IAM permissions change log

This page describes changes to the public Identity and Access Management (IAM) permissions for all Generally Available (GA) and Preview services on Google Cloud. This change log can help you maintain and troubleshoot your custom roles.

When a permission is added, IAM does not automatically add the permission to your custom roles.

For changes that occurred before 2022, see Archived permissions change log.

You can see the latest product updates for all of Google Cloud on the Google Cloud page, browse and filter all release notes in the Google Cloud console, or programmatically access release notes in BigQuery.

To get the latest product updates delivered to you, add the URL of this page to your feed reader, or add the feed URL directly.

Upcoming IAM changes for the week of 2024-10-28

Service	Description
Artifact Registry	The Container Registry -> Artifact Registry Migration Admin role (`roles/artifactregistry.containerRegistryMigrationAdmin`) has reached General Availability (GA).
Audit Manager	The following permissions have been added to the Audit Manager Auditing Service Agent role (`roles/auditmanager.serviceAgent`): `certificatemanager.certs.list` `certificatemanager.trustconfigs.list` `cloudkms.cryptoKeys.list` `cloudsql.instances.get` `compute.firewallPolicies.list` `compute.instances.get` `container.clusters.get` `dns.managedZones.list` `iam.serviceAccounts.getIamPolicy` `privateca.certificates.list`
Dataplex	The Dataplex Discovery BigLake Publishing Service Agent role (`roles/dataplex.discoveryBigLakePublishingServiceAgent`) has reached General Availability (GA).
Dataplex	The Dataplex Discovery Publishing Service Agent role (`roles/dataplex.discoveryPublishingServiceAgent`) has reached General Availability (GA).
Dataplex	The Dataplex Discovery Service Agent role (`roles/dataplex.discoveryServiceAgent`) has reached General Availability (GA).
Application Design Center	The DesignCenter Service Agent role (`roles/designcenter.serviceAgent`) has reached General Availability (GA).
Parallelstore	The Parallelstore Admin role (`roles/parallelstore.admin`) has reached General Availability (GA).
Parallelstore	The Parallelstore Viewer role (`roles/parallelstore.viewer`) has reached General Availability (GA).
Compute Engine	The following permissions have been added: `compute.multiMig.create` `compute.multiMig.delete` `compute.multiMig.get` `compute.multiMig.list`
Compute Engine	The following permissions are supported in custom roles: `compute.multiMig.create` `compute.multiMig.delete` `compute.multiMig.get` `compute.multiMig.list`
Network Services	The following permissions have been added: `networkservices.wasmPlugins.create` `networkservices.wasmPlugins.delete` `networkservices.wasmPlugins.get` `networkservices.wasmPlugins.list` `networkservices.wasmPlugins.update` `networkservices.wasmPlugins.use`
Network Services	The following permissions are supported in custom roles: `networkservices.wasmPlugins.create` `networkservices.wasmPlugins.delete` `networkservices.wasmPlugins.get` `networkservices.wasmPlugins.list` `networkservices.wasmPlugins.update` `networkservices.wasmPlugins.use`
Cloud OS Config	The following permissions have been added: `osconfig.locations.get` `osconfig.locations.list` `osconfig.operations.cancel` `osconfig.operations.delete` `osconfig.operations.get` `osconfig.operations.list` `osconfig.policyOrchestrators.create` `osconfig.policyOrchestrators.delete` `osconfig.policyOrchestrators.get` `osconfig.policyOrchestrators.list` `osconfig.policyOrchestrators.update`
Cloud OS Config	The following permissions are supported in custom roles: `osconfig.locations.get` `osconfig.locations.list` `osconfig.operations.cancel` `osconfig.operations.delete` `osconfig.operations.get` `osconfig.operations.list` `osconfig.policyOrchestrators.create` `osconfig.policyOrchestrators.delete` `osconfig.policyOrchestrators.get` `osconfig.policyOrchestrators.list` `osconfig.policyOrchestrators.update`
Parallelstore	The following permissions have been added: `parallelstore.instances.create` `parallelstore.instances.delete` `parallelstore.instances.exportData` `parallelstore.instances.get` `parallelstore.instances.importData` `parallelstore.instances.list` `parallelstore.instances.update` `parallelstore.locations.get` `parallelstore.locations.list` `parallelstore.operations.cancel` `parallelstore.operations.delete` `parallelstore.operations.get` `parallelstore.operations.list`
Parallelstore	The following permissions are supported in custom roles: `parallelstore.instances.create` `parallelstore.instances.delete` `parallelstore.instances.exportData` `parallelstore.instances.get` `parallelstore.instances.importData` `parallelstore.instances.list` `parallelstore.instances.update` `parallelstore.locations.get` `parallelstore.locations.list` `parallelstore.operations.cancel` `parallelstore.operations.delete` `parallelstore.operations.get` `parallelstore.operations.list`
Parallelstore	The following permissions have reached General Availability (GA): `parallelstore.instances.create` `parallelstore.instances.delete` `parallelstore.instances.exportData` `parallelstore.instances.get` `parallelstore.instances.importData` `parallelstore.instances.list` `parallelstore.instances.update` `parallelstore.locations.get` `parallelstore.locations.list` `parallelstore.operations.cancel` `parallelstore.operations.delete` `parallelstore.operations.get` `parallelstore.operations.list`
Secure Source Manager	The following permissions have been added: `securesourcemanager.repositories.approvePullRequests`
Secure Source Manager	The following permissions are supported in custom roles: `securesourcemanager.repositories.approvePullRequests`

IAM changes as of 2024-10-25

Service	Description
Anthos Support	The following permissions have been added to the Anthos Support Service Agent role (`roles/anthossupport.serviceAgent`): `gkehub.gateway.generateCredentials`
Batch	The following permissions have been added to the Google Batch Service Agent role (`roles/batch.serviceAgent`): `backupdr.backupPlanAssociations.create` `backupdr.backupPlanAssociations.createForComputeInstance` `backupdr.backupPlanAssociations.delete` `backupdr.backupPlanAssociations.deleteForComputeInstance` `backupdr.backupPlanAssociations.list` `backupdr.backupPlanAssociations.triggerBackup` `backupdr.backupPlanAssociations.triggerBackupForComputeInstance` `backupdr.backupPlans.useComputeInstanceOnly` `backupdr.backupPlans.useForComputeInstance`
Cloud TPU	The following permissions have been added to the Cloud TPU V2 API Service Agent role (`roles/cloudtpu.serviceAgent`): `backupdr.backupPlanAssociations.create` `backupdr.backupPlanAssociations.createForComputeInstance` `backupdr.backupPlanAssociations.delete` `backupdr.backupPlanAssociations.deleteForComputeInstance` `backupdr.backupPlanAssociations.list` `backupdr.backupPlanAssociations.triggerBackup` `backupdr.backupPlanAssociations.triggerBackupForComputeInstance` `backupdr.backupPlans.useComputeInstanceOnly` `backupdr.backupPlans.useForComputeInstance`
Cloud Composer	The following permissions have been added to the Cloud Composer API Service Agent role (`roles/composer.serviceAgent`): `backupdr.backupPlanAssociations.create` `backupdr.backupPlanAssociations.createForComputeInstance` `backupdr.backupPlanAssociations.delete` `backupdr.backupPlanAssociations.deleteForComputeInstance` `backupdr.backupPlanAssociations.list` `backupdr.backupPlanAssociations.triggerBackup` `backupdr.backupPlanAssociations.triggerBackupForComputeInstance` `backupdr.backupPlans.useComputeInstanceOnly` `backupdr.backupPlans.useForComputeInstance`
Compute Engine	The following permissions have been added to the Compute Admin role (`roles/compute.admin`): `backupdr.backupPlanAssociations.create` `backupdr.backupPlanAssociations.createForComputeInstance` `backupdr.backupPlanAssociations.delete` `backupdr.backupPlanAssociations.deleteForComputeInstance` `backupdr.backupPlanAssociations.list` `backupdr.backupPlanAssociations.triggerBackup` `backupdr.backupPlanAssociations.triggerBackupForComputeInstance` `backupdr.backupPlans.useComputeInstanceOnly` `backupdr.backupPlans.useForComputeInstance`
Compute Engine	The following permissions have been added to the Compute Instance Admin (beta) role (`roles/compute.instanceAdmin`): `backupdr.backupPlanAssociations.create` `backupdr.backupPlanAssociations.createForComputeInstance` `backupdr.backupPlanAssociations.delete` `backupdr.backupPlanAssociations.deleteForComputeInstance` `backupdr.backupPlanAssociations.list` `backupdr.backupPlanAssociations.triggerBackup` `backupdr.backupPlanAssociations.triggerBackupForComputeInstance` `backupdr.backupPlans.useComputeInstanceOnly` `backupdr.backupPlans.useForComputeInstance`
Compute Engine	The following permissions have been added to the Compute Instance Admin (v1) role (`roles/compute.instanceAdmin.v1`): `backupdr.backupPlanAssociations.create` `backupdr.backupPlanAssociations.createForComputeInstance` `backupdr.backupPlanAssociations.delete` `backupdr.backupPlanAssociations.deleteForComputeInstance` `backupdr.backupPlanAssociations.list` `backupdr.backupPlanAssociations.triggerBackup` `backupdr.backupPlanAssociations.triggerBackupForComputeInstance` `backupdr.backupPlans.useComputeInstanceOnly` `backupdr.backupPlans.useForComputeInstance`
Google Kubernetes Engine	The following permissions have been added to the Kubernetes Engine Service Agent role (`roles/container.serviceAgent`): `backupdr.backupPlanAssociations.create` `backupdr.backupPlanAssociations.createForComputeInstance` `backupdr.backupPlanAssociations.delete` `backupdr.backupPlanAssociations.deleteForComputeInstance` `backupdr.backupPlanAssociations.list` `backupdr.backupPlanAssociations.triggerBackup` `backupdr.backupPlanAssociations.triggerBackupForComputeInstance` `backupdr.backupPlans.useComputeInstanceOnly` `backupdr.backupPlans.useForComputeInstance`
Dataflow	The following permissions have been added to the Cloud Dataflow Service Agent role (`roles/dataflow.serviceAgent`): `backupdr.backupPlanAssociations.create` `backupdr.backupPlanAssociations.createForComputeInstance` `backupdr.backupPlanAssociations.delete` `backupdr.backupPlanAssociations.deleteForComputeInstance` `backupdr.backupPlanAssociations.list` `backupdr.backupPlanAssociations.triggerBackup` `backupdr.backupPlanAssociations.triggerBackupForComputeInstance` `backupdr.backupPlans.useComputeInstanceOnly` `backupdr.backupPlans.useForComputeInstance`
Database Migration Service	The following permissions have been added to the Database Migration Service Agent role (`roles/datamigration.serviceAgent`): `cloudsql.instances.export`
Dataproc	The following permissions have been added to the Dataproc Service Agent role (`roles/dataproc.serviceAgent`): `backupdr.backupPlanAssociations.create` `backupdr.backupPlanAssociations.createForComputeInstance` `backupdr.backupPlanAssociations.delete` `backupdr.backupPlanAssociations.deleteForComputeInstance` `backupdr.backupPlanAssociations.list` `backupdr.backupPlanAssociations.triggerBackup` `backupdr.backupPlanAssociations.triggerBackupForComputeInstance` `backupdr.backupPlans.useComputeInstanceOnly` `backupdr.backupPlans.useForComputeInstance` `servicemanagement.services.bind` `serviceusage.services.enable`
Data Security Posture Management	The following permissions have been added to the DSPM Service Agent role (`roles/dspm.serviceAgent`): `securityposture.postureDeployments.delete`
Cloud Life Sciences	The following permissions have been added to the Genomics Service Agent role (`roles/genomics.serviceAgent`): `backupdr.backupPlanAssociations.create` `backupdr.backupPlanAssociations.createForComputeInstance` `backupdr.backupPlanAssociations.delete` `backupdr.backupPlanAssociations.deleteForComputeInstance` `backupdr.backupPlanAssociations.list` `backupdr.backupPlanAssociations.triggerBackup` `backupdr.backupPlanAssociations.triggerBackupForComputeInstance` `backupdr.backupPlans.useComputeInstanceOnly` `backupdr.backupPlans.useForComputeInstance`
Cloud Life Sciences	The following permissions have been added to the Cloud Life Sciences Service Agent role (`roles/lifesciences.serviceAgent`): `backupdr.backupPlanAssociations.create` `backupdr.backupPlanAssociations.createForComputeInstance` `backupdr.backupPlanAssociations.delete` `backupdr.backupPlanAssociations.deleteForComputeInstance` `backupdr.backupPlanAssociations.list` `backupdr.backupPlanAssociations.triggerBackup` `backupdr.backupPlanAssociations.triggerBackupForComputeInstance` `backupdr.backupPlans.useComputeInstanceOnly` `backupdr.backupPlans.useForComputeInstance`
Notebooks	The following permissions have been added to the Notebooks Legacy Admin role (`roles/notebooks.legacyAdmin`): `backupdr.backupPlanAssociations.create` `backupdr.backupPlanAssociations.createForComputeInstance` `backupdr.backupPlanAssociations.delete` `backupdr.backupPlanAssociations.deleteForComputeInstance` `backupdr.backupPlanAssociations.list` `backupdr.backupPlanAssociations.triggerBackup` `backupdr.backupPlanAssociations.triggerBackupForComputeInstance` `backupdr.backupPlans.useComputeInstanceOnly` `backupdr.backupPlans.useForComputeInstance`
Notebooks	The following permissions have been added to the AI Platform Notebooks Service Agent role (`roles/notebooks.serviceAgent`): `backupdr.backupPlanAssociations.create` `backupdr.backupPlanAssociations.createForComputeInstance` `backupdr.backupPlanAssociations.delete` `backupdr.backupPlanAssociations.deleteForComputeInstance` `backupdr.backupPlanAssociations.list` `backupdr.backupPlanAssociations.triggerBackup` `backupdr.backupPlanAssociations.triggerBackupForComputeInstance` `backupdr.backupPlans.useComputeInstanceOnly` `backupdr.backupPlans.useForComputeInstance`
Conversational Insights	The following permissions have been added: `contactcenterinsights.qaScorecardRevisions.undeploy`
Conversational Insights	The following permissions are supported in custom roles: `contactcenterinsights.qaScorecardRevisions.undeploy`
Conversational Insights	The following permissions have reached General Availability (GA): `contactcenterinsights.feedbackLabels.create` `contactcenterinsights.feedbackLabels.delete` `contactcenterinsights.feedbackLabels.download` `contactcenterinsights.feedbackLabels.get` `contactcenterinsights.feedbackLabels.list` `contactcenterinsights.feedbackLabels.update` `contactcenterinsights.feedbackLabels.upload` `contactcenterinsights.operations.cancel` `contactcenterinsights.qaQuestions.create` `contactcenterinsights.qaQuestions.delete` `contactcenterinsights.qaQuestions.get` `contactcenterinsights.qaQuestions.list` `contactcenterinsights.qaQuestions.update` `contactcenterinsights.qaScorecardRevisions.create` `contactcenterinsights.qaScorecardRevisions.delete` `contactcenterinsights.qaScorecardRevisions.deploy` `contactcenterinsights.qaScorecardRevisions.get` `contactcenterinsights.qaScorecardRevisions.list` `contactcenterinsights.qaScorecardRevisions.tune` `contactcenterinsights.qaScorecards.create` `contactcenterinsights.qaScorecards.delete` `contactcenterinsights.qaScorecards.get` `contactcenterinsights.qaScorecards.list` `contactcenterinsights.qaScorecards.update`
Network Connectivity Center	The following permissions have been added: `networkconnectivity.hubs.queryStatus`
Network Connectivity Center	The following permissions are supported in custom roles: `networkconnectivity.hubs.queryStatus`
Network Connectivity Center	The following permissions have reached General Availability (GA): `networkconnectivity.hubs.queryStatus`

IAM changes as of 2024-10-18

Service	Description
Backup and Disaster Recovery	The following permissions have been added to the Backup and DR Compute Engine Operator role (`roles/backupdr.computeEngineOperator`): `compute.instances.createTagBinding` `compute.instances.pscInterfaceCreate` `compute.instances.setDeletionProtection` `compute.instances.updateDisplayDevice` `compute.resourcePolicies.use`
BigQuery Data Policy	The BigQuery Data Policy Admin role (`roles/bigquerydatapolicy.admin`) has reached General Availability (GA).
BigQuery Data Policy	The BigQuery Data Policy Viewer role (`roles/bigquerydatapolicy.viewer`) has reached General Availability (GA).
Database Migration Service	The following permissions have been added to the Database Migration Service Agent role (`roles/datamigration.serviceAgent`): `networkmanagement.connectivitytests.list`
Dataplex	The following permissions have been added to the Dataplex Aspect Type Owner role (`roles/dataplex.aspectTypeOwner`): `datacatalog.migrationConfig.get`
Dataplex	The following permissions have been added to the Dataplex Aspect Type User role (`roles/dataplex.aspectTypeUser`): `datacatalog.migrationConfig.get`
Dataplex	The following permissions have been added to the Dataplex Catalog Admin role (`roles/dataplex.catalogAdmin`): `datacatalog.migrationConfig.get`
Dataplex	The following permissions have been added to the Dataplex Catalog Editor role (`roles/dataplex.catalogEditor`): `datacatalog.migrationConfig.get`
Dataplex	The following permissions have been added to the Dataplex Catalog Viewer role (`roles/dataplex.catalogViewer`): `datacatalog.migrationConfig.get`
Dataplex	The following permissions have been added to the Dataplex Entry Group Owner role (`roles/dataplex.entryGroupOwner`): `datacatalog.migrationConfig.get`
Dataplex	The following permissions have been added to the Dataplex Entry Owner role (`roles/dataplex.entryOwner`): `datacatalog.migrationConfig.get`
Dataplex	The following permissions have been added to the Dataplex Entry Type Owner role (`roles/dataplex.entryTypeOwner`): `datacatalog.migrationConfig.get`
Dataplex	The following permissions have been added to the Dataplex Entry Type User role (`roles/dataplex.entryTypeUser`): `datacatalog.migrationConfig.get`
FleetEngine	The following permissions have been added to the FleetEngine Service Agent role (`roles/fleetengine.serviceAgent`): `bigquery.datasets.create` `serviceusage.services.enable`
Service Usage	The following permissions have been added to the API Keys Admin role (`roles/serviceusage.apiKeysAdmin`): `orgpolicy.policy.get`
Audit Manager	The following permissions have been added: `auditmanager.billingSettings.get`
Audit Manager	The following permissions are supported in custom roles: `auditmanager.billingSettings.get`
Blockchain Validator Manager	The following permissions have been added: `blockchainvalidatormanager.blockchainValidatorConfigs.create` `blockchainvalidatormanager.blockchainValidatorConfigs.delete` `blockchainvalidatormanager.blockchainValidatorConfigs.get` `blockchainvalidatormanager.blockchainValidatorConfigs.list` `blockchainvalidatormanager.blockchainValidatorConfigs.update` `blockchainvalidatormanager.locations.get` `blockchainvalidatormanager.locations.list` `blockchainvalidatormanager.operations.cancel` `blockchainvalidatormanager.operations.delete` `blockchainvalidatormanager.operations.get` `blockchainvalidatormanager.operations.list`
Blockchain Validator Manager	The following permissions are supported in custom roles: `blockchainvalidatormanager.blockchainValidatorConfigs.create` `blockchainvalidatormanager.blockchainValidatorConfigs.delete` `blockchainvalidatormanager.blockchainValidatorConfigs.get` `blockchainvalidatormanager.blockchainValidatorConfigs.list` `blockchainvalidatormanager.blockchainValidatorConfigs.update` `blockchainvalidatormanager.locations.get` `blockchainvalidatormanager.locations.list` `blockchainvalidatormanager.operations.cancel` `blockchainvalidatormanager.operations.delete` `blockchainvalidatormanager.operations.get` `blockchainvalidatormanager.operations.list`
Compute Engine	The following permissions have been added: `compute.networkEdgeSecurityServices.createTagBinding` `compute.networkEdgeSecurityServices.deleteTagBinding` `compute.networkEdgeSecurityServices.listEffectiveTags` `compute.networkEdgeSecurityServices.listTagBindings`
Database Migration Service	The following permissions have been added: `datamigration.objects.get` `datamigration.objects.list`
Database Migration Service	The following permissions have reached General Availability (GA): `datamigration.objects.get` `datamigration.objects.list`

IAM changes as of 2024-10-11

Service	Description
Backup and Disaster Recovery	The Backup and DR Backup Vault Accessor role (`roles/backupdr.backupvaultAccessor`) has reached General Availability (GA).
Backup and Disaster Recovery	The Backup and DR Backup Vault Admin role (`roles/backupdr.backupvaultAdmin`) has reached General Availability (GA).
Backup and Disaster Recovery	The Backup and DR Backup Vault Lister role (`roles/backupdr.backupvaultLister`) has reached General Availability (GA).
Backup and Disaster Recovery	The Backup and DR Backup Vault Viewer role (`roles/backupdr.backupvaultViewer`) has reached General Availability (GA).
Google Security Operations	The following permissions have been added to the Chronicle SOAR Service Agent role (`roles/chronicle.soarServiceAgent`): `cloudasset.assets.exportIamPolicy` `cloudasset.assets.exportResource`
Cloud Controls Partner API	The Cloud Controls Partner Support Case Service Agent role (`roles/cloudcontrolspartner.supportCaseServiceAgent`) has reached General Availability (GA).
Cloud Composer	The following permissions have been added to the Cloud Composer API Service Agent role (`roles/composer.serviceAgent`): `iam.serviceAccounts.getOpenIdToken`
Google Kubernetes Engine	The Kubernetes Engine KMS Crypto Key User role (`roles/container.cloudKmsKeyUser`) has reached General Availability (GA).
Dataflow	The following permissions have been added to the Cloud Dataflow Service Agent role (`roles/dataflow.serviceAgent`): `dns.networks.targetWithPeeringZone`
Dataproc Resource Manager	The Dataproc Resource Manager Node Service Agent role (`roles/dataprocrm.nodeServiceAgent`) has reached General Availability (GA).
Eventarc	The following permissions have been added to the Eventarc Service Agent role (`roles/eventarc.serviceAgent`): `eventarc.messageBuses.publish`
Oracle Database@Google Cloud service agent	The Oracle Database@Google Cloud Service Agent role (`roles/oci.serviceAgent`) has reached General Availability (GA).
Oracle Database@Google Cloud	The following permissions have been added to the Oracle Database@Google Cloud VM Cluster Admin role (`roles/oracledatabase.cloudVmClusterAdmin`): `oracledatabase.cloudExadataInfrastructures.list` `oracledatabase.dbServers.list` `oracledatabase.giVersions.list`
Backup and Disaster Recovery	The following permissions have reached General Availability (GA): `backupdr.backupVaults.create` `backupdr.backupVaults.delete` `backupdr.backupVaults.get` `backupdr.backupVaults.list` `backupdr.backupVaults.update` `backupdr.bvbackups.delete` `backupdr.bvbackups.get` `backupdr.bvbackups.list` `backupdr.bvbackups.restore` `backupdr.bvbackups.update` `backupdr.bvdataSources.abandonBackup` `backupdr.bvdataSources.fetchAccessToken` `backupdr.bvdataSources.finalizeBackup` `backupdr.bvdataSources.get` `backupdr.bvdataSources.initiateBackup` `backupdr.bvdataSources.list` `backupdr.bvdataSources.remove` `backupdr.bvdataSources.setInternalStatus` `backupdr.bvdataSources.update`
Cloud Controls Partner API	The following permissions have been added: `cloudcontrolspartner.customers.create` `cloudcontrolspartner.customers.delete`
Cloud Controls Partner API	The following permissions are supported in custom roles: `cloudcontrolspartner.customers.create` `cloudcontrolspartner.customers.delete`
Eventarc	The following permissions have been added: `eventarc.enrollments.create` `eventarc.enrollments.delete` `eventarc.enrollments.get` `eventarc.enrollments.getIamPolicy` `eventarc.enrollments.list` `eventarc.enrollments.setIamPolicy` `eventarc.enrollments.update` `eventarc.googleApiSources.create` `eventarc.googleApiSources.delete` `eventarc.googleApiSources.get` `eventarc.googleApiSources.getIamPolicy` `eventarc.googleApiSources.list` `eventarc.googleApiSources.setIamPolicy` `eventarc.googleApiSources.update` `eventarc.messageBuses.create` `eventarc.messageBuses.delete` `eventarc.messageBuses.get` `eventarc.messageBuses.getIamPolicy` `eventarc.messageBuses.list` `eventarc.messageBuses.publish` `eventarc.messageBuses.setIamPolicy` `eventarc.messageBuses.update` `eventarc.messageBuses.use` `eventarc.pipelines.create` `eventarc.pipelines.delete` `eventarc.pipelines.get` `eventarc.pipelines.getIamPolicy` `eventarc.pipelines.list` `eventarc.pipelines.setIamPolicy` `eventarc.pipelines.update`
Cloud Integrations	The following permissions have been added: `integrations.executions.cancel` `integrations.integrations.generateOpenApiSpec` `integrations.testCases.create` `integrations.testCases.delete` `integrations.testCases.get` `integrations.testCases.invoke` `integrations.testCases.list` `integrations.testCases.update`
Cloud Integrations	The following permissions have reached General Availability (GA): `integrations.executions.cancel` `integrations.integrations.generateOpenApiSpec` `integrations.testCases.create` `integrations.testCases.delete` `integrations.testCases.get` `integrations.testCases.invoke` `integrations.testCases.list` `integrations.testCases.update`
Cloud Logging	The following permissions have been added: `logging.sqlAlerts.create` `logging.sqlAlerts.update`
Cloud Logging	The following permissions are supported in custom roles: `logging.sqlAlerts.create` `logging.sqlAlerts.update`
Recommender	The following permissions have reached General Availability (GA): `recommender.storageBucketSoftDeleteInsights.get` `recommender.storageBucketSoftDeleteInsights.list` `recommender.storageBucketSoftDeleteInsights.update` `recommender.storageBucketSoftDeleteRecommendations.get` `recommender.storageBucketSoftDeleteRecommendations.list` `recommender.storageBucketSoftDeleteRecommendations.update`

IAM changes as of 2024-10-04

Service	Description
Cloud Billing	The following permissions have been added to the Billing Account Administrator role (`roles/billing.admin`): `consumerprocurement.licensePools.assign` `consumerprocurement.licensePools.enumerateLicensedUsers` `consumerprocurement.licensePools.get` `consumerprocurement.licensePools.unassign` `consumerprocurement.licensePools.update`
Cloud Build	The following permissions have been added to the Cloud Build Service Agent role (`roles/cloudbuild.serviceAgent`): `developerconnect.connections.get`
Dialogflow	The following permissions have been added to the Dialogflow Service Agent role (`roles/dialogflow.serviceAgent`): `connectors.operations.get` `discoveryengine.dataStores.create`
Sensitive Data Protection	The following permissions have been added to the DLP Organization Data Profiles Driver role (`roles/dlp.orgdriver`): `aiplatform.agentExamples.get` `aiplatform.agentExamples.list` `aiplatform.agents.get` `aiplatform.agents.list` `aiplatform.annotationSpecs.get` `aiplatform.annotationSpecs.list` `aiplatform.annotations.get` `aiplatform.annotations.list` `aiplatform.apps.get` `aiplatform.apps.list` `aiplatform.artifacts.get` `aiplatform.artifacts.list` `aiplatform.batchPredictionJobs.get` `aiplatform.batchPredictionJobs.list` `aiplatform.cacheConfigs.get` `aiplatform.cachedContents.get` `aiplatform.cachedContents.list` `aiplatform.consents.get` `aiplatform.contexts.get` `aiplatform.contexts.list` `aiplatform.contexts.queryContextLineageSubgraph` `aiplatform.customJobs.get` `aiplatform.customJobs.list` `aiplatform.dataItems.get` `aiplatform.dataItems.list` `aiplatform.dataLabelingJobs.get` `aiplatform.dataLabelingJobs.list` `aiplatform.datasetVersions.get` `aiplatform.datasetVersions.list` `aiplatform.datasets.get` `aiplatform.datasets.list` `aiplatform.deploymentResourcePools.get` `aiplatform.deploymentResourcePools.list` `aiplatform.deploymentResourcePools.queryDeployedModels` `aiplatform.edgeDeploymentJobs.get` `aiplatform.edgeDeploymentJobs.list` `aiplatform.edgeDeviceDebugInfo.get` `aiplatform.edgeDevices.get` `aiplatform.edgeDevices.list` `aiplatform.endpoints.get` `aiplatform.endpoints.list` `aiplatform.entityTypes.get` `aiplatform.entityTypes.list` `aiplatform.executions.get` `aiplatform.executions.list` `aiplatform.executions.queryExecutionInputsAndOutputs` `aiplatform.extensions.get` `aiplatform.extensions.list` `aiplatform.featureGroups.get` `aiplatform.featureGroups.list` `aiplatform.featureOnlineStores.get` `aiplatform.featureOnlineStores.list` `aiplatform.featureViewSyncs.get` `aiplatform.featureViewSyncs.list` `aiplatform.featureViews.fetchFeatureValues` `aiplatform.featureViews.get` `aiplatform.featureViews.list` `aiplatform.featureViews.searchNearestEntities` `aiplatform.features.get` `aiplatform.features.list` `aiplatform.featurestores.get` `aiplatform.featurestores.list` `aiplatform.humanInTheLoops.get` `aiplatform.humanInTheLoops.list` `aiplatform.hyperparameterTuningJobs.get` `aiplatform.hyperparameterTuningJobs.list` `aiplatform.indexEndpoints.get` `aiplatform.indexEndpoints.list` `aiplatform.indexEndpoints.queryVectors` `aiplatform.indexes.get` `aiplatform.indexes.list` `aiplatform.locations.get` `aiplatform.locations.list` `aiplatform.metadataSchemas.get` `aiplatform.metadataSchemas.list` `aiplatform.metadataStores.get` `aiplatform.metadataStores.list` `aiplatform.modelDeploymentMonitoringJobs.get` `aiplatform.modelDeploymentMonitoringJobs.list` `aiplatform.modelDeploymentMonitoringJobs.searchStatsAnomalies` `aiplatform.modelEvaluationSlices.get` `aiplatform.modelEvaluationSlices.list` `aiplatform.modelEvaluations.get` `aiplatform.modelEvaluations.list` `aiplatform.modelMonitoringJobs.get` `aiplatform.modelMonitoringJobs.list` `aiplatform.modelMonitors.get` `aiplatform.modelMonitors.list` `aiplatform.modelMonitors.searchModelMonitoringAlerts` `aiplatform.modelMonitors.searchModelMonitoringStats` `aiplatform.models.get` `aiplatform.models.list` `aiplatform.nasJobs.get` `aiplatform.nasJobs.list` `aiplatform.nasTrialDetails.get` `aiplatform.nasTrialDetails.list` `aiplatform.notebookExecutionJobs.get` `aiplatform.notebookExecutionJobs.list` `aiplatform.notebookRuntimeTemplates.get` `aiplatform.notebookRuntimeTemplates.list` `aiplatform.notebookRuntimes.get` `aiplatform.notebookRuntimes.list` `aiplatform.operations.list` `aiplatform.persistentResources.get` `aiplatform.persistentResources.list` `aiplatform.pipelineJobs.get` `aiplatform.pipelineJobs.list` `aiplatform.reasoningEngines.get` `aiplatform.reasoningEngines.list` `aiplatform.reasoningEngines.query` `aiplatform.schedules.get` `aiplatform.schedules.list` `aiplatform.sessions.get` `aiplatform.sessions.list` `aiplatform.specialistPools.get` `aiplatform.specialistPools.list` `aiplatform.specialistPools.update` `aiplatform.studies.get` `aiplatform.studies.list` `aiplatform.tensorboardExperiments.get` `aiplatform.tensorboardExperiments.list` `aiplatform.tensorboardRuns.get` `aiplatform.tensorboardRuns.list` `aiplatform.tensorboardTimeSeries.batchRead` `aiplatform.tensorboardTimeSeries.get` `aiplatform.tensorboardTimeSeries.list` `aiplatform.tensorboardTimeSeries.read` `aiplatform.tensorboards.get` `aiplatform.tensorboards.list` `aiplatform.trainingPipelines.get` `aiplatform.trainingPipelines.list` `aiplatform.trials.get` `aiplatform.trials.list` `aiplatform.tuningJobs.get` `aiplatform.tuningJobs.list`
Sensitive Data Protection	The following permissions have been added to the DLP Project Data Profiles Driver role (`roles/dlp.projectdriver`): `aiplatform.agentExamples.get` `aiplatform.agentExamples.list` `aiplatform.agents.get` `aiplatform.agents.list` `aiplatform.annotationSpecs.get` `aiplatform.annotationSpecs.list` `aiplatform.annotations.get` `aiplatform.annotations.list` `aiplatform.apps.get` `aiplatform.apps.list` `aiplatform.artifacts.get` `aiplatform.artifacts.list` `aiplatform.batchPredictionJobs.get` `aiplatform.batchPredictionJobs.list` `aiplatform.cacheConfigs.get` `aiplatform.cachedContents.get` `aiplatform.cachedContents.list` `aiplatform.consents.get` `aiplatform.contexts.get` `aiplatform.contexts.list` `aiplatform.contexts.queryContextLineageSubgraph` `aiplatform.customJobs.get` `aiplatform.customJobs.list` `aiplatform.dataItems.get` `aiplatform.dataItems.list` `aiplatform.dataLabelingJobs.get` `aiplatform.dataLabelingJobs.list` `aiplatform.datasetVersions.get` `aiplatform.datasetVersions.list` `aiplatform.datasets.get` `aiplatform.datasets.list` `aiplatform.deploymentResourcePools.get` `aiplatform.deploymentResourcePools.list` `aiplatform.deploymentResourcePools.queryDeployedModels` `aiplatform.edgeDeploymentJobs.get` `aiplatform.edgeDeploymentJobs.list` `aiplatform.edgeDeviceDebugInfo.get` `aiplatform.edgeDevices.get` `aiplatform.edgeDevices.list` `aiplatform.endpoints.get` `aiplatform.endpoints.list` `aiplatform.entityTypes.get` `aiplatform.entityTypes.list` `aiplatform.executions.get` `aiplatform.executions.list` `aiplatform.executions.queryExecutionInputsAndOutputs` `aiplatform.extensions.get` `aiplatform.extensions.list` `aiplatform.featureGroups.get` `aiplatform.featureGroups.list` `aiplatform.featureOnlineStores.get` `aiplatform.featureOnlineStores.list` `aiplatform.featureViewSyncs.get` `aiplatform.featureViewSyncs.list` `aiplatform.featureViews.fetchFeatureValues` `aiplatform.featureViews.get` `aiplatform.featureViews.list` `aiplatform.featureViews.searchNearestEntities` `aiplatform.features.get` `aiplatform.features.list` `aiplatform.featurestores.get` `aiplatform.featurestores.list` `aiplatform.humanInTheLoops.get` `aiplatform.humanInTheLoops.list` `aiplatform.hyperparameterTuningJobs.get` `aiplatform.hyperparameterTuningJobs.list` `aiplatform.indexEndpoints.get` `aiplatform.indexEndpoints.list` `aiplatform.indexEndpoints.queryVectors` `aiplatform.indexes.get` `aiplatform.indexes.list` `aiplatform.locations.get` `aiplatform.locations.list` `aiplatform.metadataSchemas.get` `aiplatform.metadataSchemas.list` `aiplatform.metadataStores.get` `aiplatform.metadataStores.list` `aiplatform.modelDeploymentMonitoringJobs.get` `aiplatform.modelDeploymentMonitoringJobs.list` `aiplatform.modelDeploymentMonitoringJobs.searchStatsAnomalies` `aiplatform.modelEvaluationSlices.get` `aiplatform.modelEvaluationSlices.list` `aiplatform.modelEvaluations.get` `aiplatform.modelEvaluations.list` `aiplatform.modelMonitoringJobs.get` `aiplatform.modelMonitoringJobs.list` `aiplatform.modelMonitors.get` `aiplatform.modelMonitors.list` `aiplatform.modelMonitors.searchModelMonitoringAlerts` `aiplatform.modelMonitors.searchModelMonitoringStats` `aiplatform.models.get` `aiplatform.models.list` `aiplatform.nasJobs.get` `aiplatform.nasJobs.list` `aiplatform.nasTrialDetails.get` `aiplatform.nasTrialDetails.list` `aiplatform.notebookExecutionJobs.get` `aiplatform.notebookExecutionJobs.list` `aiplatform.notebookRuntimeTemplates.get` `aiplatform.notebookRuntimeTemplates.list` `aiplatform.notebookRuntimes.get` `aiplatform.notebookRuntimes.list` `aiplatform.operations.list` `aiplatform.persistentResources.get` `aiplatform.persistentResources.list` `aiplatform.pipelineJobs.get` `aiplatform.pipelineJobs.list` `aiplatform.reasoningEngines.get` `aiplatform.reasoningEngines.list` `aiplatform.reasoningEngines.query` `aiplatform.schedules.get` `aiplatform.schedules.list` `aiplatform.sessions.get` `aiplatform.sessions.list` `aiplatform.specialistPools.get` `aiplatform.specialistPools.list` `aiplatform.specialistPools.update` `aiplatform.studies.get` `aiplatform.studies.list` `aiplatform.tensorboardExperiments.get` `aiplatform.tensorboardExperiments.list` `aiplatform.tensorboardRuns.get` `aiplatform.tensorboardRuns.list` `aiplatform.tensorboardTimeSeries.batchRead` `aiplatform.tensorboardTimeSeries.get` `aiplatform.tensorboardTimeSeries.list` `aiplatform.tensorboardTimeSeries.read` `aiplatform.tensorboards.get` `aiplatform.tensorboards.list` `aiplatform.trainingPipelines.get` `aiplatform.trainingPipelines.list` `aiplatform.trials.get` `aiplatform.trials.list` `aiplatform.tuningJobs.get` `aiplatform.tuningJobs.list`
Spanner	The following permissions have been added to the Cloud Spanner Backup Admin role (`roles/spanner.backupAdmin`): `spanner.backupSchedules.create` `spanner.backupSchedules.delete` `spanner.backupSchedules.get` `spanner.backupSchedules.list` `spanner.backupSchedules.update`
Spanner	The following permissions have been added to the Cloud Spanner Backup Writer role (`roles/spanner.backupWriter`): `spanner.backupSchedules.create` `spanner.backupSchedules.get` `spanner.backupSchedules.list`
Vertex AI	The following permissions have been added: `aiplatform.cachedContents.create` `aiplatform.cachedContents.delete` `aiplatform.cachedContents.get` `aiplatform.cachedContents.list` `aiplatform.cachedContents.update`
BigQuery Migration API	The following permissions have been added: `bigquerymigration.taskTypes.writeLogs`
BigQuery Migration API	The following permissions have reached General Availability (GA): `bigquerymigration.taskTypes.writeLogs`
Cloud SQL	The following permissions have been added: `cloudsql.backups.create` `cloudsql.backups.delete` `cloudsql.backups.get` `cloudsql.backups.list` `cloudsql.backups.update` `cloudsql.operations.get` `cloudsql.operations.list`
Cloud SQL	The following permissions are supported in custom roles: `cloudsql.backups.create` `cloudsql.backups.delete` `cloudsql.backups.get` `cloudsql.backups.list` `cloudsql.backups.update` `cloudsql.operations.get` `cloudsql.operations.list`
Cloud SQL	The following permissions have reached General Availability (GA): `cloudsql.backups.create` `cloudsql.backups.delete` `cloudsql.backups.get` `cloudsql.backups.list` `cloudsql.backups.update` `cloudsql.operations.get` `cloudsql.operations.list`
Cloud Trace	The following permissions have been added: `cloudtrace.traceScopes.create` `cloudtrace.traceScopes.delete` `cloudtrace.traceScopes.get` `cloudtrace.traceScopes.list` `cloudtrace.traceScopes.update`
Cloud Trace	The following permissions are supported in custom roles: `cloudtrace.traceScopes.create` `cloudtrace.traceScopes.delete` `cloudtrace.traceScopes.get` `cloudtrace.traceScopes.list` `cloudtrace.traceScopes.update`
Cloud Logging	The following permissions have been added: `logging.buckets.createTagBinding` `logging.buckets.deleteTagBinding` `logging.buckets.listEffectiveTags` `logging.buckets.listTagBindings`
Cloud Logging	The following permissions are supported in custom roles: `logging.buckets.createTagBinding` `logging.buckets.deleteTagBinding` `logging.buckets.listEffectiveTags` `logging.buckets.listTagBindings`
Cloud Logging	The following permissions have reached General Availability (GA): `logging.buckets.createTagBinding` `logging.buckets.deleteTagBinding` `logging.buckets.listEffectiveTags` `logging.buckets.listTagBindings`
Network Security	The following permissions have been added: `networksecurity.mirroringDeploymentGroups.create` `networksecurity.mirroringDeploymentGroups.delete` `networksecurity.mirroringDeploymentGroups.get` `networksecurity.mirroringDeploymentGroups.list` `networksecurity.mirroringDeploymentGroups.update` `networksecurity.mirroringDeploymentGroups.use` `networksecurity.mirroringDeployments.create` `networksecurity.mirroringDeployments.delete` `networksecurity.mirroringDeployments.get` `networksecurity.mirroringDeployments.list` `networksecurity.mirroringDeployments.update` `networksecurity.mirroringEndpointGroupAssociations.create` `networksecurity.mirroringEndpointGroupAssociations.delete` `networksecurity.mirroringEndpointGroupAssociations.get` `networksecurity.mirroringEndpointGroupAssociations.list` `networksecurity.mirroringEndpointGroupAssociations.update` `networksecurity.mirroringEndpointGroups.create` `networksecurity.mirroringEndpointGroups.delete` `networksecurity.mirroringEndpointGroups.get` `networksecurity.mirroringEndpointGroups.list` `networksecurity.mirroringEndpointGroups.update` `networksecurity.mirroringEndpointGroups.use`
Network Security	The following permissions are supported in custom roles: `networksecurity.mirroringDeploymentGroups.create` `networksecurity.mirroringDeploymentGroups.delete` `networksecurity.mirroringDeploymentGroups.get` `networksecurity.mirroringDeploymentGroups.list` `networksecurity.mirroringDeploymentGroups.update` `networksecurity.mirroringDeploymentGroups.use` `networksecurity.mirroringDeployments.create` `networksecurity.mirroringDeployments.delete` `networksecurity.mirroringDeployments.get` `networksecurity.mirroringDeployments.list` `networksecurity.mirroringDeployments.update` `networksecurity.mirroringEndpointGroupAssociations.create` `networksecurity.mirroringEndpointGroupAssociations.delete` `networksecurity.mirroringEndpointGroupAssociations.get` `networksecurity.mirroringEndpointGroupAssociations.list` `networksecurity.mirroringEndpointGroupAssociations.update` `networksecurity.mirroringEndpointGroups.create` `networksecurity.mirroringEndpointGroups.delete` `networksecurity.mirroringEndpointGroups.get` `networksecurity.mirroringEndpointGroups.list` `networksecurity.mirroringEndpointGroups.update` `networksecurity.mirroringEndpointGroups.use`
Cloud Storage	The following permissions have been added: `storage.folders.create` `storage.folders.delete` `storage.folders.get` `storage.folders.list` `storage.folders.rename`
Cloud Storage	The following permissions have reached General Availability (GA): `storage.folders.create` `storage.folders.delete` `storage.folders.get` `storage.folders.list` `storage.folders.rename`
Google Cloud VMware Engine	The following permissions have been added: `vmwareengine.projectState.get`
Google Cloud VMware Engine	The following permissions are supported in custom roles: `vmwareengine.projectState.get`
Google Cloud VMware Engine	The following permissions have reached General Availability (GA): `vmwareengine.projectState.get`

