control of Compute Engine instances, instance groups, disks, snapshots, and images. Read access to all Compute Engine networking resources.

If you grant a user this role only at an instance level, then that user cannot create new instances.

  • compute.acceleratorTypes.*
  • compute.addresses.createInternal
  • compute.addresses.deleteInternal
  • compute.addresses.get
  • compute.addresses.list
  • compute.addresses.use
  • compute.addresses.useInternal
  • compute.autoscalers.*
  • compute.backendBuckets.get
  • compute.backendBuckets.list
  • compute.backendServices.get
  • compute.backendServices.list
  • compute.diskTypes.*
  • compute.disks.*
  • compute.externalVpnGateways.get
  • compute.externalVpnGateways.list
  • compute.firewalls.get
  • compute.firewalls.list
  • compute.forwardingRules.get
  • compute.forwardingRules.list
  • compute.globalAddresses.get
  • compute.globalAddresses.list
  • compute.globalAddresses.use
  • compute.globalForwardingRules.get
  • compute.globalForwardingRules.list
  • compute.globalForwardingRules.pscGet
  • compute.globalNetworkEndpointGroups.*
  • compute.globalOperations.get
  • compute.globalOperations.list
  • compute.healthChecks.get
  • compute.healthChecks.list
  • compute.httpHealthChecks.get
  • compute.httpHealthChecks.list
  • compute.httpsHealthChecks.get
  • compute.httpsHealthChecks.list
  • compute.images.*
  • compute.instanceGroupManagers.*
  • compute.instanceGroups.*
  • compute.instanceTemplates.*
  • compute.instances.*
  • compute.interconnectAttachments.get
  • compute.interconnectAttachments.list
  • compute.interconnectLocations.*
  • compute.interconnects.get
  • compute.interconnects.list
  • compute.licenseCodes.*
  • compute.licenses.*
  • compute.machineImages.*
  • compute.machineTypes.*
  • compute.networkEndpointGroups.*
  • compute.networks.get
  • compute.networks.list
  • compute.networks.use
  • compute.networks.useExternalIp
  • compute.projects.get
  • compute.projects.setCommonInstanceMetadata
  • compute.regionBackendServices.get
  • compute.regionBackendServices.list
  • compute.regionHealthCheckServices.get
  • compute.regionHealthCheckServices.list
  • compute.regionHealthChecks.get
  • compute.regionHealthChecks.list
  • compute.regionNetworkEndpointGroups.*
  • compute.regionNotificationEndpoints.get
  • compute.regionNotificationEndpoints.list
  • compute.regionOperations.get
  • compute.regionOperations.list
  • compute.regionSslCertificates.get
  • compute.regionSslCertificates.list
  • compute.regionTargetHttpProxies.get
  • compute.regionTargetHttpProxies.list
  • compute.regionTargetHttpsProxies.get
  • compute.regionTargetHttpsProxies.list
  • compute.regionUrlMaps.get
  • compute.regionUrlMaps.list
  • compute.regions.*
  • compute.reservations.get
  • compute.reservations.list
  • compute.resourcePolicies.*
  • compute.routers.get
  • compute.routers.list
  • compute.routes.get
  • compute.routes.list
  • compute.serviceAttachments.get
  • compute.serviceAttachments.list
  • compute.snapshots.*
  • compute.sslCertificates.get
  • compute.sslCertificates.list
  • compute.sslPolicies.get
  • compute.sslPolicies.list
  • compute.sslPolicies.listAvailableFeatures
  • compute.subnetworks.get
  • compute.subnetworks.list
  • compute.subnetworks.use
  • compute.subnetworks.useExternalIp
  • compute.targetGrpcProxies.get
  • compute.targetGrpcProxies.list
  • compute.targetHttpProxies.get
  • compute.targetHttpProxies.list
  • compute.targetHttpsProxies.get
  • compute.targetHttpsProxies.list
  • compute.targetInstances.get
  • compute.targetInstances.list
  • compute.targetPools.get
  • compute.targetPools.list
  • compute.targetSslProxies.get
  • compute.targetSslProxies.list
  • compute.targetTcpProxies.get
  • compute.targetTcpProxies.list
  • compute.targetVpnGateways.get
  • compute.targetVpnGateways.list
  • compute.urlMaps.get
  • compute.urlMaps.list
  • compute.vpnGateways.get
  • compute.vpnGateways.list
  • compute.vpnTunnels.get
  • compute.vpnTunnels.list
  • compute.zoneOperations.get
  • compute.zoneOperations.list
  • compute.zones.*
  • resourcemanager.projects.get
  • resourcemanager.projects.list
  • serviceusage.quotas.get
  • serviceusage.services.get
  • serviceusage.services.list

Compute Load Balancer Admin role

Title and name Description Permissions
Compute Load Balancer Admin
(roles/compute.loadBalancerAdmin) Beta

Permissions to create, modify, and delete load balancers and associate resources.

For example, if your company has a load balancing team that manages load balancers, SSL certificates for load balancers, SSL policies, and other load balancing resources, and a separate networking team that manages the rest of the networking resources, then grant this role to the load balancing team's group.

Lowest-level resources where you can grant this role:

  • InstanceBeta
  • certificatemanager.certmaps.get
  • certificatemanager.certmaps.list
  • certificatemanager.certmaps.use
  • compute.addresses.*
  • compute.backendBuckets.*
  • compute.backendServices.*
  • compute.disks.listEffectiveTags
  • compute.disks.listTagBindings
  • compute.forwardingRules.*
  • compute.globalAddresses.*
  • compute.globalForwardingRules.*
  • compute.globalNetworkEndpointGroups.*
  • compute.healthChecks.*
  • compute.httpHealthChecks.*
  • compute.httpsHealthChecks.*
  • compute.images.listEffectiveTags
  • compute.images.listTagBindings
  • compute.instanceGroups.*
  • compute.instances.get
  • compute.instances.list
  • compute.instances.listEffectiveTags
  • compute.instances.listTagBindings
  • compute.instances.use
  • compute.instances.useReadOnly
  • compute.networkEndpointGroups.*
  • compute.networks.get
  • compute.networks.list
  • compute.networks.use
  • compute.projects.get
  • compute.regionBackendServices.*
  • compute.regionHealthCheckServices.*
  • compute.regionHealthChecks.*
  • compute.regionNetworkEndpointGroups.*
  • compute.regionNotificationEndpoints.*
  • compute.regionSslCertificates.*
  • compute.regionTargetHttpProxies.*
  • compute.regionTargetHttpsProxies.*
  • compute.regionUrlMaps.*
  • compute.securityPolicies.get
  • compute.securityPolicies.list
  • compute.securityPolicies.use
  • compute.snapshots.listEffectiveTags
  • compute.snapshots.listTagBindings
  • compute.sslCertificates.*
  • compute.sslPolicies.*
  • compute.subnetworks.get
  • compute.subnetworks.list
  • compute.subnetworks.use
  • compute.targetGrpcProxies.*
  • compute.targetHttpProxies.*
  • compute.targetHttpsProxies.*
  • compute.targetInstances.*
  • compute.targetPools.*
  • compute.targetSslProxies.*
  • compute.targetTcpProxies.*
  • compute.urlMaps.*
  • networksecurity.clientTlsPolicies.get
  • networksecurity.clientTlsPolicies.list
  • networksecurity.clientTlsPolicies.use
  • networksecurity.serverTlsPolicies.get
  • networksecurity.serverTlsPolicies.list
  • networksecurity.serverTlsPolicies.use
  • resourcemanager.projects.get
  • resourcemanager.projects.list
  • serviceusage.quotas.get
  • serviceusage.services.get
  • serviceusage.services.list

