Sensitive Data Protection IAM permissions

Common permissions

Some methods do not have Sensitive Data Protection-specific permissions. Instead, they use common ones, as the methods can cause billable events, but do not access any protected cloud resources.

All actions that trigger billable events such as the projects.content methods require the serviceusage.services.use permission for the project that's specified in parent. The roles/editor, roles/owner, and roles/dlp.user roles contain the required permission or you can define your own custom roles containing this permission.

This permission ensures you are authorized to bill the project you specify.

Service account

To access both Google Cloud resources and execute calls to Sensitive Data Protection, Sensitive Data Protection uses the credentials of the Cloud Data Loss Prevention Service Agent to authenticate to other APIs. A service agent is a special type of service account that runs internal Google processes on your behalf. The service agent is identifiable using the email:

[e-mail]

The Cloud Data Loss Prevention Service Agent is created the first time it is needed. You can create it in advance by making a call to InspectContent:

curl --request POST \
  "https://dlp.googleapis.com/v2/projects/PROJECT_ID/locations/us-central1/content:inspect" \
  --header "X-Goog-User-Project: PROJECT_ID" \
  --header "Authorization: Bearer $(gcloud auth print-access-token)" \
  --header 'Accept: application/json' \
  --header 'Content-Type: application/json' \
  --data '{"item":{"value":"[e-mail]"}}' \
  --compressed

Replace PROJECT_ID with the project ID.

The Cloud Data Loss Prevention Service Agent is automatically granted common permissions on the project that are needed for inspecting resources and is listed in the IAM section of the Google Cloud console. The service agent exists indefinitely with the project and is only deleted when the project is deleted. Sensitive Data Protection relies on this service agent, so you should not remove it.

Note: If you are using Sensitive Data Protection to scan critical resources, such as those protected by additional custom Identity and Access Management roles, you must assign those additional IAM roles to the Cloud Data Loss Prevention Service Agent. For example, if you want to use Sensitive Data Protection to inspect files in Google Cloud that are restricted to only a subset of individuals, you must grant the appropriate role to the Cloud Data Loss Prevention Service Agent.

Warning: If you remove the Cloud Data Loss Prevention Service Agent or revoke its roles, all jobs and job triggers will fail.

For more information on how service accounts are used in data profiling operations, see Service agent container and service agent.

Job permissions

Permission name	Description
dlp.jobs.create	Create new jobs.
dlp.jobs.cancel	Cancel jobs.
dlp.jobs.delete	Delete jobs.
dlp.jobs.get	Read job objects.
dlp.jobs.list	List jobs.
dlp.jobs.hybridInspect	Make a hybrid inspect call on a hybrid job.

Job trigger permissions

Permission name	Description
dlp.jobTriggers.create	Create new job triggers.
dlp.jobTriggers.delete	Delete job triggers.
dlp.jobTriggers.get	Read job trigger objects.
dlp.jobTriggers.list	List job triggers.
dlp.jobTriggers.update	Update job triggers.
dlp.jobTriggers.hybridInspect	Make a hybrid inspect call on a hybrid trigger.

Inspection template permissions

Permission name	Description
dlp.inspectTemplates.create	Create new inspection templates.
dlp.inspectTemplates.delete	Delete inspection templates.
dlp.inspectTemplates.get	Read inspection template objects.
dlp.inspectTemplates.list	List inspection templates.
dlp.inspectTemplates.update	Update inspection templates.

De-identification template permissions

Permission name	Description
dlp.deidentifyTemplates.create	Create new de-identification templates.
dlp.deidentifyTemplates.delete	Delete de-identification templates.
dlp.deidentifyTemplates.get	Read de-identification template objects.
dlp.deidentifyTemplates.list	List de-identification templates.
dlp.deidentifyTemplates.update	Update de-identification templates.

Data profile permissions

Permission name	Description
dlp.projectDataProfiles.list	List project data profiles.
dlp.projectDataProfiles.get	Read project data profile objects.
dlp.tableDataProfiles.list	List table data profiles.
dlp.tableDataProfiles.get	Read table data profile objects.
dlp.columnDataProfiles.list	List column data profiles.
dlp.columnDataProfiles.get	Read column data profile objects.

Estimate permissions

Permission name	Description
dlp.estimates.get	Read estimate objects.
dlp.estimates.list	List estimate objects.
dlp.estimates.create	Create an estimate object.
dlp.estimates.delete	Delete an estimate object.
dlp.estimates.cancel	Cancel an ongoing estimation.

Stored infoType permissions

Permission name	Description
dlp.storedInfoTypes.create	Create new stored infotypes.
dlp.storedInfoTypes.delete	Delete stored infotypes.
dlp.storedInfoTypes.get	Read stored infotypes.
dlp.storedInfoTypes.list	List stored infotypes.
dlp.storedInfoTypes.update	Update stored infotypes.

Subscription permissions

Permission name	Description
dlp.subscriptions.get	Create new subscriptions.
dlp.subscriptions.list	List subscriptions.
dlp.subscriptions.create	Create subscriptions.
dlp.subscriptions.cancel	Cancel subscriptions.
dlp.subscriptions.update	Update subscriptions.

Misc permissions

Permission name	Description
dlp.kms.encrypt	De-identify content using encryption tokens persisted in Cloud KMS.