IAM changes as of 2024-09-27

Service	Description
Vertex AI	The following permissions have been added to the Vertex AI RAG Data Service Agent role (`roles/aiplatform.ragServiceAgent`): `aiplatform.indexEndpoints.create` `aiplatform.indexEndpoints.delete` `aiplatform.indexEndpoints.deploy` `aiplatform.indexEndpoints.get` `aiplatform.indexEndpoints.list` `aiplatform.indexEndpoints.queryVectors` `aiplatform.indexEndpoints.undeploy` `aiplatform.indexEndpoints.update` `aiplatform.indexes.create` `aiplatform.indexes.delete` `aiplatform.indexes.get` `aiplatform.indexes.list` `aiplatform.indexes.update`
Vertex AI	The following permissions have been added to the Vertex AI Service Agent role (`roles/aiplatform.serviceAgent`): `iam.serviceAccounts.getOpenIdToken`
Cloud Key Management Service	The Cloud KMS Autokey Admin role (`roles/cloudkms.autokeyAdmin`) has reached General Availability (GA).
Cloud Key Management Service	The Cloud KMS Autokey User role (`roles/cloudkms.autokeyUser`) has reached General Availability (GA).
Cloud Commerce Consumer Procurement	The Consumer Procurement License Pool Editor role (`roles/consumerprocurement.licensePoolEditor`) has been added with the following permissions: `consumerprocurement.googleapis.com/licensePools.assign` `consumerprocurement.googleapis.com/licensePools.enumerateLicensedUsers` `consumerprocurement.googleapis.com/licensePools.get` `consumerprocurement.googleapis.com/licensePools.unassign` `consumerprocurement.googleapis.com/licensePools.update` `consumerprocurement.licensePools.assign` `consumerprocurement.licensePools.enumerateLicensedUsers` `consumerprocurement.licensePools.get` `consumerprocurement.licensePools.unassign` `consumerprocurement.licensePools.update`
Cloud Commerce Consumer Procurement	The Consumer Procurement License Pool Viewer role (`roles/consumerprocurement.licensePoolViewer`) has been added with the following permissions: `consumerprocurement.googleapis.com/licensePools.enumerateLicensedUsers` `consumerprocurement.googleapis.com/licensePools.get` `consumerprocurement.licensePools.enumerateLicensedUsers` `consumerprocurement.licensePools.get`
Cloud Commerce Consumer Procurement	The following permissions have been added to the Consumer Procurement Order Viewer role (`roles/consumerprocurement.orderViewer`): `consumerprocurement.licensePools.enumerateLicensedUsers` `consumerprocurement.licensePools.get`
Cloud Commerce Consumer Procurement	The following permissions have been added to the Consumer Procurement Viewer role (`roles/consumerprocurement.procurementViewer`): `consumerprocurement.licensePools.enumerateLicensedUsers` `consumerprocurement.licensePools.get`
Conversational Insights	The following permissions have been added to the Contact Center AI Insights editor role (`roles/contactcenterinsights.editor`): `contactcenterinsights.operations.cancel`
Database Migration Service	The following permissions have been added to the Database Migration Service Agent role (`roles/datamigration.serviceAgent`): `cloudsql.instances.executeSql`
Dialogflow	The following permissions have been added to the Dialogflow Service Agent role (`roles/dialogflow.serviceAgent`): `connectors.actions.execute` `connectors.actions.list` `connectors.connections.executeSqlQuery` `connectors.connections.generateOpenAPISpec` `connectors.connections.get` `connectors.entities.create` `connectors.entities.delete` `connectors.entities.deleteEntitiesWithConditions` `connectors.entities.get` `connectors.entities.list` `connectors.entities.update` `connectors.entities.updateEntitiesWithConditions` `connectors.entityTypes.list` `connectors.versions.get`
Oracle Database@Google Cloud	The Oracle Database@Google Cloud admin role (`roles/oracledatabase.admin`) has reached General Availability (GA).
Oracle Database@Google Cloud	The Oracle Database@Google Cloud Autonomous Database Admin role (`roles/oracledatabase.autonomousDatabaseAdmin`) has reached General Availability (GA).
Oracle Database@Google Cloud	The Oracle Database@Google Cloud Autonomous Database Viewer role (`roles/oracledatabase.autonomousDatabaseViewer`) has reached General Availability (GA).
Oracle Database@Google Cloud	The Oracle Database@Google Cloud Exadata Infrastructure Admin role (`roles/oracledatabase.cloudExadataInfrastructureAdmin`) has reached General Availability (GA).
Oracle Database@Google Cloud	The Oracle Database@Google Cloud Exadata Infrastructure Viewer role (`roles/oracledatabase.cloudExadataInfrastructureViewer`) has reached General Availability (GA).
Oracle Database@Google Cloud	The Oracle Database@Google Cloud VM Cluster Admin role (`roles/oracledatabase.cloudVmClusterAdmin`) has reached General Availability (GA).
Oracle Database@Google Cloud	The Oracle Database@Google Cloud VM Cluster Viewer role (`roles/oracledatabase.cloudVmClusterViewer`) has reached General Availability (GA).
Oracle Database@Google Cloud	The Oracle Database@Google Cloud viewer role (`roles/oracledatabase.viewer`) has reached General Availability (GA).
Apigee	The following permissions have been added: `apigee.securityProfilesV2.create` `apigee.securityProfilesV2.delete` `apigee.securityProfilesV2.get` `apigee.securityProfilesV2.list` `apigee.securityProfilesV2.update`
Apigee	The following permissions are supported in custom roles: `apigee.securityProfilesV2.create` `apigee.securityProfilesV2.delete` `apigee.securityProfilesV2.get` `apigee.securityProfilesV2.list` `apigee.securityProfilesV2.update`
Apigee	The following permissions have reached General Availability (GA): `apigee.securityProfilesV2.create` `apigee.securityProfilesV2.delete` `apigee.securityProfilesV2.get` `apigee.securityProfilesV2.list` `apigee.securityProfilesV2.update`
Artifact Registry	The following permissions have been added: `artifactregistry.rules.create` `artifactregistry.rules.delete` `artifactregistry.rules.get` `artifactregistry.rules.list` `artifactregistry.rules.update`
Artifact Registry	The following permissions have reached General Availability (GA): `artifactregistry.rules.create` `artifactregistry.rules.delete` `artifactregistry.rules.get` `artifactregistry.rules.list` `artifactregistry.rules.update`
Backup and Disaster Recovery	The following permissions have been added: `backupdr.backupPlanAssociations.createForComputeInstance` `backupdr.backupPlanAssociations.deleteForComputeInstance` `backupdr.backupPlanAssociations.triggerBackupForComputeInstance` `backupdr.backupPlans.useForComputeInstance`
Cloud Key Management Service	The following permissions have reached General Availability (GA): `cloudkms.autokeyConfigs.get` `cloudkms.autokeyConfigs.update` `cloudkms.keyHandles.create` `cloudkms.keyHandles.get` `cloudkms.keyHandles.list` `cloudkms.projects.showEffectiveAutokeyConfig`
Compute Engine	The following permissions have been added: `compute.addresses.createTagBinding` `compute.addresses.deleteTagBinding` `compute.addresses.listEffectiveTags` `compute.addresses.listTagBindings` `compute.globalAddresses.createTagBinding` `compute.globalAddresses.deleteTagBinding` `compute.globalAddresses.listEffectiveTags` `compute.globalAddresses.listTagBindings` `compute.networkAttachments.createTagBinding` `compute.networkAttachments.deleteTagBinding` `compute.networkAttachments.listEffectiveTags` `compute.networkAttachments.listTagBindings` `compute.publicDelegatedPrefixes.createTagBinding` `compute.publicDelegatedPrefixes.deleteTagBinding` `compute.publicDelegatedPrefixes.listEffectiveTags` `compute.publicDelegatedPrefixes.listTagBindings` `compute.serviceAttachments.createTagBinding` `compute.serviceAttachments.deleteTagBinding` `compute.serviceAttachments.listEffectiveTags` `compute.serviceAttachments.listTagBindings`
Compute Engine	The following permissions have reached General Availability (GA): `compute.addresses.createTagBinding` `compute.addresses.deleteTagBinding` `compute.addresses.listEffectiveTags` `compute.addresses.listTagBindings` `compute.globalAddresses.createTagBinding` `compute.globalAddresses.deleteTagBinding` `compute.globalAddresses.listEffectiveTags` `compute.globalAddresses.listTagBindings` `compute.networkAttachments.createTagBinding` `compute.networkAttachments.deleteTagBinding` `compute.networkAttachments.listEffectiveTags` `compute.networkAttachments.listTagBindings` `compute.publicDelegatedPrefixes.createTagBinding` `compute.publicDelegatedPrefixes.deleteTagBinding` `compute.publicDelegatedPrefixes.listEffectiveTags` `compute.publicDelegatedPrefixes.listTagBindings` `compute.serviceAttachments.createTagBinding` `compute.serviceAttachments.deleteTagBinding` `compute.serviceAttachments.listEffectiveTags` `compute.serviceAttachments.listTagBindings`
Connectors	The following permissions have been added: `connectors.connections.generateOpenAPISpec`
Connectors	The following permissions are supported in custom roles: `connectors.connections.generateOpenAPISpec`
Connectors	The following permissions have reached General Availability (GA): `connectors.connections.generateOpenAPISpec`
Cloud Commerce Consumer Procurement	The following permissions have been added: `consumerprocurement.licensePools.assign` `consumerprocurement.licensePools.enumerateLicensedUsers` `consumerprocurement.licensePools.get` `consumerprocurement.licensePools.unassign` `consumerprocurement.licensePools.update`
Cloud Commerce Consumer Procurement	The following permissions are supported in custom roles: `consumerprocurement.licensePools.assign` `consumerprocurement.licensePools.enumerateLicensedUsers` `consumerprocurement.licensePools.get` `consumerprocurement.licensePools.unassign` `consumerprocurement.licensePools.update`
Cloud Commerce Consumer Procurement	The following permissions have reached General Availability (GA): `consumerprocurement.licensePools.assign` `consumerprocurement.licensePools.enumerateLicensedUsers` `consumerprocurement.licensePools.get` `consumerprocurement.licensePools.unassign` `consumerprocurement.licensePools.update`
Conversational Insights	The following permissions have been added: `contactcenterinsights.operations.cancel`
Dataplex	The following permissions have been added: `dataplex.entryGroups.export`
Dataplex	The following permissions are supported in custom roles: `dataplex.entryGroups.export`
Dataproc	The following permissions have been added: `dataproc.batches.sparkApplicationRead` `dataproc.batches.sparkApplicationWrite` `dataproc.sessions.sparkApplicationRead` `dataproc.sessions.sparkApplicationWrite`
Dataproc	The following permissions are supported in custom roles: `dataproc.batches.sparkApplicationRead` `dataproc.batches.sparkApplicationWrite` `dataproc.sessions.sparkApplicationRead` `dataproc.sessions.sparkApplicationWrite`
Dataproc	The following permissions have reached General Availability (GA): `dataproc.batches.sparkApplicationRead` `dataproc.batches.sparkApplicationWrite` `dataproc.sessions.sparkApplicationRead` `dataproc.sessions.sparkApplicationWrite`
Google Cloud NetApp Volumes	The following permissions have been added: `netapp.replications.establishPeering` `netapp.replications.sync`
Google Cloud NetApp Volumes	The following permissions are supported in custom roles: `netapp.replications.establishPeering` `netapp.replications.sync`
Google Cloud Observability	The following permissions are supported in custom roles: `observability.scopes.get` `observability.scopes.update`
Oracle Database@Google Cloud	The following permissions have been added: `oracledatabase.autonomousDatabaseBackups.create` `oracledatabase.autonomousDatabaseBackups.delete` `oracledatabase.autonomousDatabaseBackups.get` `oracledatabase.autonomousDatabaseBackups.list` `oracledatabase.autonomousDatabaseCharacterSets.list` `oracledatabase.autonomousDatabases.create` `oracledatabase.autonomousDatabases.delete` `oracledatabase.autonomousDatabases.generateWallet` `oracledatabase.autonomousDatabases.get` `oracledatabase.autonomousDatabases.list` `oracledatabase.autonomousDatabases.restore` `oracledatabase.autonomousDbVersions.list` `oracledatabase.cloudExadataInfrastructures.create` `oracledatabase.cloudExadataInfrastructures.delete` `oracledatabase.cloudExadataInfrastructures.get` `oracledatabase.cloudExadataInfrastructures.list` `oracledatabase.cloudExadataInfrastructures.update` `oracledatabase.cloudExadataInfrastructures.use` `oracledatabase.cloudVmClusters.create` `oracledatabase.cloudVmClusters.delete` `oracledatabase.cloudVmClusters.get` `oracledatabase.cloudVmClusters.list` `oracledatabase.cloudVmClusters.update` `oracledatabase.dbNodes.list` `oracledatabase.dbServers.list` `oracledatabase.dbSystemShapes.list` `oracledatabase.entitlements.list` `oracledatabase.giVersions.list` `oracledatabase.locations.get` `oracledatabase.locations.list` `oracledatabase.operations.cancel` `oracledatabase.operations.delete` `oracledatabase.operations.get` `oracledatabase.operations.list`
Oracle Database@Google Cloud	The following permissions are supported in custom roles: `oracledatabase.autonomousDatabaseBackups.create` `oracledatabase.autonomousDatabaseBackups.delete` `oracledatabase.autonomousDatabaseBackups.get` `oracledatabase.autonomousDatabaseBackups.list` `oracledatabase.autonomousDatabaseCharacterSets.list` `oracledatabase.autonomousDatabases.create` `oracledatabase.autonomousDatabases.delete` `oracledatabase.autonomousDatabases.generateWallet` `oracledatabase.autonomousDatabases.get` `oracledatabase.autonomousDatabases.list` `oracledatabase.autonomousDatabases.restore` `oracledatabase.autonomousDbVersions.list` `oracledatabase.cloudExadataInfrastructures.create` `oracledatabase.cloudExadataInfrastructures.delete` `oracledatabase.cloudExadataInfrastructures.get` `oracledatabase.cloudExadataInfrastructures.list` `oracledatabase.cloudExadataInfrastructures.update` `oracledatabase.cloudExadataInfrastructures.use` `oracledatabase.cloudVmClusters.create` `oracledatabase.cloudVmClusters.delete` `oracledatabase.cloudVmClusters.get` `oracledatabase.cloudVmClusters.list` `oracledatabase.cloudVmClusters.update` `oracledatabase.dbNodes.list` `oracledatabase.dbServers.list` `oracledatabase.dbSystemShapes.list` `oracledatabase.entitlements.list` `oracledatabase.giVersions.list` `oracledatabase.locations.get` `oracledatabase.locations.list` `oracledatabase.operations.cancel` `oracledatabase.operations.delete` `oracledatabase.operations.get` `oracledatabase.operations.list`
Oracle Database@Google Cloud	The following permissions have reached General Availability (GA): `oracledatabase.autonomousDatabaseBackups.create` `oracledatabase.autonomousDatabaseBackups.delete` `oracledatabase.autonomousDatabaseBackups.get` `oracledatabase.autonomousDatabaseBackups.list` `oracledatabase.autonomousDatabaseCharacterSets.list` `oracledatabase.autonomousDatabases.create` `oracledatabase.autonomousDatabases.delete` `oracledatabase.autonomousDatabases.generateWallet` `oracledatabase.autonomousDatabases.get` `oracledatabase.autonomousDatabases.list` `oracledatabase.autonomousDatabases.restore` `oracledatabase.autonomousDbVersions.list` `oracledatabase.cloudExadataInfrastructures.create` `oracledatabase.cloudExadataInfrastructures.delete` `oracledatabase.cloudExadataInfrastructures.get` `oracledatabase.cloudExadataInfrastructures.list` `oracledatabase.cloudExadataInfrastructures.update` `oracledatabase.cloudExadataInfrastructures.use` `oracledatabase.cloudVmClusters.create` `oracledatabase.cloudVmClusters.delete` `oracledatabase.cloudVmClusters.get` `oracledatabase.cloudVmClusters.list` `oracledatabase.cloudVmClusters.update` `oracledatabase.dbNodes.list` `oracledatabase.dbServers.list` `oracledatabase.dbSystemShapes.list` `oracledatabase.entitlements.list` `oracledatabase.giVersions.list` `oracledatabase.locations.get` `oracledatabase.locations.list` `oracledatabase.operations.cancel` `oracledatabase.operations.delete` `oracledatabase.operations.get` `oracledatabase.operations.list`
Recommender	The following permissions have been added: `recommender.storageBucketSoftDeleteInsights.get` `recommender.storageBucketSoftDeleteInsights.list` `recommender.storageBucketSoftDeleteInsights.update` `recommender.storageBucketSoftDeleteRecommendations.get` `recommender.storageBucketSoftDeleteRecommendations.list` `recommender.storageBucketSoftDeleteRecommendations.update`
Recommender	The following permissions are supported in custom roles: `recommender.storageBucketSoftDeleteInsights.get` `recommender.storageBucketSoftDeleteInsights.list` `recommender.storageBucketSoftDeleteInsights.update` `recommender.storageBucketSoftDeleteRecommendations.get` `recommender.storageBucketSoftDeleteRecommendations.list` `recommender.storageBucketSoftDeleteRecommendations.update`
Cloud Storage	The following permissions have been added: `storage.managementHubs.get` `storage.managementHubs.update`
Cloud Storage	The following permissions are supported in custom roles: `storage.managementHubs.get` `storage.managementHubs.update`

IAM changes as of 2024-09-20

Service	Description
Vertex AI	The Vertex AI Batch Prediction Service Agent role (`roles/aiplatform.batchPredictionServiceAgent`) has reached General Availability (GA).
Google Security Operations	The following permissions have been added to the Chronicle API Admin role (`roles/chronicle.admin`): `chronicle.dataTableOperationErrors.get`
Google Security Operations	The following permissions have been added to the Chronicle API Editor role (`roles/chronicle.editor`): `chronicle.dataTableOperationErrors.get`
Google Security Operations	The following permissions have been added to the Chronicle API Viewer role (`roles/chronicle.viewer`): `chronicle.dataTableOperationErrors.get`
Cloud SQL	The Cloud SQL Studio User role (`roles/cloudsql.studioUser`) has reached General Availability (GA).
Cloud Trace	The following permissions have been added to the Cloud Trace Admin role (`roles/cloudtrace.admin`): `observability.scopes.get`
Cloud Trace	The following permissions have been added to the Cloud Trace User role (`roles/cloudtrace.user`): `observability.scopes.get`
Firebase	The following permissions have been added to the Firebase Develop Viewer role (`roles/firebase.developViewer`): `apikeys.keys.get` `apikeys.keys.list` `serviceusage.apiKeys.get` `serviceusage.apiKeys.list`
Firebase	The following permissions have been added to the Firebase Grow Admin role (`roles/firebase.growthAdmin`): `apikeys.keys.get` `apikeys.keys.list` `serviceusage.apiKeys.get` `serviceusage.apiKeys.list`
Firebase	The following permissions have been added to the Firebase Grow Viewer role (`roles/firebase.growthViewer`): `apikeys.keys.get` `apikeys.keys.list` `serviceusage.apiKeys.get` `serviceusage.apiKeys.list`
Firebase	The following permissions have been added to the Firebase Quality Admin role (`roles/firebase.qualityAdmin`): `apikeys.keys.get` `apikeys.keys.list` `serviceusage.apiKeys.get` `serviceusage.apiKeys.list`
Firebase	The following permissions have been added to the Firebase Quality Viewer role (`roles/firebase.qualityViewer`): `apikeys.keys.get` `apikeys.keys.list` `serviceusage.apiKeys.get` `serviceusage.apiKeys.list`
Firebase	The following permissions have been added to the Firebase Viewer role (`roles/firebase.viewer`): `apikeys.keys.get` `apikeys.keys.list` `serviceusage.apiKeys.get` `serviceusage.apiKeys.list`
Dataproc Metastore	The following permissions have been added to the Dataproc Metastore Service Agent role (`roles/metastore.serviceAgent`): `metastore.federations.use`
Artifact Registry	The following permissions have been added: `artifactregistry.attachments.create` `artifactregistry.attachments.delete` `artifactregistry.attachments.get` `artifactregistry.attachments.list` `artifactregistry.files.upload`
Artifact Registry	The following permissions have reached General Availability (GA): `artifactregistry.attachments.create` `artifactregistry.attachments.delete` `artifactregistry.attachments.get` `artifactregistry.attachments.list` `artifactregistry.files.upload`
Assured Workloads	The following permissions have been added: `assuredworkloads.updates.list` `assuredworkloads.updates.update`
Assured Workloads	The following permissions have reached General Availability (GA): `assuredworkloads.updates.list` `assuredworkloads.updates.update`
BigQuery	The following permissions are supported in custom roles: `bigquery.config.get` `bigquery.config.update`
Google Security Operations	The following permissions have been added: `chronicle.dataTableOperationErrors.get`
Google Security Operations	The following permissions are supported in custom roles: `chronicle.dataTableOperationErrors.get`
Google Security Operations Service Management	The following permissions have been added: `chroniclesm.gcpLogFlowFilters.get` `chroniclesm.gcpLogFlowFilters.update`
Google Security Operations Service Management	The following permissions have reached General Availability (GA): `chroniclesm.gcpLogFlowFilters.get` `chroniclesm.gcpLogFlowFilters.update`
Cloud SQL	The following permissions have been added: `cloudsql.instances.addServerCertificate` `cloudsql.instances.listServerCertificates` `cloudsql.instances.rotateServerCertificate`
Cloud SQL	The following permissions are supported in custom roles: `cloudsql.instances.addServerCertificate` `cloudsql.instances.listServerCertificates` `cloudsql.instances.rotateServerCertificate`
Cloud SQL	The following permissions have reached General Availability (GA): `cloudsql.instances.addServerCertificate` `cloudsql.instances.listServerCertificates` `cloudsql.instances.rotateServerCertificate`
Conversational Insights	The following permissions have been added: `contactcenterinsights.analysisRules.create` `contactcenterinsights.analysisRules.delete` `contactcenterinsights.analysisRules.get` `contactcenterinsights.analysisRules.list` `contactcenterinsights.analysisRules.update`
Conversational Insights	The following permissions are supported in custom roles: `contactcenterinsights.analysisRules.create` `contactcenterinsights.analysisRules.delete` `contactcenterinsights.analysisRules.get` `contactcenterinsights.analysisRules.list` `contactcenterinsights.analysisRules.update`
Security Command Center	The following permissions have been added: `securitycenter.billingtier.update`
Security Command Center	The following permissions are supported in custom roles: `securitycenter.billingtier.update`
Security Command Center	The following permissions have reached General Availability (GA): `securitycenter.billingtier.update`

IAM changes as of 2024-09-13

Service	Description
Apigee	The Apigee Deployment Invoker role (`roles/apigee.deploymentInvoker`) has reached General Availability (GA).
Cloud Key Management Service	The following permissions have been added to the Cloud KMS Autokey User role (`roles/cloudkms.autokeyUser`): `cloudkms.operations.get`
Data Catalog	The following permissions have been added to the DataCatalog Glossary Owner role (`roles/datacatalog.glossaryOwner`): `dataplex.projects.search`
Data Catalog	The following permissions have been added to the DataCatalog Glossary User role (`roles/datacatalog.glossaryUser`): `dataplex.projects.search`
Dialogflow	The following permissions have been added to the Dialogflow Service Agent role (`roles/dialogflow.serviceAgent`): `discoveryengine.collections.list` `discoveryengine.dataStores.list` `discoveryengine.engines.create` `discoveryengine.engines.update`
Google Cloud Managed Service for Apache Kafka	The following permissions have been added to the Managed Kafka Service Agent role (`roles/managedkafka.serviceAgent`): `privateca.caPools.get`
Cloud Run	The following permissions have been removed from the Cloud Run Service Agent role (`roles/run.serviceAgent`): `compute.regionOperations.get` `compute.zoneOperations.get`
SecLM	The following permissions have been added to the SecLM Service Agent role (`roles/seclm.serviceAgent`): `aiplatform.endpoints.predict`
SecLM	The following permissions have been removed from the SecLM Service Agent role (`roles/seclm.serviceAgent`): `storage.buckets.get` `storage.buckets.list` `storage.objects.get` `storage.objects.list`
Cloud Run	The following permissions have been removed from the Cloud Run Service Agent role (`roles/serverless.serviceAgent`): `compute.regionOperations.get` `compute.zoneOperations.get`
Apigee	The following permissions have been added: `apigee.deployments.getIamPolicy` `apigee.deployments.invoke` `apigee.deployments.setIamPolicy`
Apigee	The following permissions are supported in custom roles: `apigee.deployments.getIamPolicy` `apigee.deployments.invoke` `apigee.deployments.setIamPolicy`
Apigee	The following permissions have reached General Availability (GA): `apigee.deployments.getIamPolicy` `apigee.deployments.invoke` `apigee.deployments.setIamPolicy`
Compute Engine	The following permissions have been added: `compute.instanceGroups.createTagBinding` `compute.instanceGroups.deleteTagBinding` `compute.instanceGroups.listEffectiveTags` `compute.instanceGroups.listTagBindings` `compute.packetMirrorings.createTagBinding` `compute.packetMirrorings.deleteTagBinding` `compute.packetMirrorings.listEffectiveTags` `compute.packetMirrorings.listTagBindings` `compute.regionSslPolicies.createTagBinding` `compute.regionSslPolicies.deleteTagBinding` `compute.regionSslPolicies.listEffectiveTags` `compute.regionSslPolicies.listTagBindings` `compute.regionTargetTcpProxies.createTagBinding` `compute.regionTargetTcpProxies.deleteTagBinding` `compute.regionTargetTcpProxies.listEffectiveTags` `compute.regionTargetTcpProxies.listTagBindings` `compute.targetGrpcProxies.createTagBinding` `compute.targetGrpcProxies.deleteTagBinding` `compute.targetGrpcProxies.listEffectiveTags` `compute.targetGrpcProxies.listTagBindings`
Compute Engine	The following permissions have reached General Availability (GA): `compute.instanceGroups.createTagBinding` `compute.instanceGroups.deleteTagBinding` `compute.instanceGroups.listEffectiveTags` `compute.instanceGroups.listTagBindings` `compute.packetMirrorings.createTagBinding` `compute.packetMirrorings.deleteTagBinding` `compute.packetMirrorings.listEffectiveTags` `compute.packetMirrorings.listTagBindings` `compute.regionSslPolicies.createTagBinding` `compute.regionSslPolicies.deleteTagBinding` `compute.regionSslPolicies.listEffectiveTags` `compute.regionSslPolicies.listTagBindings` `compute.regionTargetTcpProxies.createTagBinding` `compute.regionTargetTcpProxies.deleteTagBinding` `compute.regionTargetTcpProxies.listEffectiveTags` `compute.regionTargetTcpProxies.listTagBindings` `compute.targetGrpcProxies.createTagBinding` `compute.targetGrpcProxies.deleteTagBinding` `compute.targetGrpcProxies.listEffectiveTags` `compute.targetGrpcProxies.listTagBindings`

IAM changes as of 2024-09-06

Service	Description
Vertex AI	The following permissions have been added to the Vertex AI Tuning Service Agent role (`roles/aiplatform.tuningServiceAgent`): `aiplatform.tuningJobs.cancel` `aiplatform.tuningJobs.create` `aiplatform.tuningJobs.delete` `aiplatform.tuningJobs.get` `aiplatform.tuningJobs.list` `aiplatform.tuningJobs.vertexTune`
Compute Engine	The following permissions have been added to the Compute Load Balancer Services User role (`roles/compute.loadBalancerServiceUser`): `compute.backendBuckets.get` `compute.backendBuckets.list` `compute.backendBuckets.listEffectiveTags` `compute.backendBuckets.listTagBindings` `compute.backendBuckets.use`
Discovery Engine	The following permissions have been added to the Discovery Engine Admin role (`roles/discoveryengine.admin`): `discoveryengine.documents.batchGetDocumentsMetadata`
Discovery Engine	The following permissions have been added to the Discovery Engine Editor role (`roles/discoveryengine.editor`): `discoveryengine.documents.batchGetDocumentsMetadata`
Discovery Engine	The following permissions have been added to the Discovery Engine Viewer role (`roles/discoveryengine.viewer`): `discoveryengine.documents.batchGetDocumentsMetadata`
Distributed Cloud Edge Container	The following permissions have been added to the Edge Container Cluster Service Agent role (`roles/edgecontainer.clusterServiceAgent`): `serviceusage.services.enable`
Cloud Run	The following permissions have been added to the Cloud Run Service Agent role (`roles/run.serviceAgent`): `compute.regionOperations.get` `compute.zoneOperations.get`
SecLM	The following permissions have been added to the SecLM Service Agent role (`roles/seclm.serviceAgent`): `aiplatform.locations.get` `discoveryengine.servingConfigs.search`
Cloud Run	The following permissions have been added to the Cloud Run Service Agent role (`roles/serverless.serviceAgent`): `compute.regionOperations.get` `compute.zoneOperations.get`
Basic Role	The following permissions have been added to the Viewer role (`roles/viewer`): `cloudaicompanion.companions.generateChat` `cloudaicompanion.companions.generateCode` `cloudaicompanion.instances.completeCode` `cloudaicompanion.instances.completeTask` `cloudaicompanion.instances.generateCode` `cloudaicompanion.instances.generateText`
Compute Engine	The following permissions are supported in custom roles: `compute.backendBuckets.use`
Discovery Engine	The following permissions have been added: `discoveryengine.documents.batchGetDocumentsMetadata`
Discovery Engine	The following permissions are supported in custom roles: `discoveryengine.documents.batchGetDocumentsMetadata`
Google Cloud NetApp Volumes	The following permissions have been added: `netapp.locations.get` `netapp.locations.list` `netapp.operations.cancel` `netapp.operations.delete` `netapp.operations.get` `netapp.operations.list` `netapp.storagePools.switch`
Google Cloud NetApp Volumes	The following permissions are supported in custom roles: `netapp.locations.get` `netapp.locations.list` `netapp.operations.cancel` `netapp.operations.delete` `netapp.operations.get` `netapp.operations.list` `netapp.storagePools.switch`
Spanner	The following permissions have been added: `spanner.backupSchedules.create` `spanner.backupSchedules.delete` `spanner.backupSchedules.get` `spanner.backupSchedules.getIamPolicy` `spanner.backupSchedules.list` `spanner.backupSchedules.setIamPolicy` `spanner.backupSchedules.update`
Spanner	The following permissions are supported in custom roles: `spanner.backupSchedules.create` `spanner.backupSchedules.delete` `spanner.backupSchedules.get` `spanner.backupSchedules.getIamPolicy` `spanner.backupSchedules.list` `spanner.backupSchedules.setIamPolicy` `spanner.backupSchedules.update`
Spanner	The following permissions have reached General Availability (GA): `spanner.backupSchedules.create` `spanner.backupSchedules.delete` `spanner.backupSchedules.get` `spanner.backupSchedules.getIamPolicy` `spanner.backupSchedules.list` `spanner.backupSchedules.setIamPolicy` `spanner.backupSchedules.update`

IAM changes as of 2024-08-30

Service	Description
Datastore	The Cloud Datastore Bulk Admin role (`roles/datastore.bulkAdmin`) has reached General Availability (GA).
Distributed Cloud Edge Container	The following permissions have been added to the Edge Container Cluster Service Agent role (`roles/edgecontainer.clusterServiceAgent`): `cloudnotifications.activities.list` `kubernetesmetadata.metadata.config` `kubernetesmetadata.metadata.publish` `kubernetesmetadata.metadata.snapshot` `monitoring.alertPolicies.get` `monitoring.alertPolicies.list` `monitoring.groups.get` `monitoring.groups.list` `monitoring.uptimeCheckConfigs.list` `opsconfigmonitoring.resourceMetadata.list` `stackdriver.projects.get` `stackdriver.resourceMetadata.list`
Distributed Cloud Edge Container	The following permissions have been added to the Edge Container Service Agent role (`roles/edgecontainer.serviceAgent`): `gkehub.memberships.list`
Identity and Access Management	The following permissions have been added to the Principal Access Boundary Policy Admin role (`roles/iam.principalAccessBoundaryAdmin`): `cloudasset.assets.listResource`
BigQuery Engine for Apache Flink	The Managed Flink Service Agent role (`roles/managedflink.serviceAgent`) has reached General Availability (GA).
Remoting Cloud	The Remoting Cloud Service Agent role (`roles/remotingcloud.serviceAgent`) has reached General Availability (GA).
BigQuery	The following permissions have been added: `bigquery.dataPolicies.getRawData`
BigQuery	The following permissions are supported in custom roles: `bigquery.dataPolicies.getRawData`
Gemini for Google Cloud API	The following permissions have been added: `cloudaicompanion.codeRepositoryIndexes.create` `cloudaicompanion.codeRepositoryIndexes.delete` `cloudaicompanion.codeRepositoryIndexes.get` `cloudaicompanion.codeRepositoryIndexes.list` `cloudaicompanion.codeRepositoryIndexes.update` `cloudaicompanion.operations.cancel` `cloudaicompanion.operations.delete` `cloudaicompanion.operations.get` `cloudaicompanion.operations.list` `cloudaicompanion.repositoryGroups.create` `cloudaicompanion.repositoryGroups.delete` `cloudaicompanion.repositoryGroups.get` `cloudaicompanion.repositoryGroups.getIamPolicy` `cloudaicompanion.repositoryGroups.list` `cloudaicompanion.repositoryGroups.setIamPolicy` `cloudaicompanion.repositoryGroups.update` `cloudaicompanion.repositoryGroups.use`
Gemini for Google Cloud API	The following permissions are supported in custom roles: `cloudaicompanion.codeRepositoryIndexes.create` `cloudaicompanion.codeRepositoryIndexes.delete` `cloudaicompanion.codeRepositoryIndexes.get` `cloudaicompanion.codeRepositoryIndexes.list` `cloudaicompanion.codeRepositoryIndexes.update` `cloudaicompanion.operations.cancel` `cloudaicompanion.operations.delete` `cloudaicompanion.operations.get` `cloudaicompanion.operations.list` `cloudaicompanion.repositoryGroups.create` `cloudaicompanion.repositoryGroups.delete` `cloudaicompanion.repositoryGroups.get` `cloudaicompanion.repositoryGroups.getIamPolicy` `cloudaicompanion.repositoryGroups.list` `cloudaicompanion.repositoryGroups.update`
Datastore	The following permissions have been added: `datastore.databases.bulkDelete`
Datastore	The following permissions have reached General Availability (GA): `datastore.databases.bulkDelete`
BigQuery Engine for Apache Flink	The following permissions have been added: `managedflink.sessions.create` `managedflink.sessions.delete` `managedflink.sessions.get` `managedflink.sessions.list` `managedflink.sessions.update`
BigQuery Engine for Apache Flink	The following permissions are supported in custom roles: `managedflink.sessions.create` `managedflink.sessions.delete` `managedflink.sessions.get` `managedflink.sessions.list` `managedflink.sessions.update`
Network Services	The following permissions have been added: `networkservices.authzExtensions.create` `networkservices.authzExtensions.delete` `networkservices.authzExtensions.get` `networkservices.authzExtensions.list` `networkservices.authzExtensions.update` `networkservices.authzExtensions.use`
Network Services	The following permissions are supported in custom roles: `networkservices.authzExtensions.create` `networkservices.authzExtensions.delete` `networkservices.authzExtensions.get` `networkservices.authzExtensions.list` `networkservices.authzExtensions.update` `networkservices.authzExtensions.use`
Secure Source Manager	The following permissions have been added: `securesourcemanager.branchRules.create` `securesourcemanager.branchRules.delete` `securesourcemanager.branchRules.get` `securesourcemanager.branchRules.list` `securesourcemanager.branchRules.update`
Secure Source Manager	The following permissions are supported in custom roles: `securesourcemanager.branchRules.create` `securesourcemanager.branchRules.delete` `securesourcemanager.branchRules.get` `securesourcemanager.branchRules.list` `securesourcemanager.branchRules.update`

IAM changes as of 2024-08-23

Service	Description
Compute Engine	The following permissions have been added to the Compute Organization Firewall Policy Admin role (`roles/compute.orgFirewallPolicyAdmin`): `compute.firewallPolicies.copyRules`
Cloud Integrations	The following permissions have been added to the Application Integration Editor role (`roles/integrations.integrationEditor`): `integrations.executions.replay`
Service Networking	The following permissions have been added to the Service Networking Service Agent role (`roles/servicenetworking.serviceAgent`): `compute.networks.create` `compute.networks.delete` `compute.networks.update` `compute.subnetworks.create` `compute.subnetworks.delete` `compute.subnetworks.get` `compute.subnetworks.list` `networkconnectivity.internalRanges.list`
VM Migration	The following permissions have been added to the VM Migration Service Agent role (`roles/vmmigration.serviceAgent`): `compute.networks.use` `compute.networks.useExternalIp`
Cloud Integrations	The following permissions have been added: `integrations.executions.replay`
Cloud Integrations	The following permissions have reached General Availability (GA): `integrations.executions.replay`
Google Cloud Migration Center	The following permissions have been added: `migrationcenter.relations.get` `migrationcenter.relations.list`
Network Security	The following permissions have been added: `networksecurity.authzPolicies.create` `networksecurity.authzPolicies.delete` `networksecurity.authzPolicies.get` `networksecurity.authzPolicies.getIamPolicy` `networksecurity.authzPolicies.list` `networksecurity.authzPolicies.setIamPolicy` `networksecurity.authzPolicies.update`
Network Security	The following permissions are supported in custom roles: `networksecurity.authzPolicies.create` `networksecurity.authzPolicies.delete` `networksecurity.authzPolicies.get` `networksecurity.authzPolicies.getIamPolicy` `networksecurity.authzPolicies.list` `networksecurity.authzPolicies.setIamPolicy` `networksecurity.authzPolicies.update`
Recommender	The following permissions have been added: `recommender.firestoreDatabaseReliabilityInsights.get` `recommender.firestoreDatabaseReliabilityInsights.list` `recommender.firestoreDatabaseReliabilityInsights.update` `recommender.firestoreDatabaseReliabilityRecommendations.get` `recommender.firestoreDatabaseReliabilityRecommendations.list` `recommender.firestoreDatabaseReliabilityRecommendations.update`
Recommender	The following permissions are supported in custom roles: `recommender.firestoreDatabaseReliabilityInsights.get` `recommender.firestoreDatabaseReliabilityInsights.list` `recommender.firestoreDatabaseReliabilityInsights.update` `recommender.firestoreDatabaseReliabilityRecommendations.get` `recommender.firestoreDatabaseReliabilityRecommendations.list` `recommender.firestoreDatabaseReliabilityRecommendations.update`
Security Command Center	The following permissions have been added: `securitycenter.complianceReports.aggregate`
Security Command Center	The following permissions are supported in custom roles: `securitycenter.complianceReports.aggregate`

IAM changes as of 2024-08-16

Service	Description
Vertex AI	The following permissions have been added to the Vertex AI RAG Data Service Agent role (`roles/aiplatform.ragServiceAgent`): `bigquery.datasets.create` `bigquery.datasets.get` `bigquery.jobs.create` `bigquery.jobs.get` `bigquery.readsessions.create` `bigquery.readsessions.getData` `bigquery.tables.create` `bigquery.tables.createSnapshot` `bigquery.tables.deleteSnapshot` `bigquery.tables.export` `bigquery.tables.get` `bigquery.tables.getData` `bigquery.tables.restoreSnapshot` `bigquery.tables.update` `bigquery.tables.updateData`
Vertex AI	The following permissions have been added to the Vertex AI Tuning Service Agent role (`roles/aiplatform.tuningServiceAgent`): `aiplatform.pipelineJobs.get` `aiplatform.pipelineJobs.list`
Backup and Disaster Recovery	The following permissions have been added to the Backup and DR Compute Engine Operator role (`roles/backupdr.computeEngineOperator`): `compute.instances.useReadOnly`
Backup and Disaster Recovery	The following permissions have been added to the Backup and DR Service Agent role (`roles/backupdr.serviceAgent`): `compute.instances.useReadOnly`
AlloyDB for PostgreSQL	The following permissions have been added: `alloydb.clusters.upgrade`
AlloyDB for PostgreSQL	The following permissions are supported in custom roles: `alloydb.clusters.upgrade`
Artifact Registry	The following permissions have been added: `artifactregistry.files.update` `artifactregistry.packages.update` `artifactregistry.versions.update`
Artifact Registry	The following permissions have reached General Availability (GA): `artifactregistry.files.update` `artifactregistry.packages.update` `artifactregistry.versions.update`
Database Migration Service	The following permissions have been added: `datamigration.migrationjobs.demoteDestination`
Database Migration Service	The following permissions are supported in custom roles: `datamigration.migrationjobs.demoteDestination`
Database Migration Service	The following permissions have reached General Availability (GA): `datamigration.migrationjobs.demoteDestination`

IAM changes as of 2024-08-09

Service	Description
Vertex AI	The following permissions have been added to the Vertex AI Reasoning Engine Service Agent role (`roles/aiplatform.reasoningEngineServiceAgent`): `cloudtrace.traces.patch`
Backup and Disaster Recovery	The following permissions have been added to the Backup and DR Backup Vault Admin role (`roles/backupdr.backupvaultAdmin`): `backupdr.compute.restoreFromBackupVault`
Backup and Disaster Recovery	The following permissions have been added to the Backup and DR Restore User role (`roles/backupdr.restoreUser`): `backupdr.compute.restoreFromBackupVault`
Backup and Disaster Recovery	The following permissions have been added to the Backup and DR User V2 role (`roles/backupdr.userv2`): `backupdr.bvbackups.restore` `backupdr.compute.restoreFromBackupVault`
Capacity Planner	The following permissions have been added to the Capacity Planner Usage Viewer role (`roles/capacityplanner.viewer`): `compute.futureReservations.get` `compute.futureReservations.list` `compute.reservations.get` `compute.reservations.list`
Google Kubernetes Engine	The Kubernetes Engine Default Node Service Account role (`roles/container.defaultNodeServiceAccount`) has reached General Availability (GA).
Google Kubernetes Engine	The following permissions have been added to the Kubernetes Engine Service Agent role (`roles/container.serviceAgent`): `autoscaling.sites.readRecommendations` `autoscaling.sites.writeMetrics` `autoscaling.sites.writeState`
Discovery Engine	The following permissions have been added to the Discovery Engine Service Agent role (`roles/discoveryengine.serviceAgent`): `discoveryengine.completionConfigs.completeQuery` `discoveryengine.servingConfigs.answer`
Dataproc Metastore	The following permissions have been added to the Dataproc Metastore Managed Migration Admin role (`roles/metastore.migrationAdmin`): `datastream.objects.get` `datastream.objects.list` `datastream.objects.startBackfillJob` `datastream.objects.stopBackfillJob`
Cloud Monitoring	The following permissions have been added to the Monitoring Service Agent role (`roles/monitoring.notificationServiceAgent`): `logging.links.list`
Service Networking	The following permissions have been removed from the Service Networking Service Agent role (`roles/servicenetworking.serviceAgent`): `compute.networks.create` `compute.networks.delete` `compute.networks.update` `compute.subnetworks.create` `compute.subnetworks.delete` `compute.subnetworks.get` `compute.subnetworks.list` `networkconnectivity.internalRanges.list`
Cloud Key Management Service	The following permissions have been added: `cloudkms.operations.get`
Compute Engine	The following permissions have reached General Availability (GA): `compute.futureReservations.cancel` `compute.futureReservations.create` `compute.futureReservations.delete` `compute.futureReservations.get` `compute.futureReservations.getIamPolicy` `compute.futureReservations.list` `compute.futureReservations.setIamPolicy` `compute.futureReservations.update`
Conversational Insights	The following permissions have been added: `contactcenterinsights.feedbackLabels.download` `contactcenterinsights.feedbackLabels.upload` `contactcenterinsights.qaScorecardRevisions.delete` `contactcenterinsights.qaScorecardRevisions.tune`
Conversational Insights	The following permissions are supported in custom roles: `contactcenterinsights.feedbackLabels.download` `contactcenterinsights.feedbackLabels.upload` `contactcenterinsights.qaScorecardRevisions.tune`
BigQuery Engine for Apache Flink	The following permissions have been added: `managedflink.deployments.create` `managedflink.deployments.delete` `managedflink.deployments.get` `managedflink.deployments.list` `managedflink.deployments.update` `managedflink.jobs.create` `managedflink.jobs.delete` `managedflink.jobs.get` `managedflink.jobs.list` `managedflink.jobs.update` `managedflink.locations.get` `managedflink.locations.list` `managedflink.operations.cancel` `managedflink.operations.delete` `managedflink.operations.get` `managedflink.operations.list`
BigQuery Engine for Apache Flink	The following permissions are supported in custom roles: `managedflink.deployments.create` `managedflink.deployments.delete` `managedflink.deployments.get` `managedflink.deployments.list` `managedflink.deployments.update` `managedflink.jobs.create` `managedflink.jobs.delete` `managedflink.jobs.get` `managedflink.jobs.list` `managedflink.jobs.update` `managedflink.locations.get` `managedflink.locations.list` `managedflink.operations.cancel` `managedflink.operations.delete` `managedflink.operations.get` `managedflink.operations.list`
Network Management API	The following permissions have been added: `networkmanagement.vpcflowlogsconfigs.create` `networkmanagement.vpcflowlogsconfigs.delete` `networkmanagement.vpcflowlogsconfigs.get` `networkmanagement.vpcflowlogsconfigs.list` `networkmanagement.vpcflowlogsconfigs.update`
Network Management API	The following permissions are supported in custom roles: `networkmanagement.vpcflowlogsconfigs.create` `networkmanagement.vpcflowlogsconfigs.delete` `networkmanagement.vpcflowlogsconfigs.get` `networkmanagement.vpcflowlogsconfigs.list` `networkmanagement.vpcflowlogsconfigs.update`
Network Management API	The following permissions have reached General Availability (GA): `networkmanagement.vpcflowlogsconfigs.create` `networkmanagement.vpcflowlogsconfigs.delete` `networkmanagement.vpcflowlogsconfigs.get` `networkmanagement.vpcflowlogsconfigs.list` `networkmanagement.vpcflowlogsconfigs.update`

IAM changes as of 2024-08-02

Service	Description
Google Security Operations	The following permissions have been added to the Chronicle SOAR Service Agent role (`roles/chronicle.soarServiceAgent`): `compute.firewalls.get` `compute.firewalls.update` `compute.instances.deleteAccessConfig` `compute.instances.updateNetworkInterface` `compute.networks.updatePolicy` `securitycenter.notificationconfig.delete` `storage.buckets.get` `storage.buckets.getIamPolicy` `storage.buckets.list` `storage.buckets.update`
Cloud Controls Partner API	The following permissions have been added to the Cloud Controls Partner Admin role (`roles/cloudcontrolspartner.admin`): `cloudcontrolspartner.customers.get`
Connectors	The following permissions have been added to the Connectors Platform Service Agent role (`roles/connectors.serviceAgent`): `connectors.entities.get`
Dataproc	The following permissions have been added to the Dataproc Worker role (`roles/dataproc.worker`): `cloudprofiler.profiles.create` `cloudprofiler.profiles.update`
Data Security Posture Management	The DSPM Service Agent role (`roles/dspm.serviceAgent`) has reached General Availability (GA).
Backup and Disaster Recovery	The following permissions have been added: `backupdr.backupPlanAssociations.create` `backupdr.backupPlanAssociations.delete` `backupdr.backupPlanAssociations.get` `backupdr.backupPlanAssociations.list` `backupdr.backupPlanAssociations.triggerBackup` `backupdr.backupPlans.create` `backupdr.backupPlans.delete` `backupdr.backupPlans.get` `backupdr.backupPlans.list` `backupdr.backupPlans.useComputeInstanceOnly` `backupdr.backupVaults.associate` `backupdr.compute.restoreFromBackupVault`
Backup and Disaster Recovery	The following permissions are supported in custom roles: `backupdr.backupPlanAssociations.create` `backupdr.backupPlanAssociations.delete` `backupdr.backupPlanAssociations.get` `backupdr.backupPlanAssociations.list` `backupdr.backupPlanAssociations.triggerBackup` `backupdr.backupPlans.create` `backupdr.backupPlans.delete` `backupdr.backupPlans.get` `backupdr.backupPlans.list` `backupdr.backupPlans.useComputeInstanceOnly` `backupdr.backupVaults.associate` `backupdr.compute.restoreFromBackupVault`
Chrome Enterprise Premium	The following permissions have been added: `beyondcorp.subscriptions.terminate` `beyondcorp.subscriptions.update`
Data Catalog	The following permissions have been added: `datacatalog.migrationConfig.get` `datacatalog.migrationConfig.set`
Data Catalog	The following permissions are supported in custom roles: `datacatalog.migrationConfig.get` `datacatalog.migrationConfig.set`
Dataform	The following permissions have been added: `dataform.config.get` `dataform.config.update`
Dataform	The following permissions are supported in custom roles: `dataform.config.get` `dataform.config.update`
Dataform	The following permissions have reached General Availability (GA): `dataform.config.get` `dataform.config.update`
Discovery Engine	The following permissions have been added: `discoveryengine.aclConfigs.get` `discoveryengine.aclConfigs.update`
Discovery Engine	The following permissions are supported in custom roles: `discoveryengine.aclConfigs.get` `discoveryengine.aclConfigs.update`
Discovery Engine	The following permissions have reached General Availability (GA): `discoveryengine.aclConfigs.get` `discoveryengine.aclConfigs.update`
Memorystore	The following permissions have been added: `memorystore.instances.connect` `memorystore.instances.create` `memorystore.instances.delete` `memorystore.instances.get` `memorystore.instances.list` `memorystore.instances.update` `memorystore.locations.get` `memorystore.locations.list` `memorystore.operations.cancel` `memorystore.operations.delete` `memorystore.operations.get` `memorystore.operations.list`
Memorystore	The following permissions are supported in custom roles: `memorystore.instances.create` `memorystore.instances.delete` `memorystore.instances.get` `memorystore.instances.list` `memorystore.instances.update` `memorystore.locations.get` `memorystore.locations.list` `memorystore.operations.cancel` `memorystore.operations.delete` `memorystore.operations.get` `memorystore.operations.list`