Compute Load Balancer Services User role

Title and name Description Permissions
Compute Load Balancer Services User
(roles/compute.loadBalancerServiceUser) Beta
Permissions to use services from a load balancer in other projects.
  • compute.backendServices.get
  • compute.backendServices.list
  • compute.backendServices.use
  • compute.projects.get
  • compute.regionBackendServices.get
  • compute.regionBackendServices.list
  • compute.regionBackendServices.use
  • resourcemanager.projects.get
  • resourcemanager.projects.list
  • serviceusage.quotas.get
  • serviceusage.services.get
  • serviceusage.services.list

Compute Network Admin role

Title and name Description Permissions
Compute Network Admin
(roles/compute.networkAdmin)

Permissions to create, modify, and delete networking resources, except for firewall rules and SSL certificates. The network admin role allows read-only access to firewall rules, SSL certificates, and instances (to view their ephemeral IP addresses). The network admin role does not allow a user to create, start, stop, or delete instances.

For example, if your company has a security team that manages firewalls and SSL certificates and a networking team that manages the rest of the networking resources, then grant this role to the networking team's group. Or, if you have a combined team that manages both security and networking, then grant this role as well as the roles/compute.securityAdmin role to the combined team's group.

Lowest-level resources where you can grant this role:

  • InstanceBeta
  • compute.acceleratorTypes.*
  • compute.addresses.*
  • compute.autoscalers.get
  • compute.autoscalers.list
  • compute.backendBuckets.*
  • compute.backendServices.*
  • compute.disks.listEffectiveTags
  • compute.disks.listTagBindings
  • compute.externalVpnGateways.*
  • compute.firewallPolicies.get
  • compute.firewallPolicies.list
  • compute.firewallPolicies.use
  • compute.firewalls.get
  • compute.firewalls.list
  • compute.forwardingRules.*
  • compute.globalAddresses.*
  • compute.globalForwardingRules.*
  • compute.globalNetworkEndpointGroups.get
  • compute.globalNetworkEndpointGroups.list
  • compute.globalNetworkEndpointGroups.use
  • compute.globalOperations.get
  • compute.globalOperations.list
  • compute.globalPublicDelegatedPrefixes.delete
  • compute.globalPublicDelegatedPrefixes.get
  • compute.globalPublicDelegatedPrefixes.list
  • compute.globalPublicDelegatedPrefixes.update
  • compute.globalPublicDelegatedPrefixes.updatePolicy
  • compute.healthChecks.*
  • compute.httpHealthChecks.*
  • compute.httpsHealthChecks.*
  • compute.images.listEffectiveTags
  • compute.images.listTagBindings
  • compute.instanceGroupManagers.get
  • compute.instanceGroupManagers.list
  • compute.instanceGroupManagers.update
  • compute.instanceGroupManagers.use
  • compute.instanceGroups.get
  • compute.instanceGroups.list
  • compute.instanceGroups.update
  • compute.instanceGroups.use
  • compute.instances.get
  • compute.instances.getGuestAttributes
  • compute.instances.getScreenshot
  • compute.instances.getSerialPortOutput
  • compute.instances.list
  • compute.instances.listEffectiveTags
  • compute.instances.listReferrers
  • compute.instances.listTagBindings
  • compute.instances.updateSecurity
  • compute.instances.use
  • compute.instances.useReadOnly
  • compute.interconnectAttachments.*
  • compute.interconnectLocations.*
  • compute.interconnects.*
  • compute.machineTypes.*
  • compute.networkEndpointGroups.get
  • compute.networkEndpointGroups.list
  • compute.networkEndpointGroups.use
  • compute.networks.*
  • compute.packetMirrorings.get
  • compute.packetMirrorings.list
  • compute.projects.get
  • compute.publicDelegatedPrefixes.delete
  • compute.publicDelegatedPrefixes.get
  • compute.publicDelegatedPrefixes.list
  • compute.publicDelegatedPrefixes.update
  • compute.publicDelegatedPrefixes.updatePolicy
  • compute.regionBackendServices.*
  • compute.regionFirewallPolicies.get
  • compute.regionFirewallPolicies.list
  • compute.regionFirewallPolicies.use
  • compute.regionHealthCheckServices.*
  • compute.regionHealthChecks.*
  • compute.regionNetworkEndpointGroups.get
  • compute.regionNetworkEndpointGroups.list
  • compute.regionNetworkEndpointGroups.use
  • compute.regionNotificationEndpoints.*
  • compute.regionOperations.get
  • compute.regionOperations.list
  • compute.regionSslCertificates.get
  • compute.regionSslCertificates.list
  • compute.regionTargetHttpProxies.*
  • compute.regionTargetHttpsProxies.*
  • compute.regionUrlMaps.*
  • compute.regions.*
  • compute.routers.*
  • compute.routes.*
  • compute.securityPolicies.get
  • compute.securityPolicies.list
  • compute.securityPolicies.use
  • compute.serviceAttachments.*
  • compute.snapshots.listEffectiveTags
  • compute.snapshots.listTagBindings
  • compute.sslCertificates.get
  • compute.sslCertificates.list
  • compute.sslPolicies.*
  • compute.subnetworks.*
  • compute.targetGrpcProxies.*
  • compute.targetHttpProxies.*
  • compute.targetHttpsProxies.*
  • compute.targetInstances.*
  • compute.targetPools.*
  • compute.targetSslProxies.*
  • compute.targetTcpProxies.*
  • compute.targetVpnGateways.*
  • compute.urlMaps.*
  • compute.vpnGateways.*
  • compute.vpnTunnels.*
  • compute.zoneOperations.get
  • compute.zoneOperations.list
  • compute.zones.*
  • networkconnectivity.locations.*
  • networkconnectivity.operations.*
  • networksecurity.*
  • networkservices.*
  • resourcemanager.projects.get
  • resourcemanager.projects.list
  • servicedirectory.namespaces.create
  • servicedirectory.namespaces.delete
  • servicedirectory.services.create
  • servicedirectory.services.delete
  • servicenetworking.operations.get
  • servicenetworking.services.addPeering
  • servicenetworking.services.createPeeredDnsDomain
  • servicenetworking.services.deletePeeredDnsDomain
  • servicenetworking.services.get
  • servicenetworking.services.listPeeredDnsDomains
  • serviceusage.quotas.get
  • serviceusage.services.get
  • serviceusage.services.list
  • trafficdirector.*

Compute Network User role

Title and name Description Permissions
Compute Network User
(roles/compute.networkUser)

Provides access to a shared VPC network

Once granted, service owners can use VPC networks and subnets that belong to the host project. For example, a network user can create a VM instance that belongs to a host project network but they cannot delete or create new networks in the host project.