IAM changes as of 2024-07-26

Service	Description
Vertex AI	The following permissions have been added to the Vertex AI Extension Service Agent role (`roles/aiplatform.extensionServiceAgent`): `aiplatform.locations.get`
Cloud Service Mesh	The following permissions have been added to the Anthos Service Mesh Service Agent role (`roles/anthosservicemesh.serviceAgent`): `compute.regionNetworkEndpointGroups.attachNetworkEndpoints` `compute.regionNetworkEndpointGroups.create` `compute.regionNetworkEndpointGroups.delete` `compute.regionNetworkEndpointGroups.detachNetworkEndpoints` `compute.regionNetworkEndpointGroups.get` `compute.regionNetworkEndpointGroups.list` `compute.regionNetworkEndpointGroups.use`
BigQuery	The following permissions have been added to the BigQuery Admin role (`roles/bigquery.admin`): `dataplex.projects.search`
BigQuery	The following permissions have been added to the BigQuery Metadata Viewer role (`roles/bigquery.metadataViewer`): `dataplex.projects.search`
BigQuery	The following permissions have been added to the BigQuery Studio Admin role (`roles/bigquery.studioAdmin`): `dataplex.projects.search`
BigQuery	The following permissions have been added to the BigQuery Studio User role (`roles/bigquery.studioUser`): `dataplex.projects.search`
BigQuery	The following permissions have been added to the BigQuery User role (`roles/bigquery.user`): `dataplex.projects.search`
Google Security Operations	The following permissions have been added to the Chronicle API Limited Viewer role (`roles/chronicle.limitedViewer`): `chronicle.dataAccessScopes.list`
Google Security Operations	The following permissions have been added to the Chronicle API Restricted Data Access Viewer role (`roles/chronicle.restrictedDataAccessViewer`): `chronicle.dashboardCharts.get` `chronicle.dashboardCharts.list` `chronicle.dashboardQueries.execute` `chronicle.dashboardQueries.get` `chronicle.dashboardQueries.list` `chronicle.nativeDashboards.get` `chronicle.nativeDashboards.list`
Cloud Composer	The following permissions have been added to the Cloud Composer API Service Agent role (`roles/composer.serviceAgent`): `observability.scopes.get`
Data Catalog	The following permissions have been added to the Data Catalog Admin role (`roles/datacatalog.admin`): `dataplex.projects.search`
Data Catalog	The following permissions have been added to the DataCatalog Data Steward role (`roles/datacatalog.dataSteward`): `dataplex.projects.search`
Data Catalog	The following permissions have been added to the DataCatalog EntryGroup Creator role (`roles/datacatalog.entryGroupCreator`): `dataplex.projects.search`
Data Catalog	The following permissions have been added to the DataCatalog EntryGroup Owner role (`roles/datacatalog.entryGroupOwner`): `dataplex.projects.search`
Data Catalog	The following permissions have been added to the DataCatalog Entry Owner role (`roles/datacatalog.entryOwner`): `dataplex.projects.search`
Data Catalog	The following permissions have been added to the DataCatalog Entry Viewer role (`roles/datacatalog.entryViewer`): `dataplex.projects.search`
Data Catalog	The following permissions have been added to the DataCatalog Search Admin role (`roles/datacatalog.searchAdmin`): `dataplex.projects.search`
Data Catalog	The following permissions have been added to the Data Catalog TagTemplate Creator role (`roles/datacatalog.tagTemplateCreator`): `dataplex.projects.search`
Data Catalog	The following permissions have been added to the Data Catalog TagTemplate Owner role (`roles/datacatalog.tagTemplateOwner`): `dataplex.projects.search`
Data Catalog	The following permissions have been added to the Data Catalog TagTemplate User role (`roles/datacatalog.tagTemplateUser`): `dataplex.projects.search`
Data Catalog	The following permissions have been added to the Data Catalog TagTemplate Viewer role (`roles/datacatalog.tagTemplateViewer`): `dataplex.projects.search`
Data Catalog	The following permissions have been added to the Data Catalog Viewer role (`roles/datacatalog.viewer`): `dataplex.projects.search`
Dataflow	The following permissions have been added to the Cloud Dataflow Service Agent role (`roles/dataflow.serviceAgent`): `dataplex.projects.search` `observability.scopes.get`
Dataplex	The following permissions have been added to the Cloud Dataplex Service Agent role (`roles/dataplex.serviceAgent`): `dataplex.projects.search`
Dataprep by Trifacta	The following permissions have been added to the Dataprep Service Agent role (`roles/dataprep.serviceAgent`): `dataplex.projects.search`
Dataproc	The following permissions have been added to the Dataproc Hub Agent role (`roles/dataproc.hubAgent`): `observability.scopes.get`
Sensitive Data Protection	The following permissions have been added to the DLP Organization Data Profiles Driver role (`roles/dlp.orgdriver`): `dataplex.projects.search`
Sensitive Data Protection	The following permissions have been added to the DLP Project Data Profiles Driver role (`roles/dlp.projectdriver`): `dataplex.projects.search`
Sensitive Data Protection	The following permissions have been added to the DLP API Service Agent role (`roles/dlp.serviceAgent`): `dataplex.projects.search`
Firebase App Hosting	The Firebase App Hosting Service Agent role (`roles/firebaseapphosting.serviceAgent`) has reached General Availability (GA).
Cloud Logging	The following permissions have been added to the Logging Admin role (`roles/logging.admin`): `observability.scopes.get`
Cloud Logging	The following permissions have been added to the Logs Configuration Writer role (`roles/logging.configWriter`): `observability.scopes.get`
Cloud Logging	The following permissions have been added to the Private Logs Viewer role (`roles/logging.privateLogViewer`): `observability.scopes.get`
Cloud Logging	The following permissions have been added to the Logs Viewer role (`roles/logging.viewer`): `observability.scopes.get`
Memorystore	The Cloud Memorystore Service Agent role (`roles/memorystore.serviceAgent`) has reached General Availability (GA).
Telco Automation API	The following permissions have been added to the Telco Automation Admin role (`roles/telcoautomation.admin`): `observability.scopes.get`
Telco Automation API	The following permissions have been added to the Telco Automation Tier 1 Operations Admin role (`roles/telcoautomation.opsAdminTier1`): `observability.scopes.get`
Telco Automation API	The following permissions have been added to the Telco Automation Tier 4 Operations Admin role (`roles/telcoautomation.opsAdminTier4`): `observability.scopes.get`
Apigee	The following permissions have been added: `apigee.securityAssessmentResults.compute`
Apigee	The following permissions are supported in custom roles: `apigee.securityAssessmentResults.compute`
Apigee	The following permissions have reached General Availability (GA): `apigee.securityAssessmentResults.compute`
Google Security Operations	The following permissions have been added: `chronicle.ingestionLogLabels.get` `chronicle.ingestionLogLabels.list` `chronicle.ingestionLogNamespaces.get` `chronicle.ingestionLogNamespaces.list`
Google Security Operations	The following permissions are supported in custom roles: `chronicle.ingestionLogLabels.get` `chronicle.ingestionLogLabels.list` `chronicle.ingestionLogNamespaces.get` `chronicle.ingestionLogNamespaces.list`
Compute Engine	The following permissions have been added: `compute.externalVpnGateways.createTagBinding` `compute.externalVpnGateways.deleteTagBinding` `compute.externalVpnGateways.listEffectiveTags` `compute.externalVpnGateways.listTagBindings` `compute.interconnectAttachments.createTagBinding` `compute.interconnectAttachments.deleteTagBinding` `compute.interconnectAttachments.listEffectiveTags` `compute.interconnectAttachments.listTagBindings` `compute.interconnects.createTagBinding` `compute.interconnects.deleteTagBinding` `compute.interconnects.listEffectiveTags` `compute.interconnects.listTagBindings` `compute.routers.createTagBinding` `compute.routers.deleteTagBinding` `compute.routers.listEffectiveTags` `compute.routers.listTagBindings` `compute.targetVpnGateways.createTagBinding` `compute.targetVpnGateways.deleteTagBinding` `compute.targetVpnGateways.listEffectiveTags` `compute.targetVpnGateways.listTagBindings` `compute.vpnGateways.createTagBinding` `compute.vpnGateways.deleteTagBinding` `compute.vpnGateways.listEffectiveTags` `compute.vpnGateways.listTagBindings` `compute.vpnTunnels.createTagBinding` `compute.vpnTunnels.deleteTagBinding` `compute.vpnTunnels.listEffectiveTags` `compute.vpnTunnels.listTagBindings`
Compute Engine	The following permissions are supported in custom roles: `compute.interconnectAttachments.createTagBinding` `compute.interconnectAttachments.deleteTagBinding` `compute.interconnectAttachments.listEffectiveTags` `compute.interconnectAttachments.listTagBindings` `compute.interconnects.createTagBinding` `compute.interconnects.deleteTagBinding` `compute.interconnects.listEffectiveTags` `compute.interconnects.listTagBindings` `compute.vpnGateways.createTagBinding` `compute.vpnGateways.deleteTagBinding` `compute.vpnGateways.listEffectiveTags` `compute.vpnGateways.listTagBindings`
Compute Engine	The following permissions have reached General Availability (GA): `compute.externalVpnGateways.createTagBinding` `compute.externalVpnGateways.deleteTagBinding` `compute.externalVpnGateways.listEffectiveTags` `compute.externalVpnGateways.listTagBindings` `compute.interconnectAttachments.createTagBinding` `compute.interconnectAttachments.deleteTagBinding` `compute.interconnectAttachments.listEffectiveTags` `compute.interconnectAttachments.listTagBindings` `compute.interconnects.createTagBinding` `compute.interconnects.deleteTagBinding` `compute.interconnects.listEffectiveTags` `compute.interconnects.listTagBindings` `compute.routers.createTagBinding` `compute.routers.deleteTagBinding` `compute.routers.listEffectiveTags` `compute.routers.listTagBindings` `compute.targetVpnGateways.createTagBinding` `compute.targetVpnGateways.deleteTagBinding` `compute.targetVpnGateways.listEffectiveTags` `compute.targetVpnGateways.listTagBindings` `compute.vpnGateways.createTagBinding` `compute.vpnGateways.deleteTagBinding` `compute.vpnGateways.listEffectiveTags` `compute.vpnGateways.listTagBindings` `compute.vpnTunnels.createTagBinding` `compute.vpnTunnels.deleteTagBinding` `compute.vpnTunnels.listEffectiveTags` `compute.vpnTunnels.listTagBindings`
Conversational Insights	The following permissions have been added: `contactcenterinsights.qaQuestions.create` `contactcenterinsights.qaQuestions.delete` `contactcenterinsights.qaQuestions.update` `contactcenterinsights.qaScorecardRevisions.create` `contactcenterinsights.qaScorecardRevisions.deploy` `contactcenterinsights.qaScorecardRevisions.list` `contactcenterinsights.qaScorecards.create` `contactcenterinsights.qaScorecards.delete` `contactcenterinsights.qaScorecards.update`
Conversational Insights	The following permissions are supported in custom roles: `contactcenterinsights.qaQuestions.create` `contactcenterinsights.qaQuestions.delete` `contactcenterinsights.qaQuestions.update` `contactcenterinsights.qaScorecardRevisions.create` `contactcenterinsights.qaScorecardRevisions.deploy` `contactcenterinsights.qaScorecardRevisions.list` `contactcenterinsights.qaScorecards.create` `contactcenterinsights.qaScorecards.delete` `contactcenterinsights.qaScorecards.update`
Dataplex	The following permissions have been added: `dataplex.entryGroups.import` `dataplex.metadataJobs.cancel` `dataplex.metadataJobs.create` `dataplex.metadataJobs.get` `dataplex.metadataJobs.list` `dataplex.projects.search`
Dataplex	The following permissions are supported in custom roles: `dataplex.entryGroups.import` `dataplex.metadataJobs.cancel` `dataplex.metadataJobs.create` `dataplex.metadataJobs.get` `dataplex.metadataJobs.list` `dataplex.projects.search`
Dataplex	The following permissions have reached General Availability (GA): `dataplex.projects.search`
GDC Hardware Management API	The following permissions have been added: `gdchardwaremanagement.hardware.create` `gdchardwaremanagement.hardware.delete`
GDC Hardware Management API	The following permissions are supported in custom roles: `gdchardwaremanagement.hardware.create` `gdchardwaremanagement.hardware.delete`
Identity and Access Management	The following permissions have been added: `iam.serviceAccounts.createTagBinding` `iam.serviceAccounts.deleteTagBinding` `iam.serviceAccounts.listEffectiveTags` `iam.serviceAccounts.listTagBindings`
Identity and Access Management	The following permissions are supported in custom roles: `iam.serviceAccounts.createTagBinding` `iam.serviceAccounts.deleteTagBinding` `iam.serviceAccounts.listEffectiveTags` `iam.serviceAccounts.listTagBindings`
Retail API	The following permissions have been added: `retail.alertConfigs.get` `retail.alertConfigs.update` `retail.branches.get` `retail.branches.list`
Retail API	The following permissions have reached General Availability (GA): `retail.catalogs.exportAnalyticsMetrics`
Secret Manager	The following permissions have been added: `secretmanager.secrets.createTagBinding` `secretmanager.secrets.deleteTagBinding` `secretmanager.secrets.listEffectiveTags` `secretmanager.secrets.listTagBindings`
Secret Manager	The following permissions have reached General Availability (GA): `secretmanager.secrets.createTagBinding` `secretmanager.secrets.deleteTagBinding` `secretmanager.secrets.listEffectiveTags` `secretmanager.secrets.listTagBindings`

IAM changes as of 2024-07-19

Service	Description
Vertex AI	The following permissions have been added to the Vertex AI RAG Data Service Agent role (`roles/aiplatform.ragServiceAgent`): `aiplatform.featureViews.get` `aiplatform.featureViews.list` `aiplatform.featureViews.sync` `aiplatform.featureViews.update`
Vertex AI	The following permissions have been added to the Vertex AI Service Agent role (`roles/aiplatform.serviceAgent`): `serviceusage.services.list`
Vertex AI	The following permissions have been added to the Vertex AI Tuning Service Agent role (`roles/aiplatform.tuningServiceAgent`): `aiplatform.models.update`
Cloud Service Mesh	The following permissions have been added to the Anthos Service Mesh Service Agent role (`roles/anthosservicemesh.serviceAgent`): `compute.regions.list` `compute.zones.list`
Batch	The Batch Administrator role (`roles/batch.admin`) has reached General Availability (GA).
Batch	The Batch Agent Reporter role (`roles/batch.agentReporter`) has reached General Availability (GA).
Batch	The Batch Job Editor role (`roles/batch.jobsEditor`) has reached General Availability (GA).
Batch	The Batch Job Viewer role (`roles/batch.jobsViewer`) has reached General Availability (GA).
Batch	The Batch ResourceAllowance Editor role (`roles/batch.resourceAllowancesEditor`) has reached General Availability (GA).
Batch	The Batch ResourceAllowance Viewer role (`roles/batch.resourceAllowancesViewer`) has reached General Availability (GA).
Recommender	The BigQuery Materialized View Recommender Admin role (`roles/recommender.bigqueryMaterializedViewAdmin`) has reached General Availability (GA).
Recommender	The BigQuery Materialized View Recommender Viewer role (`roles/recommender.bigqueryMaterializedViewViewer`) has reached General Availability (GA).
Spectrum Access System (SAS)	The following permissions have been added to the Spectrum SAS Service Agent role (`roles/spectrumsas.serviceAgent`): `pubsub.schemas.attach` `pubsub.schemas.commit` `pubsub.schemas.delete` `pubsub.schemas.get` `pubsub.schemas.list` `pubsub.schemas.listRevisions` `pubsub.schemas.rollback` `pubsub.schemas.validate` `pubsub.snapshots.create` `pubsub.snapshots.delete` `pubsub.snapshots.get` `pubsub.snapshots.list` `pubsub.snapshots.seek` `pubsub.snapshots.update` `pubsub.subscriptions.consume` `pubsub.subscriptions.delete` `pubsub.subscriptions.get` `pubsub.subscriptions.list` `pubsub.subscriptions.update` `pubsub.topics.attachSubscription` `pubsub.topics.delete` `pubsub.topics.detachSubscription` `pubsub.topics.get` `pubsub.topics.list` `pubsub.topics.update` `pubsub.topics.updateTag` `resourcemanager.projects.get` `serviceusage.quotas.get` `serviceusage.services.get` `serviceusage.services.list`
Workload Manager	The following permissions have been added to the Workload Manager Workload Viewer role (`roles/workloadmanager.workloadViewer`): `resourcemanager.projects.get` `resourcemanager.projects.list`
Vertex AI	The following permissions have reached General Availability (GA): `aiplatform.tuningJobs.cancel` `aiplatform.tuningJobs.create` `aiplatform.tuningJobs.delete` `aiplatform.tuningJobs.get` `aiplatform.tuningJobs.list` `aiplatform.tuningJobs.vertexTune`
Batch	The following permissions have been added: `batch.resourceAllowances.create` `batch.resourceAllowances.delete` `batch.resourceAllowances.get` `batch.resourceAllowances.list` `batch.resourceAllowances.update`
Batch	The following permissions have reached General Availability (GA): `batch.jobs.create` `batch.jobs.delete` `batch.jobs.get` `batch.jobs.list` `batch.locations.get` `batch.locations.list` `batch.operations.get` `batch.operations.list` `batch.resourceAllowances.create` `batch.resourceAllowances.delete` `batch.resourceAllowances.get` `batch.resourceAllowances.list` `batch.resourceAllowances.update` `batch.states.report` `batch.tasks.get` `batch.tasks.list`
Cloud Deploy	The following permissions have been added: `clouddeploy.deployPolicies.create` `clouddeploy.deployPolicies.delete` `clouddeploy.deployPolicies.get` `clouddeploy.deployPolicies.list` `clouddeploy.deployPolicies.override` `clouddeploy.deployPolicies.update`
Cloud Deploy	The following permissions are supported in custom roles: `clouddeploy.deployPolicies.create` `clouddeploy.deployPolicies.delete` `clouddeploy.deployPolicies.get` `clouddeploy.deployPolicies.list` `clouddeploy.deployPolicies.override` `clouddeploy.deployPolicies.update`
Discovery Engine	The following permissions have been added: `discoveryengine.groundingConfigs.check`
Discovery Engine	The following permissions are supported in custom roles: `discoveryengine.groundingConfigs.check`
Google Cloud Managed Service for Apache Kafka	The following permissions have been added: `managedkafka.clusters.connect` `managedkafka.clusters.create` `managedkafka.clusters.delete` `managedkafka.clusters.get` `managedkafka.clusters.list` `managedkafka.clusters.update` `managedkafka.consumerGroups.delete` `managedkafka.consumerGroups.get` `managedkafka.consumerGroups.list` `managedkafka.consumerGroups.update` `managedkafka.locations.get` `managedkafka.locations.list` `managedkafka.operations.cancel` `managedkafka.operations.delete` `managedkafka.operations.get` `managedkafka.operations.list` `managedkafka.topics.create` `managedkafka.topics.delete` `managedkafka.topics.get` `managedkafka.topics.list` `managedkafka.topics.update`
Google Cloud Managed Service for Apache Kafka	The following permissions are supported in custom roles: `managedkafka.clusters.connect` `managedkafka.clusters.create` `managedkafka.clusters.delete` `managedkafka.clusters.get` `managedkafka.clusters.list` `managedkafka.clusters.update` `managedkafka.consumerGroups.delete` `managedkafka.consumerGroups.get` `managedkafka.consumerGroups.list` `managedkafka.consumerGroups.update` `managedkafka.locations.get` `managedkafka.locations.list` `managedkafka.operations.cancel` `managedkafka.operations.delete` `managedkafka.operations.get` `managedkafka.operations.list` `managedkafka.topics.create` `managedkafka.topics.delete` `managedkafka.topics.get` `managedkafka.topics.list` `managedkafka.topics.update`
Recommender	The following permissions have reached General Availability (GA): `recommender.bigqueryMaterializedViewInsights.get` `recommender.bigqueryMaterializedViewInsights.list` `recommender.bigqueryMaterializedViewInsights.update` `recommender.bigqueryMaterializedViewRecommendations.get` `recommender.bigqueryMaterializedViewRecommendations.list` `recommender.bigqueryMaterializedViewRecommendations.update`

IAM changes as of 2024-07-12

Service	Description
Gemini for Google Cloud API	The following permissions have been added to the Cloud AI Companion Service Agent role (`roles/cloudaicompanion.serviceAgent`): `monitoring.metricDescriptors.create` `monitoring.metricDescriptors.get` `monitoring.metricDescriptors.list` `monitoring.monitoredResourceDescriptors.get` `monitoring.monitoredResourceDescriptors.list` `monitoring.timeSeries.create`
Cloud Commerce Consumer Procurement	The following permissions have been added to the Consumer Procurement Entitlement Manager role (`roles/consumerprocurement.entitlementManager`): `commerceoffercatalog.offers.get`
Cloud Commerce Consumer Procurement	The following permissions have been added to the Consumer Procurement Entitlement Viewer role (`roles/consumerprocurement.entitlementViewer`): `commerceoffercatalog.offers.get`
Cloud Run	The following permissions have been added to the Cloud Run Service Agent role (`roles/run.serviceAgent`): `networkservices.meshes.get`
AlloyDB for PostgreSQL	The following permissions have been added: `alloydb.clusters.import`
AlloyDB for PostgreSQL	The following permissions are supported in custom roles: `alloydb.clusters.import`
API Management	The following permissions have been added: `apim.apiObservations.batchEditTags` `apim.locations.listApiObservationTags`
API Management	The following permissions are supported in custom roles: `apim.apiObservations.batchEditTags` `apim.locations.listApiObservationTags`
Spanner	The following permissions have been added: `spanner.databases.changequorum`
Spanner	The following permissions have reached General Availability (GA): `spanner.databases.changequorum`

IAM changes as of 2024-07-05

Service	Description
Cloud TPU	The following permissions have been added to the Cloud TPU V2 API Service Agent role (`roles/cloudtpu.serviceAgent`): `networkmanagement.connectivitytests.get` `networkmanagement.connectivitytests.list`
Cloud Composer	The following permissions have been added to the Cloud Composer API Service Agent role (`roles/composer.serviceAgent`): `networkmanagement.connectivitytests.get` `networkmanagement.connectivitytests.list` `resourcemanager.hierarchyNodes.listEffectiveTags`
Compute Engine	The following permissions have been added to the Compute Network Admin role (`roles/compute.networkAdmin`): `networkmanagement.connectivitytests.get` `networkmanagement.connectivitytests.list`
Compute Engine	The following permissions have been added to the Compute Network User role (`roles/compute.networkUser`): `networkmanagement.connectivitytests.get` `networkmanagement.connectivitytests.list`
Compute Engine	The following permissions have been added to the Compute Network Viewer role (`roles/compute.networkViewer`): `networkmanagement.connectivitytests.get` `networkmanagement.connectivitytests.list`
Google Kubernetes Engine	The following permissions have been added to the Kubernetes Engine Service Agent role (`roles/container.serviceAgent`): `networkmanagement.connectivitytests.get` `networkmanagement.connectivitytests.list`
Dataflow	The following permissions have been added to the Cloud Dataflow Service Agent role (`roles/dataflow.serviceAgent`): `networkmanagement.connectivitytests.get` `networkmanagement.connectivitytests.list` `resourcemanager.hierarchyNodes.listEffectiveTags`
Cloud Data Fusion	The following permissions have been added to the Cloud Data Fusion API Service Agent role (`roles/datafusion.serviceAgent`): `networkmanagement.connectivitytests.get` `networkmanagement.connectivitytests.list` `resourcemanager.hierarchyNodes.listEffectiveTags`
Data Pipelines	The following permissions have been added to the Datapipelines Service Agent role (`roles/datapipelines.serviceAgent`): `resourcemanager.hierarchyNodes.listEffectiveTags`
Dataplex	The following permissions have been added to the Cloud Dataplex Service Agent role (`roles/dataplex.serviceAgent`): `resourcemanager.hierarchyNodes.listEffectiveTags`
Dataproc	The following permissions have been added to the Dataproc Service Agent role (`roles/dataproc.serviceAgent`): `resourcemanager.hierarchyNodes.listEffectiveTags`
Sensitive Data Protection	The following permissions have been added to the DLP Organization Data Profiles Driver role (`roles/dlp.orgdriver`): `alloydb.backups.createTagBinding` `alloydb.backups.deleteTagBinding` `alloydb.backups.listEffectiveTags` `alloydb.backups.listTagBindings` `alloydb.clusters.createTagBinding` `alloydb.clusters.deleteTagBinding` `alloydb.clusters.listEffectiveTags` `alloydb.clusters.listTagBindings` `artifactregistry.repositories.createTagBinding` `artifactregistry.repositories.deleteTagBinding` `artifactregistry.repositories.listEffectiveTags` `artifactregistry.repositories.listTagBindings` `bigquery.datasets.createTagBinding` `bigquery.datasets.deleteTagBinding` `bigquery.datasets.listEffectiveTags` `bigquery.datasets.listTagBindings` `bigquery.tables.createTagBinding` `bigquery.tables.deleteTagBinding` `bigquery.tables.listEffectiveTags` `bigquery.tables.listTagBindings` `bigtable.authorizedViews.createTagBinding` `bigtable.authorizedViews.deleteTagBinding` `bigtable.authorizedViews.listEffectiveTags` `bigtable.authorizedViews.listTagBindings` `bigtable.instances.createTagBinding` `bigtable.instances.deleteTagBinding` `bigtable.instances.listEffectiveTags` `bigtable.instances.listTagBindings` `clouddeploy.deliveryPipelines.createTagBinding` `clouddeploy.deliveryPipelines.deleteTagBinding` `clouddeploy.deliveryPipelines.listEffectiveTags` `clouddeploy.deliveryPipelines.listTagBindings` `clouddeploy.targets.createTagBinding` `clouddeploy.targets.deleteTagBinding` `clouddeploy.targets.listEffectiveTags` `clouddeploy.targets.listTagBindings` `cloudkms.keyRings.createTagBinding` `cloudkms.keyRings.deleteTagBinding` `cloudkms.keyRings.listEffectiveTags` `cloudkms.keyRings.listTagBindings` `cloudsql.instances.createTagBinding` `cloudsql.instances.deleteTagBinding` `cloudsql.instances.listEffectiveTags` `cloudsql.instances.listTagBindings` `compute.backendBuckets.createTagBinding` `compute.backendBuckets.deleteTagBinding` `compute.backendBuckets.listEffectiveTags` `compute.backendBuckets.listTagBindings` `compute.backendServices.createTagBinding` `compute.backendServices.deleteTagBinding` `compute.backendServices.listEffectiveTags` `compute.backendServices.listTagBindings` `compute.disks.createTagBinding` `compute.disks.deleteTagBinding` `compute.disks.listEffectiveTags` `compute.disks.listTagBindings` `compute.firewallPolicies.createTagBinding` `compute.firewallPolicies.deleteTagBinding` `compute.firewallPolicies.listEffectiveTags` `compute.firewallPolicies.listTagBindings` `compute.firewalls.createTagBinding` `compute.firewalls.deleteTagBinding` `compute.firewalls.listEffectiveTags` `compute.firewalls.listTagBindings` `compute.forwardingRules.createTagBinding` `compute.forwardingRules.deleteTagBinding` `compute.forwardingRules.listEffectiveTags` `compute.forwardingRules.listTagBindings` `compute.globalForwardingRules.createTagBinding` `compute.globalForwardingRules.deleteTagBinding` `compute.globalForwardingRules.listEffectiveTags` `compute.globalForwardingRules.listTagBindings` `compute.globalNetworkEndpointGroups.createTagBinding` `compute.globalNetworkEndpointGroups.deleteTagBinding` `compute.globalNetworkEndpointGroups.listEffectiveTags` `compute.globalNetworkEndpointGroups.listTagBindings` `compute.healthChecks.createTagBinding` `compute.healthChecks.deleteTagBinding` `compute.healthChecks.listEffectiveTags` `compute.healthChecks.listTagBindings` `compute.httpHealthChecks.createTagBinding` `compute.httpHealthChecks.deleteTagBinding` `compute.httpHealthChecks.listEffectiveTags` `compute.httpHealthChecks.listTagBindings` `compute.httpsHealthChecks.createTagBinding` `compute.httpsHealthChecks.deleteTagBinding` `compute.httpsHealthChecks.listEffectiveTags` `compute.httpsHealthChecks.listTagBindings` `compute.images.createTagBinding` `compute.images.deleteTagBinding` `compute.images.listEffectiveTags` `compute.images.listTagBindings` `compute.instanceGroupManagers.createTagBinding` `compute.instanceGroupManagers.deleteTagBinding` `compute.instanceGroupManagers.listEffectiveTags` `compute.instanceGroupManagers.listTagBindings` `compute.instances.createTagBinding` `compute.instances.deleteTagBinding` `compute.instances.listEffectiveTags` `compute.instances.listTagBindings` `compute.networkEndpointGroups.createTagBinding` `compute.networkEndpointGroups.deleteTagBinding` `compute.networkEndpointGroups.listEffectiveTags` `compute.networkEndpointGroups.listTagBindings` `compute.networks.createTagBinding` `compute.networks.deleteTagBinding` `compute.networks.listEffectiveTags` `compute.networks.listTagBindings` `compute.regionBackendServices.createTagBinding` `compute.regionBackendServices.deleteTagBinding` `compute.regionBackendServices.listEffectiveTags` `compute.regionBackendServices.listTagBindings` `compute.regionFirewallPolicies.createTagBinding` `compute.regionFirewallPolicies.deleteTagBinding` `compute.regionFirewallPolicies.listEffectiveTags` `compute.regionFirewallPolicies.listTagBindings` `compute.regionHealthChecks.createTagBinding` `compute.regionHealthChecks.deleteTagBinding` `compute.regionHealthChecks.listEffectiveTags` `compute.regionHealthChecks.listTagBindings` `compute.regionNetworkEndpointGroups.createTagBinding` `compute.regionNetworkEndpointGroups.deleteTagBinding` `compute.regionNetworkEndpointGroups.listEffectiveTags` `compute.regionNetworkEndpointGroups.listTagBindings` `compute.regionSecurityPolicies.createTagBinding` `compute.regionSecurityPolicies.deleteTagBinding` `compute.regionSecurityPolicies.listEffectiveTags` `compute.regionSecurityPolicies.listTagBindings` `compute.regionSslCertificates.createTagBinding` `compute.regionSslCertificates.deleteTagBinding` `compute.regionSslCertificates.listEffectiveTags` `compute.regionSslCertificates.listTagBindings` `compute.regionTargetHttpProxies.createTagBinding` `compute.regionTargetHttpProxies.deleteTagBinding` `compute.regionTargetHttpProxies.listEffectiveTags` `compute.regionTargetHttpProxies.listTagBindings` `compute.regionTargetHttpsProxies.createTagBinding` `compute.regionTargetHttpsProxies.deleteTagBinding` `compute.regionTargetHttpsProxies.listEffectiveTags` `compute.regionTargetHttpsProxies.listTagBindings` `compute.regionUrlMaps.createTagBinding` `compute.regionUrlMaps.deleteTagBinding` `compute.regionUrlMaps.listEffectiveTags` `compute.regionUrlMaps.listTagBindings` `compute.routes.createTagBinding` `compute.routes.deleteTagBinding` `compute.routes.listEffectiveTags` `compute.routes.listTagBindings` `compute.securityPolicies.createTagBinding` `compute.securityPolicies.deleteTagBinding` `compute.securityPolicies.listEffectiveTags` `compute.securityPolicies.listTagBindings` `compute.snapshots.createTagBinding` `compute.snapshots.deleteTagBinding` `compute.snapshots.listEffectiveTags` `compute.snapshots.listTagBindings` `compute.sslCertificates.createTagBinding` `compute.sslCertificates.deleteTagBinding` `compute.sslCertificates.listEffectiveTags` `compute.sslCertificates.listTagBindings` `compute.sslPolicies.createTagBinding` `compute.sslPolicies.deleteTagBinding` `compute.sslPolicies.listEffectiveTags` `compute.sslPolicies.listTagBindings` `compute.subnetworks.createTagBinding` `compute.subnetworks.deleteTagBinding` `compute.subnetworks.listEffectiveTags` `compute.subnetworks.listTagBindings` `compute.targetHttpProxies.createTagBinding` `compute.targetHttpProxies.deleteTagBinding` `compute.targetHttpProxies.listEffectiveTags` `compute.targetHttpProxies.listTagBindings` `compute.targetHttpsProxies.createTagBinding` `compute.targetHttpsProxies.deleteTagBinding` `compute.targetHttpsProxies.listEffectiveTags` `compute.targetHttpsProxies.listTagBindings` `compute.targetInstances.createTagBinding` `compute.targetInstances.deleteTagBinding` `compute.targetInstances.listEffectiveTags` `compute.targetInstances.listTagBindings` `compute.targetPools.createTagBinding` `compute.targetPools.deleteTagBinding` `compute.targetPools.listEffectiveTags` `compute.targetPools.listTagBindings` `compute.targetSslProxies.createTagBinding` `compute.targetSslProxies.deleteTagBinding` `compute.targetSslProxies.listEffectiveTags` `compute.targetSslProxies.listTagBindings` `compute.targetTcpProxies.createTagBinding` `compute.targetTcpProxies.deleteTagBinding` `compute.targetTcpProxies.listEffectiveTags` `compute.targetTcpProxies.listTagBindings` `compute.urlMaps.createTagBinding` `compute.urlMaps.deleteTagBinding` `compute.urlMaps.listEffectiveTags` `compute.urlMaps.listTagBindings` `container.clusters.createTagBinding` `container.clusters.deleteTagBinding` `container.clusters.listEffectiveTags` `container.clusters.listTagBindings` `datafusion.instances.createTagBinding` `datafusion.instances.deleteTagBinding` `datafusion.instances.listEffectiveTags` `datafusion.instances.listTagBindings` `datastore.databases.createTagBinding` `datastore.databases.deleteTagBinding` `datastore.databases.listEffectiveTags` `datastore.databases.listTagBindings` `datastream.connectionProfiles.createTagBinding` `datastream.connectionProfiles.deleteTagBinding` `datastream.connectionProfiles.listEffectiveTags` `datastream.connectionProfiles.listTagBindings` `datastream.privateConnections.createTagBinding` `datastream.privateConnections.deleteTagBinding` `datastream.privateConnections.listEffectiveTags` `datastream.privateConnections.listTagBindings` `datastream.streams.createTagBinding` `datastream.streams.deleteTagBinding` `datastream.streams.listEffectiveTags` `datastream.streams.listTagBindings` `domains.registrations.createTagBinding` `domains.registrations.deleteTagBinding` `domains.registrations.listEffectiveTags` `domains.registrations.listTagBindings` `file.backups.createTagBinding` `file.backups.deleteTagBinding` `file.backups.listEffectiveTags` `file.backups.listTagBindings` `file.instances.createTagBinding` `file.instances.deleteTagBinding` `file.instances.listEffectiveTags` `file.instances.listTagBindings` `file.snapshots.createTagBinding` `file.snapshots.deleteTagBinding` `file.snapshots.listEffectiveTags` `file.snapshots.listTagBindings` `managedidentities.domains.createTagBinding` `managedidentities.domains.deleteTagBinding` `managedidentities.domains.listEffectiveTags` `managedidentities.domains.listTagBindings` `redis.instances.createTagBinding` `redis.instances.deleteTagBinding` `redis.instances.listEffectiveTags` `redis.instances.listTagBindings` `resourcemanager.hierarchyNodes.createTagBinding` `resourcemanager.hierarchyNodes.deleteTagBinding` `resourcemanager.hierarchyNodes.listEffectiveTags` `resourcemanager.hierarchyNodes.listTagBindings` `resourcemanager.resourceTagBindings.create` `resourcemanager.resourceTagBindings.delete` `resourcemanager.resourceTagBindings.list` `resourcemanager.tagKeys.get` `resourcemanager.tagKeys.list` `resourcemanager.tagValueBindings.create` `resourcemanager.tagValueBindings.delete` `resourcemanager.tagValues.get` `resourcemanager.tagValues.list` `run.jobs.createTagBinding` `run.jobs.deleteTagBinding` `run.jobs.listEffectiveTags` `run.jobs.listTagBindings` `run.services.createTagBinding` `run.services.deleteTagBinding` `run.services.listEffectiveTags` `run.services.listTagBindings` `spanner.instances.createTagBinding` `spanner.instances.deleteTagBinding` `spanner.instances.listEffectiveTags` `spanner.instances.listTagBindings` `storage.buckets.createTagBinding` `storage.buckets.deleteTagBinding` `storage.buckets.listEffectiveTags` `storage.buckets.listTagBindings`
Sensitive Data Protection	The following permissions have been added to the DLP Project Data Profiles Driver role (`roles/dlp.projectdriver`): `alloydb.backups.createTagBinding` `alloydb.backups.deleteTagBinding` `alloydb.backups.listEffectiveTags` `alloydb.backups.listTagBindings` `alloydb.clusters.createTagBinding` `alloydb.clusters.deleteTagBinding` `alloydb.clusters.listEffectiveTags` `alloydb.clusters.listTagBindings` `artifactregistry.repositories.createTagBinding` `artifactregistry.repositories.deleteTagBinding` `artifactregistry.repositories.listEffectiveTags` `artifactregistry.repositories.listTagBindings` `bigquery.datasets.createTagBinding` `bigquery.datasets.deleteTagBinding` `bigquery.datasets.listEffectiveTags` `bigquery.datasets.listTagBindings` `bigquery.tables.createTagBinding` `bigquery.tables.deleteTagBinding` `bigquery.tables.listEffectiveTags` `bigquery.tables.listTagBindings` `bigtable.authorizedViews.createTagBinding` `bigtable.authorizedViews.deleteTagBinding` `bigtable.authorizedViews.listEffectiveTags` `bigtable.authorizedViews.listTagBindings` `bigtable.instances.createTagBinding` `bigtable.instances.deleteTagBinding` `bigtable.instances.listEffectiveTags` `bigtable.instances.listTagBindings` `clouddeploy.deliveryPipelines.createTagBinding` `clouddeploy.deliveryPipelines.deleteTagBinding` `clouddeploy.deliveryPipelines.listEffectiveTags` `clouddeploy.deliveryPipelines.listTagBindings` `clouddeploy.targets.createTagBinding` `clouddeploy.targets.deleteTagBinding` `clouddeploy.targets.listEffectiveTags` `clouddeploy.targets.listTagBindings` `cloudkms.keyRings.createTagBinding` `cloudkms.keyRings.deleteTagBinding` `cloudkms.keyRings.listEffectiveTags` `cloudkms.keyRings.listTagBindings` `cloudsql.instances.createTagBinding` `cloudsql.instances.deleteTagBinding` `cloudsql.instances.listEffectiveTags` `cloudsql.instances.listTagBindings` `compute.backendBuckets.createTagBinding` `compute.backendBuckets.deleteTagBinding` `compute.backendBuckets.listEffectiveTags` `compute.backendBuckets.listTagBindings` `compute.backendServices.createTagBinding` `compute.backendServices.deleteTagBinding` `compute.backendServices.listEffectiveTags` `compute.backendServices.listTagBindings` `compute.disks.createTagBinding` `compute.disks.deleteTagBinding` `compute.disks.listEffectiveTags` `compute.disks.listTagBindings` `compute.firewallPolicies.createTagBinding` `compute.firewallPolicies.deleteTagBinding` `compute.firewallPolicies.listEffectiveTags` `compute.firewallPolicies.listTagBindings` `compute.firewalls.createTagBinding` `compute.firewalls.deleteTagBinding` `compute.firewalls.listEffectiveTags` `compute.firewalls.listTagBindings` `compute.forwardingRules.createTagBinding` `compute.forwardingRules.deleteTagBinding` `compute.forwardingRules.listEffectiveTags` `compute.forwardingRules.listTagBindings` `compute.globalForwardingRules.createTagBinding` `compute.globalForwardingRules.deleteTagBinding` `compute.globalForwardingRules.listEffectiveTags` `compute.globalForwardingRules.listTagBindings` `compute.globalNetworkEndpointGroups.createTagBinding` `compute.globalNetworkEndpointGroups.deleteTagBinding` `compute.globalNetworkEndpointGroups.listEffectiveTags` `compute.globalNetworkEndpointGroups.listTagBindings` `compute.healthChecks.createTagBinding` `compute.healthChecks.deleteTagBinding` `compute.healthChecks.listEffectiveTags` `compute.healthChecks.listTagBindings` `compute.httpHealthChecks.createTagBinding` `compute.httpHealthChecks.deleteTagBinding` `compute.httpHealthChecks.listEffectiveTags` `compute.httpHealthChecks.listTagBindings` `compute.httpsHealthChecks.createTagBinding` `compute.httpsHealthChecks.deleteTagBinding` `compute.httpsHealthChecks.listEffectiveTags` `compute.httpsHealthChecks.listTagBindings` `compute.images.createTagBinding` `compute.images.deleteTagBinding` `compute.images.listEffectiveTags` `compute.images.listTagBindings` `compute.instanceGroupManagers.createTagBinding` `compute.instanceGroupManagers.deleteTagBinding` `compute.instanceGroupManagers.listEffectiveTags` `compute.instanceGroupManagers.listTagBindings` `compute.instances.createTagBinding` `compute.instances.deleteTagBinding` `compute.instances.listEffectiveTags` `compute.instances.listTagBindings` `compute.networkEndpointGroups.createTagBinding` `compute.networkEndpointGroups.deleteTagBinding` `compute.networkEndpointGroups.listEffectiveTags` `compute.networkEndpointGroups.listTagBindings` `compute.networks.createTagBinding` `compute.networks.deleteTagBinding` `compute.networks.listEffectiveTags` `compute.networks.listTagBindings` `compute.regionBackendServices.createTagBinding` `compute.regionBackendServices.deleteTagBinding` `compute.regionBackendServices.listEffectiveTags` `compute.regionBackendServices.listTagBindings` `compute.regionFirewallPolicies.createTagBinding` `compute.regionFirewallPolicies.deleteTagBinding` `compute.regionFirewallPolicies.listEffectiveTags` `compute.regionFirewallPolicies.listTagBindings` `compute.regionHealthChecks.createTagBinding` `compute.regionHealthChecks.deleteTagBinding` `compute.regionHealthChecks.listEffectiveTags` `compute.regionHealthChecks.listTagBindings` `compute.regionNetworkEndpointGroups.createTagBinding` `compute.regionNetworkEndpointGroups.deleteTagBinding` `compute.regionNetworkEndpointGroups.listEffectiveTags` `compute.regionNetworkEndpointGroups.listTagBindings` `compute.regionSecurityPolicies.createTagBinding` `compute.regionSecurityPolicies.deleteTagBinding` `compute.regionSecurityPolicies.listEffectiveTags` `compute.regionSecurityPolicies.listTagBindings` `compute.regionSslCertificates.createTagBinding` `compute.regionSslCertificates.deleteTagBinding` `compute.regionSslCertificates.listEffectiveTags` `compute.regionSslCertificates.listTagBindings` `compute.regionTargetHttpProxies.createTagBinding` `compute.regionTargetHttpProxies.deleteTagBinding` `compute.regionTargetHttpProxies.listEffectiveTags` `compute.regionTargetHttpProxies.listTagBindings` `compute.regionTargetHttpsProxies.createTagBinding` `compute.regionTargetHttpsProxies.deleteTagBinding` `compute.regionTargetHttpsProxies.listEffectiveTags` `compute.regionTargetHttpsProxies.listTagBindings` `compute.regionUrlMaps.createTagBinding` `compute.regionUrlMaps.deleteTagBinding` `compute.regionUrlMaps.listEffectiveTags` `compute.regionUrlMaps.listTagBindings` `compute.routes.createTagBinding` `compute.routes.deleteTagBinding` `compute.routes.listEffectiveTags` `compute.routes.listTagBindings` `compute.securityPolicies.createTagBinding` `compute.securityPolicies.deleteTagBinding` `compute.securityPolicies.listEffectiveTags` `compute.securityPolicies.listTagBindings` `compute.snapshots.createTagBinding` `compute.snapshots.deleteTagBinding` `compute.snapshots.listEffectiveTags` `compute.snapshots.listTagBindings` `compute.sslCertificates.createTagBinding` `compute.sslCertificates.deleteTagBinding` `compute.sslCertificates.listEffectiveTags` `compute.sslCertificates.listTagBindings` `compute.sslPolicies.createTagBinding` `compute.sslPolicies.deleteTagBinding` `compute.sslPolicies.listEffectiveTags` `compute.sslPolicies.listTagBindings` `compute.subnetworks.createTagBinding` `compute.subnetworks.deleteTagBinding` `compute.subnetworks.listEffectiveTags` `compute.subnetworks.listTagBindings` `compute.targetHttpProxies.createTagBinding` `compute.targetHttpProxies.deleteTagBinding` `compute.targetHttpProxies.listEffectiveTags` `compute.targetHttpProxies.listTagBindings` `compute.targetHttpsProxies.createTagBinding` `compute.targetHttpsProxies.deleteTagBinding` `compute.targetHttpsProxies.listEffectiveTags` `compute.targetHttpsProxies.listTagBindings` `compute.targetInstances.createTagBinding` `compute.targetInstances.deleteTagBinding` `compute.targetInstances.listEffectiveTags` `compute.targetInstances.listTagBindings` `compute.targetPools.createTagBinding` `compute.targetPools.deleteTagBinding` `compute.targetPools.listEffectiveTags` `compute.targetPools.listTagBindings` `compute.targetSslProxies.createTagBinding` `compute.targetSslProxies.deleteTagBinding` `compute.targetSslProxies.listEffectiveTags` `compute.targetSslProxies.listTagBindings` `compute.targetTcpProxies.createTagBinding` `compute.targetTcpProxies.deleteTagBinding` `compute.targetTcpProxies.listEffectiveTags` `compute.targetTcpProxies.listTagBindings` `compute.urlMaps.createTagBinding` `compute.urlMaps.deleteTagBinding` `compute.urlMaps.listEffectiveTags` `compute.urlMaps.listTagBindings` `container.clusters.createTagBinding` `container.clusters.deleteTagBinding` `container.clusters.listEffectiveTags` `container.clusters.listTagBindings` `datafusion.instances.createTagBinding` `datafusion.instances.deleteTagBinding` `datafusion.instances.listEffectiveTags` `datafusion.instances.listTagBindings` `datastore.databases.createTagBinding` `datastore.databases.deleteTagBinding` `datastore.databases.listEffectiveTags` `datastore.databases.listTagBindings` `datastream.connectionProfiles.createTagBinding` `datastream.connectionProfiles.deleteTagBinding` `datastream.connectionProfiles.listEffectiveTags` `datastream.connectionProfiles.listTagBindings` `datastream.privateConnections.createTagBinding` `datastream.privateConnections.deleteTagBinding` `datastream.privateConnections.listEffectiveTags` `datastream.privateConnections.listTagBindings` `datastream.streams.createTagBinding` `datastream.streams.deleteTagBinding` `datastream.streams.listEffectiveTags` `datastream.streams.listTagBindings` `domains.registrations.createTagBinding` `domains.registrations.deleteTagBinding` `domains.registrations.listEffectiveTags` `domains.registrations.listTagBindings` `file.backups.createTagBinding` `file.backups.deleteTagBinding` `file.backups.listEffectiveTags` `file.backups.listTagBindings` `file.instances.createTagBinding` `file.instances.deleteTagBinding` `file.instances.listEffectiveTags` `file.instances.listTagBindings` `file.snapshots.createTagBinding` `file.snapshots.deleteTagBinding` `file.snapshots.listEffectiveTags` `file.snapshots.listTagBindings` `managedidentities.domains.createTagBinding` `managedidentities.domains.deleteTagBinding` `managedidentities.domains.listEffectiveTags` `managedidentities.domains.listTagBindings` `redis.instances.createTagBinding` `redis.instances.deleteTagBinding` `redis.instances.listEffectiveTags` `redis.instances.listTagBindings` `resourcemanager.hierarchyNodes.createTagBinding` `resourcemanager.hierarchyNodes.deleteTagBinding` `resourcemanager.hierarchyNodes.listEffectiveTags` `resourcemanager.hierarchyNodes.listTagBindings` `resourcemanager.resourceTagBindings.create` `resourcemanager.resourceTagBindings.delete` `resourcemanager.resourceTagBindings.list` `resourcemanager.tagKeys.get` `resourcemanager.tagKeys.list` `resourcemanager.tagValueBindings.create` `resourcemanager.tagValueBindings.delete` `resourcemanager.tagValues.get` `resourcemanager.tagValues.list` `run.jobs.createTagBinding` `run.jobs.deleteTagBinding` `run.jobs.listEffectiveTags` `run.jobs.listTagBindings` `run.services.createTagBinding` `run.services.deleteTagBinding` `run.services.listEffectiveTags` `run.services.listTagBindings` `spanner.instances.createTagBinding` `spanner.instances.deleteTagBinding` `spanner.instances.listEffectiveTags` `spanner.instances.listTagBindings` `storage.buckets.createTagBinding` `storage.buckets.deleteTagBinding` `storage.buckets.listEffectiveTags` `storage.buckets.listTagBindings`
Sensitive Data Protection	The following permissions have been added to the DLP API Service Agent role (`roles/dlp.serviceAgent`): `resourcemanager.hierarchyNodes.listEffectiveTags`
Firebase	The following permissions have been added to the Firebase Admin role (`roles/firebase.admin`): `resourcemanager.hierarchyNodes.listEffectiveTags`
Firebase	The following permissions have been added to the Firebase Develop Admin role (`roles/firebase.developAdmin`): `resourcemanager.hierarchyNodes.listEffectiveTags`
Identity and Access Management	The following permissions have been added to the Security Admin role (`roles/iam.securityAdmin`): `logging.queries.create` `logging.queries.delete` `logging.queries.get` `logging.queries.update` `logging.queries.usePrivate`
Identity and Access Management	The following permissions have been added to the Security Reviewer role (`roles/iam.securityReviewer`): `logging.queries.create` `logging.queries.delete` `logging.queries.get` `logging.queries.update` `logging.queries.usePrivate`
Dataproc Metastore	The Dataproc Metastore Managed Migration Admin role (`roles/metastore.migrationAdmin`) has reached General Availability (GA).
Dataproc Metastore	The following permissions have been added to the Dataproc Metastore Managed Migration Admin role (`roles/metastore.migrationAdmin`): `compute.regionHealthChecks.use`
AI Platform	The following permissions have been added to the AI Platform Service Agent role (`roles/ml.serviceAgent`): `resourcemanager.hierarchyNodes.listEffectiveTags`
Cloud Monitoring	The following permissions have been added to the Monitoring Service Agent role (`roles/monitoring.notificationServiceAgent`): `bigquery.jobs.create`
Cloud Storage	The following permissions have been added to the Storage Admin role (`roles/storage.admin`): `resourcemanager.hierarchyNodes.listEffectiveTags`
Vision AI	The following permissions have been added to the Cloud Vision AI Service Agent role (`roles/visionai.serviceAgent`): `aiplatform.endpoints.predict`
Visual Inspection AI	The following permissions have been added to the Visual Inspection AI Service Agent role (`roles/visualinspection.serviceAgent`): `resourcemanager.hierarchyNodes.listEffectiveTags`
Vertex AI	The following permissions have been added: `aiplatform.modelMonitoringJobs.create` `aiplatform.modelMonitoringJobs.delete` `aiplatform.modelMonitoringJobs.get` `aiplatform.modelMonitoringJobs.list` `aiplatform.modelMonitors.create` `aiplatform.modelMonitors.delete` `aiplatform.modelMonitors.get` `aiplatform.modelMonitors.list` `aiplatform.modelMonitors.searchModelMonitoringAlerts` `aiplatform.modelMonitors.searchModelMonitoringStats` `aiplatform.modelMonitors.update`
Bare Metal Solution	The following permissions have been added: `baremetalsolution.pods.list`
Bare Metal Solution	The following permissions are supported in custom roles: `baremetalsolution.pods.list`
Bare Metal Solution	The following permissions have reached General Availability (GA): `baremetalsolution.pods.list`
Bigtable	The following permissions have been added: `bigtable.instances.executeQuery`
Discovery Engine	The following permissions have been added: `discoveryengine.answers.get` `discoveryengine.completionConfigs.completeQuery` `discoveryengine.evaluations.create` `discoveryengine.evaluations.get` `discoveryengine.evaluations.list` `discoveryengine.rankingConfigs.rank` `discoveryengine.sampleQueries.create` `discoveryengine.sampleQueries.delete` `discoveryengine.sampleQueries.get` `discoveryengine.sampleQueries.import` `discoveryengine.sampleQueries.list` `discoveryengine.sampleQueries.update` `discoveryengine.sampleQuerySets.create` `discoveryengine.sampleQuerySets.delete` `discoveryengine.sampleQuerySets.get` `discoveryengine.sampleQuerySets.list` `discoveryengine.sampleQuerySets.update` `discoveryengine.servingConfigs.answer` `discoveryengine.sessions.create` `discoveryengine.sessions.delete` `discoveryengine.sessions.get` `discoveryengine.sessions.list` `discoveryengine.sessions.update`
Discovery Engine	The following permissions are supported in custom roles: `discoveryengine.answers.get` `discoveryengine.completionConfigs.completeQuery` `discoveryengine.evaluations.create` `discoveryengine.evaluations.get` `discoveryengine.evaluations.list` `discoveryengine.rankingConfigs.rank` `discoveryengine.sampleQueries.create` `discoveryengine.sampleQueries.delete` `discoveryengine.sampleQueries.get` `discoveryengine.sampleQueries.import` `discoveryengine.sampleQueries.list` `discoveryengine.sampleQueries.update` `discoveryengine.sampleQuerySets.create` `discoveryengine.sampleQuerySets.delete` `discoveryengine.sampleQuerySets.get` `discoveryengine.sampleQuerySets.list` `discoveryengine.sampleQuerySets.update` `discoveryengine.servingConfigs.answer` `discoveryengine.sessions.create` `discoveryengine.sessions.delete` `discoveryengine.sessions.get` `discoveryengine.sessions.list` `discoveryengine.sessions.update`
Discovery Engine	The following permissions have reached General Availability (GA): `discoveryengine.answers.get` `discoveryengine.servingConfigs.answer` `discoveryengine.sessions.create` `discoveryengine.sessions.delete` `discoveryengine.sessions.get` `discoveryengine.sessions.list` `discoveryengine.sessions.update`
Firebase Data Connect	The following permissions have been added: `firebasedataconnect.connectorRevisions.delete` `firebasedataconnect.connectorRevisions.get` `firebasedataconnect.connectorRevisions.list` `firebasedataconnect.connectors.create` `firebasedataconnect.connectors.delete` `firebasedataconnect.connectors.get` `firebasedataconnect.connectors.list` `firebasedataconnect.connectors.update` `firebasedataconnect.locations.get` `firebasedataconnect.locations.list` `firebasedataconnect.operations.cancel` `firebasedataconnect.operations.delete` `firebasedataconnect.operations.get` `firebasedataconnect.operations.list` `firebasedataconnect.schemaRevisions.delete` `firebasedataconnect.schemaRevisions.get` `firebasedataconnect.schemaRevisions.list` `firebasedataconnect.schemas.create` `firebasedataconnect.schemas.delete` `firebasedataconnect.schemas.get` `firebasedataconnect.schemas.list` `firebasedataconnect.schemas.update` `firebasedataconnect.services.create` `firebasedataconnect.services.delete` `firebasedataconnect.services.executeGraphql` `firebasedataconnect.services.executeGraphqlRead` `firebasedataconnect.services.get` `firebasedataconnect.services.list` `firebasedataconnect.services.update`
Firebase Data Connect	The following permissions are supported in custom roles: `firebasedataconnect.connectorRevisions.delete` `firebasedataconnect.connectorRevisions.get` `firebasedataconnect.connectorRevisions.list` `firebasedataconnect.connectors.create` `firebasedataconnect.connectors.delete` `firebasedataconnect.connectors.get` `firebasedataconnect.connectors.list` `firebasedataconnect.connectors.update` `firebasedataconnect.locations.get` `firebasedataconnect.locations.list` `firebasedataconnect.operations.cancel` `firebasedataconnect.operations.delete` `firebasedataconnect.operations.get` `firebasedataconnect.operations.list` `firebasedataconnect.schemaRevisions.delete` `firebasedataconnect.schemaRevisions.get` `firebasedataconnect.schemaRevisions.list` `firebasedataconnect.schemas.create` `firebasedataconnect.schemas.delete` `firebasedataconnect.schemas.get` `firebasedataconnect.schemas.list` `firebasedataconnect.schemas.update` `firebasedataconnect.services.create` `firebasedataconnect.services.delete` `firebasedataconnect.services.executeGraphql` `firebasedataconnect.services.executeGraphqlRead` `firebasedataconnect.services.get` `firebasedataconnect.services.list` `firebasedataconnect.services.update`
Identity and Access Management	The following permissions have been added: `iam.operations.get` `iam.policybindings.get` `iam.policybindings.list` `iam.principalaccessboundarypolicies.bind` `iam.principalaccessboundarypolicies.create` `iam.principalaccessboundarypolicies.delete` `iam.principalaccessboundarypolicies.get` `iam.principalaccessboundarypolicies.list` `iam.principalaccessboundarypolicies.searchPolicyBindings` `iam.principalaccessboundarypolicies.unbind` `iam.principalaccessboundarypolicies.update` `iam.workforcePools.createPolicyBinding` `iam.workforcePools.deletePolicyBinding` `iam.workforcePools.searchPolicyBindings` `iam.workforcePools.updatePolicyBinding` `iam.workloadIdentityPools.createPolicyBinding` `iam.workloadIdentityPools.deletePolicyBinding` `iam.workloadIdentityPools.searchPolicyBindings` `iam.workloadIdentityPools.updatePolicyBinding` `iam.workspacePools.createPolicyBinding` `iam.workspacePools.deletePolicyBinding` `iam.workspacePools.searchPolicyBindings` `iam.workspacePools.updatePolicyBinding`
Identity and Access Management	The following permissions have been added: `iam.googleapis.com/workforcePools.createPolicyBinding` `iam.googleapis.com/workforcePools.deletePolicyBinding` `iam.googleapis.com/workforcePools.searchPolicyBindings` `iam.googleapis.com/workforcePools.updatePolicyBinding` `iam.googleapis.com/workspacePools.createPolicyBinding` `iam.googleapis.com/workspacePools.deletePolicyBinding` `iam.googleapis.com/workspacePools.searchPolicyBindings` `iam.googleapis.com/workspacePools.updatePolicyBinding`
Dataproc Metastore	The following permissions have reached General Availability (GA): `metastore.migrations.cancel` `metastore.migrations.complete` `metastore.migrations.delete` `metastore.migrations.get` `metastore.migrations.list` `metastore.migrations.start`
Google Cloud Observability	The following permissions have been added: `observability.scopes.get` `observability.scopes.update`
Resource Manager	The following permissions have been added: `resourcemanager.folders.createPolicyBinding` `resourcemanager.folders.deletePolicyBinding` `resourcemanager.folders.searchPolicyBinding` `resourcemanager.folders.searchPolicyBindings` `resourcemanager.folders.updatePolicyBinding` `resourcemanager.organizations.createPolicyBinding` `resourcemanager.organizations.deletePolicyBinding` `resourcemanager.organizations.searchPolicyBinding` `resourcemanager.organizations.searchPolicyBindings` `resourcemanager.organizations.updatePolicyBinding` `resourcemanager.projects.createPolicyBinding` `resourcemanager.projects.deletePolicyBinding` `resourcemanager.projects.searchPolicyBinding` `resourcemanager.projects.searchPolicyBindings` `resourcemanager.projects.updatePolicyBinding`

IAM changes as of 2024-06-14

Service	Description
Config Management	The following permissions have been added to the Anthos Config Management Service Agent role (`roles/anthosconfigmanagement.serviceAgent`): `gkehub.gateway.delete` `gkehub.gateway.generateCredentials` `gkehub.gateway.get` `gkehub.gateway.patch` `gkehub.gateway.post` `gkehub.gateway.put`
GKE Identity Service	The following permissions have been added to the Anthos Identity Service Agent role (`roles/anthosidentityservice.serviceAgent`): `gkehub.gateway.delete` `gkehub.gateway.generateCredentials` `gkehub.gateway.get` `gkehub.gateway.patch` `gkehub.gateway.post` `gkehub.gateway.put`
Policy Controller	The following permissions have been added to the Anthos Policy Controller Service Agent role (`roles/anthospolicycontroller.serviceAgent`): `gkehub.gateway.delete` `gkehub.gateway.generateCredentials` `gkehub.gateway.get` `gkehub.gateway.patch` `gkehub.gateway.post` `gkehub.gateway.put`
Cloud Service Mesh	The following permissions have been added to the Anthos Service Mesh Service Agent role (`roles/anthosservicemesh.serviceAgent`): `gkehub.gateway.generateCredentials`
App Development Experience	The following permissions have been added to the App Development Experience Service Agent role (`roles/appdevelopmentexperience.serviceAgent`): `gkehub.gateway.delete` `gkehub.gateway.generateCredentials` `gkehub.gateway.get` `gkehub.gateway.patch` `gkehub.gateway.post` `gkehub.gateway.put`
Backup and Disaster Recovery	The Backup and DR Management Server Accessor role (`roles/backupdr.managementServerAccessor`) has been added with the following permissions: `backupdr.googleapis.com/managementServers.createConnection` `backupdr.managementServers.createConnection`
Google Security Operations	The following permissions have been removed from the Chronicle API Restricted Data Access Viewer role (`roles/chronicle.restrictedDataAccessViewer`): `chronicle.dataTableRows.get` `chronicle.dataTableRows.list` `chronicle.dataTables.get` `chronicle.dataTables.list`
Google Security Operations	The following permissions have been added to the Chronicle Service Agent role (`roles/chronicle.serviceAgent`): `bigquery.jobs.create` `bigquery.jobs.get` `bigquery.tables.create` `bigquery.tables.delete` `bigquery.tables.get` `storage.objects.delete`
Google Security Operations	The following permissions have been added to the Chronicle SOAR Admin role (`roles/chronicle.soarAdmin`): `cloudasset.assets.exportResource` `cloudasset.assets.queryAccessPolicy` `cloudasset.assets.queryIamPolicy` `cloudasset.assets.queryOSInventories` `cloudasset.assets.queryResource` `cloudasset.assets.searchAllIamPolicies` `cloudasset.assets.searchAllResources` `resourcemanager.organizations.get` `securitycenter.attackpaths.list` `securitycenter.exposurepathexplan.get` `securitycenter.findings.bulkMuteUpdate` `securitycenter.findings.group` `securitycenter.findings.list` `securitycenter.findings.listFindingPropertyNames` `securitycenter.findings.setMute` `securitycenter.findings.setState` `securitycenter.findings.update` `securitycenter.findingsecuritymarks.update` `securitycenter.simulations.get` `securitycenter.userinterfacemetadata.get` `securitycenter.valuedresources.list`
Google Security Operations	The following permissions have been added to the Chronicle SOAR Service Agent role (`roles/chronicle.soarServiceAgent`): `securitycenter.findings.setMute` `securitycenter.findings.update` `securitycenter.sources.list`
Google Security Operations	The following permissions have been added to the Chronicle SOAR Threat Manager role (`roles/chronicle.soarThreatManager`): `cloudasset.assets.exportResource` `cloudasset.assets.queryAccessPolicy` `cloudasset.assets.queryIamPolicy` `cloudasset.assets.queryOSInventories` `cloudasset.assets.queryResource` `cloudasset.assets.searchAllIamPolicies` `cloudasset.assets.searchAllResources` `resourcemanager.organizations.get` `securitycenter.attackpaths.list` `securitycenter.exposurepathexplan.get` `securitycenter.findings.bulkMuteUpdate` `securitycenter.findings.group` `securitycenter.findings.list` `securitycenter.findings.listFindingPropertyNames` `securitycenter.findings.setMute` `securitycenter.findings.setState` `securitycenter.findings.update` `securitycenter.findingsecuritymarks.update` `securitycenter.simulations.get` `securitycenter.userinterfacemetadata.get` `securitycenter.valuedresources.list`
Google Security Operations	The following permissions have been added to the Chronicle SOAR Vulnerability Manager role (`roles/chronicle.soarVulnerabilityManager`): `cloudasset.assets.exportResource` `cloudasset.assets.queryAccessPolicy` `cloudasset.assets.queryIamPolicy` `cloudasset.assets.queryOSInventories` `cloudasset.assets.queryResource` `cloudasset.assets.searchAllIamPolicies` `cloudasset.assets.searchAllResources` `resourcemanager.organizations.get` `securitycenter.attackpaths.list` `securitycenter.exposurepathexplan.get` `securitycenter.findings.bulkMuteUpdate` `securitycenter.findings.group` `securitycenter.findings.list` `securitycenter.findings.listFindingPropertyNames` `securitycenter.findings.setMute` `securitycenter.findings.setState` `securitycenter.findings.update` `securitycenter.findingsecuritymarks.update` `securitycenter.simulations.get` `securitycenter.userinterfacemetadata.get` `securitycenter.valuedresources.list`
Config Delivery	The following permissions have been added to the Config Delivery Service Agent role (`roles/configdelivery.serviceAgent`): `gkehub.gateway.delete` `gkehub.gateway.generateCredentials` `gkehub.gateway.get` `gkehub.gateway.patch` `gkehub.gateway.post` `gkehub.gateway.put` `gkehub.memberships.get`
GKE Hub	The following permissions have been added to the GKE Hub Service Agent role (`roles/gkehub.serviceAgent`): `gkehub.gateway.generateCredentials`
Multi-Cluster Ingress	The following permissions have been added to the Multi Cluster Ingress Service Agent role (`roles/multiclusteringress.serviceAgent`): `gkehub.gateway.delete` `gkehub.gateway.generateCredentials` `gkehub.gateway.get` `gkehub.gateway.patch` `gkehub.gateway.post` `gkehub.gateway.put`
Multi-Cluster Metering	The following permissions have been added to the Multi-cluster metering Service Agent role (`roles/multiclustermetering.serviceAgent`): `gkehub.gateway.generateCredentials`
Multi-Cluster Service Discovery	The following permissions have been added to the Multi-Cluster Service Discovery Service Agent role (`roles/multiclusterservicediscovery.serviceAgent`): `gkehub.gateway.delete` `gkehub.gateway.generateCredentials` `gkehub.gateway.get` `gkehub.gateway.patch` `gkehub.gateway.post` `gkehub.gateway.put`
Network Connectivity Center	The Regional Endpoint Admin role (`roles/networkconnectivity.regionalEndpointAdmin`) has reached General Availability (GA).
Network Connectivity Center	The Regional Endpoint Viewer role (`roles/networkconnectivity.regionalEndpointViewer`) has reached General Availability (GA).
Privileged Access Manager	The Privileged Access Manager Admin role (`roles/privilegedaccessmanager.admin`) has reached General Availability (GA).
Privileged Access Manager	The Privileged Access Manager Viewer role (`roles/privilegedaccessmanager.viewer`) has reached General Availability (GA).
Secure Source Manager	The Secure Source Manager Service Agent role (`roles/securesourcemanager.serviceAgent`) has reached General Availability (GA).
Service Directory	The following permissions have been added to the Service Directory Service Agent role (`roles/servicedirectory.serviceAgent`): `gkehub.gateway.delete` `gkehub.gateway.generateCredentials` `gkehub.gateway.get` `gkehub.gateway.patch` `gkehub.gateway.post` `gkehub.gateway.put`
Personalized Service Health	The Personalized Service Health Viewer role (`roles/servicehealth.viewer`) has reached General Availability (GA).
Spectrum Access System (SAS)	The Spectrum SAS Service Agent role (`roles/spectrumsas.serviceAgent`) has reached General Availability (GA).
Google Security Operations	The following permissions have been added: `chronicle.dashboardCharts.get` `chronicle.dashboardCharts.list` `chronicle.dashboardQueries.execute` `chronicle.dashboardQueries.get` `chronicle.dashboardQueries.list` `chronicle.nativeDashboards.create` `chronicle.nativeDashboards.delete` `chronicle.nativeDashboards.duplicate` `chronicle.nativeDashboards.get` `chronicle.nativeDashboards.list` `chronicle.nativeDashboards.update`
Google Security Operations	The following permissions are supported in custom roles: `chronicle.dashboardCharts.get` `chronicle.dashboardCharts.list` `chronicle.dashboardQueries.execute` `chronicle.dashboardQueries.get` `chronicle.dashboardQueries.list` `chronicle.nativeDashboards.create` `chronicle.nativeDashboards.delete` `chronicle.nativeDashboards.duplicate` `chronicle.nativeDashboards.get` `chronicle.nativeDashboards.list` `chronicle.nativeDashboards.update`
Config Delivery	The following permissions have been added: `configdelivery.fleetPackages.create` `configdelivery.fleetPackages.delete` `configdelivery.fleetPackages.get` `configdelivery.fleetPackages.list` `configdelivery.fleetPackages.update` `configdelivery.locations.get` `configdelivery.locations.list` `configdelivery.operations.cancel` `configdelivery.operations.delete` `configdelivery.operations.get` `configdelivery.operations.list` `configdelivery.releases.create` `configdelivery.releases.delete` `configdelivery.releases.get` `configdelivery.releases.list` `configdelivery.releases.update` `configdelivery.resourceBundles.create` `configdelivery.resourceBundles.delete` `configdelivery.resourceBundles.get` `configdelivery.resourceBundles.list` `configdelivery.resourceBundles.update` `configdelivery.rollouts.abort` `configdelivery.rollouts.get` `configdelivery.rollouts.list` `configdelivery.rollouts.resume` `configdelivery.rollouts.suspend`
Config Delivery	The following permissions are supported in custom roles: `configdelivery.fleetPackages.create` `configdelivery.fleetPackages.delete` `configdelivery.fleetPackages.get` `configdelivery.fleetPackages.list` `configdelivery.fleetPackages.update` `configdelivery.locations.get` `configdelivery.locations.list` `configdelivery.operations.cancel` `configdelivery.operations.delete` `configdelivery.operations.get` `configdelivery.operations.list` `configdelivery.releases.create` `configdelivery.releases.delete` `configdelivery.releases.get` `configdelivery.releases.list` `configdelivery.releases.update` `configdelivery.resourceBundles.create` `configdelivery.resourceBundles.delete` `configdelivery.resourceBundles.get` `configdelivery.resourceBundles.list` `configdelivery.resourceBundles.update` `configdelivery.rollouts.abort` `configdelivery.rollouts.get` `configdelivery.rollouts.list` `configdelivery.rollouts.resume` `configdelivery.rollouts.suspend`
Dataproc Resource Manager	The following permissions have been added: `dataprocrm.locations.get` `dataprocrm.locations.list` `dataprocrm.nodePools.create` `dataprocrm.nodePools.delete` `dataprocrm.nodePools.deleteNodes` `dataprocrm.nodePools.get` `dataprocrm.nodePools.list` `dataprocrm.nodePools.resize` `dataprocrm.nodes.get` `dataprocrm.nodes.heartbeat` `dataprocrm.nodes.list` `dataprocrm.nodes.mintOAuthToken` `dataprocrm.nodes.update` `dataprocrm.operations.cancel` `dataprocrm.operations.delete` `dataprocrm.operations.get` `dataprocrm.operations.list` `dataprocrm.workloads.cancel` `dataprocrm.workloads.create` `dataprocrm.workloads.delete` `dataprocrm.workloads.get` `dataprocrm.workloads.list`
Dataproc Resource Manager	The following permissions are supported in custom roles: `dataprocrm.locations.get` `dataprocrm.locations.list` `dataprocrm.nodePools.create` `dataprocrm.nodePools.delete` `dataprocrm.nodePools.deleteNodes` `dataprocrm.nodePools.get` `dataprocrm.nodePools.list` `dataprocrm.nodePools.resize` `dataprocrm.nodes.get` `dataprocrm.nodes.heartbeat` `dataprocrm.nodes.list` `dataprocrm.nodes.mintOAuthToken` `dataprocrm.nodes.update` `dataprocrm.operations.cancel` `dataprocrm.operations.delete` `dataprocrm.operations.get` `dataprocrm.operations.list` `dataprocrm.workloads.cancel` `dataprocrm.workloads.create` `dataprocrm.workloads.delete` `dataprocrm.workloads.get` `dataprocrm.workloads.list`
GKE Hub	The following permissions have been added: `gkehub.gateway.generateCredentials`
GKE Hub	The following permissions are supported in custom roles: `gkehub.gateway.generateCredentials`
GKE Hub	The following permissions have reached General Availability (GA): `gkehub.gateway.generateCredentials`
Maps Analytics	The following permissions have been added: `mapsanalytics.metricData.queryMobilitySolutionsOverageData`
Maps Analytics	The following permissions are supported in custom roles: `mapsanalytics.metricData.queryMobilitySolutionsOverageData`
Network Connectivity Center	The following permissions have reached General Availability (GA): `networkconnectivity.regionalEndpoints.create` `networkconnectivity.regionalEndpoints.delete` `networkconnectivity.regionalEndpoints.get` `networkconnectivity.regionalEndpoints.list`
Privileged Access Manager	The following permissions have reached General Availability (GA): `privilegedaccessmanager.entitlements.create` `privilegedaccessmanager.entitlements.delete` `privilegedaccessmanager.entitlements.get` `privilegedaccessmanager.entitlements.list` `privilegedaccessmanager.entitlements.setIamPolicy` `privilegedaccessmanager.entitlements.update` `privilegedaccessmanager.grants.get` `privilegedaccessmanager.grants.list` `privilegedaccessmanager.grants.revoke` `privilegedaccessmanager.locations.checkOnboardingStatus` `privilegedaccessmanager.locations.get` `privilegedaccessmanager.locations.list` `privilegedaccessmanager.operations.delete` `privilegedaccessmanager.operations.get` `privilegedaccessmanager.operations.list`
Personalized Service Health	The following permissions have reached General Availability (GA): `servicehealth.events.get` `servicehealth.events.list` `servicehealth.locations.get` `servicehealth.locations.list` `servicehealth.organizationEvents.get` `servicehealth.organizationEvents.list` `servicehealth.organizationImpacts.get` `servicehealth.organizationImpacts.list`
Spanner	The following permissions have been added: `spanner.instancePartitionOperations.cancel` `spanner.instancePartitionOperations.delete` `spanner.instancePartitionOperations.get` `spanner.instancePartitionOperations.list` `spanner.instancePartitions.create` `spanner.instancePartitions.delete` `spanner.instancePartitions.get` `spanner.instancePartitions.list` `spanner.instancePartitions.update`
Spanner	The following permissions are supported in custom roles: `spanner.instancePartitionOperations.cancel` `spanner.instancePartitionOperations.delete` `spanner.instancePartitionOperations.get` `spanner.instancePartitionOperations.list` `spanner.instancePartitions.create` `spanner.instancePartitions.delete` `spanner.instancePartitions.get` `spanner.instancePartitions.list` `spanner.instancePartitions.update`
Workload Manager	The following permissions have been added: `workloadmanager.discoveredprofiles.get` `workloadmanager.discoveredprofiles.getHealth` `workloadmanager.discoveredprofiles.list`

IAM changes as of 2024-05-31

Service	Description
Assured Workloads	The following permissions have been added to the Assured Workloads Administrator role (`roles/assuredworkloads.admin`): `orgpolicy.policies.create` `orgpolicy.policies.delete` `orgpolicy.policies.list` `orgpolicy.policies.update`
Assured Workloads	The following permissions have been added to the Assured Workloads Editor role (`roles/assuredworkloads.editor`): `orgpolicy.policies.create` `orgpolicy.policies.delete` `orgpolicy.policies.list` `orgpolicy.policies.update`
Assured Workloads	The following permissions have been added to the Assured Workloads Reader role (`roles/assuredworkloads.reader`): `orgpolicy.policies.list`
Google Cloud Support	The following permissions have been added to the Tech Support Editor role (`roles/cloudsupport.techSupportEditor`): `billing.resourceAssociations.list`
Config Delivery	The Config Delivery Service Agent role (`roles/configdelivery.serviceAgent`) has reached General Availability (GA).
Workload Manager	The following permissions have been added to the Workload Manager Service Agent role (`roles/workloadmanager.serviceAgent`): `cloudasset.assets.listAccessPolicy` `cloudasset.assets.listIamPolicy` `cloudasset.assets.listOSInventories` `cloudasset.assets.listOrgPolicy` `cloudasset.assets.listResource` `serviceusage.services.use`
Cloud Workstations	The following permissions have been added to the Workstations Service Agent role (`roles/workstations.serviceAgent`): `compute.snapshots.createTagBinding` `compute.snapshots.deleteTagBinding` `compute.snapshots.listTagBindings`
BigQuery	The following permissions have been added: `bigquery.tables.listEffectiveTags` `bigquery.tables.listTagBindings`
BigQuery	The following permissions are supported in custom roles: `bigquery.tables.listEffectiveTags` `bigquery.tables.listTagBindings`
BigQuery	The following permissions have reached General Availability (GA): `bigquery.tables.createTagBinding` `bigquery.tables.deleteTagBinding` `bigquery.tables.listEffectiveTags` `bigquery.tables.listTagBindings`
Cloud Logging	The following permissions have been added: `logging.queries.usePrivate`
Cloud Logging	The following permissions are supported in custom roles: `logging.queries.usePrivate`
Cloud Logging	The following permissions have reached General Availability (GA): `logging.queries.usePrivate`

IAM changes as of 2024-05-24

Service	Description
Audit Manager	The following permissions have been added to the Audit Manager Auditing Service Agent role (`roles/auditmanager.serviceAgent`): `secretmanager.secrets.list`
Gemini for Google Cloud API	The Cloud AI Companion Service Agent role (`roles/cloudaicompanion.serviceAgent`) has been added with the following permissions: `cloudbuild.connections.get` `cloudbuild.googleapis.com/connections.get` `cloudbuild.googleapis.com/repositories.accessReadToken` `cloudbuild.googleapis.com/repositories.fetchGitRefs` `cloudbuild.googleapis.com/repositories.get` `cloudbuild.googleapis.com/repositories.list` `cloudbuild.repositories.accessReadToken` `cloudbuild.repositories.fetchGitRefs` `cloudbuild.repositories.get` `cloudbuild.repositories.list` `developerconnect.connections.get` `developerconnect.gitRepositoryLinks.fetchGitRefs` `developerconnect.gitRepositoryLinks.fetchReadToken` `developerconnect.gitRepositoryLinks.get` `developerconnect.gitRepositoryLinks.list` `developerconnect.googleapis.com/connections.get` `developerconnect.googleapis.com/gitRepositoryLinks.fetchGitRefs` `developerconnect.googleapis.com/gitRepositoryLinks.fetchReadToken` `developerconnect.googleapis.com/gitRepositoryLinks.get` `developerconnect.googleapis.com/gitRepositoryLinks.list` `logging.googleapis.com/logEntries.create` `logging.googleapis.com/logEntries.route` `logging.logEntries.create` `logging.logEntries.route` `serviceusage.googleapis.com/services.use` `serviceusage.services.use`
Dataproc	The following permissions have been added to the Dataproc Service Agent role (`roles/dataproc.serviceAgent`): `dataproc.sessionTemplates.get`
Basic Role	The following permissions have been added to the Editor role (`roles/editor`): `securitycentermanagement.securityCommandCenter.checkActivationOperation` `securitycentermanagement.securityCommandCenter.checkEligibility`
Eventarc	The following permissions have been added to the Eventarc Service Agent role (`roles/eventarc.serviceAgent`): `eventarc.operations.get`
GKE Hub	The following permissions have been added to the Fleet Project-level Scope Viewer role (`roles/gkehub.scopeViewerProjectLevel`): `monitoring.timeSeries.list`
GKE Hub	The following permissions have been added to the GKE Hub Service Agent role (`roles/gkehub.serviceAgent`): `gkehub.gateway.delete` `gkehub.gateway.get` `gkehub.gateway.patch` `gkehub.gateway.post` `gkehub.gateway.put`
Multi-Cluster Metering	The following permissions have been added to the Multi-cluster metering Service Agent role (`roles/multiclustermetering.serviceAgent`): `gkehub.gateway.delete` `gkehub.gateway.get` `gkehub.gateway.patch` `gkehub.gateway.post` `gkehub.gateway.put`
Basic Role	The following permissions have been added to the Owner role (`roles/owner`): `securitycentermanagement.securityCommandCenter.checkActivationOperation` `securitycentermanagement.securityCommandCenter.checkEligibility`
Route Optimization	The Route Optimization Editor role (`roles/routeoptimization.editor`) has reached General Availability (GA).
Route Optimization	The Route Optimization Viewer role (`roles/routeoptimization.viewer`) has reached General Availability (GA).
Security Command Center	The following permissions have been added to the Security Center Admin role (`roles/securitycenter.admin`): `securitycentermanagement.securityCommandCenter.checkActivationOperation` `securitycentermanagement.securityCommandCenter.checkEligibility`
Security Command Center	The following permissions have been added to the Security Center Settings Admin role (`roles/securitycenter.settingsAdmin`): `securitycentermanagement.securityCommandCenter.checkActivationOperation` `securitycentermanagement.securityCommandCenter.checkEligibility`
Security Command Center	The following permissions have been added to the Security Center Settings Editor role (`roles/securitycenter.settingsEditor`): `securitycentermanagement.securityCommandCenter.checkActivationOperation` `securitycentermanagement.securityCommandCenter.checkEligibility`
Security Center Management API	The Security Center Management Services Editor role (`roles/securitycentermanagement.securityCenterServicesEditor`) has reached General Availability (GA).
Security Center Management API	The Security Center Management Services Viewer role (`roles/securitycentermanagement.securityCenterServicesViewer`) has reached General Availability (GA).
Security Center Management API	The following permissions have been added to the Security Center Management Admin role (`roles/securitycentermanagement.admin`): `securitycentermanagement.securityCommandCenter.checkActivationOperation` `securitycentermanagement.securityCommandCenter.checkEligibility`
Security Center Management API	The following permissions have been added to the Security Center Management Settings Editor role (`roles/securitycentermanagement.settingsEditor`): `securitycentermanagement.securityCommandCenter.checkActivationOperation` `securitycentermanagement.securityCommandCenter.checkEligibility`
Basic Role	The following permissions have been added to the Viewer role (`roles/viewer`): `securitycentermanagement.securityCommandCenter.checkActivationOperation` `securitycentermanagement.securityCommandCenter.checkEligibility`
Basic Role	The following permissions have been removed from the Viewer role (`roles/viewer`): `chronicle.logs.import`
Vertex AI	The following permissions have been added: `aiplatform.featureOnlineStores.getIamPolicy` `aiplatform.featureOnlineStores.setIamPolicy` `aiplatform.featureViews.getIamPolicy` `aiplatform.featureViews.setIamPolicy`
Google Security Operations	The following permissions have been added: `chronicle.dataTableRows.asyncBulkCreate` `chronicle.dataTableRows.asyncBulkReplace` `chronicle.dataTableRows.asyncBulkUpdate` `chronicle.dataTableRows.bulkCreate` `chronicle.dataTableRows.bulkReplace` `chronicle.dataTableRows.bulkUpdate` `chronicle.dataTables.bulkCreateDataTableAsync`
Google Security Operations	The following permissions are supported in custom roles: `chronicle.dataTableRows.asyncBulkCreate` `chronicle.dataTableRows.asyncBulkReplace` `chronicle.dataTableRows.asyncBulkUpdate` `chronicle.dataTableRows.bulkCreate` `chronicle.dataTableRows.bulkReplace` `chronicle.dataTableRows.bulkUpdate` `chronicle.dataTables.bulkCreateDataTableAsync`
Cloud Data Fusion	The following permissions have been added: `datafusion.instances.createTagBinding` `datafusion.instances.deleteTagBinding` `datafusion.instances.listEffectiveTags` `datafusion.instances.listTagBindings`
Cloud Data Fusion	The following permissions have reached General Availability (GA): `datafusion.instances.createTagBinding` `datafusion.instances.deleteTagBinding` `datafusion.instances.listEffectiveTags` `datafusion.instances.listTagBindings`
Live Stream	The following permissions have been added: `livestream.clips.create` `livestream.clips.get` `livestream.clips.list`
Live Stream	The following permissions are supported in custom roles: `livestream.clips.create` `livestream.clips.get` `livestream.clips.list`
Live Stream	The following permissions have reached General Availability (GA): `livestream.clips.create` `livestream.clips.get` `livestream.clips.list`
Cloud Logging	The following permissions have been added: `logging.queries.deleteShared` `logging.queries.getShared`
Cloud Logging	The following permissions are supported in custom roles: `logging.queries.deleteShared` `logging.queries.getShared`
Cloud Logging	The following permissions have reached General Availability (GA): `logging.queries.deleteShared` `logging.queries.getShared`
Network Services	The following permissions have been added: `networkservices.route_views.get` `networkservices.route_views.list`
reCAPTCHA	The following permissions have been added: `recaptchaenterprise.firewallpolicies.create` `recaptchaenterprise.firewallpolicies.delete` `recaptchaenterprise.firewallpolicies.get` `recaptchaenterprise.firewallpolicies.list` `recaptchaenterprise.firewallpolicies.update`
reCAPTCHA	The following permissions are supported in custom roles: `recaptchaenterprise.firewallpolicies.create` `recaptchaenterprise.firewallpolicies.delete` `recaptchaenterprise.firewallpolicies.get` `recaptchaenterprise.firewallpolicies.list` `recaptchaenterprise.firewallpolicies.update`
Route Optimization	The following permissions have been added: `routeoptimization.locations.use` `routeoptimization.operations.create` `routeoptimization.operations.get`
Route Optimization	The following permissions are supported in custom roles: `routeoptimization.locations.use` `routeoptimization.operations.create` `routeoptimization.operations.get`
Route Optimization	The following permissions have reached General Availability (GA): `routeoptimization.locations.use` `routeoptimization.operations.create` `routeoptimization.operations.get`
Security Center Management API	The following permissions have been added: `securitycentermanagement.securityCenterServices.get` `securitycentermanagement.securityCenterServices.list` `securitycentermanagement.securityCenterServices.update` `securitycentermanagement.securityCommandCenter.checkActivationOperation` `securitycentermanagement.securityCommandCenter.checkEligibility`
Security Center Management API	The following permissions are supported in custom roles: `securitycentermanagement.securityCenterServices.get` `securitycentermanagement.securityCenterServices.list` `securitycentermanagement.securityCenterServices.update`
Security Center Management API	The following permissions have reached General Availability (GA): `securitycentermanagement.securityCenterServices.get` `securitycentermanagement.securityCenterServices.list` `securitycentermanagement.securityCenterServices.update`

IAM changes as of 2024-05-10

Service	Description
Vertex AI	The following permissions have been added to the Vertex AI Administrator role (`roles/aiplatform.admin`): `aiplatform.agentExamples.create` `aiplatform.agentExamples.delete` `aiplatform.agentExamples.get` `aiplatform.agentExamples.list` `aiplatform.agentExamples.update` `aiplatform.agents.create` `aiplatform.agents.delete` `aiplatform.agents.get` `aiplatform.agents.list` `aiplatform.agents.update` `aiplatform.apps.create` `aiplatform.apps.delete` `aiplatform.apps.get` `aiplatform.apps.list` `aiplatform.apps.update` `aiplatform.cacheConfigs.get` `aiplatform.cacheConfigs.update` `aiplatform.sessions.get` `aiplatform.sessions.list` `aiplatform.sessions.run` `aiplatform.tuningJobs.vertexTune`
Vertex AI	The following permissions have been added to the Colab Enterprise Admin role (`roles/aiplatform.colabEnterpriseAdmin`): `aiplatform.notebookRuntimeTemplates.update`
Vertex AI	The following permissions have been added to the Vertex AI Colab Service Agent role (`roles/aiplatform.colabServiceAgent`): `compute.instances.getGuestAttributes`
Vertex AI	The following permissions have been added to the Vertex AI Custom Code Service Agent role (`roles/aiplatform.customCodeServiceAgent`): `aiplatform.agentExamples.create` `aiplatform.agentExamples.delete` `aiplatform.agentExamples.get` `aiplatform.agentExamples.list` `aiplatform.agentExamples.update` `aiplatform.agents.create` `aiplatform.agents.delete` `aiplatform.agents.get` `aiplatform.agents.list` `aiplatform.agents.update` `aiplatform.apps.create` `aiplatform.apps.delete` `aiplatform.apps.get` `aiplatform.apps.list` `aiplatform.apps.update` `aiplatform.cacheConfigs.get` `aiplatform.sessions.get` `aiplatform.sessions.list` `aiplatform.sessions.run` `aiplatform.tuningJobs.vertexTune`
Vertex AI	The following permissions have been added to the Notebook Runtime Admin role (`roles/aiplatform.notebookRuntimeAdmin`): `aiplatform.notebookRuntimeTemplates.update`
Vertex AI	The following permissions have been added to the Vertex AI RAG Data Service Agent role (`roles/aiplatform.ragServiceAgent`): `aiplatform.endpoints.get` `aiplatform.models.get`
Vertex AI	The following permissions have been added to the Vertex AI Service Agent role (`roles/aiplatform.serviceAgent`): `aiplatform.agentExamples.create` `aiplatform.agentExamples.delete` `aiplatform.agentExamples.get` `aiplatform.agentExamples.list` `aiplatform.agentExamples.update` `aiplatform.agents.create` `aiplatform.agents.delete` `aiplatform.agents.get` `aiplatform.agents.list` `aiplatform.agents.update` `aiplatform.apps.create` `aiplatform.apps.delete` `aiplatform.apps.get` `aiplatform.apps.list` `aiplatform.apps.update` `aiplatform.cacheConfigs.get` `aiplatform.sessions.get` `aiplatform.sessions.list` `aiplatform.sessions.run` `aiplatform.tuningJobs.vertexTune` `compute.instances.getGuestAttributes`
Vertex AI	The following permissions have been added to the Vertex AI User role (`roles/aiplatform.user`): `aiplatform.agentExamples.create` `aiplatform.agentExamples.delete` `aiplatform.agentExamples.get` `aiplatform.agentExamples.list` `aiplatform.agentExamples.update` `aiplatform.agents.create` `aiplatform.agents.delete` `aiplatform.agents.get` `aiplatform.agents.list` `aiplatform.agents.update` `aiplatform.apps.create` `aiplatform.apps.delete` `aiplatform.apps.get` `aiplatform.apps.list` `aiplatform.apps.update` `aiplatform.cacheConfigs.get` `aiplatform.sessions.get` `aiplatform.sessions.list` `aiplatform.sessions.run` `aiplatform.tuningJobs.vertexTune`
Vertex AI	The following permissions have been added to the Vertex AI Viewer role (`roles/aiplatform.viewer`): `aiplatform.agentExamples.get` `aiplatform.agentExamples.list` `aiplatform.agents.get` `aiplatform.agents.list` `aiplatform.apps.get` `aiplatform.apps.list` `aiplatform.cacheConfigs.get` `aiplatform.sessions.get` `aiplatform.sessions.list`
API Hub	The following permissions have been added to the Cloud API Hub Editor role (`roles/apihub.editor`): `apihub.operations.get` `apihub.operations.list`
API Hub	The following permissions have been removed from the Cloud API Hub Editor role (`roles/apihub.editor`): `apihub.styleGuides.update`
API Hub	The following permissions have been added to the Cloud API hub Provisioning Admin role (`roles/apihub.provisioningAdmin`): `apihub.operations.cancel` `apihub.operations.delete` `apihub.operations.get` `apihub.operations.list`
API Hub	The following permissions have been added to the Cloud API hub Viewer role (`roles/apihub.viewer`): `apihub.operations.get` `apihub.operations.list`
Audit Manager	The following permissions have been added to the Audit Manager Auditing Service Agent role (`roles/auditmanager.serviceAgent`): `bigquery.datasets.get`
BigQuery	The following permissions have been added to the BigQuery Studio Admin role (`roles/bigquery.studioAdmin`): `aiplatform.notebookRuntimeTemplates.update`
Blockchain Node Engine	The Blockchain Node Engine Service Agent role (`roles/blockchainnodeengine.serviceAgent`) has reached General Availability (GA).
Google Security Operations	The following permissions have been added to the Chronicle API Admin role (`roles/chronicle.admin`): `chronicle.instances.logTypeClassifier`
Google Security Operations	The following permissions have been added to the Chronicle API Editor role (`roles/chronicle.editor`): `chronicle.dataTableRows.create` `chronicle.dataTableRows.delete` `chronicle.dataTableRows.get` `chronicle.dataTableRows.list` `chronicle.dataTableRows.replace` `chronicle.dataTableRows.update` `chronicle.dataTables.create` `chronicle.dataTables.delete` `chronicle.dataTables.get` `chronicle.dataTables.list` `chronicle.dataTables.update` `chronicle.instances.logTypeClassifier` `chronicle.iocMatches.get` `chronicle.iocMatches.list` `chronicle.iocState.get` `chronicle.iocState.update` `chronicle.iocs.batchGet` `chronicle.iocs.findFirstAndLastSeen` `chronicle.iocs.get` `chronicle.iocs.searchCuratedDetectionsForIoc` `chronicle.legacies.legacyGetEventForDetection`
Google Security Operations	The following permissions have been removed from the Chronicle API Editor role (`roles/chronicle.editor`): `chronicle.instances.generateWorkspaceConnectionToken`
Google Security Operations	The following permissions have been added to the Chronicle API Restricted Data Access Viewer role (`roles/chronicle.restrictedDataAccessViewer`): `chronicle.dataTableRows.get` `chronicle.dataTableRows.list` `chronicle.dataTables.get` `chronicle.dataTables.list`
Google Security Operations	The following permissions have been removed from the Chronicle API Restricted Data Access Viewer role (`roles/chronicle.restrictedDataAccessViewer`): `chronicle.instances.generateWorkspaceConnectionToken`
Google Security Operations	The following permissions have been added to the Chronicle Service Agent role (`roles/chronicle.serviceAgent`): `bigquery.connections.create` `bigquery.connections.delegate` `bigquery.connections.delete` `bigquery.connections.get` `bigquery.connections.getIamPolicy` `bigquery.connections.list` `bigquery.connections.update` `bigquery.connections.updateTag` `bigquery.connections.use` `bigquery.datasets.create` `bigquery.tables.update` `bigquery.tables.updateData` `serviceusage.quotas.get` `serviceusage.services.enable` `serviceusage.services.get` `serviceusage.services.list` `storage.buckets.create` `storage.buckets.get` `storage.buckets.getIamPolicy` `storage.buckets.setIamPolicy` `storage.objects.create` `storage.objects.get`
Google Security Operations	The following permissions have been added to the Chronicle API Viewer role (`roles/chronicle.viewer`): `chronicle.dataTableRows.get` `chronicle.dataTableRows.list` `chronicle.dataTables.get` `chronicle.dataTables.list` `chronicle.instances.logTypeClassifier` `chronicle.iocMatches.get` `chronicle.iocMatches.list` `chronicle.iocState.get` `chronicle.iocs.batchGet` `chronicle.iocs.findFirstAndLastSeen` `chronicle.iocs.get` `chronicle.iocs.searchCuratedDetectionsForIoc` `chronicle.legacies.legacyGetEventForDetection`
Google Security Operations	The following permissions have been removed from the Chronicle API Viewer role (`roles/chronicle.viewer`): `chronicle.instances.generateWorkspaceConnectionToken`
Cloud Build	The following permissions have been added to the Cloud Build Service Agent role (`roles/cloudbuild.serviceAgent`): `compute.networkAttachments.get` `compute.networkAttachments.update` `compute.regionOperations.get`
Conversational Insights	The following permissions have been added to the Contact Center AI Insights editor role (`roles/contactcenterinsights.editor`): `contactcenterinsights.qaScorecardRevisions.get`
Conversational Insights	The following permissions have been added to the Contact Center AI Insights viewer role (`roles/contactcenterinsights.viewer`): `contactcenterinsights.qaScorecardRevisions.get`
Dataform	The Code Creator role (`roles/dataform.codeCreator`) has reached General Availability (GA).
Dataform	The Code Editor role (`roles/dataform.codeEditor`) has reached General Availability (GA).
Dataform	The Code Owner role (`roles/dataform.codeOwner`) has reached General Availability (GA).
Dataform	The Code Viewer role (`roles/dataform.codeViewer`) has reached General Availability (GA).
Discovery Engine	The following permissions have been added to the Discovery Engine Admin role (`roles/discoveryengine.admin`): `resourcemanager.projects.get` `resourcemanager.projects.list`
Discovery Engine	The following permissions have been added to the Discovery Engine Editor role (`roles/discoveryengine.editor`): `resourcemanager.projects.get` `resourcemanager.projects.list`
Discovery Engine	The following permissions have been added to the Discovery Engine Viewer role (`roles/discoveryengine.viewer`): `resourcemanager.projects.get` `resourcemanager.projects.list`
Sensitive Data Protection	The DLP File Store Data Profiles Admin role (`roles/dlp.fileStoreProfilesAdmin`) has reached General Availability (GA).
Sensitive Data Protection	The DLP File Store Data Profiles Reader role (`roles/dlp.fileStoreProfilesReader`) has reached General Availability (GA).
Sensitive Data Protection	The following permissions have been added to the DLP Administrator role (`roles/dlp.admin`): `dlp.fileStoreProfiles.delete` `dlp.tableDataProfiles.delete`
Sensitive Data Protection	The following permissions have been added to the DLP Organization Data Profiles Driver role (`roles/dlp.orgdriver`): `dlp.fileStoreProfiles.delete` `dlp.tableDataProfiles.delete`
Sensitive Data Protection	The following permissions have been added to the DLP Project Data Profiles Driver role (`roles/dlp.projectdriver`): `dlp.fileStoreProfiles.delete` `dlp.tableDataProfiles.delete`
Cloud DNS	The Cloud DNS Service Agent role (`roles/dns.serviceAgent`) has reached General Availability (GA).
Basic Role	The following permissions have been added to the Editor role (`roles/editor`): `chronicle.dataTableRows.create` `chronicle.dataTableRows.delete` `chronicle.dataTableRows.get` `chronicle.dataTableRows.list` `chronicle.dataTableRows.replace` `chronicle.dataTableRows.update` `chronicle.dataTables.create` `chronicle.dataTables.delete` `chronicle.dataTables.get` `chronicle.dataTables.list` `chronicle.dataTables.update` `chronicle.iocMatches.get` `chronicle.iocMatches.list` `chronicle.iocState.get` `chronicle.iocState.update` `chronicle.iocs.batchGet` `chronicle.iocs.findFirstAndLastSeen` `chronicle.iocs.get` `chronicle.iocs.searchCuratedDetectionsForIoc` `chronicle.legacies.legacyGetEventForDetection`
GKE Hub	The Fleet Scope Admin role (`roles/gkehub.scopeAdmin`) has reached General Availability (GA).
GKE Hub	The Fleet Scope Editor role (`roles/gkehub.scopeEditor`) has reached General Availability (GA).
GKE Hub	The Fleet Project-level Scope Editor role (`roles/gkehub.scopeEditorProjectLevel`) has reached General Availability (GA).
GKE Hub	The Fleet Project-level Scope Viewer role (`roles/gkehub.scopeViewerProjectLevel`) has reached General Availability (GA).
Google Cloud Managed Service for Apache Kafka	The Managed Kafka Service Agent role (`roles/managedkafka.serviceAgent`) has reached General Availability (GA).
Progressive Rollout	The Progressive Rollout Service Agent role (`roles/progressiverollout.serviceAgent`) has reached General Availability (GA).
Basic Role	The following permissions have been added to the Viewer role (`roles/viewer`): `chronicle.dataTableRows.get` `chronicle.dataTableRows.list` `chronicle.dataTables.get` `chronicle.dataTables.list` `chronicle.iocMatches.get` `chronicle.iocMatches.list` `chronicle.iocState.get` `chronicle.iocs.batchGet` `chronicle.iocs.findFirstAndLastSeen` `chronicle.iocs.get` `chronicle.iocs.searchCuratedDetectionsForIoc` `chronicle.legacies.legacyGetEventForDetection`
Basic Role	The following permissions have been removed from the Viewer role (`roles/viewer`): `datamigration.conversionworkspaces.commit`
Visual Inspection AI	The following permissions have been added to the Visual Inspection AI Service Agent role (`roles/visualinspection.serviceAgent`): `aiplatform.agentExamples.create` `aiplatform.agentExamples.delete` `aiplatform.agentExamples.get` `aiplatform.agentExamples.list` `aiplatform.agentExamples.update` `aiplatform.agents.create` `aiplatform.agents.delete` `aiplatform.agents.get` `aiplatform.agents.list` `aiplatform.agents.update` `aiplatform.apps.create` `aiplatform.apps.delete` `aiplatform.apps.get` `aiplatform.apps.list` `aiplatform.apps.update` `aiplatform.cacheConfigs.get` `aiplatform.cacheConfigs.update` `aiplatform.sessions.get` `aiplatform.sessions.list` `aiplatform.sessions.run` `aiplatform.tuningJobs.vertexTune`
Cloud Workstations	The following permissions have been added to the Workstations Service Agent role (`roles/workstations.serviceAgent`): `serviceusage.services.get`
Vertex AI	The following permissions have been added: `aiplatform.agentExamples.create` `aiplatform.agentExamples.delete` `aiplatform.agentExamples.get` `aiplatform.agentExamples.list` `aiplatform.agentExamples.update` `aiplatform.agents.create` `aiplatform.agents.delete` `aiplatform.agents.get` `aiplatform.agents.list` `aiplatform.agents.update` `aiplatform.apps.create` `aiplatform.apps.delete` `aiplatform.apps.get` `aiplatform.apps.list` `aiplatform.apps.update` `aiplatform.cacheConfigs.get` `aiplatform.cacheConfigs.update` `aiplatform.consents.get` `aiplatform.consents.update` `aiplatform.notebookExecutionJobs.create` `aiplatform.notebookExecutionJobs.delete` `aiplatform.notebookExecutionJobs.get` `aiplatform.notebookExecutionJobs.list` `aiplatform.reasoningEngines.create` `aiplatform.reasoningEngines.delete` `aiplatform.reasoningEngines.get` `aiplatform.reasoningEngines.list` `aiplatform.reasoningEngines.query` `aiplatform.reasoningEngines.update` `aiplatform.sessions.get` `aiplatform.sessions.list` `aiplatform.sessions.run` `aiplatform.tuningJobs.cancel` `aiplatform.tuningJobs.create` `aiplatform.tuningJobs.delete` `aiplatform.tuningJobs.get` `aiplatform.tuningJobs.list` `aiplatform.tuningJobs.vertexTune`
Vertex AI	The following permissions have reached General Availability (GA): `aiplatform.notebookRuntimeTemplates.update`
AlloyDB for PostgreSQL	The following permissions have been added: `alloydb.clusters.export`
AlloyDB for PostgreSQL	The following permissions are supported in custom roles: `alloydb.clusters.export`
Google Security Operations	The following permissions have been added: `chronicle.dataTableRows.create` `chronicle.dataTableRows.delete` `chronicle.dataTableRows.get` `chronicle.dataTableRows.list` `chronicle.dataTableRows.replace` `chronicle.dataTableRows.update` `chronicle.dataTables.create` `chronicle.dataTables.delete` `chronicle.dataTables.get` `chronicle.dataTables.list` `chronicle.dataTables.update` `chronicle.instances.generateCollectionAgentAuth` `chronicle.instances.logTypeClassifier`
Google Security Operations	The following permissions are supported in custom roles: `chronicle.dataTableRows.create` `chronicle.dataTableRows.delete` `chronicle.dataTableRows.get` `chronicle.dataTableRows.list` `chronicle.dataTableRows.replace` `chronicle.dataTableRows.update` `chronicle.dataTables.create` `chronicle.dataTables.delete` `chronicle.dataTables.get` `chronicle.dataTables.list` `chronicle.dataTables.update` `chronicle.instances.generateCollectionAgentAuth` `chronicle.instances.logTypeClassifier`
Cloud Key Management Service	The following permissions have been added: `cloudkms.autokeyConfigs.get` `cloudkms.autokeyConfigs.update` `cloudkms.keyHandles.create` `cloudkms.keyHandles.get` `cloudkms.keyHandles.list` `cloudkms.projects.showEffectiveAutokeyConfig`
Conversational Insights	The following permissions have been added: `contactcenterinsights.qaQuestions.get` `contactcenterinsights.qaQuestions.list` `contactcenterinsights.qaScorecardRevisions.get` `contactcenterinsights.qaScorecards.get` `contactcenterinsights.qaScorecards.list`
Conversational Insights	The following permissions are supported in custom roles: `contactcenterinsights.qaQuestions.get` `contactcenterinsights.qaQuestions.list` `contactcenterinsights.qaScorecardRevisions.get` `contactcenterinsights.qaScorecards.get` `contactcenterinsights.qaScorecards.list`
Developer Connect	The following permissions have been added: `developerconnect.connections.constructGitHubAppManifest` `developerconnect.connections.create` `developerconnect.connections.delete` `developerconnect.connections.fetchGitHubInstallations` `developerconnect.connections.fetchLinkableGitRepositories` `developerconnect.connections.generateGitHubStateToken` `developerconnect.connections.get` `developerconnect.connections.list` `developerconnect.connections.processGitHubAppCreationCallback` `developerconnect.connections.processGitHubOAuthCallback` `developerconnect.connections.update` `developerconnect.gitRepositoryLinks.create` `developerconnect.gitRepositoryLinks.delete` `developerconnect.gitRepositoryLinks.fetchGitRefs` `developerconnect.gitRepositoryLinks.fetchReadToken` `developerconnect.gitRepositoryLinks.fetchReadWriteToken` `developerconnect.gitRepositoryLinks.get` `developerconnect.gitRepositoryLinks.list` `developerconnect.locations.get` `developerconnect.locations.list` `developerconnect.operations.cancel` `developerconnect.operations.delete` `developerconnect.operations.get` `developerconnect.operations.list`
Developer Connect	The following permissions are supported in custom roles: `developerconnect.connections.constructGitHubAppManifest` `developerconnect.connections.create` `developerconnect.connections.delete` `developerconnect.connections.fetchGitHubInstallations` `developerconnect.connections.fetchLinkableGitRepositories` `developerconnect.connections.generateGitHubStateToken` `developerconnect.connections.get` `developerconnect.connections.list` `developerconnect.connections.processGitHubAppCreationCallback` `developerconnect.connections.processGitHubOAuthCallback` `developerconnect.connections.update` `developerconnect.gitRepositoryLinks.create` `developerconnect.gitRepositoryLinks.delete` `developerconnect.gitRepositoryLinks.fetchGitRefs` `developerconnect.gitRepositoryLinks.fetchReadToken` `developerconnect.gitRepositoryLinks.fetchReadWriteToken` `developerconnect.gitRepositoryLinks.get` `developerconnect.gitRepositoryLinks.list` `developerconnect.locations.get` `developerconnect.locations.list` `developerconnect.operations.cancel` `developerconnect.operations.delete` `developerconnect.operations.get` `developerconnect.operations.list`
Sensitive Data Protection	The following permissions have been added: `dlp.fileStoreProfiles.delete` `dlp.fileStoreProfiles.get` `dlp.fileStoreProfiles.list`
Sensitive Data Protection	The following permissions have reached General Availability (GA): `dlp.fileStoreProfiles.delete` `dlp.fileStoreProfiles.get` `dlp.fileStoreProfiles.list`
GKE Hub	The following permissions have been added: `gke.fleets.create` `gke.fleets.delete` `gke.fleets.get` `gke.fleets.update`
reCAPTCHA	The following permissions have been added: `recaptchaenterprise.projectmetadata.get` `recaptchaenterprise.projectmetadata.update`
Security Command Center	The following permissions have been added: `securitycenter.vulnerabilitysnapshots.list`