Lowest-level resources where you can grant this role:

  • Project
  • compute.addresses.createInternal
  • compute.addresses.deleteInternal
  • compute.addresses.get
  • compute.addresses.list
  • compute.addresses.useInternal
  • compute.externalVpnGateways.get
  • compute.externalVpnGateways.list
  • compute.externalVpnGateways.use
  • compute.firewalls.get
  • compute.firewalls.list
  • compute.interconnectAttachments.get
  • compute.interconnectAttachments.list
  • compute.interconnectLocations.*
  • compute.interconnects.get
  • compute.interconnects.list
  • compute.interconnects.use
  • compute.networks.access
  • compute.networks.get
  • compute.networks.getEffectiveFirewalls
  • compute.networks.getRegionEffectiveFirewalls
  • compute.networks.list
  • compute.networks.listPeeringRoutes
  • compute.networks.use
  • compute.networks.useExternalIp
  • compute.projects.get
  • compute.regions.*
  • compute.routers.get
  • compute.routers.list
  • compute.routes.get
  • compute.routes.list
  • compute.serviceAttachments.get
  • compute.serviceAttachments.list
  • compute.subnetworks.get
  • compute.subnetworks.list
  • compute.subnetworks.use
  • compute.subnetworks.useExternalIp
  • compute.targetVpnGateways.get
  • compute.targetVpnGateways.list
  • compute.vpnGateways.get
  • compute.vpnGateways.list
  • compute.vpnGateways.use
  • compute.vpnTunnels.get
  • compute.vpnTunnels.list
  • compute.zones.*
  • networkconnectivity.locations.*
  • networkconnectivity.operations.get
  • networkconnectivity.operations.list
  • networksecurity.authorizationPolicies.get
  • networksecurity.authorizationPolicies.list
  • networksecurity.authorizationPolicies.use
  • networksecurity.clientTlsPolicies.get
  • networksecurity.clientTlsPolicies.list
  • networksecurity.clientTlsPolicies.use
  • networksecurity.locations.*
  • networksecurity.operations.get
  • networksecurity.operations.list
  • networksecurity.serverTlsPolicies.get
  • networksecurity.serverTlsPolicies.list
  • networksecurity.serverTlsPolicies.use
  • networkservices.endpointConfigSelectors.get
  • networkservices.endpointConfigSelectors.list
  • networkservices.endpointConfigSelectors.use
  • networkservices.endpointPolicies.get
  • networkservices.endpointPolicies.list
  • networkservices.endpointPolicies.use
  • networkservices.gateways.get
  • networkservices.gateways.list
  • networkservices.gateways.use
  • networkservices.grpcRoutes.get
  • networkservices.grpcRoutes.list
  • networkservices.grpcRoutes.use
  • networkservices.httpFilters.get
  • networkservices.httpFilters.list
  • networkservices.httpFilters.use
  • networkservices.httpRoutes.get
  • networkservices.httpRoutes.list
  • networkservices.httpRoutes.use
  • networkservices.httpfilters.get
  • networkservices.httpfilters.list
  • networkservices.httpfilters.use
  • networkservices.locations.*
  • networkservices.meshes.get
  • networkservices.meshes.list
  • networkservices.meshes.use
  • networkservices.operations.get
  • networkservices.operations.list
  • networkservices.serviceBindings.get
  • networkservices.serviceBindings.list
  • networkservices.tcpRoutes.get
  • networkservices.tcpRoutes.list
  • networkservices.tcpRoutes.use
  • networkservices.tlsRoutes.get
  • networkservices.tlsRoutes.list
  • networkservices.tlsRoutes.use
  • resourcemanager.projects.get
  • resourcemanager.projects.list
  • servicenetworking.services.get
  • serviceusage.quotas.get
  • serviceusage.services.get
  • serviceusage.services.list

Compute Network Viewer role

Title and name Description Permissions
Compute Network Viewer
(roles/compute.networkViewer)

Read-only access to all networking resources

For example, if you have software that inspects your network configuration, you could grant this role to that software's service account.

Lowest-level resources where you can grant this role:

  • InstanceBeta
  • compute.acceleratorTypes.*
  • compute.addresses.get
  • compute.addresses.list
  • compute.autoscalers.get
  • compute.autoscalers.list
  • compute.backendBuckets.get
  • compute.backendBuckets.list
  • compute.backendServices.get
  • compute.backendServices.list
  • compute.disks.listEffectiveTags
  • compute.disks.listTagBindings
  • compute.externalVpnGateways.get
  • compute.externalVpnGateways.list
  • compute.firewalls.get
  • compute.firewalls.list
  • compute.forwardingRules.get
  • compute.forwardingRules.list
  • compute.globalAddresses.get
  • compute.globalAddresses.list
  • compute.globalForwardingRules.get
  • compute.globalForwardingRules.list
  • compute.globalForwardingRules.pscGet
  • compute.healthChecks.get
  • compute.healthChecks.list
  • compute.httpHealthChecks.get
  • compute.httpHealthChecks.list
  • compute.httpsHealthChecks.get
  • compute.httpsHealthChecks.list
  • compute.images.listEffectiveTags
  • compute.images.listTagBindings
  • compute.instanceGroupManagers.get
  • compute.instanceGroupManagers.list
  • compute.instanceGroups.get
  • compute.instanceGroups.list
  • compute.instances.get
  • compute.instances.getGuestAttributes
  • compute.instances.getScreenshot
  • compute.instances.getSerialPortOutput
  • compute.instances.list
  • compute.instances.listEffectiveTags
  • compute.instances.listReferrers
  • compute.instances.listTagBindings
  • compute.interconnectAttachments.get
  • compute.interconnectAttachments.list
  • compute.interconnectLocations.*
  • compute.interconnects.get
  • compute.interconnects.list
  • compute.machineTypes.*
  • compute.networks.get
  • compute.networks.getEffectiveFirewalls
  • compute.networks.getRegionEffectiveFirewalls
  • compute.networks.list
  • compute.networks.listPeeringRoutes
  • compute.packetMirrorings.get
  • compute.packetMirrorings.list
  • compute.projects.get
  • compute.regionBackendServices.get
  • compute.regionBackendServices.list
  • compute.regionHealthCheckServices.get
  • compute.regionHealthCheckServices.list
  • compute.regionHealthChecks.get
  • compute.regionHealthChecks.list
  • compute.regionNotificationEndpoints.get
  • compute.regionNotificationEndpoints.list
  • compute.regionSslCertificates.get
  • compute.regionSslCertificates.list
  • compute.regionTargetHttpProxies.get
  • compute.regionTargetHttpProxies.list
  • compute.regionTargetHttpsProxies.get
  • compute.regionTargetHttpsProxies.list
  • compute.regionUrlMaps.get
  • compute.regionUrlMaps.list
  • compute.regions.*
  • compute.routers.get
  • compute.routers.list
  • compute.routes.get
  • compute.routes.list
  • compute.serviceAttachments.get
  • compute.serviceAttachments.list
  • compute.snapshots.listEffectiveTags
  • compute.snapshots.listTagBindings
  • compute.sslCertificates.get
  • compute.sslCertificates.list
  • compute.sslPolicies.get
  • compute.sslPolicies.list
  • compute.sslPolicies.listAvailableFeatures
  • compute.subnetworks.get
  • compute.subnetworks.list
  • compute.targetGrpcProxies.get
  • compute.targetGrpcProxies.list
  • compute.targetHttpProxies.get
  • compute.targetHttpProxies.list
  • compute.targetHttpsProxies.get
  • compute.targetHttpsProxies.list
  • compute.targetInstances.get
  • compute.targetInstances.list
  • compute.targetPools.get
  • compute.targetPools.list
  • compute.targetSslProxies.get
  • compute.targetSslProxies.list
  • compute.targetTcpProxies.get
  • compute.targetTcpProxies.list
  • compute.targetVpnGateways.get
  • compute.targetVpnGateways.list
  • compute.urlMaps.get
  • compute.urlMaps.list
  • compute.vpnGateways.get
  • compute.vpnGateways.list
  • compute.vpnTunnels.get
  • compute.vpnTunnels.list
  • compute.zones.*
  • networkconnectivity.locations.*
  • networkconnectivity.operations.get
  • networkconnectivity.operations.list
  • networksecurity.authorizationPolicies.get
  • networksecurity.authorizationPolicies.list
  • networksecurity.clientTlsPolicies.get
  • networksecurity.clientTlsPolicies.list
  • networksecurity.locations.*
  • networksecurity.operations.get
  • networksecurity.operations.list
  • networksecurity.serverTlsPolicies.get
  • networksecurity.serverTlsPolicies.list
  • networkservices.endpointConfigSelectors.get
  • networkservices.endpointConfigSelectors.list
  • networkservices.endpointPolicies.get
  • networkservices.endpointPolicies.list
  • networkservices.gateways.get
  • networkservices.gateways.list
  • networkservices.grpcRoutes.get
  • networkservices.grpcRoutes.list
  • networkservices.httpFilters.get
  • networkservices.httpFilters.list
  • networkservices.httpRoutes.get
  • networkservices.httpRoutes.list
  • networkservices.httpfilters.get
  • networkservices.httpfilters.list
  • networkservices.locations.*
  • networkservices.meshes.get
  • networkservices.meshes.list
  • networkservices.operations.get
  • networkservices.operations.list
  • networkservices.serviceBindings.get
  • networkservices.serviceBindings.list
  • networkservices.tcpRoutes.get
  • networkservices.tcpRoutes.list
  • networkservices.tlsRoutes.get
  • networkservices.tlsRoutes.list
  • resourcemanager.projects.get
  • resourcemanager.projects.list
  • servicenetworking.services.get
  • serviceusage.quotas.get
  • serviceusage.services.get
  • serviceusage.services.list
  • trafficdirector.*

Compute Organization Firewall Policy Admin role

Title and name Description Permissions
Compute Organization Firewall Policy Admin
(roles/compute.orgFirewallPolicyAdmin)
Full control of Compute Engine Organization Firewall Policies.
  • compute.firewallPolicies.cloneRules
  • compute.firewallPolicies.create
  • compute.firewallPolicies.delete
  • compute.firewallPolicies.get
  • compute.firewallPolicies.getIamPolicy
  • compute.firewallPolicies.list
  • compute.firewallPolicies.move
  • compute.firewallPolicies.setIamPolicy
  • compute.firewallPolicies.update
  • compute.firewallPolicies.use
  • compute.globalOperations.get
  • compute.globalOperations.getIamPolicy
  • compute.globalOperations.list
  • compute.globalOperations.setIamPolicy
  • compute.projects.get
  • compute.regionFirewallPolicies.*
  • compute.regionOperations.get
  • compute.regionOperations.getIamPolicy
  • compute.regionOperations.list
  • compute.regionOperations.setIamPolicy
  • resourcemanager.projects.get
  • resourcemanager.projects.list
  • serviceusage.quotas.get
  • serviceusage.services.get
  • serviceusage.services.list

Compute Organization Firewall Policy User role

Title and name Description Permissions
Compute Organization Firewall Policy User
(roles/compute.orgFirewallPolicyUser)
View or use Compute Engine Firewall Policies to associate with the organization or folders.
  • compute.firewallPolicies.get
  • compute.firewallPolicies.list
  • compute.firewallPolicies.use
  • compute.globalOperations.get
  • compute.globalOperations.getIamPolicy
  • compute.globalOperations.list
  • compute.projects.get
  • compute.regionFirewallPolicies.get
  • compute.regionFirewallPolicies.list
  • compute.regionFirewallPolicies.use
  • compute.regionOperations.get
  • compute.regionOperations.getIamPolicy
  • compute.regionOperations.list
  • resourcemanager.projects.get
  • resourcemanager.projects.list
  • serviceusage.quotas.get
  • serviceusage.services.get
  • serviceusage.services.list

Compute Organization Security Policy Admin role

Title and name Description Permissions
Compute Organization Security Policy Admin
(roles/compute.orgSecurityPolicyAdmin)
Full control of Compute Engine Organization Security Policies.
  • compute.firewallPolicies.*
  • compute.globalOperations.get
  • compute.globalOperations.getIamPolicy
  • compute.globalOperations.list
  • compute.globalOperations.setIamPolicy
  • compute.projects.get
  • compute.securityPolicies.*
  • resourcemanager.projects.get
  • resourcemanager.projects.list
  • serviceusage.quotas.get
  • serviceusage.services.get
  • serviceusage.services.list

Compute Organization Security Policy User role

Title and name Description Permissions
Compute Organization Security Policy User
(roles/compute.orgSecurityPolicyUser)
View or use Compute Engine Security Policies to associate with the organization or folders.
  • compute.firewallPolicies.addAssociation
  • compute.firewallPolicies.get
  • compute.firewallPolicies.list
  • compute.firewallPolicies.removeAssociation
  • compute.firewallPolicies.use
  • compute.globalOperations.get
  • compute.globalOperations.getIamPolicy
  • compute.globalOperations.list
  • compute.globalOperations.setIamPolicy
  • compute.projects.get
  • compute.securityPolicies.addAssociation
  • compute.securityPolicies.get
  • compute.securityPolicies.list
  • compute.securityPolicies.removeAssociation
  • compute.securityPolicies.use
  • resourcemanager.projects.get
  • resourcemanager.projects.list
  • serviceusage.quotas.get
  • serviceusage.services.get
  • serviceusage.services.list