IAM changes as of 2024-04-26

Service	Description
API Hub	The API-Hub Runtime Project Service Agent role (`roles/apihub.runtimeProjectServiceAgent`) has reached General Availability (GA).
Capacity Planner	The following permissions have been added to the Capacity Planner Usage Viewer role (`roles/capacityplanner.viewer`): `resourcemanager.folders.get`
Cloud Infrastructure Entitlement Management (CIEM)	The CIEM Service Agent role (`roles/ciem.serviceAgent`) has reached General Availability (GA).
Cloud Deploy	The Cloud Deploy Custom Target Type Admin role (`roles/clouddeploy.customTargetTypeAdmin`) has reached General Availability (GA).
Compute Engine	The following permissions have been added to the Compute Instance Admin (beta) role (`roles/compute.instanceAdmin`): `compute.resourcePolicies.list`
Dataproc	The following permissions have been added to the Dataproc Service Agent role (`roles/dataproc.serviceAgent`): `compute.resourcePolicies.list`
Firebase Data Connect	The Firebase Data Connect Service Agent role (`roles/firebasedataconnect.serviceAgent`) has reached General Availability (GA).
Cloud OS Config	The following permissions have been added to the Cloud OS Config Service Agent role (`roles/osconfig.serviceAgent`): `compute.projects.get` `compute.projects.setCommonInstanceMetadata` `osconfig.projectFeatureSettings.get` `osconfig.projectFeatureSettings.update`
Security Command Center	The following permissions have been added to the Security Center Admin role (`roles/securitycenter.admin`): `securitycentermanagement.securityCommandCenter.activate`
Security Command Center	The following permissions have been added to the Security Center Settings Admin role (`roles/securitycenter.settingsAdmin`): `securitycentermanagement.securityCommandCenter.activate`
Security Command Center	The following permissions have been added to the Security Center Settings Editor role (`roles/securitycenter.settingsEditor`): `securitycentermanagement.securityCommandCenter.activate`
Security Center Management API	The following permissions have been added to the Security Center Management Admin role (`roles/securitycentermanagement.admin`): `securitycentermanagement.securityCommandCenter.activate`
Security Center Management API	The following permissions have been added to the Security Center Management Settings Editor role (`roles/securitycentermanagement.settingsEditor`): `securitycentermanagement.securityCommandCenter.activate`
API Management	The following permissions have been added: `apim.apiObservations.get` `apim.apiObservations.list` `apim.apiOperations.get` `apim.apiOperations.list` `apim.locations.get` `apim.locations.list` `apim.observationJobs.create` `apim.observationJobs.delete` `apim.observationJobs.disable` `apim.observationJobs.enable` `apim.observationJobs.get` `apim.observationJobs.list` `apim.observationSources.create` `apim.observationSources.delete` `apim.observationSources.get` `apim.observationSources.list` `apim.operations.cancel` `apim.operations.delete` `apim.operations.get` `apim.operations.list`
API Management	The following permissions are supported in custom roles: `apim.apiObservations.get` `apim.apiObservations.list` `apim.apiOperations.get` `apim.apiOperations.list` `apim.locations.get` `apim.locations.list` `apim.observationJobs.create` `apim.observationJobs.delete` `apim.observationJobs.disable` `apim.observationJobs.enable` `apim.observationJobs.get` `apim.observationJobs.list` `apim.observationSources.create` `apim.observationSources.delete` `apim.observationSources.get` `apim.observationSources.list` `apim.operations.cancel` `apim.operations.delete` `apim.operations.get` `apim.operations.list`
Cloud Deploy	The following permissions have reached General Availability (GA): `clouddeploy.customTargetTypes.create` `clouddeploy.customTargetTypes.delete` `clouddeploy.customTargetTypes.get` `clouddeploy.customTargetTypes.getIamPolicy` `clouddeploy.customTargetTypes.list` `clouddeploy.customTargetTypes.setIamPolicy` `clouddeploy.customTargetTypes.update`
Security Center Management API	The following permissions have been added: `securitycentermanagement.securityCommandCenter.activate`
Security Center Management API	The following permissions are supported in custom roles: `securitycentermanagement.securityCommandCenter.activate`
Security Center Management API	The following permissions have reached General Availability (GA): `securitycentermanagement.securityCommandCenter.activate`
Video Stitcher API	The following permissions have been added: `videostitcher.vodConfigs.create` `videostitcher.vodConfigs.delete` `videostitcher.vodConfigs.get` `videostitcher.vodConfigs.list` `videostitcher.vodConfigs.update`
Video Stitcher API	The following permissions are supported in custom roles: `videostitcher.vodConfigs.create` `videostitcher.vodConfigs.delete` `videostitcher.vodConfigs.get` `videostitcher.vodConfigs.list` `videostitcher.vodConfigs.update`
Video Stitcher API	The following permissions have reached General Availability (GA): `videostitcher.vodConfigs.create` `videostitcher.vodConfigs.delete` `videostitcher.vodConfigs.get` `videostitcher.vodConfigs.list` `videostitcher.vodConfigs.update`

IAM changes as of 2024-04-19

Service	Description
Vertex AI	The Vertex AI Model Monitoring Service Agent role (`roles/aiplatform.modelMonitoringServiceAgent`) has reached General Availability (GA).
AlloyDB for PostgreSQL	The following permissions have been added to the Cloud AlloyDB Admin role (`roles/alloydb.admin`): `recommender.alloydbClusterPerformanceInsights.get` `recommender.alloydbClusterPerformanceInsights.list` `recommender.alloydbClusterPerformanceInsights.update` `recommender.alloydbClusterPerformanceRecommendations.get` `recommender.alloydbClusterPerformanceRecommendations.list` `recommender.alloydbClusterPerformanceRecommendations.update` `recommender.alloydbClusterReliabilityInsights.get` `recommender.alloydbClusterReliabilityInsights.list` `recommender.alloydbClusterReliabilityInsights.update` `recommender.alloydbClusterReliabilityRecommendations.get` `recommender.alloydbClusterReliabilityRecommendations.list` `recommender.alloydbClusterReliabilityRecommendations.update` `recommender.alloydbInstanceSecurityInsights.get` `recommender.alloydbInstanceSecurityInsights.list` `recommender.alloydbInstanceSecurityInsights.update` `recommender.alloydbInstanceSecurityRecommendations.get` `recommender.alloydbInstanceSecurityRecommendations.list` `recommender.alloydbInstanceSecurityRecommendations.update`
AlloyDB for PostgreSQL	The following permissions have been added to the Cloud AlloyDB Viewer role (`roles/alloydb.viewer`): `recommender.alloydbClusterPerformanceInsights.get` `recommender.alloydbClusterPerformanceInsights.list` `recommender.alloydbClusterPerformanceRecommendations.get` `recommender.alloydbClusterPerformanceRecommendations.list` `recommender.alloydbClusterReliabilityInsights.get` `recommender.alloydbClusterReliabilityInsights.list` `recommender.alloydbClusterReliabilityRecommendations.get` `recommender.alloydbClusterReliabilityRecommendations.list`
API Management	The APIM API Discovery Service Agent role (`roles/apim.apiDiscoveryServiceAgent`) has been added with the following permissions: `compute.backendServices.create` `compute.backendServices.delete` `compute.backendServices.get` `compute.backendServices.list` `compute.backendServices.update` `compute.backendServices.use` `compute.globalOperations.get` `compute.googleapis.com/backendServices.create` `compute.googleapis.com/backendServices.delete` `compute.googleapis.com/backendServices.get` `compute.googleapis.com/backendServices.list` `compute.googleapis.com/backendServices.update` `compute.googleapis.com/backendServices.use` `compute.googleapis.com/globalOperations.get` `compute.googleapis.com/networks.use` `compute.googleapis.com/regionBackendServices.create` `compute.googleapis.com/regionBackendServices.delete` `compute.googleapis.com/regionBackendServices.get` `compute.googleapis.com/regionBackendServices.list` `compute.googleapis.com/regionBackendServices.update` `compute.googleapis.com/regionBackendServices.use` `compute.googleapis.com/regionNetworkEndpointGroups.attachNetworkEndpoints` `compute.googleapis.com/regionNetworkEndpointGroups.create` `compute.googleapis.com/regionNetworkEndpointGroups.delete` `compute.googleapis.com/regionNetworkEndpointGroups.detachNetworkEndpoints` `compute.googleapis.com/regionNetworkEndpointGroups.get` `compute.googleapis.com/regionNetworkEndpointGroups.list` `compute.googleapis.com/regionNetworkEndpointGroups.use` `compute.googleapis.com/regionOperations.get` `compute.googleapis.com/subnetworks.use` `compute.networks.use` `compute.regionBackendServices.create` `compute.regionBackendServices.delete` `compute.regionBackendServices.get` `compute.regionBackendServices.list` `compute.regionBackendServices.update` `compute.regionBackendServices.use` `compute.regionNetworkEndpointGroups.attachNetworkEndpoints` `compute.regionNetworkEndpointGroups.create` `compute.regionNetworkEndpointGroups.delete` `compute.regionNetworkEndpointGroups.detachNetworkEndpoints` `compute.regionNetworkEndpointGroups.get` `compute.regionNetworkEndpointGroups.list` `compute.regionNetworkEndpointGroups.use` `compute.regionOperations.get` `compute.subnetworks.use` `networkservices.googleapis.com/operations.cancel` `networkservices.googleapis.com/operations.delete` `networkservices.googleapis.com/operations.get` `networkservices.googleapis.com/operations.list` `networkservices.googleapis.com/projectLbObservabilityExtensions.create` `networkservices.googleapis.com/projectLbObservabilityExtensions.delete` `networkservices.googleapis.com/projectLbObservabilityExtensions.get` `networkservices.googleapis.com/projectLbObservabilityExtensions.list` `networkservices.googleapis.com/projectLbObservabilityExtensions.update` `networkservices.operations.cancel` `networkservices.operations.delete` `networkservices.operations.get` `networkservices.operations.list` `networkservices.projectLbObservabilityExtensions.create` `networkservices.projectLbObservabilityExtensions.delete` `networkservices.projectLbObservabilityExtensions.get` `networkservices.projectLbObservabilityExtensions.list` `networkservices.projectLbObservabilityExtensions.update`
Assured Open Source Software	The following permissions have been added to the Assured OSS Admin role (`roles/assuredoss.admin`): `iam.serviceAccountKeys.create` `pubsub.schemas.get` `pubsub.schemas.list` `pubsub.schemas.listRevisions` `pubsub.schemas.validate` `pubsub.snapshots.get` `pubsub.snapshots.list` `pubsub.subscriptions.create` `pubsub.subscriptions.get` `pubsub.subscriptions.list` `pubsub.subscriptions.update` `pubsub.topics.get` `pubsub.topics.list` `serviceusage.quotas.get` `serviceusage.services.list`
Assured Open Source Software	The following permissions have been added to the Assured OSS Project Admin role (`roles/assuredoss.projectAdmin`): `pubsub.schemas.get` `pubsub.schemas.list` `pubsub.schemas.listRevisions` `pubsub.schemas.validate` `pubsub.snapshots.get` `pubsub.snapshots.list` `pubsub.subscriptions.get` `pubsub.subscriptions.list` `pubsub.topics.get` `pubsub.topics.list` `serviceusage.quotas.get` `serviceusage.services.list`
Assured Open Source Software	The following permissions have been added to the Assured OSS Reader role (`roles/assuredoss.reader`): `pubsub.schemas.get` `pubsub.schemas.list` `pubsub.schemas.listRevisions` `pubsub.schemas.validate` `pubsub.snapshots.get` `pubsub.snapshots.list` `pubsub.subscriptions.get` `pubsub.subscriptions.list` `pubsub.topics.get` `pubsub.topics.list` `serviceusage.quotas.get` `serviceusage.services.get` `serviceusage.services.list`
Assured Workloads	The following permissions have been added to the Assured Workloads Service Agent role (`roles/assuredworkloads.serviceAgent`): `orgpolicy.policies.list` `orgpolicy.policy.get`
Audit Manager	The following permissions have been added to the Audit Manager Admin role (`roles/auditmanager.admin`): `cloudasset.assets.searchAllResources`
Audit Manager	The following permissions have been added to the Audit Manager Auditor role (`roles/auditmanager.auditor`): `cloudasset.assets.searchAllResources`
Compliance Scanning	The Compliance Scanning Service Agent role (`roles/compliancescanning.serviceAgent`) has reached General Availability (GA).
Cloud Config Manager API	The following permissions have been added to the Cloud Infrastructure Manager Agent role (`roles/config.agent`): `monitoring.timeSeries.list`
Conversational Insights	The following permissions have been added to the Contact Center AI Insights editor role (`roles/contactcenterinsights.editor`): `contactcenterinsights.feedbackLabels.create` `contactcenterinsights.feedbackLabels.delete` `contactcenterinsights.feedbackLabels.get` `contactcenterinsights.feedbackLabels.list` `contactcenterinsights.feedbackLabels.update`
Conversational Insights	The following permissions have been added to the Contact Center AI Insights viewer role (`roles/contactcenterinsights.viewer`): `contactcenterinsights.feedbackLabels.get` `contactcenterinsights.feedbackLabels.list`
Database Migration Service	The following permissions have been added to the Database Migration Service Agent role (`roles/datamigration.serviceAgent`): `cloudsql.databases.list`
Dataplex	The Dataplex Catalog Admin role (`roles/dataplex.catalogAdmin`) has reached General Availability (GA).
Dataplex	The Dataplex Catalog Editor role (`roles/dataplex.catalogEditor`) has reached General Availability (GA).
Dataplex	The Dataplex Catalog Viewer role (`roles/dataplex.catalogViewer`) has reached General Availability (GA).
Dialogflow	The following permissions have been added to the Dialogflow Service Agent role (`roles/dialogflow.serviceAgent`): `aiplatform.extensions.execute` `aiplatform.extensions.get`
Discovery Engine	The following permissions have been added to the Discovery Engine Service Agent role (`roles/discoveryengine.serviceAgent`): `alloydb.databases.list` `storage.managedFolders.create` `storage.managedFolders.delete` `storage.managedFolders.get` `storage.managedFolders.getIamPolicy` `storage.managedFolders.list` `storage.managedFolders.setIamPolicy`
Distributed Cloud Edge Container	The following permissions have been added to the Edge Container Service Agent role (`roles/edgecontainer.serviceAgent`): `serviceusage.services.list`
Basic Role	The following permissions have been added to the Editor role (`roles/editor`): `contactcenterinsights.feedbackLabels.create` `contactcenterinsights.feedbackLabels.delete` `contactcenterinsights.feedbackLabels.get` `contactcenterinsights.feedbackLabels.list` `contactcenterinsights.feedbackLabels.update`
Firebase	The following permissions have been added to the Firebase Service Management Service Agent role (`roles/firebase.managementServiceAgent`): `serviceusage.services.list`
ML Kit for Firebase	The Firebase Machine Learning Service Agent role (`roles/firebaseml.serviceAgent`) has reached General Availability (GA).
GKE Hub	The Fleet Scope Viewer role (`roles/gkehub.scopeViewer`) has reached General Availability (GA).
Identity and Access Management	The following permissions have been added to the Security Admin role (`roles/iam.securityAdmin`): `contactcenterinsights.feedbackLabels.list`
Identity and Access Management	The following permissions have been added to the Security Reviewer role (`roles/iam.securityReviewer`): `contactcenterinsights.feedbackLabels.list`
Cloud OS Config	The Project Feature Settings Editor role (`roles/osconfig.projectFeatureSettingsEditor`) has reached General Availability (GA).
Cloud OS Config	The Project Feature Settings Viewer role (`roles/osconfig.projectFeatureSettingsViewer`) has reached General Availability (GA).
Basic Role	The following permissions have been added to the Owner role (`roles/owner`): `contactcenterinsights.feedbackLabels.create` `contactcenterinsights.feedbackLabels.delete` `contactcenterinsights.feedbackLabels.get` `contactcenterinsights.feedbackLabels.list` `contactcenterinsights.feedbackLabels.update`
Security Command Center	The following permissions have been added to the Security Center Admin role (`roles/securitycenter.admin`): `iam.serviceAccountKeys.create` `pubsub.schemas.get` `pubsub.schemas.list` `pubsub.schemas.listRevisions` `pubsub.schemas.validate` `pubsub.snapshots.get` `pubsub.snapshots.list` `pubsub.subscriptions.create` `pubsub.subscriptions.get` `pubsub.subscriptions.list` `pubsub.subscriptions.update` `pubsub.topics.get` `pubsub.topics.list`
Security Command Center	The following permissions have been added to the Security Center Admin Editor role (`roles/securitycenter.adminEditor`): `pubsub.schemas.get` `pubsub.schemas.list` `pubsub.schemas.listRevisions` `pubsub.schemas.validate` `pubsub.snapshots.get` `pubsub.snapshots.list` `pubsub.subscriptions.get` `pubsub.subscriptions.list` `pubsub.topics.get` `pubsub.topics.list`
Security Command Center	The following permissions have been added to the Security Center Admin Viewer role (`roles/securitycenter.adminViewer`): `pubsub.schemas.get` `pubsub.schemas.list` `pubsub.schemas.listRevisions` `pubsub.schemas.validate` `pubsub.snapshots.get` `pubsub.snapshots.list` `pubsub.subscriptions.get` `pubsub.subscriptions.list` `pubsub.topics.get` `pubsub.topics.list`
Security Center Management API	The Security Center Management Admin role (`roles/securitycentermanagement.admin`) has reached General Availability (GA).
Security Center Management API	The Security Center Management Settings Editor role (`roles/securitycentermanagement.settingsEditor`) has reached General Availability (GA).
Security Center Management API	The Security Center Management Settings Viewer role (`roles/securitycentermanagement.settingsViewer`) has reached General Availability (GA).
Security Center Management API	The Security Center Management Viewer role (`roles/securitycentermanagement.viewer`) has reached General Availability (GA).
Service Networking	The following permissions have been added to the Service Networking Service Agent role (`roles/servicenetworking.serviceAgent`): `networkconnectivity.internalRanges.list`
Basic Role	The following permissions have been added to the Viewer role (`roles/viewer`): `contactcenterinsights.feedbackLabels.get` `contactcenterinsights.feedbackLabels.list`
Gemini for Google Cloud API	The following permissions have been added: `cloudaicompanion.instances.completeCode` `cloudaicompanion.instances.completeTask` `cloudaicompanion.instances.generateCode` `cloudaicompanion.instances.generateText`
Gemini for Google Cloud API	The following permissions are supported in custom roles: `cloudaicompanion.instances.completeCode` `cloudaicompanion.instances.completeTask` `cloudaicompanion.instances.generateCode` `cloudaicompanion.instances.generateText`
Compute Engine	The following permissions have reached General Availability (GA): `compute.nodeGroups.performMaintenance`
Conversational Insights	The following permissions have been added: `contactcenterinsights.feedbackLabels.create` `contactcenterinsights.feedbackLabels.delete` `contactcenterinsights.feedbackLabels.get` `contactcenterinsights.feedbackLabels.list` `contactcenterinsights.feedbackLabels.update`
Google Kubernetes Engine	The following permissions have been added: `container.clusters.connect`
Google Kubernetes Engine	The following permissions have reached General Availability (GA): `container.clusters.connect`
Database Center	The following permissions have been added: `databasecenter.fleetHealthStats.list` `databasecenter.fleetStats.list` `databasecenter.locations.list` `databasecenter.products.list` `databasecenter.resourceGroups.list` `databasecenter.userLabels.list`
Database Center	The following permissions are supported in custom roles: `databasecenter.fleetHealthStats.list` `databasecenter.fleetStats.list` `databasecenter.locations.list` `databasecenter.products.list` `databasecenter.resourceGroups.list` `databasecenter.userLabels.list`
Dataproc	The following permissions have been added: `dataproc.batches.analyze`
Dataproc	The following permissions are supported in custom roles: `dataproc.batches.analyze`
Dataproc	The following permissions have reached General Availability (GA): `dataproc.batches.analyze`
Discovery Engine	The following permissions have reached General Availability (GA): `discoveryengine.dataStores.create` `discoveryengine.dataStores.delete` `discoveryengine.dataStores.get` `discoveryengine.dataStores.list` `discoveryengine.dataStores.update` `discoveryengine.engines.create` `discoveryengine.engines.delete` `discoveryengine.engines.get` `discoveryengine.engines.list` `discoveryengine.engines.pause` `discoveryengine.engines.resume` `discoveryengine.engines.tune` `discoveryengine.engines.update` `discoveryengine.servingConfigs.recommend`
Identity and Access Management	The following permissions have been added: `iam.oauthClientCredentials.create` `iam.oauthClientCredentials.delete` `iam.oauthClientCredentials.get` `iam.oauthClientCredentials.list` `iam.oauthClientCredentials.update` `iam.oauthClients.create` `iam.oauthClients.delete` `iam.oauthClients.get` `iam.oauthClients.list` `iam.oauthClients.undelete` `iam.oauthClients.update`
Identity and Access Management	The following permissions are supported in custom roles: `iam.oauthClientCredentials.create` `iam.oauthClientCredentials.delete` `iam.oauthClientCredentials.get` `iam.oauthClientCredentials.list` `iam.oauthClientCredentials.update` `iam.oauthClients.create` `iam.oauthClients.delete` `iam.oauthClients.get` `iam.oauthClients.list` `iam.oauthClients.undelete` `iam.oauthClients.update`
Identity and Access Management	The following permissions have been added: `iam.googleapis.com/oauthClientCredentials.create` `iam.googleapis.com/oauthClientCredentials.delete` `iam.googleapis.com/oauthClientCredentials.get` `iam.googleapis.com/oauthClientCredentials.list` `iam.googleapis.com/oauthClientCredentials.update` `iam.googleapis.com/oauthClients.create` `iam.googleapis.com/oauthClients.delete` `iam.googleapis.com/oauthClients.get` `iam.googleapis.com/oauthClients.list` `iam.googleapis.com/oauthClients.undelete` `iam.googleapis.com/oauthClients.update`
Identity and Access Management	The following permissions are supported in custom roles: `iam.googleapis.com/oauthClientCredentials.create` `iam.googleapis.com/oauthClientCredentials.delete` `iam.googleapis.com/oauthClientCredentials.get` `iam.googleapis.com/oauthClientCredentials.list` `iam.googleapis.com/oauthClientCredentials.update` `iam.googleapis.com/oauthClients.create` `iam.googleapis.com/oauthClients.delete` `iam.googleapis.com/oauthClients.get` `iam.googleapis.com/oauthClients.list` `iam.googleapis.com/oauthClients.undelete` `iam.googleapis.com/oauthClients.update`
Cloud Logging	The following permissions have been added: `logging.views.getIamPolicy` `logging.views.setIamPolicy`
Cloud Logging	The following permissions have reached General Availability (GA): `logging.views.getIamPolicy` `logging.views.setIamPolicy`
Cloud OS Config	The following permissions have been added: `osconfig.projectFeatureSettings.get` `osconfig.projectFeatureSettings.update`
Cloud OS Config	The following permissions are supported in custom roles: `osconfig.projectFeatureSettings.get` `osconfig.projectFeatureSettings.update`
Cloud OS Config	The following permissions have reached General Availability (GA): `osconfig.projectFeatureSettings.get` `osconfig.projectFeatureSettings.update`
Recommender	The following permissions have been added: `recommender.alloydbClusterPerformanceInsights.get` `recommender.alloydbClusterPerformanceInsights.list` `recommender.alloydbClusterPerformanceInsights.update` `recommender.alloydbClusterPerformanceRecommendations.get` `recommender.alloydbClusterPerformanceRecommendations.list` `recommender.alloydbClusterPerformanceRecommendations.update` `recommender.alloydbClusterReliabilityInsights.get` `recommender.alloydbClusterReliabilityInsights.list` `recommender.alloydbClusterReliabilityInsights.update` `recommender.alloydbClusterReliabilityRecommendations.get` `recommender.alloydbClusterReliabilityRecommendations.list` `recommender.alloydbClusterReliabilityRecommendations.update` `recommender.alloydbInstanceSecurityInsights.get` `recommender.alloydbInstanceSecurityInsights.list` `recommender.alloydbInstanceSecurityInsights.update` `recommender.alloydbInstanceSecurityRecommendations.get` `recommender.alloydbInstanceSecurityRecommendations.list` `recommender.alloydbInstanceSecurityRecommendations.update`
Recommender	The following permissions are supported in custom roles: `recommender.alloydbClusterPerformanceInsights.get` `recommender.alloydbClusterPerformanceInsights.list` `recommender.alloydbClusterPerformanceInsights.update` `recommender.alloydbClusterPerformanceRecommendations.get` `recommender.alloydbClusterPerformanceRecommendations.list` `recommender.alloydbClusterPerformanceRecommendations.update` `recommender.alloydbClusterReliabilityInsights.get` `recommender.alloydbClusterReliabilityInsights.list` `recommender.alloydbClusterReliabilityInsights.update` `recommender.alloydbClusterReliabilityRecommendations.get` `recommender.alloydbClusterReliabilityRecommendations.list` `recommender.alloydbClusterReliabilityRecommendations.update` `recommender.alloydbInstanceSecurityInsights.get` `recommender.alloydbInstanceSecurityInsights.list` `recommender.alloydbInstanceSecurityInsights.update` `recommender.alloydbInstanceSecurityRecommendations.get` `recommender.alloydbInstanceSecurityRecommendations.list` `recommender.alloydbInstanceSecurityRecommendations.update`
Security Center Management API	The following permissions have been added: `securitycentermanagement.securityCommandCenter.generateServiceAccounts` `securitycentermanagement.securityCommandCenter.get` `securitycentermanagement.securityCommandCenter.update`
Security Center Management API	The following permissions are supported in custom roles: `securitycentermanagement.securityCommandCenter.generateServiceAccounts` `securitycentermanagement.securityCommandCenter.get` `securitycentermanagement.securityCommandCenter.update`
Security Center Management API	The following permissions have reached General Availability (GA): `securitycentermanagement.securityCommandCenter.generateServiceAccounts` `securitycentermanagement.securityCommandCenter.get` `securitycentermanagement.securityCommandCenter.update`

IAM changes as of 2024-03-29

Service	Description
Vertex AI	The Vertex AI Extension Custom Code Service Agent role (`roles/aiplatform.extensionCustomCodeServiceAgent`) has reached General Availability (GA).
Vertex AI	The Vertex AI Rapid Eval Service Agent role (`roles/aiplatform.rapidevalServiceAgent`) has reached General Availability (GA).
Vertex AI	The following permissions have been added to the Vertex AI Colab Service Agent role (`roles/aiplatform.colabServiceAgent`): `iam.serviceAccounts.actAs`
Vertex AI	The following permissions have been added to the Vertex AI Extension Service Agent role (`roles/aiplatform.extensionServiceAgent`): `serviceusage.services.use`
Vertex AI	The following permissions have been added to the Vertex AI Tuning Service Agent role (`roles/aiplatform.tuningServiceAgent`): `aiplatform.locations.get`
API Hub	The API hub attribute admin role (`roles/apihub.attributeAdmin`) has been added with the following permissions: `apihub.attributes.create` `apihub.attributes.delete` `apihub.attributes.get` `apihub.attributes.list` `apihub.attributes.update` `apihub.googleapis.com/attributes.create` `apihub.googleapis.com/attributes.delete` `apihub.googleapis.com/attributes.get` `apihub.googleapis.com/attributes.list` `apihub.googleapis.com/attributes.update` `cloudresourcemanager.googleapis.com/projects.get` `cloudresourcemanager.googleapis.com/projects.list` `resourcemanager.projects.get` `resourcemanager.projects.list`
API Hub	The API hub plugin admin role (`roles/apihub.pluginAdmin`) has been added with the following permissions: `apihub.googleapis.com/plugins.disable` `apihub.googleapis.com/plugins.enable` `apihub.googleapis.com/plugins.get` `apihub.googleapis.com/plugins.list` `apihub.googleapis.com/specs.lint` `apihub.googleapis.com/styleGuides.get` `apihub.googleapis.com/styleGuides.update` `apihub.plugins.disable` `apihub.plugins.enable` `apihub.plugins.get` `apihub.plugins.list` `apihub.specs.lint` `apihub.styleGuides.get` `apihub.styleGuides.update` `cloudresourcemanager.googleapis.com/projects.get` `cloudresourcemanager.googleapis.com/projects.list` `resourcemanager.projects.get` `resourcemanager.projects.list`
API Hub	The API hub all permissions related to provisioning role (`roles/apihub.provisioningAdmin`) has been added with the following permissions: `apihub.apiHubInstances.create` `apihub.apiHubInstances.delete` `apihub.apiHubInstances.get` `apihub.apiHubInstances.list` `apihub.googleapis.com/apiHubInstances.create` `apihub.googleapis.com/apiHubInstances.delete` `apihub.googleapis.com/apiHubInstances.get` `apihub.googleapis.com/apiHubInstances.list` `apihub.googleapis.com/hostProjectRegistrations.create` `apihub.googleapis.com/hostProjectRegistrations.delete` `apihub.googleapis.com/hostProjectRegistrations.get` `apihub.googleapis.com/hostProjectRegistrations.list` `apihub.googleapis.com/hostProjectRegistrations.register` `apihub.googleapis.com/runTimeProjectAttachments.attach` `apihub.googleapis.com/runTimeProjectAttachments.create` `apihub.googleapis.com/runTimeProjectAttachments.delete` `apihub.googleapis.com/runTimeProjectAttachments.get` `apihub.googleapis.com/runTimeProjectAttachments.list` `apihub.googleapis.com/runTimeProjectAttachments.lookup` `apihub.hostProjectRegistrations.create` `apihub.hostProjectRegistrations.delete` `apihub.hostProjectRegistrations.get` `apihub.hostProjectRegistrations.list` `apihub.hostProjectRegistrations.register` `apihub.runTimeProjectAttachments.attach` `apihub.runTimeProjectAttachments.create` `apihub.runTimeProjectAttachments.delete` `apihub.runTimeProjectAttachments.get` `apihub.runTimeProjectAttachments.list` `apihub.runTimeProjectAttachments.lookup` `cloudresourcemanager.googleapis.com/projects.get` `cloudresourcemanager.googleapis.com/projects.list` `resourcemanager.projects.get` `resourcemanager.projects.list`
Assured Open Source Software	The Assured OSS Admin role (`roles/assuredoss.admin`) has reached General Availability (GA).
Assured Open Source Software	The Assured OSS Reader role (`roles/assuredoss.reader`) has reached General Availability (GA).
Assured Open Source Software	The Assured OSS User role (`roles/assuredoss.user`) has reached General Availability (GA).
Google Security Operations	The following permissions have been removed from the Chronicle API Restricted Data Access Viewer role (`roles/chronicle.restrictedDataAccessViewer`): `chronicle.riskConfigs.get` `chronicle.watchlists.get` `chronicle.watchlists.list`
Database Migration Service	The following permissions have been added to the Database Migration Service Agent role (`roles/datamigration.serviceAgent`): `cloudsql.databases.delete` `cloudsql.databases.get` `serviceusage.services.use`
Discovery Engine	The following permissions have been added to the Discovery Engine Service Agent role (`roles/discoveryengine.serviceAgent`): `storage.buckets.getIamPolicy` `storage.buckets.setIamPolicy`
Distributed Cloud Edge Container	The following permissions have been added to the Edge Container Cluster Service Agent role (`roles/edgecontainer.clusterServiceAgent`): `gkehub.endpoints.connect` `gkehub.features.create` `gkehub.features.list` `gkehub.features.update` `gkehub.fleet.create` `gkehub.fleet.delete` `gkehub.fleet.get` `gkehub.locations.get` `gkehub.locations.list` `gkehub.memberships.create` `gkehub.memberships.delete` `gkehub.memberships.generateConnectManifest` `gkehub.memberships.list` `gkehub.memberships.update` `gkehub.operations.cancel` `gkehub.operations.delete` `gkehub.operations.get` `gkehub.operations.list` `serviceusage.services.list`
Basic Role	The following permissions have been added to the Editor role (`roles/editor`): `apihub.apiHubInstances.create` `apihub.apiHubInstances.delete` `apihub.apiHubInstances.get` `apihub.apiHubInstances.list` `apihub.apiOperations.get` `apihub.apiOperations.list` `apihub.apiOperations.update` `apihub.attributes.create` `apihub.attributes.delete` `apihub.attributes.get` `apihub.attributes.list` `apihub.attributes.update` `apihub.definitions.get` `apihub.definitions.list` `apihub.definitions.update` `apihub.dependencies.create` `apihub.dependencies.delete` `apihub.dependencies.get` `apihub.dependencies.list` `apihub.dependencies.update` `apihub.deployments.create` `apihub.deployments.delete` `apihub.deployments.get` `apihub.deployments.list` `apihub.deployments.update` `apihub.externalApis.create` `apihub.externalApis.delete` `apihub.externalApis.get` `apihub.externalApis.list` `apihub.externalApis.update` `apihub.hostProjectRegistrations.create` `apihub.hostProjectRegistrations.delete` `apihub.hostProjectRegistrations.get` `apihub.hostProjectRegistrations.list` `apihub.hostProjectRegistrations.register` `apihub.llmEnablements.deregister` `apihub.llmEnablements.get` `apihub.llmEnablements.list` `apihub.llmEnablements.register` `apihub.locations.searchResources` `apihub.locations2.searchResources` `apihub.plugins.disable` `apihub.plugins.enable` `apihub.plugins.get` `apihub.plugins.list` `apihub.runTimeProjectAttachments.create` `apihub.runTimeProjectAttachments.delete` `apihub.runTimeProjectAttachments.get` `apihub.runTimeProjectAttachments.list` `apihub.runTimeProjectAttachments.lookup` `apihub.specs.lint` `apihub.styleGuides.get` `apihub.styleGuides.update`
Identity and Access Management	The following permissions have been added to the Security Admin role (`roles/iam.securityAdmin`): `apihub.apiHubInstances.list` `apihub.apiOperations.list` `apihub.attributes.list` `apihub.definitions.list` `apihub.dependencies.list` `apihub.deployments.list` `apihub.externalApis.list` `apihub.hostProjectRegistrations.list` `apihub.llmEnablements.list` `apihub.plugins.list` `apihub.runTimeProjectAttachments.list`
Identity and Access Management	The following permissions have been added to the Security Reviewer role (`roles/iam.securityReviewer`): `apihub.apiHubInstances.list` `apihub.apiOperations.list` `apihub.attributes.list` `apihub.definitions.list` `apihub.dependencies.list` `apihub.deployments.list` `apihub.externalApis.list` `apihub.hostProjectRegistrations.list` `apihub.llmEnablements.list` `apihub.plugins.list` `apihub.runTimeProjectAttachments.list`
Basic Role	The following permissions have been added to the Owner role (`roles/owner`): `apihub.apiHubInstances.create` `apihub.apiHubInstances.delete` `apihub.apiHubInstances.get` `apihub.apiHubInstances.list` `apihub.apiOperations.get` `apihub.apiOperations.list` `apihub.apiOperations.update` `apihub.attributes.create` `apihub.attributes.delete` `apihub.attributes.get` `apihub.attributes.list` `apihub.attributes.update` `apihub.definitions.get` `apihub.definitions.list` `apihub.definitions.update` `apihub.dependencies.create` `apihub.dependencies.delete` `apihub.dependencies.get` `apihub.dependencies.list` `apihub.dependencies.update` `apihub.deployments.create` `apihub.deployments.delete` `apihub.deployments.get` `apihub.deployments.list` `apihub.deployments.update` `apihub.externalApis.create` `apihub.externalApis.delete` `apihub.externalApis.get` `apihub.externalApis.list` `apihub.externalApis.update` `apihub.hostProjectRegistrations.create` `apihub.hostProjectRegistrations.delete` `apihub.hostProjectRegistrations.get` `apihub.hostProjectRegistrations.list` `apihub.hostProjectRegistrations.register` `apihub.llmEnablements.deregister` `apihub.llmEnablements.get` `apihub.llmEnablements.list` `apihub.llmEnablements.register` `apihub.locations.searchResources` `apihub.locations2.searchResources` `apihub.plugins.disable` `apihub.plugins.enable` `apihub.plugins.get` `apihub.plugins.list` `apihub.runTimeProjectAttachments.attach` `apihub.runTimeProjectAttachments.create` `apihub.runTimeProjectAttachments.delete` `apihub.runTimeProjectAttachments.get` `apihub.runTimeProjectAttachments.list` `apihub.runTimeProjectAttachments.lookup` `apihub.specs.lint` `apihub.styleGuides.get` `apihub.styleGuides.update`
Privileged Access Manager	The Privileged Access Manager Service Agent role (`roles/privilegedaccessmanager.serviceAgent`) has reached General Availability (GA).
Cloud Run	The following permissions have been removed from the Cloud Run Invoker role (`roles/run.invoker`): `run.executions.cancel`
Basic Role	The following permissions have been added to the Viewer role (`roles/viewer`): `apihub.apiHubInstances.get` `apihub.apiHubInstances.list` `apihub.apiOperations.get` `apihub.apiOperations.list` `apihub.attributes.get` `apihub.attributes.list` `apihub.definitions.get` `apihub.definitions.list` `apihub.dependencies.get` `apihub.dependencies.list` `apihub.deployments.get` `apihub.deployments.list` `apihub.externalApis.get` `apihub.externalApis.list` `apihub.hostProjectRegistrations.get` `apihub.hostProjectRegistrations.list` `apihub.llmEnablements.get` `apihub.llmEnablements.list` `apihub.locations.searchResources` `apihub.locations2.searchResources` `apihub.plugins.get` `apihub.plugins.list` `apihub.runTimeProjectAttachments.get` `apihub.runTimeProjectAttachments.list` `apihub.runTimeProjectAttachments.lookup` `apihub.styleGuides.get`
API Hub	The following permissions have been added: `apihub.apiHubInstances.create` `apihub.apiHubInstances.delete` `apihub.apiHubInstances.get` `apihub.apiHubInstances.list` `apihub.apiOperations.get` `apihub.apiOperations.list` `apihub.apiOperations.update` `apihub.apis.create` `apihub.apis.delete` `apihub.apis.get` `apihub.apis.list` `apihub.apis.update` `apihub.attributes.create` `apihub.attributes.delete` `apihub.attributes.get` `apihub.attributes.list` `apihub.attributes.update` `apihub.definitions.get` `apihub.definitions.list` `apihub.definitions.update` `apihub.dependencies.create` `apihub.dependencies.delete` `apihub.dependencies.get` `apihub.dependencies.list` `apihub.dependencies.update` `apihub.deployments.create` `apihub.deployments.delete` `apihub.deployments.get` `apihub.deployments.list` `apihub.deployments.update` `apihub.externalApis.create` `apihub.externalApis.delete` `apihub.externalApis.get` `apihub.externalApis.list` `apihub.externalApis.update` `apihub.hostProjectRegistrations.create` `apihub.hostProjectRegistrations.delete` `apihub.hostProjectRegistrations.get` `apihub.hostProjectRegistrations.list` `apihub.hostProjectRegistrations.register` `apihub.llmEnablements.deregister` `apihub.llmEnablements.get` `apihub.llmEnablements.list` `apihub.llmEnablements.register` `apihub.locations.searchResources` `apihub.locations2.searchResources` `apihub.operations.cancel` `apihub.operations.delete` `apihub.operations.get` `apihub.operations.list` `apihub.plugins.disable` `apihub.plugins.enable` `apihub.plugins.get` `apihub.plugins.list` `apihub.runTimeProjectAttachments.attach` `apihub.runTimeProjectAttachments.create` `apihub.runTimeProjectAttachments.delete` `apihub.runTimeProjectAttachments.get` `apihub.runTimeProjectAttachments.list` `apihub.runTimeProjectAttachments.lookup` `apihub.specs.create` `apihub.specs.delete` `apihub.specs.get` `apihub.specs.lint` `apihub.specs.list` `apihub.specs.update` `apihub.styleGuides.get` `apihub.styleGuides.update` `apihub.versions.create` `apihub.versions.delete` `apihub.versions.get` `apihub.versions.list` `apihub.versions.update`
API Hub	The following permissions are supported in custom roles: `apihub.apis.create` `apihub.apis.delete` `apihub.apis.get` `apihub.apis.list` `apihub.apis.update` `apihub.operations.cancel` `apihub.operations.delete` `apihub.operations.get` `apihub.operations.list` `apihub.specs.create` `apihub.specs.delete` `apihub.specs.get` `apihub.specs.list` `apihub.specs.update` `apihub.versions.create` `apihub.versions.delete` `apihub.versions.get` `apihub.versions.list` `apihub.versions.update`
Artifact Registry	The following permissions have been added: `artifactregistry.files.delete`
Artifact Registry	The following permissions have reached General Availability (GA): `artifactregistry.files.delete`
Assured Open Source Software	The following permissions have reached General Availability (GA): `assuredoss.customers.create` `assuredoss.locations.get` `assuredoss.locations.list` `assuredoss.operations.cancel` `assuredoss.operations.delete` `assuredoss.operations.get` `assuredoss.operations.list`
Google Security Operations	The following permissions have been added: `chronicle.instances.generateWorkspaceConnectionToken`
Google Security Operations	The following permissions are supported in custom roles: `chronicle.instances.generateWorkspaceConnectionToken`
Commerce Org Governance	The following permissions have been added: `commerceorggovernance.collectionRequestApprovals.list` `commerceorggovernance.collectionRequestApprovals.review` `commerceorggovernance.services.get` `commerceorggovernance.services.request`
Commerce Org Governance	The following permissions are supported in custom roles: `commerceorggovernance.collectionRequestApprovals.list` `commerceorggovernance.collectionRequestApprovals.review` `commerceorggovernance.services.get` `commerceorggovernance.services.request`
GDC Hardware Management API	The following permissions have been added: `gdchardwaremanagement.zones.create` `gdchardwaremanagement.zones.delete` `gdchardwaremanagement.zones.get` `gdchardwaremanagement.zones.list` `gdchardwaremanagement.zones.update`
GDC Hardware Management API	The following permissions are supported in custom roles: `gdchardwaremanagement.zones.create` `gdchardwaremanagement.zones.delete` `gdchardwaremanagement.zones.get` `gdchardwaremanagement.zones.list` `gdchardwaremanagement.zones.update`
Privileged Access Manager	The following permissions have been added: `privilegedaccessmanager.locations.checkOnboardingStatus`
Privileged Access Manager	The following permissions are supported in custom roles: `privilegedaccessmanager.locations.checkOnboardingStatus`
Security Posture API	The following permissions have been added: `securityposture.reports.get` `securityposture.reports.list`
Security Posture API	The following permissions are supported in custom roles: `securityposture.reports.get` `securityposture.reports.list`
Security Posture API	The following permissions have reached General Availability (GA): `securityposture.reports.get` `securityposture.reports.list`

IAM changes as of 2024-03-22

Service	Description
Vertex AI	The Vertex AI Extension Service Agent role (`roles/aiplatform.extensionServiceAgent`) has reached General Availability (GA).
Vertex AI	The Vertex AI Reasoning Engine Service Agent role (`roles/aiplatform.reasoningEngineServiceAgent`) has reached General Availability (GA).
Vertex AI	The Vertex AI Tuning Service Agent role (`roles/aiplatform.tuningServiceAgent`) has reached General Availability (GA).
BigQuery	The BigQuery Studio Admin role (`roles/bigquery.studioAdmin`) has reached General Availability (GA).
BigQuery	The BigQuery Studio User role (`roles/bigquery.studioUser`) has reached General Availability (GA).
Google Security Operations	The Chronicle SOAR Service Agent role (`roles/chronicle.soarServiceAgent`) has reached General Availability (GA).
Discovery Engine	The following permissions have been added to the Discovery Engine Service Agent role (`roles/discoveryengine.serviceAgent`): `spanner.databases.useDataBoost`
Multi-Cluster Ingress	The following permissions have been added to the Multi Cluster Ingress Service Agent role (`roles/multiclusteringress.serviceAgent`): `compute.regionSslPolicies.use`
Basic Role	The following permissions have been removed from the Viewer role (`roles/viewer`): `aiplatform.extensions.execute`
VM Migration	The following permissions have been added to the VM Migration Service Agent role (`roles/vmmigration.serviceAgent`): `compute.machineImages.create` `compute.machineImages.get`
Vertex AI	The following permissions have been added: `aiplatform.extensions.delete` `aiplatform.extensions.execute` `aiplatform.extensions.get` `aiplatform.extensions.import` `aiplatform.extensions.list` `aiplatform.extensions.update`
Assured Open Source Software	The following permissions have been added: `assuredoss.customers.create`
Assured Open Source Software	The following permissions are supported in custom roles: `assuredoss.customers.create`
Bigtable	The following permissions have been added: `bigtable.authorizedViews.create` `bigtable.authorizedViews.createTagBinding` `bigtable.authorizedViews.delete` `bigtable.authorizedViews.deleteTagBinding` `bigtable.authorizedViews.get` `bigtable.authorizedViews.getIamPolicy` `bigtable.authorizedViews.list` `bigtable.authorizedViews.listEffectiveTags` `bigtable.authorizedViews.listTagBindings` `bigtable.authorizedViews.mutateRows` `bigtable.authorizedViews.readRows` `bigtable.authorizedViews.sampleRowKeys` `bigtable.authorizedViews.setIamPolicy` `bigtable.authorizedViews.update`
Bigtable	The following permissions have reached General Availability (GA): `bigtable.authorizedViews.create` `bigtable.authorizedViews.createTagBinding` `bigtable.authorizedViews.delete` `bigtable.authorizedViews.deleteTagBinding` `bigtable.authorizedViews.get` `bigtable.authorizedViews.getIamPolicy` `bigtable.authorizedViews.list` `bigtable.authorizedViews.listEffectiveTags` `bigtable.authorizedViews.listTagBindings` `bigtable.authorizedViews.mutateRows` `bigtable.authorizedViews.readRows` `bigtable.authorizedViews.sampleRowKeys` `bigtable.authorizedViews.setIamPolicy` `bigtable.authorizedViews.update`
Cloud SQL	The following permissions have been added: `cloudsql.instances.executeSql`
Cloud SQL	The following permissions have reached General Availability (GA): `cloudsql.instances.executeSql`
Compute Engine	The following permissions have been added: `compute.routers.deleteRoutePolicy` `compute.routers.getRoutePolicy` `compute.routers.listBgpRoutes` `compute.routers.listRoutePolicies` `compute.routers.updateRoutePolicy`
Dataproc Metastore	The following permissions have been added: `metastore.migrations.cancel` `metastore.migrations.complete` `metastore.migrations.delete` `metastore.migrations.get` `metastore.migrations.list` `metastore.migrations.start`
Dataproc Metastore	The following permissions are supported in custom roles: `metastore.migrations.cancel` `metastore.migrations.complete` `metastore.migrations.delete` `metastore.migrations.get` `metastore.migrations.list` `metastore.migrations.start`
Recommender	The following permissions have been added: `recommender.bigqueryMaterializedViewInsights.get` `recommender.bigqueryMaterializedViewInsights.list` `recommender.bigqueryMaterializedViewInsights.update` `recommender.bigqueryMaterializedViewRecommendations.get` `recommender.bigqueryMaterializedViewRecommendations.list` `recommender.bigqueryMaterializedViewRecommendations.update`
Recommender	The following permissions are supported in custom roles: `recommender.bigqueryMaterializedViewInsights.get` `recommender.bigqueryMaterializedViewInsights.list` `recommender.bigqueryMaterializedViewInsights.update` `recommender.bigqueryMaterializedViewRecommendations.get` `recommender.bigqueryMaterializedViewRecommendations.list` `recommender.bigqueryMaterializedViewRecommendations.update`

IAM changes as of 2024-03-15

Service	Description
Vertex AI	The Vertex AI Colab Service Agent role (`roles/aiplatform.colabServiceAgent`) has reached General Availability (GA).
Vertex AI	The Vertex AI RAG Data Service Agent role (`roles/aiplatform.ragServiceAgent`) has reached General Availability (GA).
AlloyDB for PostgreSQL	The following permissions have been added to the Cloud AlloyDB Admin role (`roles/alloydb.admin`): `cloudaicompanion.entitlements.get`
AlloyDB for PostgreSQL	The following permissions have been added to the Cloud AlloyDB Viewer role (`roles/alloydb.viewer`): `cloudaicompanion.entitlements.get`
Assured Open Source Software	The following permissions have been added to the Assured OSS Admin role (`roles/assuredoss.admin`): `iam.serviceAccounts.create` `iam.serviceAccounts.get` `serviceusage.services.enable` `serviceusage.services.get`
Backup and Disaster Recovery	The following permissions have been added to the Backup and DR Backup User role (`roles/backupdr.backupUser`): `backupdr.managementServers.createDynamicProtection` `backupdr.managementServers.deleteDynamicProtection` `backupdr.managementServers.getDynamicProtection` `backupdr.managementServers.listDynamicProtection`
Backup and Disaster Recovery	The following permissions have been added to the Backup and DR Mount User role (`roles/backupdr.mountUser`): `backupdr.managementServers.getDynamicProtection` `backupdr.managementServers.listDynamicProtection`
Backup and Disaster Recovery	The following permissions have been added to the Backup and DR Restore User role (`roles/backupdr.restoreUser`): `backupdr.managementServers.getDynamicProtection` `backupdr.managementServers.listDynamicProtection`
Backup and Disaster Recovery	The following permissions have been added to the Backup and DR User V2 role (`roles/backupdr.userv2`): `backupdr.managementServers.createDynamicProtection` `backupdr.managementServers.deleteDynamicProtection`
Google Security Operations	The following permissions have been added to the Chronicle API Limited Viewer role (`roles/chronicle.limitedViewer`): `chronicle.legacies.legacySearchCustomerStats` `chronicle.legacies.legacySearchIngestionStats`
Google Security Operations	The following permissions have been added to the Chronicle API Restricted Data Access Viewer role (`roles/chronicle.restrictedDataAccessViewer`): `chronicle.legacies.legacySearchCustomerStats` `chronicle.legacies.legacySearchIngestionStats` `chronicle.multitenantDirectories.get` `chronicle.referenceLists.get` `chronicle.referenceLists.list` `chronicle.referenceLists.verifyReferenceList`
Cloud Config Manager API	The following permissions have been added to the Cloud Infrastructure Manager Agent role (`roles/config.agent`): `cloudquotas.quotas.get`
Container Security	The following permissions have been added to the GKE Security Posture Viewer role (`roles/containersecurity.viewer`): `container.clusters.list`
Database Migration Service	The following permissions have been added to the Database Migration Admin role (`roles/datamigration.admin`): `cloudaicompanion.entitlements.get`
Dialogflow	The following permissions have been added to the Dialogflow Agent Assist Client role (`roles/dialogflow.agentAssistClient`): `dialogflow.messages.list`
Discovery Engine	The following permissions have been added to the Discovery Engine Service Agent role (`roles/discoveryengine.serviceAgent`): `datastore.databases.getMetadata`
Distributed Cloud Edge Container	The following permissions have been removed from the Edge Container Cluster Service Agent role (`roles/edgecontainer.clusterServiceAgent`): `gkehub.endpoints.connect` `gkehub.features.create` `gkehub.features.list` `gkehub.features.update` `gkehub.fleet.create` `gkehub.fleet.delete` `gkehub.fleet.get` `gkehub.locations.get` `gkehub.locations.list` `gkehub.memberships.create` `gkehub.memberships.delete` `gkehub.memberships.generateConnectManifest` `gkehub.memberships.list` `gkehub.memberships.update` `gkehub.operations.cancel` `gkehub.operations.delete` `gkehub.operations.get` `gkehub.operations.list` `serviceusage.services.list`
Security Command Center	The following permissions have been added to the Security Center Admin role (`roles/securitycenter.admin`): `artifactregistry.dockerimages.get` `artifactregistry.dockerimages.list` `artifactregistry.files.download` `artifactregistry.files.get` `artifactregistry.files.list` `artifactregistry.locations.get` `artifactregistry.locations.list` `artifactregistry.mavenartifacts.get` `artifactregistry.mavenartifacts.list` `artifactregistry.npmpackages.get` `artifactregistry.npmpackages.list` `artifactregistry.packages.get` `artifactregistry.packages.list` `artifactregistry.projectsettings.get` `artifactregistry.pythonpackages.get` `artifactregistry.pythonpackages.list` `artifactregistry.repositories.create` `artifactregistry.repositories.downloadArtifacts` `artifactregistry.repositories.get` `artifactregistry.repositories.list` `artifactregistry.repositories.listEffectiveTags` `artifactregistry.repositories.listTagBindings` `artifactregistry.repositories.readViaVirtualRepository` `artifactregistry.tags.get` `artifactregistry.tags.list` `artifactregistry.versions.get` `artifactregistry.versions.list` `assuredoss.config.get` `assuredoss.locations.get` `assuredoss.locations.list` `assuredoss.metadata.get` `assuredoss.metadata.list` `assuredoss.operations.cancel` `assuredoss.operations.delete` `assuredoss.operations.get` `assuredoss.operations.list` `iam.serviceAccounts.create` `iam.serviceAccounts.get` `serviceusage.services.enable`
Security Command Center	The following permissions have been added to the Security Center Admin Editor role (`roles/securitycenter.adminEditor`): `artifactregistry.dockerimages.get` `artifactregistry.dockerimages.list` `artifactregistry.files.download` `artifactregistry.files.get` `artifactregistry.files.list` `artifactregistry.locations.get` `artifactregistry.locations.list` `artifactregistry.mavenartifacts.get` `artifactregistry.mavenartifacts.list` `artifactregistry.npmpackages.get` `artifactregistry.npmpackages.list` `artifactregistry.packages.get` `artifactregistry.packages.list` `artifactregistry.projectsettings.get` `artifactregistry.pythonpackages.get` `artifactregistry.pythonpackages.list` `artifactregistry.repositories.downloadArtifacts` `artifactregistry.repositories.get` `artifactregistry.repositories.list` `artifactregistry.repositories.listEffectiveTags` `artifactregistry.repositories.listTagBindings` `artifactregistry.repositories.readViaVirtualRepository` `artifactregistry.tags.get` `artifactregistry.tags.list` `artifactregistry.versions.get` `artifactregistry.versions.list` `assuredoss.config.get` `assuredoss.locations.get` `assuredoss.locations.list` `assuredoss.metadata.get` `assuredoss.metadata.list` `assuredoss.operations.get` `assuredoss.operations.list`
Security Command Center	The following permissions have been added to the Security Center Admin Viewer role (`roles/securitycenter.adminViewer`): `artifactregistry.dockerimages.get` `artifactregistry.dockerimages.list` `artifactregistry.files.download` `artifactregistry.files.get` `artifactregistry.files.list` `artifactregistry.locations.get` `artifactregistry.locations.list` `artifactregistry.mavenartifacts.get` `artifactregistry.mavenartifacts.list` `artifactregistry.npmpackages.get` `artifactregistry.npmpackages.list` `artifactregistry.packages.get` `artifactregistry.packages.list` `artifactregistry.projectsettings.get` `artifactregistry.pythonpackages.get` `artifactregistry.pythonpackages.list` `artifactregistry.repositories.downloadArtifacts` `artifactregistry.repositories.get` `artifactregistry.repositories.list` `artifactregistry.repositories.listEffectiveTags` `artifactregistry.repositories.listTagBindings` `artifactregistry.repositories.readViaVirtualRepository` `artifactregistry.tags.get` `artifactregistry.tags.list` `artifactregistry.versions.get` `artifactregistry.versions.list` `assuredoss.config.get` `assuredoss.locations.get` `assuredoss.locations.list` `assuredoss.metadata.get` `assuredoss.metadata.list` `assuredoss.operations.get` `assuredoss.operations.list`
Cloud Storage	The Storage Folder Admin role (`roles/storage.folderAdmin`) has reached General Availability (GA).
Backup and Disaster Recovery	The following permissions have been added: `backupdr.managementServers.createDynamicProtection` `backupdr.managementServers.deleteDynamicProtection` `backupdr.managementServers.getDynamicProtection` `backupdr.managementServers.listDynamicProtection`
Backup and Disaster Recovery	The following permissions are supported in custom roles: `backupdr.managementServers.createDynamicProtection` `backupdr.managementServers.deleteDynamicProtection` `backupdr.managementServers.getDynamicProtection` `backupdr.managementServers.listDynamicProtection`
Backup and Disaster Recovery	The following permissions have reached General Availability (GA): `backupdr.managementServers.createDynamicProtection` `backupdr.managementServers.deleteDynamicProtection` `backupdr.managementServers.getDynamicProtection` `backupdr.managementServers.listDynamicProtection`
BigQuery Reservation API	The following permissions have been added: `bigqueryreservation.googleapis.com/bireservations.get` `bigqueryreservation.googleapis.com/bireservations.update`
Google Security Operations	The following permissions have been added: `chronicle.bigQueryAccess.provide` `chronicle.dataExports.cancel` `chronicle.dataExports.create` `chronicle.dataExports.fetchLogTypesAvailableForExport` `chronicle.dataExports.get` `chronicle.dataTaps.create` `chronicle.dataTaps.delete` `chronicle.dataTaps.get` `chronicle.dataTaps.list` `chronicle.dataTaps.update` `chronicle.feeds.generateSecret` `chronicle.instances.generateSoarAuthJwt` `chronicle.instances.soarAdmin` `chronicle.instances.soarThreatManager` `chronicle.instances.soarVulnerabilityManager` `chronicle.iocMatches.get` `chronicle.iocMatches.list` `chronicle.iocState.get` `chronicle.iocState.update` `chronicle.iocs.batchGet` `chronicle.iocs.findFirstAndLastSeen` `chronicle.iocs.get` `chronicle.iocs.searchCuratedDetectionsForIoc` `chronicle.legacies.legacyGetEventForDetection` `chronicle.legacies.legacySearchCustomerStats` `chronicle.legacies.legacySearchIngestionStats`
Google Security Operations	The following permissions are supported in custom roles: `chronicle.bigQueryAccess.provide` `chronicle.dataExports.cancel` `chronicle.dataExports.create` `chronicle.dataExports.fetchLogTypesAvailableForExport` `chronicle.dataExports.get` `chronicle.dataTaps.create` `chronicle.dataTaps.delete` `chronicle.dataTaps.get` `chronicle.dataTaps.list` `chronicle.dataTaps.update` `chronicle.feeds.generateSecret` `chronicle.iocMatches.get` `chronicle.iocMatches.list` `chronicle.iocState.get` `chronicle.iocState.update` `chronicle.iocs.batchGet` `chronicle.iocs.findFirstAndLastSeen` `chronicle.iocs.get` `chronicle.iocs.searchCuratedDetectionsForIoc` `chronicle.legacies.legacyGetEventForDetection` `chronicle.legacies.legacySearchCustomerStats` `chronicle.legacies.legacySearchIngestionStats`
Compute Engine	The following permissions have been added: `compute.projects.setCloudArmorTier` `compute.storagePools.setIamPolicy` `compute.storagePools.use`
Compute Engine	The following permissions are supported in custom roles: `compute.storagePools.use`
Compute Engine	The following permissions have reached General Availability (GA): `compute.instanceSettings.get` `compute.instanceSettings.update` `compute.projects.setCloudArmorTier` `compute.storagePools.setIamPolicy` `compute.storagePools.use`
Discovery Engine	The following permissions have been added: `discoveryengine.schemas.preview` `discoveryengine.schemas.validate`
Discovery Engine	The following permissions are supported in custom roles: `discoveryengine.schemas.preview` `discoveryengine.schemas.validate`
GKE Hub	The following permissions have been added: `gkehub.scopes.listBoundMemberships`
GKE Hub	The following permissions are supported in custom roles: `gkehub.scopes.listBoundMemberships`
GKE Hub	The following permissions have reached General Availability (GA): `gkehub.scopes.listBoundMemberships`
Google Cloud Migration Center	The following permissions have been added: `migrationcenter.discoveryClients.create` `migrationcenter.discoveryClients.delete` `migrationcenter.discoveryClients.get` `migrationcenter.discoveryClients.list` `migrationcenter.discoveryClients.sendHeartbeat` `migrationcenter.discoveryClients.update`
Privileged Access Manager	The following permissions have been added: `privilegedaccessmanager.entitlements.create` `privilegedaccessmanager.entitlements.delete` `privilegedaccessmanager.entitlements.get` `privilegedaccessmanager.entitlements.list` `privilegedaccessmanager.entitlements.setIamPolicy` `privilegedaccessmanager.entitlements.update` `privilegedaccessmanager.grants.approve` `privilegedaccessmanager.grants.create` `privilegedaccessmanager.grants.deny` `privilegedaccessmanager.grants.get` `privilegedaccessmanager.grants.list` `privilegedaccessmanager.grants.revoke` `privilegedaccessmanager.locations.get` `privilegedaccessmanager.locations.list` `privilegedaccessmanager.operations.delete` `privilegedaccessmanager.operations.get` `privilegedaccessmanager.operations.list`
Privileged Access Manager	The following permissions are supported in custom roles: `privilegedaccessmanager.entitlements.create` `privilegedaccessmanager.entitlements.delete` `privilegedaccessmanager.entitlements.get` `privilegedaccessmanager.entitlements.list` `privilegedaccessmanager.entitlements.setIamPolicy` `privilegedaccessmanager.entitlements.update` `privilegedaccessmanager.grants.get` `privilegedaccessmanager.grants.list` `privilegedaccessmanager.grants.revoke` `privilegedaccessmanager.locations.get` `privilegedaccessmanager.locations.list` `privilegedaccessmanager.operations.delete` `privilegedaccessmanager.operations.get` `privilegedaccessmanager.operations.list`
Cloud Storage	The following permissions have been added: `storage.anywhereCaches.create` `storage.anywhereCaches.disable` `storage.anywhereCaches.get` `storage.anywhereCaches.list` `storage.anywhereCaches.pause` `storage.anywhereCaches.resume` `storage.anywhereCaches.update`
Cloud Storage	The following permissions are supported in custom roles: `storage.anywhereCaches.create` `storage.anywhereCaches.disable` `storage.anywhereCaches.get` `storage.anywhereCaches.list` `storage.anywhereCaches.pause` `storage.anywhereCaches.resume` `storage.anywhereCaches.update`
Cloud Storage	The following permissions have reached General Availability (GA): `storage.managedFolders.create` `storage.managedFolders.delete` `storage.managedFolders.get` `storage.managedFolders.getIamPolicy` `storage.managedFolders.list` `storage.managedFolders.setIamPolicy`
Workload Manager	The following permissions have been added: `workloadmanager.insights.export`

IAM changes as of 2024-03-08

Service	Description
Cloud Service Mesh	The following permissions have been added to the Anthos Service Mesh Service Agent role (`roles/anthosservicemesh.serviceAgent`): `compute.networkEndpointGroups.attachNetworkEndpoints` `compute.networkEndpointGroups.create` `compute.networkEndpointGroups.delete` `compute.networkEndpointGroups.detachNetworkEndpoints` `compute.networkEndpointGroups.get`
Assured Open Source Software	The Assured OSS Project Admin role (`roles/assuredoss.projectAdmin`) has been added with the following permissions: `artifactregistry.dockerimages.get` `artifactregistry.dockerimages.list` `artifactregistry.files.download` `artifactregistry.files.get` `artifactregistry.files.list` `artifactregistry.googleapis.com/dockerimages.get` `artifactregistry.googleapis.com/dockerimages.list` `artifactregistry.googleapis.com/files.download` `artifactregistry.googleapis.com/files.get` `artifactregistry.googleapis.com/files.list` `artifactregistry.googleapis.com/locations.get` `artifactregistry.googleapis.com/locations.list` `artifactregistry.googleapis.com/mavenartifacts.get` `artifactregistry.googleapis.com/mavenartifacts.list` `artifactregistry.googleapis.com/npmpackages.get` `artifactregistry.googleapis.com/npmpackages.list` `artifactregistry.googleapis.com/packages.get` `artifactregistry.googleapis.com/packages.list` `artifactregistry.googleapis.com/projectsettings.get` `artifactregistry.googleapis.com/pythonpackages.get` `artifactregistry.googleapis.com/pythonpackages.list` `artifactregistry.googleapis.com/repositories.create` `artifactregistry.googleapis.com/repositories.downloadArtifacts` `artifactregistry.googleapis.com/repositories.get` `artifactregistry.googleapis.com/repositories.list` `artifactregistry.googleapis.com/repositories.listEffectiveTags` `artifactregistry.googleapis.com/repositories.listTagBindings` `artifactregistry.googleapis.com/repositories.readViaVirtualRepository` `artifactregistry.googleapis.com/rules.get` `artifactregistry.googleapis.com/rules.list` `artifactregistry.googleapis.com/tags.get` `artifactregistry.googleapis.com/tags.list` `artifactregistry.googleapis.com/versions.get` `artifactregistry.googleapis.com/versions.list` `artifactregistry.googleapis.com/vpcscconfigs.get` `artifactregistry.locations.get` `artifactregistry.locations.list` `artifactregistry.mavenartifacts.get` `artifactregistry.mavenartifacts.list` `artifactregistry.npmpackages.get` `artifactregistry.npmpackages.list` `artifactregistry.packages.get` `artifactregistry.packages.list` `artifactregistry.projectsettings.get` `artifactregistry.pythonpackages.get` `artifactregistry.pythonpackages.list` `artifactregistry.repositories.create` `artifactregistry.repositories.downloadArtifacts` `artifactregistry.repositories.get` `artifactregistry.repositories.list` `artifactregistry.repositories.listEffectiveTags` `artifactregistry.repositories.listTagBindings` `artifactregistry.repositories.readViaVirtualRepository` `artifactregistry.rules.get` `artifactregistry.rules.list` `artifactregistry.tags.get` `artifactregistry.tags.list` `artifactregistry.versions.get` `artifactregistry.versions.list` `artifactregistry.vpcscconfigs.get` `assuredoss.config.get` `assuredoss.customers.create` `assuredoss.googleapis.com/config.get` `assuredoss.googleapis.com/customers.create` `assuredoss.googleapis.com/locations.get` `assuredoss.googleapis.com/locations.list` `assuredoss.googleapis.com/metadata.get` `assuredoss.googleapis.com/metadata.list` `assuredoss.googleapis.com/operations.cancel` `assuredoss.googleapis.com/operations.delete` `assuredoss.googleapis.com/operations.get` `assuredoss.googleapis.com/operations.list` `assuredoss.locations.get` `assuredoss.locations.list` `assuredoss.metadata.get` `assuredoss.metadata.list` `assuredoss.operations.cancel` `assuredoss.operations.delete` `assuredoss.operations.get` `assuredoss.operations.list` `cloudresourcemanager.googleapis.com/organizations.get` `cloudresourcemanager.googleapis.com/projects.get` `cloudresourcemanager.googleapis.com/projects.list` `iam.googleapis.com/serviceAccounts.create` `iam.googleapis.com/serviceAccounts.get` `iam.serviceAccounts.create` `iam.serviceAccounts.get` `resourcemanager.organizations.get` `resourcemanager.projects.get` `resourcemanager.projects.list` `serviceusage.googleapis.com/services.enable` `serviceusage.googleapis.com/services.get` `serviceusage.services.enable` `serviceusage.services.get`
BigQuery Continuous Query	The BigQuery Continuous Query Service Agent role (`roles/bigquerycontinuousquery.serviceAgent`) has reached General Availability (GA).
Cloud Controls Partner API	The Cloud Controls Partner Admin role (`roles/cloudcontrolspartner.admin`) has reached General Availability (GA).
Cloud Controls Partner API	The Cloud Controls Partner Editor role (`roles/cloudcontrolspartner.editor`) has reached General Availability (GA).
Cloud Controls Partner API	The Cloud Controls Partner Inspectability Reader role (`roles/cloudcontrolspartner.inspectabilityReader`) has reached General Availability (GA).
Cloud Controls Partner API	The Cloud Controls Partner Monitoring Reader role (`roles/cloudcontrolspartner.monitoringReader`) has reached General Availability (GA).
Cloud Controls Partner API	The Cloud Controls Partner Reader role (`roles/cloudcontrolspartner.reader`) has reached General Availability (GA).
Cloud Deployment Manager	The Cloud Deployment Manager Service Agent role (`roles/clouddeploymentmanager.serviceAgent`) has reached General Availability (GA).
Cloud SQL	The following permissions have been added to the Cloud SQL Admin role (`roles/cloudsql.admin`): `cloudaicompanion.entitlements.get`
Cloud SQL	The following permissions have been added to the Cloud SQL Editor role (`roles/cloudsql.editor`): `cloudaicompanion.entitlements.get`
Cloud SQL	The following permissions have been added to the Cloud SQL Viewer role (`roles/cloudsql.viewer`): `cloudaicompanion.entitlements.get`
Cloud Composer	The following permissions have been added to the Cloud Composer API Service Agent role (`roles/composer.serviceAgent`): `cloudaicompanion.entitlements.get`
Route Optimization	The Route Optimization Service Agent role (`roles/routeoptimization.serviceAgent`) has reached General Availability (GA).
AlloyDB for PostgreSQL	The following permissions have been added: `alloydb.clusters.promote`
Apigee	The following permissions have been added: `apigee.securityFeedback.create` `apigee.securityFeedback.delete` `apigee.securityFeedback.get` `apigee.securityFeedback.list`
Apigee	The following permissions are supported in custom roles: `apigee.securityFeedback.create` `apigee.securityFeedback.delete` `apigee.securityFeedback.get` `apigee.securityFeedback.list`
Apigee	The following permissions have reached General Availability (GA): `apigee.securityFeedback.create` `apigee.securityFeedback.delete` `apigee.securityFeedback.get` `apigee.securityFeedback.list`
Cloud Controls Partner API	The following permissions have reached General Availability (GA): `cloudcontrolspartner.accessapprovalrequests.list` `cloudcontrolspartner.customers.get` `cloudcontrolspartner.customers.list` `cloudcontrolspartner.ekmconnections.get` `cloudcontrolspartner.inspectabilityevents.get` `cloudcontrolspartner.partnerpermissions.get` `cloudcontrolspartner.partners.get` `cloudcontrolspartner.platformcontrols.get` `cloudcontrolspartner.violations.get` `cloudcontrolspartner.violations.list` `cloudcontrolspartner.workloads.get` `cloudcontrolspartner.workloads.list`
Compute Engine	The following permissions have been added: `compute.instanceGroupManagers.createTagBinding` `compute.instanceGroupManagers.deleteTagBinding` `compute.instanceGroupManagers.listEffectiveTags` `compute.instanceGroupManagers.listTagBindings`
Compute Engine	The following permissions are supported in custom roles: `compute.instanceGroupManagers.createTagBinding` `compute.instanceGroupManagers.deleteTagBinding` `compute.instanceGroupManagers.listEffectiveTags` `compute.instanceGroupManagers.listTagBindings`
Compute Engine	The following permissions have reached General Availability (GA): `compute.instanceGroupManagers.createTagBinding` `compute.instanceGroupManagers.deleteTagBinding` `compute.instanceGroupManagers.listEffectiveTags` `compute.instanceGroupManagers.listTagBindings`
Cloud Config Manager API	The following permissions have been added: `config.terraformversions.get` `config.terraformversions.list`
Cloud Config Manager API	The following permissions are supported in custom roles: `config.terraformversions.get` `config.terraformversions.list`
Database Insights	The following permissions have been added: `databaseinsights.activeQueries.fetch` `databaseinsights.activeQuery.terminate` `databaseinsights.activitySummary.fetch` `databaseinsights.aggregatedEvents.query` `databaseinsights.aggregatedStats.query` `databaseinsights.clusterEvents.query` `databaseinsights.instanceEvents.query` `databaseinsights.locations.get` `databaseinsights.locations.list` `databaseinsights.recommendations.query` `databaseinsights.resourceRecommendations.query` `databaseinsights.timeSeries.query` `databaseinsights.workloadRecommendations.fetch`
Database Insights	The following permissions are supported in custom roles: `databaseinsights.activeQueries.fetch` `databaseinsights.activeQuery.terminate` `databaseinsights.activitySummary.fetch` `databaseinsights.aggregatedEvents.query` `databaseinsights.aggregatedStats.query` `databaseinsights.clusterEvents.query` `databaseinsights.instanceEvents.query` `databaseinsights.locations.get` `databaseinsights.locations.list` `databaseinsights.recommendations.query` `databaseinsights.resourceRecommendations.query` `databaseinsights.timeSeries.query` `databaseinsights.workloadRecommendations.fetch`
Sensitive Data Protection	The following permissions have been added: `dlp.charts.get`
Sensitive Data Protection	The following permissions have reached General Availability (GA): `dlp.charts.get`
Backup for GKE	The following permissions have been added: `gkebackup.backups.getBackupIndex`
Backup for GKE	The following permissions have reached General Availability (GA): `gkebackup.backups.getBackupIndex`
Cloud Run	The following permissions have been added: `run.executions.cancel`
Cloud Run	The following permissions have reached General Availability (GA): `run.executions.cancel`

IAM changes as of 2024-03-01

Service	Description
Vertex AI	The following permissions have been added to the Vertex AI Service Agent role (`roles/aiplatform.serviceAgent`): `run.executions.delete` `run.executions.get` `run.jobs.create` `run.jobs.delete` `run.jobs.get` `run.jobs.run` `run.jobs.update` `run.operations.delete` `run.operations.get`
Capacity Planner	The following permissions have been added to the Capacity Planner Usage Viewer role (`roles/capacityplanner.viewer`): `resourcemanager.organizations.get`
Cloud Run functions	The following permissions have been added to the Cloud Functions Admin role (`roles/cloudfunctions.admin`): `recommender.runServicePerformanceInsights.get` `recommender.runServicePerformanceInsights.list` `recommender.runServicePerformanceInsights.update` `recommender.runServicePerformanceRecommendations.get` `recommender.runServicePerformanceRecommendations.list` `recommender.runServicePerformanceRecommendations.update`
Cloud Run functions	The following permissions have been added to the Cloud Functions Developer role (`roles/cloudfunctions.developer`): `recommender.runServicePerformanceInsights.get` `recommender.runServicePerformanceInsights.list` `recommender.runServicePerformanceInsights.update` `recommender.runServicePerformanceRecommendations.get` `recommender.runServicePerformanceRecommendations.list` `recommender.runServicePerformanceRecommendations.update`
Cloud Run functions	The following permissions have been added to the Cloud Functions Service Agent role (`roles/cloudfunctions.serviceAgent`): `recommender.runServicePerformanceInsights.get` `recommender.runServicePerformanceInsights.list` `recommender.runServicePerformanceInsights.update` `recommender.runServicePerformanceRecommendations.get` `recommender.runServicePerformanceRecommendations.list` `recommender.runServicePerformanceRecommendations.update`
Cloud Run functions	The following permissions have been added to the Cloud Functions Viewer role (`roles/cloudfunctions.viewer`): `recommender.runServicePerformanceInsights.get` `recommender.runServicePerformanceInsights.list` `recommender.runServicePerformanceRecommendations.get` `recommender.runServicePerformanceRecommendations.list`
Compute Engine	The following permissions have been added to the Compute Load Balancer Admin role (`roles/compute.loadBalancerAdmin`): `compute.globalOperations.get` `compute.globalOperations.list` `compute.regionOperations.get` `compute.regionOperations.list` `compute.zoneOperations.get` `compute.zoneOperations.list`
Dataplex	The Dataplex Aspect Type Owner role (`roles/dataplex.aspectTypeOwner`) has reached General Availability (GA).
Dataplex	The Dataplex Aspect Type User role (`roles/dataplex.aspectTypeUser`) has reached General Availability (GA).
Dataplex	The Dataplex Entry Group Owner role (`roles/dataplex.entryGroupOwner`) has reached General Availability (GA).
Dataplex	The Dataplex Entry Owner role (`roles/dataplex.entryOwner`) has reached General Availability (GA).
Dataplex	The Dataplex Entry Type Owner role (`roles/dataplex.entryTypeOwner`) has reached General Availability (GA).
Dataplex	The Dataplex Entry Type User role (`roles/dataplex.entryTypeUser`) has reached General Availability (GA).
Dataplex	The following permissions have been removed from the Dataplex Administrator role (`roles/dataplex.admin`): `dataplex.aspectTypes.create` `dataplex.aspectTypes.delete` `dataplex.aspectTypes.get` `dataplex.aspectTypes.getIamPolicy` `dataplex.aspectTypes.list` `dataplex.aspectTypes.setIamPolicy` `dataplex.aspectTypes.update` `dataplex.aspectTypes.use` `dataplex.entries.create` `dataplex.entries.delete` `dataplex.entries.get` `dataplex.entries.list` `dataplex.entries.update` `dataplex.entryGroups.create` `dataplex.entryGroups.delete` `dataplex.entryGroups.get` `dataplex.entryGroups.getIamPolicy` `dataplex.entryGroups.list` `dataplex.entryGroups.setIamPolicy` `dataplex.entryGroups.update` `dataplex.entryGroups.useContactsAspect` `dataplex.entryGroups.useGenericAspect` `dataplex.entryGroups.useGenericEntry` `dataplex.entryGroups.useOverviewAspect` `dataplex.entryGroups.useSchemaAspect` `dataplex.entryTypes.create` `dataplex.entryTypes.delete` `dataplex.entryTypes.get` `dataplex.entryTypes.getIamPolicy` `dataplex.entryTypes.list` `dataplex.entryTypes.setIamPolicy` `dataplex.entryTypes.update` `dataplex.entryTypes.use`
Dataplex	The following permissions have been removed from the Dataplex Editor role (`roles/dataplex.editor`): `dataplex.aspectTypes.create` `dataplex.aspectTypes.delete` `dataplex.aspectTypes.get` `dataplex.aspectTypes.getIamPolicy` `dataplex.aspectTypes.list` `dataplex.aspectTypes.update` `dataplex.entryGroups.create` `dataplex.entryGroups.delete` `dataplex.entryGroups.get` `dataplex.entryGroups.getIamPolicy` `dataplex.entryGroups.list` `dataplex.entryGroups.update` `dataplex.entryTypes.create` `dataplex.entryTypes.delete` `dataplex.entryTypes.get` `dataplex.entryTypes.getIamPolicy` `dataplex.entryTypes.list` `dataplex.entryTypes.update`
Dataplex	The following permissions have been removed from the Dataplex Metadata Reader role (`roles/dataplex.metadataReader`): `dataplex.aspectTypes.get` `dataplex.aspectTypes.list` `dataplex.entries.get` `dataplex.entries.list` `dataplex.entryGroups.get` `dataplex.entryGroups.list` `dataplex.entryTypes.get` `dataplex.entryTypes.list`
Dataplex	The following permissions have been removed from the Dataplex Metadata Writer role (`roles/dataplex.metadataWriter`): `dataplex.aspectTypes.get` `dataplex.aspectTypes.list` `dataplex.aspectTypes.use` `dataplex.entries.create` `dataplex.entries.get` `dataplex.entries.list` `dataplex.entries.update` `dataplex.entryGroups.get` `dataplex.entryGroups.useContactsAspect` `dataplex.entryGroups.useGenericAspect` `dataplex.entryGroups.useGenericEntry` `dataplex.entryGroups.useOverviewAspect` `dataplex.entryGroups.useSchemaAspect` `dataplex.entryTypes.get` `dataplex.entryTypes.list` `dataplex.entryTypes.use`
Dataplex	The following permissions have been removed from the Dataplex Viewer role (`roles/dataplex.viewer`): `dataplex.aspectTypes.get` `dataplex.aspectTypes.getIamPolicy` `dataplex.aspectTypes.list` `dataplex.entryGroups.get` `dataplex.entryGroups.getIamPolicy` `dataplex.entryGroups.list` `dataplex.entryTypes.get` `dataplex.entryTypes.getIamPolicy` `dataplex.entryTypes.list`
Discovery Engine	The following permissions have been added to the Discovery Engine Service Agent role (`roles/discoveryengine.serviceAgent`): `alloydb.instances.get` `alloydb.operations.get` `bigtable.tables.readRows` `bigtable.tables.sampleRowKeys` `cloudsql.databases.get` `cloudsql.instances.export` `cloudsql.instances.get` `datastore.databases.export` `datastore.databases.get` `datastore.operations.get` `spanner.databases.beginReadOnlyTransaction` `spanner.databases.partitionQuery` `spanner.databases.select` `spanner.sessions.create`
Firebase	The following permissions have been added to the Firebase Admin role (`roles/firebase.admin`): `recommender.runServicePerformanceInsights.get` `recommender.runServicePerformanceInsights.list` `recommender.runServicePerformanceInsights.update` `recommender.runServicePerformanceRecommendations.get` `recommender.runServicePerformanceRecommendations.list` `recommender.runServicePerformanceRecommendations.update`
Firebase	The following permissions have been added to the Firebase Develop Admin role (`roles/firebase.developAdmin`): `recommender.runServicePerformanceInsights.get` `recommender.runServicePerformanceInsights.list` `recommender.runServicePerformanceInsights.update` `recommender.runServicePerformanceRecommendations.get` `recommender.runServicePerformanceRecommendations.list` `recommender.runServicePerformanceRecommendations.update`
Firebase	The following permissions have been added to the Firebase Develop Viewer role (`roles/firebase.developViewer`): `recommender.runServicePerformanceInsights.get` `recommender.runServicePerformanceInsights.list` `recommender.runServicePerformanceRecommendations.get` `recommender.runServicePerformanceRecommendations.list`
Firebase	The following permissions have been added to the Firebase Viewer role (`roles/firebase.viewer`): `recommender.runServicePerformanceInsights.get` `recommender.runServicePerformanceInsights.list` `recommender.runServicePerformanceRecommendations.get` `recommender.runServicePerformanceRecommendations.list`
Cloud Run	The following permissions have been added to the Cloud Run Admin role (`roles/run.admin`): `recommender.runServicePerformanceInsights.get` `recommender.runServicePerformanceInsights.list` `recommender.runServicePerformanceInsights.update` `recommender.runServicePerformanceRecommendations.get` `recommender.runServicePerformanceRecommendations.list` `recommender.runServicePerformanceRecommendations.update`
Cloud Run	The following permissions have been added to the Cloud Run Developer role (`roles/run.developer`): `recommender.runServicePerformanceInsights.get` `recommender.runServicePerformanceInsights.list` `recommender.runServicePerformanceInsights.update` `recommender.runServicePerformanceRecommendations.get` `recommender.runServicePerformanceRecommendations.list` `recommender.runServicePerformanceRecommendations.update`
Cloud Run	The following permissions have been added to the Cloud Run Viewer role (`roles/run.viewer`): `recommender.runServicePerformanceInsights.get` `recommender.runServicePerformanceInsights.list` `recommender.runServicePerformanceRecommendations.get` `recommender.runServicePerformanceRecommendations.list`
Security Command Center	The Attack Surface Management Scanner Service Agent role (`roles/securitycenter.attackSurfaceManagementScannerServiceAgent`) has reached General Availability (GA).
BigQuery	The following permissions have been added: `bigquery.tables.setColumnDataPolicy`
Bigtable	The following permissions have been added: `bigtable.instances.executeQuery`
Bigtable	The following permissions are supported in custom roles: `bigtable.instances.executeQuery`
Cloud Controls Partner API	The following permissions have been added: `cloudcontrolspartner.accessapprovalrequests.list` `cloudcontrolspartner.partnerpermissions.get`
Cloud Controls Partner API	The following permissions are supported in custom roles: `cloudcontrolspartner.accessapprovalrequests.list` `cloudcontrolspartner.partnerpermissions.get`
Dataplex	The following permissions have been added: `dataplex.aspectTypes.create` `dataplex.aspectTypes.delete` `dataplex.aspectTypes.get` `dataplex.aspectTypes.getIamPolicy` `dataplex.aspectTypes.list` `dataplex.aspectTypes.setIamPolicy` `dataplex.aspectTypes.update` `dataplex.aspectTypes.use` `dataplex.entries.create` `dataplex.entries.delete` `dataplex.entries.get` `dataplex.entries.list` `dataplex.entries.update` `dataplex.entryGroups.create` `dataplex.entryGroups.delete` `dataplex.entryGroups.get` `dataplex.entryGroups.getIamPolicy` `dataplex.entryGroups.list` `dataplex.entryGroups.setIamPolicy` `dataplex.entryGroups.update` `dataplex.entryGroups.useContactsAspect` `dataplex.entryGroups.useGenericAspect` `dataplex.entryGroups.useGenericEntry` `dataplex.entryGroups.useOverviewAspect` `dataplex.entryGroups.useSchemaAspect` `dataplex.entryTypes.create` `dataplex.entryTypes.delete` `dataplex.entryTypes.get` `dataplex.entryTypes.getIamPolicy` `dataplex.entryTypes.list` `dataplex.entryTypes.setIamPolicy` `dataplex.entryTypes.update` `dataplex.entryTypes.use`
Dataplex	The following permissions are supported in custom roles: `dataplex.aspectTypes.create` `dataplex.aspectTypes.delete` `dataplex.aspectTypes.get` `dataplex.aspectTypes.getIamPolicy` `dataplex.aspectTypes.list` `dataplex.aspectTypes.setIamPolicy` `dataplex.aspectTypes.update` `dataplex.aspectTypes.use` `dataplex.entries.create` `dataplex.entries.delete` `dataplex.entries.get` `dataplex.entries.list` `dataplex.entries.update` `dataplex.entryGroups.create` `dataplex.entryGroups.delete` `dataplex.entryGroups.get` `dataplex.entryGroups.getIamPolicy` `dataplex.entryGroups.list` `dataplex.entryGroups.setIamPolicy` `dataplex.entryGroups.update` `dataplex.entryGroups.useContactsAspect` `dataplex.entryGroups.useGenericAspect` `dataplex.entryGroups.useGenericEntry` `dataplex.entryGroups.useOverviewAspect` `dataplex.entryGroups.useSchemaAspect` `dataplex.entryTypes.create` `dataplex.entryTypes.delete` `dataplex.entryTypes.get` `dataplex.entryTypes.getIamPolicy` `dataplex.entryTypes.list` `dataplex.entryTypes.setIamPolicy` `dataplex.entryTypes.update` `dataplex.entryTypes.use`
Dataplex	The following permissions have reached General Availability (GA): `dataplex.aspectTypes.create` `dataplex.aspectTypes.delete` `dataplex.aspectTypes.get` `dataplex.aspectTypes.getIamPolicy` `dataplex.aspectTypes.list` `dataplex.aspectTypes.setIamPolicy` `dataplex.aspectTypes.update` `dataplex.aspectTypes.use` `dataplex.entries.create` `dataplex.entries.delete` `dataplex.entries.get` `dataplex.entries.list` `dataplex.entries.update` `dataplex.entryGroups.create` `dataplex.entryGroups.delete` `dataplex.entryGroups.get` `dataplex.entryGroups.getIamPolicy` `dataplex.entryGroups.list` `dataplex.entryGroups.setIamPolicy` `dataplex.entryGroups.update` `dataplex.entryGroups.useContactsAspect` `dataplex.entryGroups.useGenericAspect` `dataplex.entryGroups.useGenericEntry` `dataplex.entryGroups.useOverviewAspect` `dataplex.entryGroups.useSchemaAspect` `dataplex.entryTypes.create` `dataplex.entryTypes.delete` `dataplex.entryTypes.get` `dataplex.entryTypes.getIamPolicy` `dataplex.entryTypes.list` `dataplex.entryTypes.setIamPolicy` `dataplex.entryTypes.update` `dataplex.entryTypes.use`
Recommender	The following permissions have been added: `recommender.runServicePerformanceInsights.get` `recommender.runServicePerformanceInsights.list` `recommender.runServicePerformanceInsights.update` `recommender.runServicePerformanceRecommendations.get` `recommender.runServicePerformanceRecommendations.list` `recommender.runServicePerformanceRecommendations.update`
Recommender	The following permissions are supported in custom roles: `recommender.runServicePerformanceInsights.get` `recommender.runServicePerformanceInsights.list` `recommender.runServicePerformanceInsights.update` `recommender.runServicePerformanceRecommendations.get` `recommender.runServicePerformanceRecommendations.list` `recommender.runServicePerformanceRecommendations.update`
Recommender	The following permissions have reached General Availability (GA): `recommender.runServicePerformanceInsights.get` `recommender.runServicePerformanceInsights.list` `recommender.runServicePerformanceInsights.update` `recommender.runServicePerformanceRecommendations.get` `recommender.runServicePerformanceRecommendations.list` `recommender.runServicePerformanceRecommendations.update`
Security Posture API	The following permissions have been added: `securityposture.reports.create`
Security Posture API	The following permissions are supported in custom roles: `securityposture.reports.create`
Security Posture API	The following permissions have reached General Availability (GA): `securityposture.reports.create`