Compute Organization Resource Admin role

Title and name Description Permissions
Compute Organization Resource Admin
(roles/compute.orgSecurityResourceAdmin)
Full control of Compute Engine Firewall Policy associations to the organization or folders.
  • compute.globalOperations.get
  • compute.globalOperations.getIamPolicy
  • compute.globalOperations.list
  • compute.globalOperations.setIamPolicy
  • compute.organizations.listAssociations
  • compute.organizations.setFirewallPolicy
  • compute.organizations.setSecurityPolicy
  • compute.projects.get
  • resourcemanager.projects.get
  • resourcemanager.projects.list
  • serviceusage.quotas.get
  • serviceusage.services.get
  • serviceusage.services.list

Compute OS Admin Login role

Title and name Description Permissions
Compute OS Admin Login
(roles/compute.osAdminLogin)

Access to log in to a Compute Engine instance as an administrator user.

Lowest-level resources where you can grant this role:

  • InstanceBeta
  • compute.disks.listEffectiveTags
  • compute.disks.listTagBindings
  • compute.images.listEffectiveTags
  • compute.images.listTagBindings
  • compute.instances.get
  • compute.instances.list
  • compute.instances.listEffectiveTags
  • compute.instances.listTagBindings
  • compute.instances.osAdminLogin
  • compute.instances.osLogin
  • compute.projects.get
  • compute.snapshots.listEffectiveTags
  • compute.snapshots.listTagBindings
  • resourcemanager.projects.get
  • resourcemanager.projects.list
  • serviceusage.quotas.get
  • serviceusage.services.get
  • serviceusage.services.list

Compute OS Login role

Title and name Description Permissions
Compute OS Login
(roles/compute.osLogin)

Access to log in to a Compute Engine instance as a standard user.

Lowest-level resources where you can grant this role:

  • InstanceBeta
  • compute.disks.listEffectiveTags
  • compute.disks.listTagBindings
  • compute.images.listEffectiveTags
  • compute.images.listTagBindings
  • compute.instances.get
  • compute.instances.list
  • compute.instances.listEffectiveTags
  • compute.instances.listTagBindings
  • compute.instances.osLogin
  • compute.projects.get
  • compute.snapshots.listEffectiveTags
  • compute.snapshots.listTagBindings
  • resourcemanager.projects.get
  • resourcemanager.projects.list
  • serviceusage.quotas.get
  • serviceusage.services.get
  • serviceusage.services.list

Compute OS Login External User role

Title and name Description Permissions
Compute OS Login External User
(roles/compute.osLoginExternalUser)

Available only at the organization level.

Access for an external user to set OS Login information associated with this organization. This role does not grant access to instances. External users must be granted one of the required OS Login roles in order to allow access to instances using SSH.

Lowest-level resources where you can grant this role:

  • Organization
  • compute.oslogin.*

Compute packet mirroring admin role

Title and name Description Permissions
Compute packet mirroring admin
(roles/compute.packetMirroringAdmin)
Specify resources to be mirrored.
  • compute.instances.updateSecurity
  • compute.networks.mirror
  • compute.projects.get
  • compute.subnetworks.mirror
  • resourcemanager.projects.get
  • resourcemanager.projects.list
  • serviceusage.quotas.get
  • serviceusage.services.get
  • serviceusage.services.list

Compute packet mirroring user role

Title and name Description Permissions
Compute packet mirroring user
(roles/compute.packetMirroringUser)
Use Compute Engine packet mirrorings.
  • compute.packetMirrorings.*
  • compute.projects.get
  • resourcemanager.projects.get
  • resourcemanager.projects.list
  • serviceusage.quotas.get
  • serviceusage.services.get
  • serviceusage.services.list

Compute Public IP Admin role

Title and name Description Permissions
Compute Public IP Admin
(roles/compute.publicIpAdmin)
Full control of public IP address management for Compute Engine.
  • compute.addresses.*
  • compute.globalAddresses.*
  • compute.globalPublicDelegatedPrefixes.*
  • compute.publicAdvertisedPrefixes.*
  • compute.publicDelegatedPrefixes.*
  • resourcemanager.projects.get
  • resourcemanager.projects.list

Compute Security Admin role

Title and name Description Permissions
Compute Security Admin
(roles/compute.securityAdmin)

Permissions to create, modify, and delete firewall rules and SSL certificates, and also to configure Shielded VM settings.

For example, if your company has a security team that manages firewalls and SSL certificates and a networking team that manages the rest of the networking resources, then grant this role to the security team's group.

Lowest-level resources where you can grant this role:

  • InstanceBeta
  • compute.firewallPolicies.*
  • compute.firewalls.*
  • compute.globalOperations.get
  • compute.globalOperations.list
  • compute.instances.getEffectiveFirewalls
  • compute.instances.setShieldedInstanceIntegrityPolicy
  • compute.instances.setShieldedVmIntegrityPolicy
  • compute.instances.updateSecurity
  • compute.instances.updateShieldedInstanceConfig
  • compute.instances.updateShieldedVmConfig
  • compute.networks.get
  • compute.networks.getEffectiveFirewalls
  • compute.networks.getRegionEffectiveFirewalls
  • compute.networks.list
  • compute.networks.updatePolicy
  • compute.packetMirrorings.*
  • compute.projects.get
  • compute.regionFirewallPolicies.*
  • compute.regionOperations.get
  • compute.regionOperations.list
  • compute.regionSslCertificates.*
  • compute.regions.*
  • compute.routes.get
  • compute.routes.list
  • compute.securityPolicies.*
  • compute.sslCertificates.*
  • compute.sslPolicies.*
  • compute.subnetworks.get
  • compute.subnetworks.list
  • compute.zoneOperations.get
  • compute.zoneOperations.list
  • compute.zones.*
  • resourcemanager.projects.get
  • resourcemanager.projects.list
  • serviceusage.quotas.get
  • serviceusage.services.get
  • serviceusage.services.list

Compute Sole Tenant Viewer role

Title and name Description Permissions
Compute Sole Tenant Viewer
(roles/compute.soleTenantViewer) Beta
Permissions to view sole tenancy node groups
  • compute.nodeGroups.get
  • compute.nodeGroups.getIamPolicy
  • compute.nodeGroups.list
  • compute.nodeTemplates.get
  • compute.nodeTemplates.getIamPolicy
  • compute.nodeTemplates.list
  • compute.nodeTypes.*

Compute Storage Admin role

Title and name Description Permissions
Compute Storage Admin
(roles/compute.storageAdmin)

Permissions to create, modify, and delete disks, images, and snapshots.