IAM changes as of 2024-02-23

Service	Description
App Hub	The App Hub Admin role (`roles/apphub.admin`) has reached General Availability (GA).
App Hub	The App Hub Editor role (`roles/apphub.editor`) has reached General Availability (GA).
App Hub	The App Hub Viewer role (`roles/apphub.viewer`) has reached General Availability (GA).
Audit Manager	The following permissions have been added to the Audit Manager Auditing Service Agent role (`roles/auditmanager.serviceAgent`): `compute.autoscalers.list` `compute.globalForwardingRules.list` `compute.instanceGroupManagers.list` `compute.regionSslPolicies.list` `compute.regionTargetHttpProxies.list` `compute.regionUrlMaps.list` `compute.urlMaps.list` `container.clusters.list` `monitoring.timeSeries.list` `serviceusage.operations.get` `serviceusage.operations.list` `serviceusage.quotas.get` `serviceusage.services.list` `storage.buckets.get`
Backup and Disaster Recovery	The following permissions have been added to the Backup and DR Compute Engine Operator role (`roles/backupdr.computeEngineOperator`): `compute.instances.listEffectiveTags`
Cloud SQL	The Cloud SQL Schema Viewer role (`roles/cloudsql.schemaViewer`) has reached General Availability (GA).
Privileged Access Manager	The following permissions have been added to the Privileged Access Manager Folder Service Agent role (`roles/privilegedaccessmanager.folderServiceAgent`): `resourcemanager.folders.get`
Privileged Access Manager	The following permissions have been added to the Privileged Access Manager Organization Service Agent role (`roles/privilegedaccessmanager.organizationServiceAgent`): `resourcemanager.organizations.get`
Privileged Access Manager	The following permissions have been added to the Privileged Access Manager Project Service Agent role (`roles/privilegedaccessmanager.projectServiceAgent`): `resourcemanager.projects.get`
Recommender	The RecentChange RecommenderConfig Admin role (`roles/recommender.recentChangeConfigAdmin`) has reached General Availability (GA).
Recommender	The Recent Change Risk Recommender Admin role (`roles/recommender.recentchangeriskAdmin`) has reached General Availability (GA).
Recommender	The Recent Change Risk Recommender Viewer role (`roles/recommender.recentchangeriskViewer`) has reached General Availability (GA).
AlloyDB for PostgreSQL	The following permissions have been added: `alloydb.backups.createTagBinding` `alloydb.backups.deleteTagBinding` `alloydb.backups.listEffectiveTags` `alloydb.backups.listTagBindings` `alloydb.clusters.createTagBinding` `alloydb.clusters.deleteTagBinding` `alloydb.clusters.listEffectiveTags` `alloydb.clusters.listTagBindings`
App Hub	The following permissions have reached General Availability (GA): `apphub.applications.create` `apphub.applications.delete` `apphub.applications.get` `apphub.applications.getIamPolicy` `apphub.applications.list` `apphub.applications.setIamPolicy` `apphub.applications.update` `apphub.discoveredServices.get` `apphub.discoveredServices.list` `apphub.discoveredServices.register` `apphub.discoveredWorkloads.get` `apphub.discoveredWorkloads.list` `apphub.discoveredWorkloads.register` `apphub.locations.get` `apphub.locations.list` `apphub.operations.cancel` `apphub.operations.delete` `apphub.operations.get` `apphub.operations.list` `apphub.serviceProjectAttachments.attach` `apphub.serviceProjectAttachments.create` `apphub.serviceProjectAttachments.delete` `apphub.serviceProjectAttachments.detach` `apphub.serviceProjectAttachments.get` `apphub.serviceProjectAttachments.list` `apphub.serviceProjectAttachments.lookup` `apphub.services.create` `apphub.services.delete` `apphub.services.get` `apphub.services.list` `apphub.services.update` `apphub.workloads.create` `apphub.workloads.delete` `apphub.workloads.get` `apphub.workloads.list` `apphub.workloads.update`
Cloud SQL	The following permissions have been added: `cloudsql.schemas.view`
Cloud SQL	The following permissions have reached General Availability (GA): `cloudsql.schemas.view`
Compute Engine	The following permissions have been added: `compute.storagePools.create` `compute.storagePools.delete` `compute.storagePools.get` `compute.storagePools.getIamPolicy` `compute.storagePools.list` `compute.storagePools.update`
Compute Engine	The following permissions are supported in custom roles: `compute.storagePools.create` `compute.storagePools.delete` `compute.storagePools.get` `compute.storagePools.getIamPolicy` `compute.storagePools.list` `compute.storagePools.update`
Compute Engine	The following permissions have reached General Availability (GA): `compute.storagePools.create` `compute.storagePools.delete` `compute.storagePools.get` `compute.storagePools.getIamPolicy` `compute.storagePools.list` `compute.storagePools.update`
Recommender	The following permissions have been added: `recommender.cloudRecentChangeInsights.get` `recommender.cloudRecentChangeInsights.list` `recommender.cloudRecentChangeInsights.update` `recommender.cloudRecentChangeRecommendations.get` `recommender.cloudRecentChangeRecommendations.list` `recommender.cloudRecentChangeRecommendations.update` `recommender.cloudRecentChangeRecommenderConfig.get` `recommender.cloudRecentChangeRecommenderConfig.update`
Recommender	The following permissions are supported in custom roles: `recommender.cloudRecentChangeInsights.get` `recommender.cloudRecentChangeInsights.list` `recommender.cloudRecentChangeInsights.update` `recommender.cloudRecentChangeRecommendations.get` `recommender.cloudRecentChangeRecommendations.list` `recommender.cloudRecentChangeRecommendations.update` `recommender.cloudRecentChangeRecommenderConfig.get` `recommender.cloudRecentChangeRecommenderConfig.update`
Recommender	The following permissions have reached General Availability (GA): `recommender.cloudRecentChangeInsights.get` `recommender.cloudRecentChangeInsights.list` `recommender.cloudRecentChangeInsights.update` `recommender.cloudRecentChangeRecommendations.get` `recommender.cloudRecentChangeRecommendations.list` `recommender.cloudRecentChangeRecommendations.update` `recommender.cloudRecentChangeRecommenderConfig.get` `recommender.cloudRecentChangeRecommenderConfig.update`
Cloud Storage	The following permissions have been added: `storage.bucketOperations.cancel` `storage.bucketOperations.get` `storage.bucketOperations.list` `storage.buckets.restore` `storage.objects.restore`
Cloud Storage	The following permissions have reached General Availability (GA): `storage.bucketOperations.cancel` `storage.bucketOperations.get` `storage.bucketOperations.list` `storage.buckets.restore` `storage.objects.restore`

IAM changes as of 2024-02-16

Service	Description
Audit Manager	The following permissions have been added to the Audit Manager Auditing Service Agent role (`roles/auditmanager.serviceAgent`): `compute.vpnGateways.list` `logging.buckets.list` `serviceusage.services.get` `storage.buckets.getIamPolicy`
BigQuery	The following permissions have been added to the BigQuery Admin role (`roles/bigquery.admin`): `dataform.compilationResults.create` `dataform.compilationResults.get` `dataform.compilationResults.list` `dataform.compilationResults.query` `dataform.locations.get` `dataform.locations.list` `dataform.releaseConfigs.create` `dataform.releaseConfigs.delete` `dataform.releaseConfigs.get` `dataform.releaseConfigs.list` `dataform.releaseConfigs.update` `dataform.repositories.commit` `dataform.repositories.computeAccessTokenStatus` `dataform.repositories.create` `dataform.repositories.delete` `dataform.repositories.fetchHistory` `dataform.repositories.fetchRemoteBranches` `dataform.repositories.get` `dataform.repositories.getIamPolicy` `dataform.repositories.list` `dataform.repositories.queryDirectoryContents` `dataform.repositories.readFile` `dataform.repositories.setIamPolicy` `dataform.repositories.update` `dataform.workflowConfigs.create` `dataform.workflowConfigs.delete` `dataform.workflowConfigs.get` `dataform.workflowConfigs.list` `dataform.workflowConfigs.update` `dataform.workflowInvocations.cancel` `dataform.workflowInvocations.create` `dataform.workflowInvocations.delete` `dataform.workflowInvocations.get` `dataform.workflowInvocations.list` `dataform.workflowInvocations.query` `dataform.workspaces.commit` `dataform.workspaces.create` `dataform.workspaces.delete` `dataform.workspaces.fetchFileDiff` `dataform.workspaces.fetchFileGitStatuses` `dataform.workspaces.fetchGitAheadBehind` `dataform.workspaces.get` `dataform.workspaces.getIamPolicy` `dataform.workspaces.installNpmPackages` `dataform.workspaces.list` `dataform.workspaces.makeDirectory` `dataform.workspaces.moveDirectory` `dataform.workspaces.moveFile` `dataform.workspaces.pull` `dataform.workspaces.push` `dataform.workspaces.queryDirectoryContents` `dataform.workspaces.readFile` `dataform.workspaces.removeDirectory` `dataform.workspaces.removeFile` `dataform.workspaces.reset` `dataform.workspaces.searchFiles` `dataform.workspaces.setIamPolicy` `dataform.workspaces.writeFile`
BigQuery	The following permissions have been added to the BigQuery Job User role (`roles/bigquery.jobUser`): `dataform.locations.get` `dataform.locations.list` `dataform.repositories.create` `dataform.repositories.list`
BigQuery	The following permissions have been added to the BigQuery User role (`roles/bigquery.user`): `dataform.locations.get` `dataform.locations.list` `dataform.repositories.create` `dataform.repositories.list`
BigQuery Data Transfer Service	The following permissions have been added to the BigQuery Data Transfer Service Agent role (`roles/bigquerydatatransfer.serviceAgent`): `compute.regionOperations.get` `compute.subnetworks.use` `dataform.locations.get` `dataform.locations.list` `dataform.repositories.create` `dataform.repositories.list`
Dataflow	The following permissions have been added to the Cloud Dataflow Service Agent role (`roles/dataflow.serviceAgent`): `dataform.compilationResults.create` `dataform.compilationResults.get` `dataform.compilationResults.list` `dataform.compilationResults.query` `dataform.locations.get` `dataform.locations.list` `dataform.releaseConfigs.create` `dataform.releaseConfigs.delete` `dataform.releaseConfigs.get` `dataform.releaseConfigs.list` `dataform.releaseConfigs.update` `dataform.repositories.commit` `dataform.repositories.computeAccessTokenStatus` `dataform.repositories.create` `dataform.repositories.delete` `dataform.repositories.fetchHistory` `dataform.repositories.fetchRemoteBranches` `dataform.repositories.get` `dataform.repositories.getIamPolicy` `dataform.repositories.list` `dataform.repositories.queryDirectoryContents` `dataform.repositories.readFile` `dataform.repositories.setIamPolicy` `dataform.repositories.update` `dataform.workflowConfigs.create` `dataform.workflowConfigs.delete` `dataform.workflowConfigs.get` `dataform.workflowConfigs.list` `dataform.workflowConfigs.update` `dataform.workflowInvocations.cancel` `dataform.workflowInvocations.create` `dataform.workflowInvocations.delete` `dataform.workflowInvocations.get` `dataform.workflowInvocations.list` `dataform.workflowInvocations.query` `dataform.workspaces.commit` `dataform.workspaces.create` `dataform.workspaces.delete` `dataform.workspaces.fetchFileDiff` `dataform.workspaces.fetchFileGitStatuses` `dataform.workspaces.fetchGitAheadBehind` `dataform.workspaces.get` `dataform.workspaces.getIamPolicy` `dataform.workspaces.installNpmPackages` `dataform.workspaces.list` `dataform.workspaces.makeDirectory` `dataform.workspaces.moveDirectory` `dataform.workspaces.moveFile` `dataform.workspaces.pull` `dataform.workspaces.push` `dataform.workspaces.queryDirectoryContents` `dataform.workspaces.readFile` `dataform.workspaces.removeDirectory` `dataform.workspaces.removeFile` `dataform.workspaces.reset` `dataform.workspaces.searchFiles` `dataform.workspaces.setIamPolicy` `dataform.workspaces.writeFile`
Cloud Data Fusion	The following permissions have been added to the Cloud Data Fusion API Service Agent role (`roles/datafusion.serviceAgent`): `dataform.locations.get` `dataform.locations.list` `dataform.repositories.create` `dataform.repositories.list`
Dataplex	The following permissions have been added to the Cloud Dataplex Service Agent role (`roles/dataplex.serviceAgent`): `dataform.compilationResults.create` `dataform.compilationResults.get` `dataform.compilationResults.list` `dataform.compilationResults.query` `dataform.locations.get` `dataform.locations.list` `dataform.releaseConfigs.create` `dataform.releaseConfigs.delete` `dataform.releaseConfigs.get` `dataform.releaseConfigs.list` `dataform.releaseConfigs.update` `dataform.repositories.commit` `dataform.repositories.computeAccessTokenStatus` `dataform.repositories.create` `dataform.repositories.delete` `dataform.repositories.fetchHistory` `dataform.repositories.fetchRemoteBranches` `dataform.repositories.get` `dataform.repositories.getIamPolicy` `dataform.repositories.list` `dataform.repositories.queryDirectoryContents` `dataform.repositories.readFile` `dataform.repositories.setIamPolicy` `dataform.repositories.update` `dataform.workflowConfigs.create` `dataform.workflowConfigs.delete` `dataform.workflowConfigs.get` `dataform.workflowConfigs.list` `dataform.workflowConfigs.update` `dataform.workflowInvocations.cancel` `dataform.workflowInvocations.create` `dataform.workflowInvocations.delete` `dataform.workflowInvocations.get` `dataform.workflowInvocations.list` `dataform.workflowInvocations.query` `dataform.workspaces.commit` `dataform.workspaces.create` `dataform.workspaces.delete` `dataform.workspaces.fetchFileDiff` `dataform.workspaces.fetchFileGitStatuses` `dataform.workspaces.fetchGitAheadBehind` `dataform.workspaces.get` `dataform.workspaces.getIamPolicy` `dataform.workspaces.installNpmPackages` `dataform.workspaces.list` `dataform.workspaces.makeDirectory` `dataform.workspaces.moveDirectory` `dataform.workspaces.moveFile` `dataform.workspaces.pull` `dataform.workspaces.push` `dataform.workspaces.queryDirectoryContents` `dataform.workspaces.readFile` `dataform.workspaces.removeDirectory` `dataform.workspaces.removeFile` `dataform.workspaces.reset` `dataform.workspaces.searchFiles` `dataform.workspaces.setIamPolicy` `dataform.workspaces.writeFile`
Dataprep by Trifacta	The following permissions have been added to the Dataprep Service Agent role (`roles/dataprep.serviceAgent`): `dataform.locations.get` `dataform.locations.list` `dataform.repositories.create` `dataform.repositories.list`
Sensitive Data Protection	The following permissions have been added to the DLP Organization Data Profiles Driver role (`roles/dlp.orgdriver`): `dataform.locations.get` `dataform.locations.list` `dataform.repositories.create` `dataform.repositories.list`
Sensitive Data Protection	The following permissions have been added to the DLP Project Data Profiles Driver role (`roles/dlp.projectdriver`): `dataform.locations.get` `dataform.locations.list` `dataform.repositories.create` `dataform.repositories.list`
Sensitive Data Protection	The following permissions have been added to the DLP API Service Agent role (`roles/dlp.serviceAgent`): `dataform.locations.get` `dataform.locations.list` `dataform.repositories.create` `dataform.repositories.list`
Enterprise Knowledge Graph	The following permissions have been added to the Enterprise Knowledge Graph Service Agent role (`roles/enterpriseknowledgegraph.serviceAgent`): `dataform.locations.get` `dataform.locations.list` `dataform.repositories.create` `dataform.repositories.list`
FleetEngine	The following permissions have been added to the FleetEngine Service Agent role (`roles/fleetengine.serviceAgent`): `dataform.locations.get` `dataform.locations.list` `dataform.repositories.create` `dataform.repositories.list`
Security Posture API	The following permissions have been added to the Security Posture Shift-Left Validator role (`roles/securityposture.reportCreator`): `securityposture.operations.get`
Google Security Operations	The following permissions have been added: `chronicle.events.searchRawLogs` `chronicle.logTypes.list`
Google Security Operations	The following permissions are supported in custom roles: `chronicle.events.searchRawLogs` `chronicle.logTypes.list`
Firebase Test Lab	The following permissions have been added: `cloudtestservice.devicesession.cancel` `cloudtestservice.devicesession.create` `cloudtestservice.devicesession.get` `cloudtestservice.devicesession.list` `cloudtestservice.devicesession.update` `cloudtestservice.devicesession.use`
Firebase Test Lab	The following permissions are supported in custom roles: `cloudtestservice.devicesession.cancel` `cloudtestservice.devicesession.create` `cloudtestservice.devicesession.get` `cloudtestservice.devicesession.list` `cloudtestservice.devicesession.update` `cloudtestservice.devicesession.use`
Conversational Insights	The following permissions have reached General Availability (GA): `contactcenterinsights.issueModels.import`
Discovery Engine	The following permissions have been added: `discoveryengine.collections.delete` `discoveryengine.collections.get` `discoveryengine.collections.list`
Discovery Engine	The following permissions are supported in custom roles: `discoveryengine.collections.delete` `discoveryengine.collections.get` `discoveryengine.collections.list`

IAM changes as of 2024-02-09

Service	Description
Advisory Notifications	The Advisory Notifications Admin role (`roles/advisorynotifications.admin`) has reached General Availability (GA).
Vertex AI	The following permissions have been added to the Vertex AI Custom Code Service Agent role (`roles/aiplatform.customCodeServiceAgent`): `monitoring.metricDescriptors.create` `monitoring.metricDescriptors.get` `monitoring.metricDescriptors.list` `monitoring.monitoredResourceDescriptors.get` `monitoring.monitoredResourceDescriptors.list` `monitoring.timeSeries.create`
App Engine	The following permissions have been added to the App Engine Code Viewer role (`roles/appengine.codeViewer`): `appengine.applications.listRuntimes`
Audit Manager	The following permissions have been added to the Audit Manager Auditing Service Agent role (`roles/auditmanager.serviceAgent`): `cloudsql.instances.list` `compute.disks.list` `compute.firewalls.list` `compute.forwardingRules.list` `compute.routers.list` `compute.securityPolicies.list` `compute.sslCertificates.list` `compute.sslPolicies.list` `compute.subnetworks.list` `compute.targetHttpProxies.list` `compute.targetSslProxies.list` `orgpolicy.policy.get` `storage.buckets.list`
Advisory Notifications	The following permissions have reached General Availability (GA): `advisorynotifications.settings.get` `advisorynotifications.settings.update`
App Engine	The following permissions have been added: `appengine.applications.listRuntimes`
App Engine	The following permissions have reached General Availability (GA): `appengine.applications.listRuntimes`
Artifact Registry	The following permissions have been added: `artifactregistry.files.download`
Artifact Registry	The following permissions have reached General Availability (GA): `artifactregistry.files.download`
Cloud Deploy	The following permissions have been added: `clouddeploy.customTargetTypes.getIamPolicy` `clouddeploy.customTargetTypes.setIamPolicy`
Cloud Composer	The following permissions have been added: `composer.userworkloadsconfigmaps.create` `composer.userworkloadsconfigmaps.delete` `composer.userworkloadsconfigmaps.get` `composer.userworkloadsconfigmaps.list` `composer.userworkloadsconfigmaps.update` `composer.userworkloadssecrets.create` `composer.userworkloadssecrets.delete` `composer.userworkloadssecrets.get` `composer.userworkloadssecrets.list` `composer.userworkloadssecrets.update`
Cloud Composer	The following permissions are supported in custom roles: `composer.userworkloadsconfigmaps.create` `composer.userworkloadsconfigmaps.delete` `composer.userworkloadsconfigmaps.get` `composer.userworkloadsconfigmaps.list` `composer.userworkloadsconfigmaps.update` `composer.userworkloadssecrets.create` `composer.userworkloadssecrets.delete` `composer.userworkloadssecrets.get` `composer.userworkloadssecrets.list` `composer.userworkloadssecrets.update`
Cloud Composer	The following permissions have reached General Availability (GA): `composer.userworkloadsconfigmaps.create` `composer.userworkloadsconfigmaps.delete` `composer.userworkloadsconfigmaps.get` `composer.userworkloadsconfigmaps.list` `composer.userworkloadsconfigmaps.update` `composer.userworkloadssecrets.create` `composer.userworkloadssecrets.delete` `composer.userworkloadssecrets.get` `composer.userworkloadssecrets.list` `composer.userworkloadssecrets.update`
Dialogflow	The following permissions have been added: `dialogflow.encryptionspec.get` `dialogflow.encryptionspec.update` `dialogflow.examples.create` `dialogflow.examples.delete` `dialogflow.examples.get` `dialogflow.examples.list` `dialogflow.examples.update` `dialogflow.playbooks.create` `dialogflow.playbooks.delete` `dialogflow.playbooks.get` `dialogflow.playbooks.list` `dialogflow.playbooks.update` `dialogflow.tools.create` `dialogflow.tools.delete` `dialogflow.tools.get` `dialogflow.tools.list` `dialogflow.tools.update`
Dialogflow	The following permissions have reached General Availability (GA): `dialogflow.encryptionspec.get` `dialogflow.encryptionspec.update` `dialogflow.examples.create` `dialogflow.examples.delete` `dialogflow.examples.get` `dialogflow.examples.list` `dialogflow.examples.update` `dialogflow.playbooks.create` `dialogflow.playbooks.delete` `dialogflow.playbooks.get` `dialogflow.playbooks.list` `dialogflow.playbooks.update` `dialogflow.tools.create` `dialogflow.tools.delete` `dialogflow.tools.get` `dialogflow.tools.list` `dialogflow.tools.update`

IAM changes as of 2024-02-02

Service	Description
Google Security Operations	The following permissions have been added to the Chronicle API Restricted Data Access Viewer role (`roles/chronicle.restrictedDataAccessViewer`): `chronicle.dataAccessScopes.list`
Google Security Operations	The following permissions have been added to the Chronicle API Viewer role (`roles/chronicle.viewer`): `chronicle.dataAccessScopes.list`
Cloud Key Management Service	The Cloud KMS KACLS Service Agent role (`roles/cloudkmskacls.serviceAgent`) has reached General Availability (GA).
Firebase	The following permissions have been added to the Firebase Service Management Service Agent role (`roles/firebase.managementServiceAgent`): `firebaseabt.experiments.delete`
Workload Manager	The following permissions have been added to the Workload Manager Admin role (`roles/workloadmanager.admin`): `dns.managedZones.list` `resourcemanager.projects.getIamPolicy` `storage.objects.list`
Workload Manager	The following permissions have been added to the Workload Manager Deployment Admin role (`roles/workloadmanager.deploymentAdmin`): `dns.managedZones.list` `resourcemanager.projects.getIamPolicy` `storage.objects.list`
AlloyDB for PostgreSQL	The following permissions have been added: `alloydb.databases.list`
AlloyDB for PostgreSQL	The following permissions are supported in custom roles: `alloydb.databases.list`
Audit Manager	The following permissions have been added: `auditmanager.auditReports.generate` `auditmanager.auditScopeReports.generate` `auditmanager.locations.enrollResource` `auditmanager.locations.get` `auditmanager.locations.list` `auditmanager.operations.get` `auditmanager.operations.list`
Audit Manager	The following permissions are supported in custom roles: `auditmanager.auditReports.generate` `auditmanager.auditScopeReports.generate` `auditmanager.locations.enrollResource` `auditmanager.locations.get` `auditmanager.locations.list` `auditmanager.operations.get` `auditmanager.operations.list`
Google Security Operations	The following permissions have been added: `chronicle.entities.batchCreate` `chronicle.entities.batchDelete` `chronicle.entities.batchValidate` `chronicle.entities.create` `chronicle.entities.delete` `chronicle.entities.list` `chronicle.entities.modifyEntityRiskScore` `chronicle.operations.streamSearch` `chronicle.watchlists.create` `chronicle.watchlists.delete` `chronicle.watchlists.get` `chronicle.watchlists.list` `chronicle.watchlists.update`
Google Security Operations	The following permissions are supported in custom roles: `chronicle.entities.batchCreate` `chronicle.entities.batchDelete` `chronicle.entities.batchValidate` `chronicle.entities.create` `chronicle.entities.delete` `chronicle.entities.list` `chronicle.entities.modifyEntityRiskScore` `chronicle.operations.streamSearch` `chronicle.watchlists.create` `chronicle.watchlists.delete` `chronicle.watchlists.get` `chronicle.watchlists.list` `chronicle.watchlists.update`

IAM changes as of 2024-01-26

Service	Description
Vertex AI	The following permissions have been added to the Vertex AI Feature Store Resource Viewer role (`roles/aiplatform.featurestoreResourceViewer`): `aiplatform.featureGroups.get` `aiplatform.featureGroups.list` `aiplatform.featureOnlineStores.get` `aiplatform.featureOnlineStores.list` `aiplatform.featureViewSyncs.get` `aiplatform.featureViewSyncs.list` `aiplatform.featureViews.get` `aiplatform.featureViews.list`
Audit Manager	The Audit Manager Auditing Service Agent role (`roles/auditmanager.serviceAgent`) has reached General Availability (GA).
Gemini for Google Cloud API	The following permissions have been added to the Cloud AI Companion User role (`roles/cloudaicompanion.user`): `cloudaicompanion.entitlements.get`
Dialogflow	The following permissions have been added to the Dialogflow Service Agent role (`roles/dialogflow.serviceAgent`): `aiplatform.endpoints.get` `aiplatform.endpoints.predict` `aiplatform.models.get` `run.jobs.run` `run.routes.invoke`
Sensitive Data Protection	The following permissions have been added to the DLP Administrator role (`roles/dlp.admin`): `dlp.connections.create` `dlp.connections.delete` `dlp.connections.get` `dlp.connections.list` `dlp.connections.search` `dlp.connections.update` `dlp.subscriptions.cancel` `dlp.subscriptions.create` `dlp.subscriptions.get` `dlp.subscriptions.list` `dlp.subscriptions.update` `resourcemanager.projects.get` `resourcemanager.projects.list`
Sensitive Data Protection	The following permissions have been added to the DLP Organization Data Profiles Driver role (`roles/dlp.orgdriver`): `cloudsql.instances.connect` `cloudsql.instances.get` `cloudsql.instances.login` `dlp.connections.create` `dlp.connections.delete` `dlp.connections.get` `dlp.connections.list` `dlp.connections.search` `dlp.connections.update` `dlp.subscriptions.cancel` `dlp.subscriptions.create` `dlp.subscriptions.get` `dlp.subscriptions.list` `dlp.subscriptions.update`
Sensitive Data Protection	The following permissions have been added to the DLP Project Data Profiles Driver role (`roles/dlp.projectdriver`): `cloudsql.instances.connect` `cloudsql.instances.get` `cloudsql.instances.login` `dlp.connections.create` `dlp.connections.delete` `dlp.connections.get` `dlp.connections.list` `dlp.connections.search` `dlp.connections.update` `dlp.subscriptions.cancel` `dlp.subscriptions.create` `dlp.subscriptions.get` `dlp.subscriptions.list` `dlp.subscriptions.update`
Distributed Cloud Edge Container	The following permissions have been added to the Edge Container Cluster Service Agent role (`roles/edgecontainer.clusterServiceAgent`): `monitoring.notificationChannelDescriptors.get` `monitoring.notificationChannelDescriptors.list` `monitoring.notificationChannels.get` `monitoring.notificationChannels.list` `monitoring.publicWidgets.get` `monitoring.publicWidgets.list` `monitoring.services.get` `monitoring.services.list` `monitoring.slos.get` `monitoring.slos.list` `monitoring.snoozes.get` `monitoring.snoozes.list` `monitoring.timeSeries.list` `monitoring.uptimeCheckConfigs.get`
Basic Role	The following permissions have been added to the Editor role (`roles/editor`): `cloudaicompanion.entitlements.get`
Basic Role	The following permissions have been added to the Owner role (`roles/owner`): `cloudaicompanion.entitlements.get`
Policy Simulator	The following permissions have been added to the OrgPolicy Simulator Admin role (`roles/policysimulator.orgPolicyAdmin`): `cloudasset.assets.analyzeOrgPolicy`
Basic Role	The following permissions have been added to the Viewer role (`roles/viewer`): `cloudaicompanion.entitlements.get`
Google Cloud VMware Engine	The following permissions have been added to the VMware Engine Service Agent role (`roles/vmwareengine.serviceAgent`): `vmwareengine.nodes.get` `vmwareengine.nodes.list`
AlloyDB for PostgreSQL	The following permissions have been added: `alloydb.instances.executeSql`
AlloyDB for PostgreSQL	The following permissions are supported in custom roles: `alloydb.instances.executeSql`
Gemini for Google Cloud API	The following permissions have been added: `cloudaicompanion.entitlements.get`
Discovery Engine	The following permissions have been added: `discoveryengine.branches.get` `discoveryengine.branches.list` `discoveryengine.documentProcessingConfigs.get` `discoveryengine.documentProcessingConfigs.update` `discoveryengine.siteSearchEngines.batchVerifyTargetSites` `discoveryengine.siteSearchEngines.fetchDomainVerificationStatus`
Discovery Engine	The following permissions are supported in custom roles: `discoveryengine.documentProcessingConfigs.get` `discoveryengine.documentProcessingConfigs.update` `discoveryengine.siteSearchEngines.batchVerifyTargetSites` `discoveryengine.siteSearchEngines.fetchDomainVerificationStatus`
Retail API	The following permissions have been added: `retail.catalogs.exportAnalyticsMetrics`

IAM changes as of 2024-01-19

Service	Description
Vertex AI	The following permissions have been added to the Vertex AI Feature Store EntityType owner role (`roles/aiplatform.entityTypeOwner`): `aiplatform.featureViews.searchNearestEntities`
Vertex AI	The following permissions have been added to the Vertex AI Feature Store Admin role (`roles/aiplatform.featurestoreAdmin`): `aiplatform.featureViews.searchNearestEntities`
Vertex AI	The following permissions have been added to the Vertex AI Feature Store Data Viewer role (`roles/aiplatform.featurestoreDataViewer`): `aiplatform.featureViews.searchNearestEntities`
Vertex AI	The following permissions have been added to the Vertex AI Feature Store Data Writer role (`roles/aiplatform.featurestoreDataWriter`): `aiplatform.featureViews.searchNearestEntities`
Artifact Registry	The following permissions have been added to the Artifact Registry Service Agent role (`roles/artifactregistry.serviceAgent`): `artifactregistry.repositories.get`
Assured Open Source Software	The Assured OSS User role (`roles/assuredoss.user`) has been added with the following permissions: `artifactregistry.dockerimages.get` `artifactregistry.dockerimages.list` `artifactregistry.files.download` `artifactregistry.files.get` `artifactregistry.files.list` `artifactregistry.googleapis.com/dockerimages.get` `artifactregistry.googleapis.com/dockerimages.list` `artifactregistry.googleapis.com/files.download` `artifactregistry.googleapis.com/files.get` `artifactregistry.googleapis.com/files.list` `artifactregistry.googleapis.com/locations.get` `artifactregistry.googleapis.com/locations.list` `artifactregistry.googleapis.com/mavenartifacts.get` `artifactregistry.googleapis.com/mavenartifacts.list` `artifactregistry.googleapis.com/npmpackages.get` `artifactregistry.googleapis.com/npmpackages.list` `artifactregistry.googleapis.com/packages.get` `artifactregistry.googleapis.com/packages.list` `artifactregistry.googleapis.com/projectsettings.get` `artifactregistry.googleapis.com/pythonpackages.get` `artifactregistry.googleapis.com/pythonpackages.list` `artifactregistry.googleapis.com/repositories.downloadArtifacts` `artifactregistry.googleapis.com/repositories.get` `artifactregistry.googleapis.com/repositories.list` `artifactregistry.googleapis.com/repositories.listEffectiveTags` `artifactregistry.googleapis.com/repositories.listTagBindings` `artifactregistry.googleapis.com/repositories.readViaVirtualRepository` `artifactregistry.googleapis.com/tags.get` `artifactregistry.googleapis.com/tags.list` `artifactregistry.googleapis.com/versions.get` `artifactregistry.googleapis.com/versions.list` `artifactregistry.googleapis.com/vpcscconfigs.get` `artifactregistry.locations.get` `artifactregistry.locations.list` `artifactregistry.mavenartifacts.get` `artifactregistry.mavenartifacts.list` `artifactregistry.npmpackages.get` `artifactregistry.npmpackages.list` `artifactregistry.packages.get` `artifactregistry.packages.list` `artifactregistry.projectsettings.get` `artifactregistry.pythonpackages.get` `artifactregistry.pythonpackages.list` `artifactregistry.repositories.downloadArtifacts` `artifactregistry.repositories.get` `artifactregistry.repositories.list` `artifactregistry.repositories.listEffectiveTags` `artifactregistry.repositories.listTagBindings` `artifactregistry.repositories.readViaVirtualRepository` `artifactregistry.tags.get` `artifactregistry.tags.list` `artifactregistry.versions.get` `artifactregistry.versions.list` `artifactregistry.vpcscconfigs.get` `assuredoss.googleapis.com/locations.get` `assuredoss.googleapis.com/locations.list` `assuredoss.googleapis.com/metadata.get` `assuredoss.googleapis.com/metadata.list` `assuredoss.googleapis.com/operations.get` `assuredoss.googleapis.com/operations.list` `assuredoss.locations.get` `assuredoss.locations.list` `assuredoss.metadata.get` `assuredoss.metadata.list` `assuredoss.operations.get` `assuredoss.operations.list` `cloudresourcemanager.googleapis.com/organizations.get` `cloudresourcemanager.googleapis.com/projects.get` `cloudresourcemanager.googleapis.com/projects.list` `resourcemanager.organizations.get` `resourcemanager.projects.get` `resourcemanager.projects.list`
Connectors	The following permissions have been added to the Connector Admin role (`roles/connectors.admin`): `connectors.customConnectorVersions.create` `connectors.customConnectorVersions.delete` `connectors.customConnectorVersions.setIamPolicy` `connectors.customConnectorVersions.update` `connectors.customConnectors.create` `connectors.customConnectors.delete` `connectors.customConnectors.setIamPolicy` `connectors.customConnectors.update`
Discovery Engine	The Discovery Engine Admin role (`roles/discoveryengine.admin`) has reached General Availability (GA).
Discovery Engine	The Discovery Engine Editor role (`roles/discoveryengine.editor`) has reached General Availability (GA).
Discovery Engine	The Discovery Engine Viewer role (`roles/discoveryengine.viewer`) has reached General Availability (GA).
Basic Role	The following permissions have been added to the Editor role (`roles/editor`): `assuredoss.config.get` `assuredoss.metadata.get` `assuredoss.metadata.list`
GKE Hub	The following permissions have been added to the Connect Gateway Admin role (`roles/gkehub.gatewayAdmin`): `gkehub.memberships.get`
GKE Hub	The following permissions have been added to the Connect Gateway Editor role (`roles/gkehub.gatewayEditor`): `gkehub.memberships.get`
GKE Hub	The following permissions have been added to the Connect Gateway Reader role (`roles/gkehub.gatewayReader`): `gkehub.memberships.get`
GKE Multi-Cloud	The following permissions have been added to the Anthos Multi-Cloud Container Service Agent role (`roles/gkemulticloud.containerServiceAgent`): `kubernetesmetadata.metadata.config` `kubernetesmetadata.metadata.publish` `kubernetesmetadata.metadata.snapshot`
Identity and Access Management	The following permissions have been added to the Security Admin role (`roles/iam.securityAdmin`): `assuredoss.metadata.list`
Identity and Access Management	The following permissions have been added to the Security Reviewer role (`roles/iam.securityReviewer`): `assuredoss.metadata.list`
Basic Role	The following permissions have been added to the Owner role (`roles/owner`): `assuredoss.config.get` `assuredoss.metadata.get` `assuredoss.metadata.list`
Serverless Integrations	The following permissions have been added to the Serverless Integrations Service Agent role (`roles/runapps.serviceAgent`): `cloudsql.databases.get` `cloudsql.instances.get` `cloudsql.users.get`
Security Command Center	The following permissions have been added to the Security Center Control Service Agent role (`roles/securitycenter.controlServiceAgent`): `securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.get` `securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.list` `securitycentermanagement.securityHealthAnalyticsCustomModules.create` `securitycentermanagement.securityHealthAnalyticsCustomModules.delete` `securitycentermanagement.securityHealthAnalyticsCustomModules.get` `securitycentermanagement.securityHealthAnalyticsCustomModules.list` `securitycentermanagement.securityHealthAnalyticsCustomModules.simulate` `securitycentermanagement.securityHealthAnalyticsCustomModules.update`
Security Command Center	The following permissions have been added to the Security Center Service Agent role (`roles/securitycenter.serviceAgent`): `securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.get` `securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.list` `securitycentermanagement.securityHealthAnalyticsCustomModules.create` `securitycentermanagement.securityHealthAnalyticsCustomModules.delete` `securitycentermanagement.securityHealthAnalyticsCustomModules.get` `securitycentermanagement.securityHealthAnalyticsCustomModules.list` `securitycentermanagement.securityHealthAnalyticsCustomModules.simulate` `securitycentermanagement.securityHealthAnalyticsCustomModules.update`
Basic Role	The following permissions have been added to the Viewer role (`roles/viewer`): `assuredoss.config.get` `assuredoss.metadata.get` `assuredoss.metadata.list`
Cloud Workstations	The following permissions have been added to the Workstations Service Agent role (`roles/workstations.serviceAgent`): `compute.disks.createTagBinding` `compute.disks.deleteTagBinding` `compute.instances.createTagBinding` `compute.instances.deleteTagBinding` `resourcemanager.tagValueBindings.create` `resourcemanager.tagValueBindings.delete`
Assured Open Source Software	The following permissions have been added: `assuredoss.config.get` `assuredoss.locations.get` `assuredoss.locations.list` `assuredoss.metadata.get` `assuredoss.metadata.list` `assuredoss.operations.cancel` `assuredoss.operations.delete` `assuredoss.operations.get` `assuredoss.operations.list`
Assured Open Source Software	The following permissions are supported in custom roles: `assuredoss.locations.get` `assuredoss.locations.list` `assuredoss.operations.cancel` `assuredoss.operations.delete` `assuredoss.operations.get` `assuredoss.operations.list`
Database Migration Service	The following permissions have been added: `datamigration.conversionworkspaces.apply`
Database Migration Service	The following permissions have reached General Availability (GA): `datamigration.conversionworkspaces.apply`
Discovery Engine	The following permissions have been added: `discoveryengine.analytics.acquireDashboardSession` `discoveryengine.analytics.refreshDashboardSessionTokens` `discoveryengine.cmekConfigs.get` `discoveryengine.cmekConfigs.list` `discoveryengine.cmekConfigs.update` `discoveryengine.dataStores.trainCustomModel` `discoveryengine.engines.pause` `discoveryengine.engines.resume` `discoveryengine.engines.tune` `discoveryengine.locations.estimateDataSize` `discoveryengine.siteSearchEngines.disableAdvancedSiteSearch` `discoveryengine.siteSearchEngines.enableAdvancedSiteSearch` `discoveryengine.siteSearchEngines.recrawlUris` `discoveryengine.suggestionDenyListEntries.import` `discoveryengine.suggestionDenyListEntries.purge`
Discovery Engine	The following permissions are supported in custom roles: `discoveryengine.analytics.acquireDashboardSession` `discoveryengine.analytics.refreshDashboardSessionTokens` `discoveryengine.cmekConfigs.get` `discoveryengine.cmekConfigs.list` `discoveryengine.cmekConfigs.update` `discoveryengine.dataStores.trainCustomModel` `discoveryengine.engines.pause` `discoveryengine.engines.resume` `discoveryengine.engines.tune` `discoveryengine.locations.estimateDataSize` `discoveryengine.siteSearchEngines.disableAdvancedSiteSearch` `discoveryengine.siteSearchEngines.enableAdvancedSiteSearch` `discoveryengine.siteSearchEngines.recrawlUris` `discoveryengine.suggestionDenyListEntries.import` `discoveryengine.suggestionDenyListEntries.purge`
Discovery Engine	The following permissions have reached General Availability (GA): `discoveryengine.conversations.converse` `discoveryengine.conversations.create` `discoveryengine.conversations.delete` `discoveryengine.conversations.get` `discoveryengine.conversations.list` `discoveryengine.conversations.update` `discoveryengine.documents.create` `discoveryengine.documents.delete` `discoveryengine.documents.get` `discoveryengine.documents.import` `discoveryengine.documents.list` `discoveryengine.documents.purge` `discoveryengine.documents.update` `discoveryengine.operations.get` `discoveryengine.operations.list` `discoveryengine.schemas.create` `discoveryengine.schemas.delete` `discoveryengine.schemas.get` `discoveryengine.schemas.list` `discoveryengine.schemas.update` `discoveryengine.servingConfigs.search` `discoveryengine.suggestionDenyListEntries.import` `discoveryengine.suggestionDenyListEntries.purge` `discoveryengine.userEvents.create` `discoveryengine.userEvents.import` `discoveryengine.userEvents.purge`
Cloud Healthcare API	The following permissions have been added: `healthcare.fhirStores.explainDataAccess`
Cloud Healthcare API	The following permissions are supported in custom roles: `healthcare.fhirStores.explainDataAccess`