For example, if your company has someone who manages project images and you don't want them to have the editor role on the project, then grant this role to their account on the project.

Lowest-level resources where you can grant this role:

  • Disk
  • Image
  • Snapshot Beta
  • compute.diskTypes.*
  • compute.disks.*
  • compute.globalOperations.get
  • compute.globalOperations.list
  • compute.images.*
  • compute.licenseCodes.*
  • compute.licenses.*
  • compute.projects.get
  • compute.regionOperations.get
  • compute.regionOperations.list
  • compute.regions.*
  • compute.resourcePolicies.*
  • compute.snapshots.*
  • compute.zoneOperations.get
  • compute.zoneOperations.list
  • compute.zones.*
  • resourcemanager.projects.get
  • resourcemanager.projects.list
  • serviceusage.quotas.get
  • serviceusage.services.get
  • serviceusage.services.list

Compute Viewer role

Title and name Description Permissions
Compute Viewer
(roles/compute.viewer)

Read-only access to get and list Compute Engine resources, without being able to read the data stored on them.

For example, an account with this role could inventory all of the disks in a project, but it could not read any of the data on those disks.

Lowest-level resources where you can grant this role:

  • Disk
  • Image
  • Instance
  • Instance template
  • Node group
  • Node template
  • Snapshot Beta
  • compute.acceleratorTypes.*
  • compute.addresses.get
  • compute.addresses.list
  • compute.autoscalers.get
  • compute.autoscalers.list
  • compute.backendBuckets.get
  • compute.backendBuckets.list
  • compute.backendServices.get
  • compute.backendServices.getIamPolicy
  • compute.backendServices.list
  • compute.commitments.get
  • compute.commitments.list
  • compute.diskTypes.*
  • compute.disks.get
  • compute.disks.getIamPolicy
  • compute.disks.list
  • compute.disks.listEffectiveTags
  • compute.disks.listTagBindings
  • compute.externalVpnGateways.get
  • compute.externalVpnGateways.list
  • compute.firewallPolicies.get
  • compute.firewallPolicies.getIamPolicy
  • compute.firewallPolicies.list
  • compute.firewalls.get
  • compute.firewalls.list
  • compute.forwardingRules.get
  • compute.forwardingRules.list
  • compute.globalAddresses.get
  • compute.globalAddresses.list
  • compute.globalForwardingRules.get
  • compute.globalForwardingRules.list
  • compute.globalForwardingRules.pscGet
  • compute.globalNetworkEndpointGroups.get
  • compute.globalNetworkEndpointGroups.list
  • compute.globalOperations.get
  • compute.globalOperations.getIamPolicy
  • compute.globalOperations.list
  • compute.globalPublicDelegatedPrefixes.get
  • compute.globalPublicDelegatedPrefixes.list
  • compute.healthChecks.get
  • compute.healthChecks.list
  • compute.httpHealthChecks.get
  • compute.httpHealthChecks.list
  • compute.httpsHealthChecks.get
  • compute.httpsHealthChecks.list
  • compute.images.get
  • compute.images.getFromFamily
  • compute.images.getIamPolicy
  • compute.images.list
  • compute.images.listEffectiveTags
  • compute.images.listTagBindings
  • compute.instanceGroupManagers.get
  • compute.instanceGroupManagers.list
  • compute.instanceGroups.get
  • compute.instanceGroups.list
  • compute.instanceTemplates.get
  • compute.instanceTemplates.getIamPolicy
  • compute.instanceTemplates.list
  • compute.instances.get
  • compute.instances.getEffectiveFirewalls
  • compute.instances.getGuestAttributes
  • compute.instances.getIamPolicy
  • compute.instances.getScreenshot
  • compute.instances.getSerialPortOutput
  • compute.instances.getShieldedInstanceIdentity
  • compute.instances.getShieldedVmIdentity
  • compute.instances.list
  • compute.instances.listEffectiveTags
  • compute.instances.listReferrers
  • compute.instances.listTagBindings
  • compute.interconnectAttachments.get
  • compute.interconnectAttachments.list
  • compute.interconnectLocations.*
  • compute.interconnects.get
  • compute.interconnects.list
  • compute.licenseCodes.get
  • compute.licenseCodes.getIamPolicy
  • compute.licenseCodes.list
  • compute.licenses.get
  • compute.licenses.getIamPolicy
  • compute.licenses.list
  • compute.machineImages.get
  • compute.machineImages.getIamPolicy
  • compute.machineImages.list
  • compute.machineTypes.*
  • compute.maintenancePolicies.get
  • compute.maintenancePolicies.getIamPolicy
  • compute.maintenancePolicies.list
  • compute.networkEndpointGroups.get
  • compute.networkEndpointGroups.getIamPolicy
  • compute.networkEndpointGroups.list
  • compute.networks.get
  • compute.networks.getEffectiveFirewalls
  • compute.networks.getRegionEffectiveFirewalls
  • compute.networks.list
  • compute.networks.listPeeringRoutes
  • compute.nodeGroups.get
  • compute.nodeGroups.getIamPolicy
  • compute.nodeGroups.list
  • compute.nodeTemplates.get
  • compute.nodeTemplates.getIamPolicy
  • compute.nodeTemplates.list
  • compute.nodeTypes.*
  • compute.organizations.listAssociations
  • compute.packetMirrorings.get
  • compute.packetMirrorings.list
  • compute.projects.get
  • compute.publicAdvertisedPrefixes.get
  • compute.publicAdvertisedPrefixes.list
  • compute.publicDelegatedPrefixes.get
  • compute.publicDelegatedPrefixes.list
  • compute.regionBackendServices.get
  • compute.regionBackendServices.getIamPolicy
  • compute.regionBackendServices.list
  • compute.regionFirewallPolicies.get
  • compute.regionFirewallPolicies.getIamPolicy
  • compute.regionFirewallPolicies.list
  • compute.regionHealthCheckServices.get
  • compute.regionHealthCheckServices.list
  • compute.regionHealthChecks.get
  • compute.regionHealthChecks.list
  • compute.regionNetworkEndpointGroups.get
  • compute.regionNetworkEndpointGroups.list
  • compute.regionNotificationEndpoints.get
  • compute.regionNotificationEndpoints.list
  • compute.regionOperations.get
  • compute.regionOperations.getIamPolicy
  • compute.regionOperations.list
  • compute.regionSslCertificates.get
  • compute.regionSslCertificates.list
  • compute.regionTargetHttpProxies.get
  • compute.regionTargetHttpProxies.list
  • compute.regionTargetHttpsProxies.get
  • compute.regionTargetHttpsProxies.list
  • compute.regionUrlMaps.get
  • compute.regionUrlMaps.list
  • compute.regionUrlMaps.validate
  • compute.regions.*
  • compute.reservations.get
  • compute.reservations.list
  • compute.resourcePolicies.get
  • compute.resourcePolicies.list
  • compute.routers.get
  • compute.routers.list
  • compute.routes.get
  • compute.routes.list
  • compute.securityPolicies.get
  • compute.securityPolicies.getIamPolicy
  • compute.securityPolicies.list
  • compute.serviceAttachments.get
  • compute.serviceAttachments.list
  • compute.snapshots.get
  • compute.snapshots.getIamPolicy
  • compute.snapshots.list
  • compute.snapshots.listEffectiveTags
  • compute.snapshots.listTagBindings
  • compute.sslCertificates.get
  • compute.sslCertificates.list
  • compute.sslPolicies.get
  • compute.sslPolicies.list
  • compute.sslPolicies.listAvailableFeatures
  • compute.subnetworks.get
  • compute.subnetworks.getIamPolicy
  • compute.subnetworks.list
  • compute.targetGrpcProxies.get
  • compute.targetGrpcProxies.list
  • compute.targetHttpProxies.get
  • compute.targetHttpProxies.list
  • compute.targetHttpsProxies.get
  • compute.targetHttpsProxies.list
  • compute.targetInstances.get
  • compute.targetInstances.list
  • compute.targetPools.get
  • compute.targetPools.list
  • compute.targetSslProxies.get
  • compute.targetSslProxies.list
  • compute.targetTcpProxies.get
  • compute.targetTcpProxies.list
  • compute.targetVpnGateways.get
  • compute.targetVpnGateways.list
  • compute.urlMaps.get
  • compute.urlMaps.list
  • compute.urlMaps.validate
  • compute.vpnGateways.get
  • compute.vpnGateways.list
  • compute.vpnTunnels.get
  • compute.vpnTunnels.list
  • compute.zoneOperations.get
  • compute.zoneOperations.getIamPolicy
  • compute.zoneOperations.list
  • compute.zones.*
  • resourcemanager.projects.get
  • resourcemanager.projects.list
  • serviceusage.quotas.get
  • serviceusage.services.get
  • serviceusage.services.list

Compute Shared VPC Admin role

Title and name Description Permissions
Compute Shared VPC Admin
(roles/compute.xpnAdmin)

Permissions to administer shared VPC host projects, specifically enabling the host projects and associating shared VPC service projects to the host project's network.

At the organization level, this role can only be granted by an organization admin.

Google Cloud recommends that the Shared VPC Admin be the owner of the shared VPC host project. The Shared VPC Admin is responsible for granting the Compute Network User role (roles/compute.networkUser) to service owners, and the shared VPC host project owner controls the project itself. Managing the project is easier if a single principal (individual or group) can fulfill both roles.

Lowest-level resources where you can grant this role:

  • Folder
  • compute.globalOperations.get
  • compute.globalOperations.list
  • compute.organizations.administerXpn
  • compute.organizations.disableXpnHost
  • compute.organizations.disableXpnResource
  • compute.organizations.enableXpnHost
  • compute.organizations.enableXpnResource
  • compute.projects.get
  • compute.subnetworks.getIamPolicy
  • compute.subnetworks.setIamPolicy
  • resourcemanager.organizations.get
  • resourcemanager.projects.get
  • resourcemanager.projects.getIamPolicy
  • resourcemanager.projects.list

GuestPolicy Admin role

Title and name Description Permissions
GuestPolicy Admin
(roles/osconfig.guestPolicyAdmin) Beta
Full admin access to GuestPolicies
  • osconfig.guestPolicies.*
  • resourcemanager.projects.get
  • resourcemanager.projects.list

GuestPolicy Editor role

Title and name Description Permissions
GuestPolicy Editor
(roles/osconfig.guestPolicyEditor) Beta
Editor of GuestPolicy resources
  • osconfig.guestPolicies.get
  • osconfig.guestPolicies.list
  • osconfig.guestPolicies.update
  • resourcemanager.projects.get
  • resourcemanager.projects.list

GuestPolicy Viewer role

Title and name Description Permissions
GuestPolicy Viewer
(roles/osconfig.guestPolicyViewer) Beta
Viewer of GuestPolicy resources
  • osconfig.guestPolicies.get
  • osconfig.guestPolicies.list
  • resourcemanager.projects.get
  • resourcemanager.projects.list

InstanceOSPoliciesCompliance Viewer role

Title and name Description Permissions
InstanceOSPoliciesCompliance Viewer
(roles/osconfig.instanceOSPoliciesComplianceViewer) Beta
Viewer of OS Policies Compliance of VM instances
  • osconfig.instanceOSPoliciesCompliances.*
  • resourcemanager.projects.get
  • resourcemanager.projects.list

OS Inventory Viewer role

Title and name Description Permissions
OS Inventory Viewer
(roles/osconfig.inventoryViewer)
Viewer of OS Inventories
  • osconfig.inventories.*
  • resourcemanager.projects.get
  • resourcemanager.projects.list

OSPolicyAssignment Admin role

Title and name Description Permissions
OSPolicyAssignment Admin
(roles/osconfig.osPolicyAssignmentAdmin)
Full admin access to OS Policy Assignments
  • osconfig.osPolicyAssignments.*
  • resourcemanager.projects.get
  • resourcemanager.projects.list

OSPolicyAssignment Editor role

Title and name Description Permissions
OSPolicyAssignment Editor
(roles/osconfig.osPolicyAssignmentEditor)
Editor of OS Policy Assignments
  • osconfig.osPolicyAssignments.get
  • osconfig.osPolicyAssignments.list
  • osconfig.osPolicyAssignments.update
  • resourcemanager.projects.get
  • resourcemanager.projects.list

OSPolicyAssignmentReport Viewer role

Title and name Description Permissions
OSPolicyAssignmentReport Viewer
(roles/osconfig.osPolicyAssignmentReportViewer)
Viewer of OS policy assignment reports for VM instances
  • osconfig.osPolicyAssignmentReports.*
  • resourcemanager.projects.get
  • resourcemanager.projects.list

OSPolicyAssignment Viewer role

Title and name Description Permissions
OSPolicyAssignment Viewer
(roles/osconfig.osPolicyAssignmentViewer)
Viewer of OS Policy Assignments
  • osconfig.osPolicyAssignments.get
  • osconfig.osPolicyAssignments.list
  • resourcemanager.projects.get
  • resourcemanager.projects.list

PatchDeployment Admin role

Title and name Description Permissions
PatchDeployment Admin
(roles/osconfig.patchDeploymentAdmin)
Full admin access to PatchDeployments
  • osconfig.patchDeployments.*
  • resourcemanager.projects.get
  • resourcemanager.projects.list

PatchDeployment Viewer role

Title and name Description Permissions
PatchDeployment Viewer
(roles/osconfig.patchDeploymentViewer)
Viewer of PatchDeployment resources
  • osconfig.patchDeployments.get
  • osconfig.patchDeployments.list
  • resourcemanager.projects.get
  • resourcemanager.projects.list

Patch Job Executor role

Title and name Description Permissions
Patch Job Executor
(roles/osconfig.patchJobExecutor)
Access to execute Patch Jobs.
  • osconfig.patchJobs.*
  • resourcemanager.projects.get
  • resourcemanager.projects.list

Patch Job Viewer role

Title and name Description Permissions
Patch Job Viewer
(roles/osconfig.patchJobViewer)
Get and list Patch Jobs.
  • osconfig.patchJobs.get
  • osconfig.patchJobs.list
  • resourcemanager.projects.get
  • resourcemanager.projects.list

OS VulnerabilityReport Viewer role

Title and name Description Permissions
OS VulnerabilityReport Viewer
(roles/osconfig.vulnerabilityReportViewer)
Viewer of OS VulnerabilityReports
  • osconfig.vulnerabilityReports.*
  • resourcemanager.projects.get
  • resourcemanager.projects.list

DNS Administrator role

Title and name Description Permissions
DNS Administrator
(roles/dns.admin)

Provides read-write access to all Cloud DNS resources.

Lowest-level resources where you can grant this role:

  • Project
  • compute.networks.get
  • compute.networks.list
  • dns.changes.*
  • dns.dnsKeys.*
  • dns.managedZoneOperations.*
  • dns.managedZones.create
  • dns.managedZones.delete
  • dns.managedZones.get
  • dns.managedZones.list
  • dns.managedZones.update
  • dns.networks.*
  • dns.policies.create
  • dns.policies.delete
  • dns.policies.get
  • dns.policies.list
  • dns.policies.update
  • dns.projects.*
  • dns.resourceRecordSets.*
  • dns.responsePolicies.*
  • dns.responsePolicyRules.*
  • resourcemanager.projects.get
  • resourcemanager.projects.list

DNS Peer role

Title and name Description Permissions
DNS Peer
(roles/dns.peer)
Access to target networks with DNS peering zones
  • dns.networks.targetWithPeeringZone

DNS Reader role

Title and name Description Permissions
DNS Reader
(roles/dns.reader)

Provides read-only access to all Cloud DNS resources.

Lowest-level resources where you can grant this role:

  • Project
  • compute.networks.get
  • dns.changes.get
  • dns.changes.list
  • dns.dnsKeys.*
  • dns.managedZoneOperations.*
  • dns.managedZones.get
  • dns.managedZones.list
  • dns.policies.get
  • dns.policies.list
  • dns.projects.*
  • dns.resourceRecordSets.get
  • dns.resourceRecordSets.list
  • dns.responsePolicies.get
  • dns.responsePolicies.list
  • dns.responsePolicyRules.get
  • dns.responsePolicyRules.list
  • resourcemanager.projects.get
  • resourcemanager.projects.list

서비스 계정 관리자 역할

직책 및 이름 설명 권한
서비스 계정 관리자
(roles/iam.serviceAccountAdmin)
서비스 계정을 만들고 관리합니다.

이 역할을 부여할 수 있는 최하위 수준 리소스:

  • 서비스 계정
  • iam.serviceAccounts.create
  • iam.serviceAccounts.delete
  • iam.serviceAccounts.disable
  • iam.serviceAccounts.enable
  • iam.serviceAccounts.get
  • iam.serviceAccounts.getIamPolicy
  • iam.serviceAccounts.list
  • iam.serviceAccounts.setIamPolicy
  • iam.serviceAccounts.undelete
  • iam.serviceAccounts.update
  • resourcemanager.projects.get
  • resourcemanager.projects.list

서비스 계정 만들기 역할

직책 및 이름 설명 권한
서비스 계정 만들기
(roles/iam.serviceAccountCreator)
서비스 계정을 만들 수 있는 액세스 권한입니다.
  • iam.serviceAccounts.create
  • iam.serviceAccounts.get
  • iam.serviceAccounts.list
  • resourcemanager.projects.get
  • resourcemanager.projects.list

서비스 계정 삭제 역할

직책 및 이름 설명 권한
서비스 계정 삭제
(roles/iam.serviceAccountDeleter)
서비스 계정을 삭제할 수 있는 액세스 권한입니다.
  • iam.serviceAccounts.delete
  • iam.serviceAccounts.get
  • iam.serviceAccounts.list
  • resourcemanager.projects.get
  • resourcemanager.projects.list

서비스 계정 키 관리자 역할

직책 및 이름 설명 권한
서비스 계정 키 관리자
(roles/iam.serviceAccountKeyAdmin)
서비스 계정 키를 만들고 관리(및 순환)합니다.

이 역할을 부여할 수 있는 최하위 수준 리소스:

  • 서비스 계정
  • iam.serviceAccountKeys.*
  • iam.serviceAccounts.get
  • iam.serviceAccounts.list
  • resourcemanager.projects.get
  • resourcemanager.projects.list

서비스 계정 토큰 생성자 역할

직책 및 이름 설명 권한
서비스 계정 토큰 생성자
(roles/iam.serviceAccountTokenCreator)
OAuth2 액세스 토큰, 서명 blob 또는 JWT 생성 등과 같이 서비스 계정을 가장합니다.

이 역할을 부여할 수 있는 최하위 수준 리소스:

  • 서비스 계정
  • iam.serviceAccounts.get
  • iam.serviceAccounts.getAccessToken
  • iam.serviceAccounts.getOpenIdToken
  • iam.serviceAccounts.implicitDelegation
  • iam.serviceAccounts.list
  • iam.serviceAccounts.signBlob
  • iam.serviceAccounts.signJwt
  • resourcemanager.projects.get
  • resourcemanager.projects.list

서비스 계정 사용자 역할

직책 및 이름 설명 권한
서비스 계정 사용자
(roles/iam.serviceAccountUser)
서비스 계정으로 작업을 실행합니다.

이 역할을 부여할 수 있는 최하위 수준 리소스:

  • 서비스 계정
  • iam.serviceAccounts.actAs
  • iam.serviceAccounts.get
  • iam.serviceAccounts.list
  • resourcemanager.projects.get
  • resourcemanager.projects.list

서비스 계정 역할 보기

직책 및 이름 설명 권한
서비스 계정 보기
(roles/iam.serviceAccountViewer)
서비스 계정, 메타데이터, 키에 대한 읽기 액세스 권한입니다.
  • iam.serviceAccountKeys.get
  • iam.serviceAccountKeys.list
  • iam.serviceAccounts.get
  • iam.serviceAccounts.getIamPolicy
  • iam.serviceAccounts.list
  • resourcemanager.projects.get
  • resourcemanager.projects.list

워크로드 아이덴티티 사용자 역할

직책 및 이름 설명 권한
워크로드 아이덴티티 사용자
(roles/iam.workloadIdentityUser)
GKE 워크로드의 서비스 계정을 가장합니다.
  • iam.serviceAccounts.get
  • iam.serviceAccounts.getAccessToken
  • iam.serviceAccounts.getOpenIdToken
  • iam.serviceAccounts.list

다음 단계