IAM changes as of 2024-01-05

Service	Description
API Gateway	The following permissions have been added to the ApiGateway Admin role (`roles/apigateway.admin`): `serviceusage.services.get`
API Gateway	The following permissions have been added to the ApiGateway Viewer role (`roles/apigateway.viewer`): `serviceusage.services.get`
Assured Workloads	The following permissions have been added to the Assured Workloads Service Agent role (`roles/assuredworkloads.serviceAgent`): `serviceusage.services.get`
AutoML	The following permissions have been added to the AutoML Admin role (`roles/automl.admin`): `serviceusage.services.get`
AutoML	The following permissions have been added to the AutoML Editor role (`roles/automl.editor`): `serviceusage.services.get`
AutoML	The following permissions have been added to the AutoML Viewer role (`roles/automl.viewer`): `serviceusage.services.get`
Google Security Operations	The following permissions have been added to the Chronicle API Admin role (`roles/chronicle.admin`): `chronicle.rules.delete`
Cloud Run functions	The following permissions have been added to the Cloud Functions Service Agent role (`roles/cloudfunctions.serviceAgent`): `serviceusage.services.get`
Cloud Commerce Consumer Procurement	The Consumer Procurement Entitlement Manager role (`roles/consumerprocurement.entitlementManager`) has reached General Availability (GA).
Cloud Commerce Consumer Procurement	The Consumer Procurement Entitlement Viewer role (`roles/consumerprocurement.entitlementViewer`) has reached General Availability (GA).
Cloud Commerce Consumer Procurement	The Consumer Procurement Events Viewer role (`roles/consumerprocurement.eventsViewer`) has reached General Availability (GA).
Cloud Commerce Consumer Procurement	The Consumer Procurement Order Administrator role (`roles/consumerprocurement.orderAdmin`) has reached General Availability (GA).
Cloud Commerce Consumer Procurement	The Consumer Procurement Order Viewer role (`roles/consumerprocurement.orderViewer`) has reached General Availability (GA).
Cloud Commerce Consumer Procurement	The Consumer Procurement Administrator role (`roles/consumerprocurement.procurementAdmin`) has reached General Availability (GA).
Cloud Commerce Consumer Procurement	The Consumer Procurement Viewer role (`roles/consumerprocurement.procurementViewer`) has reached General Availability (GA).
AI Platform Data Labeling Service	The following permissions have been added to the Data Labeling Service Agent role (`roles/datalabeling.serviceAgent`): `serviceusage.services.get`
Dialogflow	The following permissions have been added to the Dialogflow Agent Assist Client role (`roles/dialogflow.agentAssistClient`): `dialogflow.generators.get`
Dialogflow	The following permissions have been added to the Dialogflow Service Agent role (`roles/dialogflow.serviceAgent`): `discoveryengine.engines.delete` `discoveryengine.engines.get`
Basic Role	The following permissions have been added to the Editor role (`roles/editor`): `securityposture.postures.extract` `securityposture.reports.create`
Firebase	The following permissions have been added to the Firebase SDK Provisioning Service Agent role (`roles/firebase.sdkProvisioningServiceAgent`): `serviceusage.services.get`
Firewall Insights	The following permissions have been added to the Cloud Firewall Insights Service Agent role (`roles/firewallinsights.serviceAgent`): `compute.regionTargetTcpProxies.list`
Cloud Service Mesh	The following permissions have been added to the Mesh Config Service Agent role (`roles/meshconfig.serviceAgent`): `compute.regionTargetTcpProxies.create` `compute.regionTargetTcpProxies.delete` `compute.regionTargetTcpProxies.get` `compute.regionTargetTcpProxies.list` `compute.regionTargetTcpProxies.use`
Cloud Monitoring	The following permissions have been added to the Monitoring Admin role (`roles/monitoring.admin`): `serviceusage.services.get`
Cloud Monitoring	The following permissions have been added to the Monitoring Editor role (`roles/monitoring.editor`): `serviceusage.services.get`
Multi-Cluster Service Discovery	The following permissions have been added to the Multi-Cluster Service Discovery Service Agent role (`roles/multiclusterservicediscovery.serviceAgent`): `compute.regionTargetTcpProxies.create` `compute.regionTargetTcpProxies.delete` `compute.regionTargetTcpProxies.get` `compute.regionTargetTcpProxies.list` `compute.regionTargetTcpProxies.use`
Network Management API	The following permissions have been added to the GCP Network Management Service Agent role (`roles/networkmanagement.serviceAgent`): `compute.regionTargetTcpProxies.get` `compute.regionTargetTcpProxies.list`
Basic Role	The following permissions have been added to the Owner role (`roles/owner`): `securityposture.postures.extract` `securityposture.reports.create`
Security Command Center	The following permissions have been added to the Security Center Automation Service Agent role (`roles/securitycenter.automationServiceAgent`): `serviceusage.services.get`
Security Posture API	The Security Posture Shift-Left Validator role (`roles/securityposture.reportCreator`) has been added with the following permissions: `securityposture.googleapis.com/reports.create` `securityposture.reports.create`
Security Posture API	The Security Posture Admin role (`roles/securityposture.admin`) has reached General Availability (GA).
Security Posture API	The Security Posture Deployer role (`roles/securityposture.postureDeployer`) has reached General Availability (GA).
Security Posture API	The Security Posture Deployments Viewer role (`roles/securityposture.postureDeploymentsViewer`) has reached General Availability (GA).
Security Posture API	The Security Posture Resource Editor role (`roles/securityposture.postureEditor`) has reached General Availability (GA).
Security Posture API	The Security Posture Resource Viewer role (`roles/securityposture.postureViewer`) has reached General Availability (GA).
Security Posture API	The Security Posture Viewer role (`roles/securityposture.viewer`) has reached General Availability (GA).
Google Cloud Observability	The following permissions have been added to the Stackdriver Accounts Editor role (`roles/stackdriver.accounts.editor`): `serviceusage.services.get`
Apigee	The following permissions have been added: `apigee.keyvaluemapentries.update`
Apigee	The following permissions have reached General Availability (GA): `apigee.keyvaluemapentries.update`
BigQuery	The following permissions have been added: `bigquery.tables.createTagBinding` `bigquery.tables.deleteTagBinding`
BigQuery	The following permissions are supported in custom roles: `bigquery.tables.createTagBinding` `bigquery.tables.deleteTagBinding`
BigQuery Reservation API	The following permissions have been added: `bigqueryreservation.googleapis.com/capacityCommitments.create` `bigqueryreservation.googleapis.com/capacityCommitments.delete` `bigqueryreservation.googleapis.com/capacityCommitments.get` `bigqueryreservation.googleapis.com/capacityCommitments.list` `bigqueryreservation.googleapis.com/capacityCommitments.update` `bigqueryreservation.googleapis.com/reservationAssignments.create` `bigqueryreservation.googleapis.com/reservationAssignments.delete` `bigqueryreservation.googleapis.com/reservationAssignments.list` `bigqueryreservation.googleapis.com/reservationAssignments.search`
Google Security Operations	The following permissions have been added: `chronicle.ais.createFeedback` `chronicle.ais.translateUdmQuery` `chronicle.ais.translateYlRule` `chronicle.analyticValues.list` `chronicle.analytics.list` `chronicle.cases.countPriorities` `chronicle.conversations.create` `chronicle.conversations.delete` `chronicle.conversations.get` `chronicle.conversations.list` `chronicle.conversations.update` `chronicle.entities.queryEntityRiskScoreModifications` `chronicle.entityRiskScores.queryEntityRiskScores` `chronicle.errorNotificationConfigs.create` `chronicle.errorNotificationConfigs.delete` `chronicle.errorNotificationConfigs.get` `chronicle.errorNotificationConfigs.list` `chronicle.errorNotificationConfigs.update` `chronicle.feedServiceAccounts.fetch` `chronicle.findingsRefinementDeployments.get` `chronicle.findingsRefinementDeployments.list` `chronicle.findingsRefinementDeployments.update` `chronicle.findingsRefinements.computeActivity` `chronicle.findingsRefinements.computeAllActivities` `chronicle.findingsRefinements.create` `chronicle.findingsRefinements.get` `chronicle.findingsRefinements.list` `chronicle.findingsRefinements.test` `chronicle.findingsRefinements.update` `chronicle.legacies.legacyGetDetection` `chronicle.legacies.legacySearchAlerts` `chronicle.legacies.legacySearchCuratedDetections` `chronicle.legacies.legacySearchDetections` `chronicle.legacies.legacySearchEnterpriseWideAlerts` `chronicle.legacies.legacySearchEnterpriseWideIoCs` `chronicle.legacies.legacyStreamDetectionAlerts` `chronicle.legacies.legacyTestRuleStreaming` `chronicle.legacies.legacyUpdateAlert` `chronicle.logs.export` `chronicle.logs.get` `chronicle.logs.import` `chronicle.logs.list` `chronicle.messages.create` `chronicle.messages.delete` `chronicle.messages.get` `chronicle.messages.list` `chronicle.messages.update` `chronicle.parsers.generateEventTypesSuggestions` `chronicle.preferenceSets.get` `chronicle.preferenceSets.update` `chronicle.riskConfigs.get` `chronicle.riskConfigs.update` `chronicle.rules.delete` `chronicle.searchQueries.create` `chronicle.searchQueries.delete` `chronicle.searchQueries.get` `chronicle.searchQueries.list` `chronicle.searchQueries.update`
Google Security Operations	The following permissions are supported in custom roles: `chronicle.ais.createFeedback` `chronicle.ais.translateUdmQuery` `chronicle.ais.translateYlRule` `chronicle.analyticValues.list` `chronicle.analytics.list` `chronicle.cases.countPriorities` `chronicle.conversations.create` `chronicle.conversations.delete` `chronicle.conversations.get` `chronicle.conversations.list` `chronicle.conversations.update` `chronicle.entities.queryEntityRiskScoreModifications` `chronicle.feedServiceAccounts.fetch` `chronicle.legacies.legacyGetDetection` `chronicle.legacies.legacySearchCuratedDetections` `chronicle.legacies.legacySearchDetections` `chronicle.legacies.legacySearchEnterpriseWideAlerts` `chronicle.legacies.legacySearchEnterpriseWideIoCs` `chronicle.legacies.legacyStreamDetectionAlerts` `chronicle.legacies.legacyTestRuleStreaming` `chronicle.logs.export` `chronicle.logs.get` `chronicle.logs.import` `chronicle.logs.list` `chronicle.messages.create` `chronicle.messages.delete` `chronicle.messages.get` `chronicle.messages.list` `chronicle.messages.update` `chronicle.parsers.generateEventTypesSuggestions` `chronicle.preferenceSets.get` `chronicle.preferenceSets.update` `chronicle.riskConfigs.get` `chronicle.riskConfigs.update` `chronicle.rules.delete` `chronicle.searchQueries.create` `chronicle.searchQueries.delete` `chronicle.searchQueries.get` `chronicle.searchQueries.list` `chronicle.searchQueries.update`
Google Security Operations	The following permissions have reached General Availability (GA): `chronicle.ais.createFeedback` `chronicle.ais.translateUdmQuery` `chronicle.ais.translateYlRule` `chronicle.analyticValues.list` `chronicle.analytics.list` `chronicle.cases.countPriorities` `chronicle.conversations.create` `chronicle.conversations.delete` `chronicle.conversations.get` `chronicle.conversations.list` `chronicle.conversations.update` `chronicle.entityRiskScores.queryEntityRiskScores` `chronicle.errorNotificationConfigs.create` `chronicle.errorNotificationConfigs.delete` `chronicle.errorNotificationConfigs.get` `chronicle.errorNotificationConfigs.list` `chronicle.errorNotificationConfigs.update` `chronicle.feedServiceAccounts.fetch` `chronicle.findingsRefinementDeployments.get` `chronicle.findingsRefinementDeployments.list` `chronicle.findingsRefinementDeployments.update` `chronicle.findingsRefinements.computeActivity` `chronicle.findingsRefinements.computeAllActivities` `chronicle.findingsRefinements.create` `chronicle.findingsRefinements.get` `chronicle.findingsRefinements.list` `chronicle.findingsRefinements.test` `chronicle.findingsRefinements.update` `chronicle.logs.export` `chronicle.logs.get` `chronicle.logs.import` `chronicle.logs.list` `chronicle.messages.create` `chronicle.messages.delete` `chronicle.messages.get` `chronicle.messages.list` `chronicle.messages.update` `chronicle.preferenceSets.get` `chronicle.preferenceSets.update` `chronicle.riskConfigs.get` `chronicle.riskConfigs.update` `chronicle.searchQueries.create` `chronicle.searchQueries.delete` `chronicle.searchQueries.get` `chronicle.searchQueries.list` `chronicle.searchQueries.update`
Translation	The following permissions have been added: `cloudtranslate.adaptiveMtDatasets.create` `cloudtranslate.adaptiveMtDatasets.delete` `cloudtranslate.adaptiveMtDatasets.get` `cloudtranslate.adaptiveMtDatasets.import` `cloudtranslate.adaptiveMtDatasets.list` `cloudtranslate.adaptiveMtDatasets.predict` `cloudtranslate.adaptiveMtFiles.delete` `cloudtranslate.adaptiveMtFiles.get` `cloudtranslate.adaptiveMtFiles.list` `cloudtranslate.adaptiveMtSentences.list`
Compute Engine	The following permissions have been added: `compute.networkAttachments.update`
Compute Engine	The following permissions are supported in custom roles: `compute.networkAttachments.update`
Compute Engine	The following permissions have reached General Availability (GA): `compute.networkAttachments.update`
Cloud Config Manager API	The following permissions have been added: `config.artifacts.import` `config.previews.create` `config.previews.delete` `config.previews.export` `config.previews.get` `config.previews.list` `config.previews.upload`
Cloud Config Manager API	The following permissions are supported in custom roles: `config.artifacts.import` `config.previews.create` `config.previews.delete` `config.previews.export` `config.previews.get` `config.previews.list` `config.previews.upload`
Cloud Commerce Consumer Procurement	The following permissions have reached General Availability (GA): `consumerprocurement.accounts.create` `consumerprocurement.accounts.delete` `consumerprocurement.accounts.get` `consumerprocurement.accounts.list` `consumerprocurement.consents.allowProjectGrant` `consumerprocurement.consents.check` `consumerprocurement.consents.grant` `consumerprocurement.consents.list` `consumerprocurement.consents.revoke` `consumerprocurement.entitlements.get` `consumerprocurement.entitlements.list` `consumerprocurement.events.get` `consumerprocurement.events.list` `consumerprocurement.freeTrials.create` `consumerprocurement.freeTrials.get` `consumerprocurement.freeTrials.list` `consumerprocurement.orderAttributions.get` `consumerprocurement.orderAttributions.list` `consumerprocurement.orderAttributions.update` `consumerprocurement.orders.cancel` `consumerprocurement.orders.get` `consumerprocurement.orders.list` `consumerprocurement.orders.modify` `consumerprocurement.orders.place`
Enterprise Purchasing API	The following permissions have been added: `enterprisepurchasing.gcveCuds.create` `enterprisepurchasing.gcveCuds.get` `enterprisepurchasing.gcveCuds.list` `enterprisepurchasing.gcveNodePricingInfo.list` `enterprisepurchasing.locations.get` `enterprisepurchasing.locations.list` `enterprisepurchasing.operations.cancel` `enterprisepurchasing.operations.delete` `enterprisepurchasing.operations.get` `enterprisepurchasing.operations.list`
Enterprise Purchasing API	The following permissions are supported in custom roles: `enterprisepurchasing.gcveCuds.create` `enterprisepurchasing.gcveCuds.get` `enterprisepurchasing.gcveCuds.list` `enterprisepurchasing.gcveNodePricingInfo.list` `enterprisepurchasing.locations.get` `enterprisepurchasing.locations.list` `enterprisepurchasing.operations.cancel` `enterprisepurchasing.operations.delete` `enterprisepurchasing.operations.get` `enterprisepurchasing.operations.list`
Mandiant	The following permissions have been added: `mandiant.genericAttackSurfaceManagements.create` `mandiant.genericAttackSurfaceManagements.delete` `mandiant.genericAttackSurfaceManagements.get` `mandiant.genericAttackSurfaceManagements.update` `mandiant.genericDigitalThreatMonitorings.create` `mandiant.genericDigitalThreatMonitorings.get` `mandiant.genericDigitalThreatMonitorings.update` `mandiant.genericExpertiseOnDemands.create` `mandiant.genericExpertiseOnDemands.delete` `mandiant.genericExpertiseOnDemands.get` `mandiant.genericExpertiseOnDemands.update` `mandiant.genericPlatforms.create` `mandiant.genericPlatforms.delete` `mandiant.genericPlatforms.get` `mandiant.genericPlatforms.update` `mandiant.genericThreatIntels.create` `mandiant.genericThreatIntels.delete` `mandiant.genericThreatIntels.get` `mandiant.genericThreatIntels.update` `mandiant.genericValidations.create` `mandiant.genericValidations.delete` `mandiant.genericValidations.get` `mandiant.genericValidations.update`
Mandiant	The following permissions are supported in custom roles: `mandiant.genericAttackSurfaceManagements.create` `mandiant.genericAttackSurfaceManagements.delete` `mandiant.genericAttackSurfaceManagements.get` `mandiant.genericAttackSurfaceManagements.update` `mandiant.genericDigitalThreatMonitorings.create` `mandiant.genericDigitalThreatMonitorings.get` `mandiant.genericDigitalThreatMonitorings.update` `mandiant.genericExpertiseOnDemands.create` `mandiant.genericExpertiseOnDemands.delete` `mandiant.genericExpertiseOnDemands.get` `mandiant.genericExpertiseOnDemands.update` `mandiant.genericPlatforms.create` `mandiant.genericPlatforms.delete` `mandiant.genericPlatforms.get` `mandiant.genericPlatforms.update` `mandiant.genericThreatIntels.create` `mandiant.genericThreatIntels.delete` `mandiant.genericThreatIntels.get` `mandiant.genericThreatIntels.update` `mandiant.genericValidations.create` `mandiant.genericValidations.delete` `mandiant.genericValidations.get` `mandiant.genericValidations.update`
Marketplace Solutions API	The following permissions have been added: `marketplacesolutions.locations.get` `marketplacesolutions.locations.list` `marketplacesolutions.operations.cancel` `marketplacesolutions.operations.delete` `marketplacesolutions.operations.get` `marketplacesolutions.operations.list` `marketplacesolutions.powerImages.get` `marketplacesolutions.powerImages.list` `marketplacesolutions.powerInstances.applyPowerAction` `marketplacesolutions.powerInstances.create` `marketplacesolutions.powerInstances.delete` `marketplacesolutions.powerInstances.get` `marketplacesolutions.powerInstances.list` `marketplacesolutions.powerInstances.reset` `marketplacesolutions.powerInstances.update` `marketplacesolutions.powerNetworks.get` `marketplacesolutions.powerNetworks.list` `marketplacesolutions.powerSshKeys.get` `marketplacesolutions.powerSshKeys.list` `marketplacesolutions.powerVolumes.get` `marketplacesolutions.powerVolumes.list`
Marketplace Solutions API	The following permissions are supported in custom roles: `marketplacesolutions.locations.get` `marketplacesolutions.locations.list` `marketplacesolutions.operations.cancel` `marketplacesolutions.operations.delete` `marketplacesolutions.operations.get` `marketplacesolutions.operations.list` `marketplacesolutions.powerImages.get` `marketplacesolutions.powerImages.list` `marketplacesolutions.powerInstances.applyPowerAction` `marketplacesolutions.powerInstances.create` `marketplacesolutions.powerInstances.delete` `marketplacesolutions.powerInstances.get` `marketplacesolutions.powerInstances.list` `marketplacesolutions.powerInstances.reset` `marketplacesolutions.powerInstances.update` `marketplacesolutions.powerNetworks.get` `marketplacesolutions.powerNetworks.list` `marketplacesolutions.powerSshKeys.get` `marketplacesolutions.powerSshKeys.list` `marketplacesolutions.powerVolumes.get` `marketplacesolutions.powerVolumes.list`
Memorystore for Redis	The following permissions have been added: `redis.instances.createTagBinding` `redis.instances.deleteTagBinding` `redis.instances.listEffectiveTags` `redis.instances.listTagBindings`
Memorystore for Redis	The following permissions have reached General Availability (GA): `redis.instances.createTagBinding` `redis.instances.deleteTagBinding` `redis.instances.listEffectiveTags` `redis.instances.listTagBindings`
Security Command Center	The following permissions have been added: `securitycenter.compliancesnapshots.list`
Security Posture API	The following permissions have been added: `securityposture.locations.get` `securityposture.locations.list` `securityposture.operations.delete` `securityposture.operations.get` `securityposture.operations.list` `securityposture.postureDeployments.create` `securityposture.postureDeployments.delete` `securityposture.postureDeployments.get` `securityposture.postureDeployments.list` `securityposture.postureDeployments.update` `securityposture.postureTemplates.get` `securityposture.postureTemplates.list` `securityposture.postures.create` `securityposture.postures.delete` `securityposture.postures.extract` `securityposture.postures.get` `securityposture.postures.list` `securityposture.postures.update` `securityposture.reports.create`
Security Posture API	The following permissions are supported in custom roles: `securityposture.locations.get` `securityposture.locations.list` `securityposture.operations.delete` `securityposture.operations.get` `securityposture.operations.list` `securityposture.postureDeployments.create` `securityposture.postureDeployments.delete` `securityposture.postureDeployments.get` `securityposture.postureDeployments.list` `securityposture.postureDeployments.update` `securityposture.postureTemplates.get` `securityposture.postureTemplates.list` `securityposture.postures.create` `securityposture.postures.delete` `securityposture.postures.get` `securityposture.postures.list` `securityposture.postures.update`
Security Posture API	The following permissions have reached General Availability (GA): `securityposture.locations.get` `securityposture.locations.list` `securityposture.operations.delete` `securityposture.operations.get` `securityposture.operations.list` `securityposture.postureDeployments.create` `securityposture.postureDeployments.delete` `securityposture.postureDeployments.get` `securityposture.postureDeployments.list` `securityposture.postureDeployments.update` `securityposture.postureTemplates.get` `securityposture.postureTemplates.list` `securityposture.postures.create` `securityposture.postures.delete` `securityposture.postures.get` `securityposture.postures.list` `securityposture.postures.update`
Personalized Service Health	The following permissions have been added: `servicehealth.statuses.get`
Personalized Service Health	The following permissions are supported in custom roles: `servicehealth.statuses.get`

IAM changes as of 2023-12-15

Service	Description
Cloud Service Mesh	The following permissions have been added to the Anthos Service Mesh Service Agent role (`roles/anthosservicemesh.serviceAgent`): `compute.globalNetworkEndpointGroups.attachNetworkEndpoints` `compute.globalNetworkEndpointGroups.create` `compute.globalNetworkEndpointGroups.delete` `compute.globalNetworkEndpointGroups.detachNetworkEndpoints` `compute.globalNetworkEndpointGroups.get` `compute.globalNetworkEndpointGroups.list` `compute.globalNetworkEndpointGroups.use`
Apigee	The following permissions have been added to the Apigee Security Admin role (`roles/apigee.securityAdmin`): `apigee.addonsconfig.get`
Apigee	The following permissions have been added to the Apigee Security Viewer role (`roles/apigee.securityViewer`): `apigee.addonsconfig.get`
Connectors	The Connector Event Listener role (`roles/connectors.listener`) has been added with the following permissions: `connectors.connections.listenEvent` `connectors.googleapis.com/connections.listenEvent`
Artifact Analysis	The following permissions have been removed from the Container Analysis Service Agent role (`roles/containeranalysis.ServiceAgent`): `storage.buckets.create` `storage.buckets.get` `storage.buckets.list` `storage.objects.create` `storage.objects.delete` `storage.objects.update`
Container Scanning	The following permissions have been removed from the Container Scanner Service Agent role (`roles/containerscanning.ServiceAgent`): `storage.buckets.create` `storage.buckets.get` `storage.buckets.list` `storage.objects.create` `storage.objects.delete` `storage.objects.update`
Basic Role	The following permissions have been added to the Editor role (`roles/editor`): `connectors.connections.listenEvent`
Cloud Integrations	The following permissions have been added to the Application Integration Service Agent role (`roles/integrations.serviceAgent`): `storage.buckets.create` `storage.buckets.get` `storage.buckets.list` `storage.buckets.update` `storage.objects.create` `storage.objects.get` `storage.objects.list` `storage.objects.update`
Multi-Cluster Service Discovery	The following permissions have been added to the Multi-Cluster Service Discovery Service Agent role (`roles/multiclusterservicediscovery.serviceAgent`): `container.thirdPartyObjects.update`
Basic Role	The following permissions have been added to the Owner role (`roles/owner`): `connectors.connections.listenEvent`
Security Command Center	The following permissions have been added to the Security Center Control Service Agent role (`roles/securitycenter.controlServiceAgent`): `compute.disks.useReadOnly`
Security Command Center	The following permissions have been added to the Security Center Service Agent role (`roles/securitycenter.serviceAgent`): `compute.disks.useReadOnly`
BigQuery	The following permissions have reached General Availability (GA): `bigquery.connections.updateTag` `bigquery.datasets.updateTag` `bigquery.models.updateTag` `bigquery.routines.updateTag` `bigquery.tables.updateTag`
Cloud Billing	The following permissions have been added: `billing.billingAccountPrices.list`
Cloud Billing	The following permissions have reached General Availability (GA): `billing.billingAccountPrices.list`
Commerce Business Enablement	The following permissions have been added: `commercebusinessenablement.resellerConfig.update` `commercebusinessenablement.resellerRestrictions.list` `commercebusinessenablement.resellerRestrictions.update`
Commerce Business Enablement	The following permissions are supported in custom roles: `commercebusinessenablement.resellerConfig.update` `commercebusinessenablement.resellerRestrictions.list` `commercebusinessenablement.resellerRestrictions.update`
Connectors	The following permissions have been added: `connectors.connections.listenEvent`
Firebase Storage	The following permissions have been added: `firebasestorage.defaultBucket.create` `firebasestorage.defaultBucket.delete` `firebasestorage.defaultBucket.get`
Google Cloud NetApp Volumes	The following permissions have been added: `netapp.backupPolicies.create` `netapp.backupPolicies.delete` `netapp.backupPolicies.get` `netapp.backupPolicies.list` `netapp.backupPolicies.update` `netapp.backupVaults.create` `netapp.backupVaults.delete` `netapp.backupVaults.get` `netapp.backupVaults.list` `netapp.backupVaults.update` `netapp.backups.create` `netapp.backups.delete` `netapp.backups.get` `netapp.backups.list` `netapp.backups.update`
Google Cloud NetApp Volumes	The following permissions are supported in custom roles: `netapp.backupPolicies.create` `netapp.backupPolicies.delete` `netapp.backupPolicies.get` `netapp.backupPolicies.list` `netapp.backupPolicies.update` `netapp.backupVaults.create` `netapp.backupVaults.delete` `netapp.backupVaults.get` `netapp.backupVaults.list` `netapp.backupVaults.update` `netapp.backups.create` `netapp.backups.delete` `netapp.backups.get` `netapp.backups.list` `netapp.backups.update`

IAM changes as of 2023-12-08

Service	Description
Vertex AI	The following permissions have been added to the Vertex AI Service Agent role (`roles/aiplatform.serviceAgent`): `compute.snapshots.useReadOnly`
Cloud Service Mesh	The following permissions have been added to the Anthos Service Mesh Service Agent role (`roles/anthosservicemesh.serviceAgent`): `compute.firewalls.create` `compute.firewalls.delete` `compute.firewalls.get` `compute.firewalls.update` `compute.healthChecks.useReadOnly` `compute.networks.updatePolicy`
Apigee	The following permissions have been added to the Apigee Organization Admin role (`roles/apigee.admin`): `apigee.securitySettings.get` `apigee.securitySettings.update`
Apigee	The following permissions have been added to the Apigee Read-only Admin role (`roles/apigee.readOnlyAdmin`): `apigee.securitySettings.get`
Apigee	The following permissions have been added to the Apigee Security Admin role (`roles/apigee.securityAdmin`): `apigee.securitySettings.get` `apigee.securitySettings.update`
Apigee	The following permissions have been added to the Apigee Security Viewer role (`roles/apigee.securityViewer`): `apigee.securitySettings.get`
Binary Authorization	The following permissions have been added to the Binary Authorization Service Agent role (`roles/binaryauthorization.serviceAgent`): `artifactregistry.dockerimages.get`
Blockchain Node Engine	The Blockchain Node Engine Admin role (`roles/blockchainnodeengine.admin`) has reached General Availability (GA).
Blockchain Node Engine	The Blockchain Node Engine Viewer role (`roles/blockchainnodeengine.viewer`) has reached General Availability (GA).
Capacity Planner	The following permissions have been added to the Capacity Planner Usage Viewer role (`roles/capacityplanner.viewer`): `cloudquotas.quotas.get`
Connectors	The Custom Connectors Admin role (`roles/connectors.customConnectorAdmin`) has been added with the following permissions: `connectors.customConnectorVersions.create` `connectors.customConnectorVersions.delete` `connectors.customConnectorVersions.get` `connectors.customConnectorVersions.getIamPolicy` `connectors.customConnectorVersions.list` `connectors.customConnectorVersions.setIamPolicy` `connectors.customConnectorVersions.update` `connectors.customConnectors.create` `connectors.customConnectors.delete` `connectors.customConnectors.get` `connectors.customConnectors.getIamPolicy` `connectors.customConnectors.list` `connectors.customConnectors.setIamPolicy` `connectors.customConnectors.update` `connectors.googleapis.com/customConnectorVersions.create` `connectors.googleapis.com/customConnectorVersions.delete` `connectors.googleapis.com/customConnectorVersions.get` `connectors.googleapis.com/customConnectorVersions.getIamPolicy` `connectors.googleapis.com/customConnectorVersions.list` `connectors.googleapis.com/customConnectorVersions.setIamPolicy` `connectors.googleapis.com/customConnectorVersions.update` `connectors.googleapis.com/customConnectors.create` `connectors.googleapis.com/customConnectors.delete` `connectors.googleapis.com/customConnectors.get` `connectors.googleapis.com/customConnectors.getIamPolicy` `connectors.googleapis.com/customConnectors.list` `connectors.googleapis.com/customConnectors.setIamPolicy` `connectors.googleapis.com/customConnectors.update` `connectors.googleapis.com/locations.get` `connectors.googleapis.com/locations.list` `connectors.locations.get` `connectors.locations.list`
Connectors	The Custom Connector Viewer role (`roles/connectors.customConnectorViewer`) has been added with the following permissions: `connectors.customConnectorVersions.get` `connectors.customConnectorVersions.getIamPolicy` `connectors.customConnectorVersions.list` `connectors.customConnectors.get` `connectors.customConnectors.getIamPolicy` `connectors.customConnectors.list` `connectors.googleapis.com/customConnectorVersions.get` `connectors.googleapis.com/customConnectorVersions.getIamPolicy` `connectors.googleapis.com/customConnectorVersions.list` `connectors.googleapis.com/customConnectors.get` `connectors.googleapis.com/customConnectors.getIamPolicy` `connectors.googleapis.com/customConnectors.list` `connectors.googleapis.com/locations.get` `connectors.googleapis.com/locations.list` `connectors.locations.get` `connectors.locations.list`
Connectors	The following permissions have been added to the Connector Admin role (`roles/connectors.admin`): `connectors.customConnectorVersions.get` `connectors.customConnectorVersions.getIamPolicy` `connectors.customConnectorVersions.list` `connectors.customConnectors.get` `connectors.customConnectors.getIamPolicy` `connectors.customConnectors.list`
Connectors	The following permissions have been added to the Connectors Platform Service Agent role (`roles/connectors.serviceAgent`): `connectors.customConnectorVersions.get` `connectors.customConnectorVersions.list` `connectors.customConnectors.get` `connectors.customConnectors.list`
Connectors	The following permissions have been added to the Connectors Viewer role (`roles/connectors.viewer`): `connectors.customConnectorVersions.get` `connectors.customConnectorVersions.getIamPolicy` `connectors.customConnectorVersions.list` `connectors.customConnectors.get` `connectors.customConnectors.getIamPolicy` `connectors.customConnectors.list`
Database Migration Service	The following permissions have been added to the Database Migration Service Agent role (`roles/datamigration.serviceAgent`): `cloudsql.instances.import` `storage.objects.list`
Dataplex	The following permissions have been added to the Cloud Dataplex Service Agent role (`roles/dataplex.serviceAgent`): `datacatalog.entries.get`
Basic Role	The following permissions have been added to the Editor role (`roles/editor`): `apigee.securitySettings.get` `apigee.securitySettings.update` `connectors.customConnectorVersions.create` `connectors.customConnectorVersions.delete` `connectors.customConnectorVersions.get` `connectors.customConnectorVersions.getIamPolicy` `connectors.customConnectorVersions.list` `connectors.customConnectorVersions.update` `connectors.customConnectors.create` `connectors.customConnectors.delete` `connectors.customConnectors.get` `connectors.customConnectors.getIamPolicy` `connectors.customConnectors.list` `connectors.customConnectors.update`
FleetEngine	The Fleet Engine Delivery Admin role (`roles/fleetengine.deliveryAdmin`) has reached General Availability (GA).
FleetEngine	The Fleet Engine On-Demand Admin role (`roles/fleetengine.ondemandAdmin`) has reached General Availability (GA).
GKE Multi-Cloud	The following permissions have been added to the Anthos Multi-Cloud Control Plane Machine Service Agent role (`roles/gkemulticloud.controlPlaneMachineServiceAgent`): `serviceusage.services.use`
GKE Multi-Cloud	The following permissions have been added to the Anthos Multi-Cloud Node Pool Machine Service Agent role (`roles/gkemulticloud.nodePoolMachineServiceAgent`): `serviceusage.services.use`
Identity and Access Management	The following permissions have been added to the Security Admin role (`roles/iam.securityAdmin`): `connectors.customConnectorVersions.getIamPolicy` `connectors.customConnectorVersions.list` `connectors.customConnectorVersions.setIamPolicy` `connectors.customConnectors.getIamPolicy` `connectors.customConnectors.list` `connectors.customConnectors.setIamPolicy`
Identity and Access Management	The following permissions have been added to the Security Reviewer role (`roles/iam.securityReviewer`): `connectors.customConnectorVersions.getIamPolicy` `connectors.customConnectorVersions.list` `connectors.customConnectors.getIamPolicy` `connectors.customConnectors.list`
Basic Role	The following permissions have been added to the Owner role (`roles/owner`): `apigee.securitySettings.get` `apigee.securitySettings.update` `connectors.customConnectorVersions.create` `connectors.customConnectorVersions.delete` `connectors.customConnectorVersions.get` `connectors.customConnectorVersions.getIamPolicy` `connectors.customConnectorVersions.list` `connectors.customConnectorVersions.setIamPolicy` `connectors.customConnectorVersions.update` `connectors.customConnectors.create` `connectors.customConnectors.delete` `connectors.customConnectors.get` `connectors.customConnectors.getIamPolicy` `connectors.customConnectors.list` `connectors.customConnectors.setIamPolicy` `connectors.customConnectors.update`
Security Center Management API	The Security Center Management Custom Modules Editor role (`roles/securitycentermanagement.customModulesEditor`) has been added with the following permissions: `cloudresourcemanager.googleapis.com/organizations.get` `cloudresourcemanager.googleapis.com/projects.get` `cloudresourcemanager.googleapis.com/projects.list` `resourcemanager.organizations.get` `resourcemanager.projects.get` `resourcemanager.projects.list` `securitycentermanagement.effectiveEventThreatDetectionCustomModules.get` `securitycentermanagement.effectiveEventThreatDetectionCustomModules.list` `securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.get` `securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.list` `securitycentermanagement.eventThreatDetectionCustomModules.create` `securitycentermanagement.eventThreatDetectionCustomModules.delete` `securitycentermanagement.eventThreatDetectionCustomModules.get` `securitycentermanagement.eventThreatDetectionCustomModules.list` `securitycentermanagement.eventThreatDetectionCustomModules.update` `securitycentermanagement.eventThreatDetectionCustomModules.validate` `securitycentermanagement.googleapis.com/effectiveEventThreatDetectionCustomModules.get` `securitycentermanagement.googleapis.com/effectiveEventThreatDetectionCustomModules.list` `securitycentermanagement.googleapis.com/effectiveSecurityHealthAnalyticsCustomModules.get` `securitycentermanagement.googleapis.com/effectiveSecurityHealthAnalyticsCustomModules.list` `securitycentermanagement.googleapis.com/eventThreatDetectionCustomModules.create` `securitycentermanagement.googleapis.com/eventThreatDetectionCustomModules.delete` `securitycentermanagement.googleapis.com/eventThreatDetectionCustomModules.get` `securitycentermanagement.googleapis.com/eventThreatDetectionCustomModules.list` `securitycentermanagement.googleapis.com/eventThreatDetectionCustomModules.update` `securitycentermanagement.googleapis.com/eventThreatDetectionCustomModules.validate` `securitycentermanagement.googleapis.com/locations.get` `securitycentermanagement.googleapis.com/locations.list` `securitycentermanagement.googleapis.com/securityHealthAnalyticsCustomModules.create` `securitycentermanagement.googleapis.com/securityHealthAnalyticsCustomModules.delete` `securitycentermanagement.googleapis.com/securityHealthAnalyticsCustomModules.get` `securitycentermanagement.googleapis.com/securityHealthAnalyticsCustomModules.list` `securitycentermanagement.googleapis.com/securityHealthAnalyticsCustomModules.simulate` `securitycentermanagement.googleapis.com/securityHealthAnalyticsCustomModules.test` `securitycentermanagement.googleapis.com/securityHealthAnalyticsCustomModules.update` `securitycentermanagement.locations.get` `securitycentermanagement.locations.list` `securitycentermanagement.securityHealthAnalyticsCustomModules.create` `securitycentermanagement.securityHealthAnalyticsCustomModules.delete` `securitycentermanagement.securityHealthAnalyticsCustomModules.get` `securitycentermanagement.securityHealthAnalyticsCustomModules.list` `securitycentermanagement.securityHealthAnalyticsCustomModules.simulate` `securitycentermanagement.securityHealthAnalyticsCustomModules.test` `securitycentermanagement.securityHealthAnalyticsCustomModules.update`
Security Center Management API	The Security Center Management Custom Modules Viewer role (`roles/securitycentermanagement.customModulesViewer`) has been added with the following permissions: `cloudresourcemanager.googleapis.com/organizations.get` `cloudresourcemanager.googleapis.com/projects.get` `cloudresourcemanager.googleapis.com/projects.list` `resourcemanager.organizations.get` `resourcemanager.projects.get` `resourcemanager.projects.list` `securitycentermanagement.effectiveEventThreatDetectionCustomModules.get` `securitycentermanagement.effectiveEventThreatDetectionCustomModules.list` `securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.get` `securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.list` `securitycentermanagement.eventThreatDetectionCustomModules.get` `securitycentermanagement.eventThreatDetectionCustomModules.list` `securitycentermanagement.eventThreatDetectionCustomModules.validate` `securitycentermanagement.googleapis.com/effectiveEventThreatDetectionCustomModules.get` `securitycentermanagement.googleapis.com/effectiveEventThreatDetectionCustomModules.list` `securitycentermanagement.googleapis.com/effectiveSecurityHealthAnalyticsCustomModules.get` `securitycentermanagement.googleapis.com/effectiveSecurityHealthAnalyticsCustomModules.list` `securitycentermanagement.googleapis.com/eventThreatDetectionCustomModules.get` `securitycentermanagement.googleapis.com/eventThreatDetectionCustomModules.list` `securitycentermanagement.googleapis.com/eventThreatDetectionCustomModules.validate` `securitycentermanagement.googleapis.com/locations.get` `securitycentermanagement.googleapis.com/locations.list` `securitycentermanagement.googleapis.com/securityHealthAnalyticsCustomModules.get` `securitycentermanagement.googleapis.com/securityHealthAnalyticsCustomModules.list` `securitycentermanagement.googleapis.com/securityHealthAnalyticsCustomModules.simulate` `securitycentermanagement.googleapis.com/securityHealthAnalyticsCustomModules.test` `securitycentermanagement.locations.get` `securitycentermanagement.locations.list` `securitycentermanagement.securityHealthAnalyticsCustomModules.get` `securitycentermanagement.securityHealthAnalyticsCustomModules.list` `securitycentermanagement.securityHealthAnalyticsCustomModules.simulate` `securitycentermanagement.securityHealthAnalyticsCustomModules.test`
Security Center Management API	The Security Center Management Custom ETD Modules Editor role (`roles/securitycentermanagement.etdCustomModulesEditor`) has been added with the following permissions: `cloudresourcemanager.googleapis.com/organizations.get` `cloudresourcemanager.googleapis.com/projects.get` `cloudresourcemanager.googleapis.com/projects.list` `resourcemanager.organizations.get` `resourcemanager.projects.get` `resourcemanager.projects.list` `securitycentermanagement.effectiveEventThreatDetectionCustomModules.get` `securitycentermanagement.effectiveEventThreatDetectionCustomModules.list` `securitycentermanagement.eventThreatDetectionCustomModules.create` `securitycentermanagement.eventThreatDetectionCustomModules.delete` `securitycentermanagement.eventThreatDetectionCustomModules.get` `securitycentermanagement.eventThreatDetectionCustomModules.list` `securitycentermanagement.eventThreatDetectionCustomModules.update` `securitycentermanagement.eventThreatDetectionCustomModules.validate` `securitycentermanagement.googleapis.com/effectiveEventThreatDetectionCustomModules.get` `securitycentermanagement.googleapis.com/effectiveEventThreatDetectionCustomModules.list` `securitycentermanagement.googleapis.com/eventThreatDetectionCustomModules.create` `securitycentermanagement.googleapis.com/eventThreatDetectionCustomModules.delete` `securitycentermanagement.googleapis.com/eventThreatDetectionCustomModules.get` `securitycentermanagement.googleapis.com/eventThreatDetectionCustomModules.list` `securitycentermanagement.googleapis.com/eventThreatDetectionCustomModules.update` `securitycentermanagement.googleapis.com/eventThreatDetectionCustomModules.validate` `securitycentermanagement.googleapis.com/locations.get` `securitycentermanagement.googleapis.com/locations.list` `securitycentermanagement.locations.get` `securitycentermanagement.locations.list`
Security Center Management API	The Security Center Management ETD Custom Modules Viewer role (`roles/securitycentermanagement.etdCustomModulesViewer`) has been added with the following permissions: `cloudresourcemanager.googleapis.com/organizations.get` `cloudresourcemanager.googleapis.com/projects.get` `cloudresourcemanager.googleapis.com/projects.list` `resourcemanager.organizations.get` `resourcemanager.projects.get` `resourcemanager.projects.list` `securitycentermanagement.effectiveEventThreatDetectionCustomModules.get` `securitycentermanagement.effectiveEventThreatDetectionCustomModules.list` `securitycentermanagement.eventThreatDetectionCustomModules.get` `securitycentermanagement.eventThreatDetectionCustomModules.list` `securitycentermanagement.eventThreatDetectionCustomModules.validate` `securitycentermanagement.googleapis.com/effectiveEventThreatDetectionCustomModules.get` `securitycentermanagement.googleapis.com/effectiveEventThreatDetectionCustomModules.list` `securitycentermanagement.googleapis.com/eventThreatDetectionCustomModules.get` `securitycentermanagement.googleapis.com/eventThreatDetectionCustomModules.list` `securitycentermanagement.googleapis.com/eventThreatDetectionCustomModules.validate` `securitycentermanagement.googleapis.com/locations.get` `securitycentermanagement.googleapis.com/locations.list` `securitycentermanagement.locations.get` `securitycentermanagement.locations.list`
Security Center Management API	The Security Center Management SHA Custom Modules Editor role (`roles/securitycentermanagement.shaCustomModulesEditor`) has been added with the following permissions: `cloudresourcemanager.googleapis.com/organizations.get` `cloudresourcemanager.googleapis.com/projects.get` `cloudresourcemanager.googleapis.com/projects.list` `resourcemanager.organizations.get` `resourcemanager.projects.get` `resourcemanager.projects.list` `securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.get` `securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.list` `securitycentermanagement.googleapis.com/effectiveSecurityHealthAnalyticsCustomModules.get` `securitycentermanagement.googleapis.com/effectiveSecurityHealthAnalyticsCustomModules.list` `securitycentermanagement.googleapis.com/locations.get` `securitycentermanagement.googleapis.com/locations.list` `securitycentermanagement.googleapis.com/securityHealthAnalyticsCustomModules.create` `securitycentermanagement.googleapis.com/securityHealthAnalyticsCustomModules.delete` `securitycentermanagement.googleapis.com/securityHealthAnalyticsCustomModules.get` `securitycentermanagement.googleapis.com/securityHealthAnalyticsCustomModules.list` `securitycentermanagement.googleapis.com/securityHealthAnalyticsCustomModules.simulate` `securitycentermanagement.googleapis.com/securityHealthAnalyticsCustomModules.test` `securitycentermanagement.googleapis.com/securityHealthAnalyticsCustomModules.update` `securitycentermanagement.locations.get` `securitycentermanagement.locations.list` `securitycentermanagement.securityHealthAnalyticsCustomModules.create` `securitycentermanagement.securityHealthAnalyticsCustomModules.delete` `securitycentermanagement.securityHealthAnalyticsCustomModules.get` `securitycentermanagement.securityHealthAnalyticsCustomModules.list` `securitycentermanagement.securityHealthAnalyticsCustomModules.simulate` `securitycentermanagement.securityHealthAnalyticsCustomModules.test` `securitycentermanagement.securityHealthAnalyticsCustomModules.update`
Security Center Management API	The Security Center Management SHA Custom Modules Viewer role (`roles/securitycentermanagement.shaCustomModulesViewer`) has been added with the following permissions: `cloudresourcemanager.googleapis.com/organizations.get` `cloudresourcemanager.googleapis.com/projects.get` `cloudresourcemanager.googleapis.com/projects.list` `resourcemanager.organizations.get` `resourcemanager.projects.get` `resourcemanager.projects.list` `securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.get` `securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.list` `securitycentermanagement.googleapis.com/effectiveSecurityHealthAnalyticsCustomModules.get` `securitycentermanagement.googleapis.com/effectiveSecurityHealthAnalyticsCustomModules.list` `securitycentermanagement.googleapis.com/locations.get` `securitycentermanagement.googleapis.com/locations.list` `securitycentermanagement.googleapis.com/securityHealthAnalyticsCustomModules.get` `securitycentermanagement.googleapis.com/securityHealthAnalyticsCustomModules.list` `securitycentermanagement.googleapis.com/securityHealthAnalyticsCustomModules.simulate` `securitycentermanagement.googleapis.com/securityHealthAnalyticsCustomModules.test` `securitycentermanagement.locations.get` `securitycentermanagement.locations.list` `securitycentermanagement.securityHealthAnalyticsCustomModules.get` `securitycentermanagement.securityHealthAnalyticsCustomModules.list` `securitycentermanagement.securityHealthAnalyticsCustomModules.simulate` `securitycentermanagement.securityHealthAnalyticsCustomModules.test`
Basic Role	The following permissions have been added to the Viewer role (`roles/viewer`): `apigee.securitySettings.get` `connectors.customConnectorVersions.get` `connectors.customConnectorVersions.getIamPolicy` `connectors.customConnectorVersions.list` `connectors.customConnectors.get` `connectors.customConnectors.getIamPolicy` `connectors.customConnectors.list`
Vision AI	The following permissions have been added to the Cloud Vision AI Service Agent role (`roles/visionai.serviceAgent`): `visionai.assets.analyze` `visionai.assets.generateHlsUri` `visionai.assets.index` `visionai.assets.removeIndex` `visionai.assets.upload` `visionai.corpora.analyze` `visionai.corpora.create` `visionai.corpora.import` `visionai.corpora.suggest` `visionai.indexEndpoints.create` `visionai.indexEndpoints.delete` `visionai.indexEndpoints.deploy` `visionai.indexEndpoints.get` `visionai.indexEndpoints.list` `visionai.indexEndpoints.search` `visionai.indexEndpoints.undeploy` `visionai.indexEndpoints.update` `visionai.indexes.create` `visionai.indexes.delete` `visionai.indexes.get` `visionai.indexes.list` `visionai.indexes.update` `visionai.indexes.viewAssets`
Workflows	The following permissions have been added to the Workflows Invoker role (`roles/workflows.invoker`): `workflows.stepEntries.get` `workflows.stepEntries.list`
Workload Manager	The following permissions have been added to the Workload Manager Worker role (`roles/workloadmanager.worker`): `workloadmanager.insights.write`
Apigee	The following permissions have been added: `apigee.securitySettings.get` `apigee.securitySettings.update`
Blockchain Node Engine	The following permissions have reached General Availability (GA): `blockchainnodeengine.blockchainNodes.create` `blockchainnodeengine.blockchainNodes.delete` `blockchainnodeengine.blockchainNodes.get` `blockchainnodeengine.blockchainNodes.list` `blockchainnodeengine.blockchainNodes.update` `blockchainnodeengine.locations.get` `blockchainnodeengine.locations.list` `blockchainnodeengine.operations.cancel` `blockchainnodeengine.operations.delete` `blockchainnodeengine.operations.get` `blockchainnodeengine.operations.list`
Cloud Deploy	The following permissions have been added: `clouddeploy.automationRuns.cancel` `clouddeploy.automationRuns.get` `clouddeploy.automationRuns.list` `clouddeploy.automations.create` `clouddeploy.automations.delete` `clouddeploy.automations.get` `clouddeploy.automations.list` `clouddeploy.automations.update` `clouddeploy.customTargetTypes.create` `clouddeploy.customTargetTypes.delete` `clouddeploy.customTargetTypes.get` `clouddeploy.customTargetTypes.list` `clouddeploy.customTargetTypes.update`
Cloud Deploy	The following permissions are supported in custom roles: `clouddeploy.automationRuns.cancel` `clouddeploy.automationRuns.get` `clouddeploy.automationRuns.list` `clouddeploy.automations.create` `clouddeploy.automations.delete` `clouddeploy.automations.get` `clouddeploy.automations.list` `clouddeploy.automations.update` `clouddeploy.customTargetTypes.create` `clouddeploy.customTargetTypes.delete` `clouddeploy.customTargetTypes.get` `clouddeploy.customTargetTypes.list` `clouddeploy.customTargetTypes.update`
Connectors	The following permissions have been added: `connectors.customConnectorVersions.create` `connectors.customConnectorVersions.delete` `connectors.customConnectorVersions.get` `connectors.customConnectorVersions.getIamPolicy` `connectors.customConnectorVersions.list` `connectors.customConnectorVersions.setIamPolicy` `connectors.customConnectorVersions.update` `connectors.customConnectors.create` `connectors.customConnectors.delete` `connectors.customConnectors.get` `connectors.customConnectors.getIamPolicy` `connectors.customConnectors.list` `connectors.customConnectors.setIamPolicy` `connectors.customConnectors.update`
Firebase App Check	The following permissions have been added: `firebaseappcheck.resourcePolicies.get` `firebaseappcheck.resourcePolicies.update`
Firebase App Check	The following permissions are supported in custom roles: `firebaseappcheck.resourcePolicies.get` `firebaseappcheck.resourcePolicies.update`
Firebase App Check	The following permissions have reached General Availability (GA): `firebaseappcheck.resourcePolicies.get` `firebaseappcheck.resourcePolicies.update`
FleetEngine	The following permissions have been added: `fleetengine.deliveryvehicles.allowAllActions` `fleetengine.tasks.allowAllActions` `fleetengine.tasktrackinginfo.allowAllActions` `fleetengine.trips.allowAllActions` `fleetengine.vehicles.allowAllActions`
FleetEngine	The following permissions have reached General Availability (GA): `fleetengine.deliveryvehicles.allowAllActions` `fleetengine.tasks.allowAllActions` `fleetengine.tasktrackinginfo.allowAllActions` `fleetengine.trips.allowAllActions` `fleetengine.vehicles.allowAllActions`
Kubernetes Metadata API	The following permissions have been added: `kubernetesmetadata.metadata.config` `kubernetesmetadata.metadata.publish` `kubernetesmetadata.metadata.snapshot`
Kubernetes Metadata API	The following permissions are supported in custom roles: `kubernetesmetadata.metadata.config` `kubernetesmetadata.metadata.publish` `kubernetesmetadata.metadata.snapshot`
Live Stream	The following permissions have been added: `livestream.assets.create` `livestream.assets.delete` `livestream.assets.get` `livestream.assets.list` `livestream.pools.get` `livestream.pools.update`
Live Stream	The following permissions are supported in custom roles: `livestream.assets.create` `livestream.assets.delete` `livestream.assets.get` `livestream.assets.list` `livestream.pools.get` `livestream.pools.update`
Live Stream	The following permissions have reached General Availability (GA): `livestream.assets.create` `livestream.assets.delete` `livestream.assets.get` `livestream.assets.list` `livestream.pools.get` `livestream.pools.update`
Maps Analytics	The following permissions have been added: `mapsanalytics.metricData.query` `mapsanalytics.metricMetadata.list`
Maps Analytics	The following permissions are supported in custom roles: `mapsanalytics.metricData.query` `mapsanalytics.metricMetadata.list`
Network Connectivity Center	The following permissions have been added: `networkconnectivity.regionalEndpoints.create` `networkconnectivity.regionalEndpoints.delete` `networkconnectivity.regionalEndpoints.get` `networkconnectivity.regionalEndpoints.list`
Network Connectivity Center	The following permissions are supported in custom roles: `networkconnectivity.regionalEndpoints.create` `networkconnectivity.regionalEndpoints.delete` `networkconnectivity.regionalEndpoints.get` `networkconnectivity.regionalEndpoints.list`
Recommender	The following permissions have been added: `recommender.costRecommendations.listAll` `recommender.costRecommendations.summarizeAll`
Recommender	The following permissions are supported in custom roles: `recommender.costRecommendations.listAll` `recommender.costRecommendations.summarizeAll`
Security Center Management API	The following permissions have been added: `securitycentermanagement.effectiveEventThreatDetectionCustomModules.get` `securitycentermanagement.effectiveEventThreatDetectionCustomModules.list` `securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.get` `securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.list` `securitycentermanagement.eventThreatDetectionCustomModules.create` `securitycentermanagement.eventThreatDetectionCustomModules.delete` `securitycentermanagement.eventThreatDetectionCustomModules.get` `securitycentermanagement.eventThreatDetectionCustomModules.list` `securitycentermanagement.eventThreatDetectionCustomModules.update` `securitycentermanagement.eventThreatDetectionCustomModules.validate` `securitycentermanagement.locations.get` `securitycentermanagement.locations.list` `securitycentermanagement.securityHealthAnalyticsCustomModules.create` `securitycentermanagement.securityHealthAnalyticsCustomModules.delete` `securitycentermanagement.securityHealthAnalyticsCustomModules.get` `securitycentermanagement.securityHealthAnalyticsCustomModules.list` `securitycentermanagement.securityHealthAnalyticsCustomModules.simulate` `securitycentermanagement.securityHealthAnalyticsCustomModules.test` `securitycentermanagement.securityHealthAnalyticsCustomModules.update`
Security Center Management API	The following permissions are supported in custom roles: `securitycentermanagement.effectiveEventThreatDetectionCustomModules.get` `securitycentermanagement.effectiveEventThreatDetectionCustomModules.list` `securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.get` `securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.list` `securitycentermanagement.eventThreatDetectionCustomModules.create` `securitycentermanagement.eventThreatDetectionCustomModules.delete` `securitycentermanagement.eventThreatDetectionCustomModules.get` `securitycentermanagement.eventThreatDetectionCustomModules.list` `securitycentermanagement.eventThreatDetectionCustomModules.update` `securitycentermanagement.eventThreatDetectionCustomModules.validate` `securitycentermanagement.locations.get` `securitycentermanagement.locations.list` `securitycentermanagement.securityHealthAnalyticsCustomModules.create` `securitycentermanagement.securityHealthAnalyticsCustomModules.delete` `securitycentermanagement.securityHealthAnalyticsCustomModules.get` `securitycentermanagement.securityHealthAnalyticsCustomModules.list` `securitycentermanagement.securityHealthAnalyticsCustomModules.simulate` `securitycentermanagement.securityHealthAnalyticsCustomModules.test` `securitycentermanagement.securityHealthAnalyticsCustomModules.update`
Security Center Management API	The following permissions have reached General Availability (GA): `securitycentermanagement.effectiveEventThreatDetectionCustomModules.get` `securitycentermanagement.effectiveEventThreatDetectionCustomModules.list` `securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.get` `securitycentermanagement.effectiveSecurityHealthAnalyticsCustomModules.list` `securitycentermanagement.eventThreatDetectionCustomModules.create` `securitycentermanagement.eventThreatDetectionCustomModules.delete` `securitycentermanagement.eventThreatDetectionCustomModules.get` `securitycentermanagement.eventThreatDetectionCustomModules.list` `securitycentermanagement.eventThreatDetectionCustomModules.update` `securitycentermanagement.eventThreatDetectionCustomModules.validate` `securitycentermanagement.locations.get` `securitycentermanagement.locations.list` `securitycentermanagement.securityHealthAnalyticsCustomModules.create` `securitycentermanagement.securityHealthAnalyticsCustomModules.delete` `securitycentermanagement.securityHealthAnalyticsCustomModules.get` `securitycentermanagement.securityHealthAnalyticsCustomModules.list` `securitycentermanagement.securityHealthAnalyticsCustomModules.simulate` `securitycentermanagement.securityHealthAnalyticsCustomModules.test` `securitycentermanagement.securityHealthAnalyticsCustomModules.update`
Cloud Storage	The following permissions have been added: `storage.buckets.enableObjectRetention` `storage.objects.overrideUnlockedRetention` `storage.objects.setRetention`
Cloud Storage	The following permissions are supported in custom roles: `storage.buckets.enableObjectRetention` `storage.objects.overrideUnlockedRetention` `storage.objects.setRetention`
Cloud Storage	The following permissions have reached General Availability (GA): `storage.buckets.enableObjectRetention` `storage.objects.overrideUnlockedRetention` `storage.objects.setRetention`
Video Stitcher API	The following permissions have been added: `videostitcher.liveConfigs.create` `videostitcher.liveConfigs.delete` `videostitcher.liveConfigs.get` `videostitcher.liveConfigs.list`
Video Stitcher API	The following permissions are supported in custom roles: `videostitcher.liveConfigs.create` `videostitcher.liveConfigs.delete` `videostitcher.liveConfigs.get` `videostitcher.liveConfigs.list`
Video Stitcher API	The following permissions have reached General Availability (GA): `videostitcher.liveConfigs.create` `videostitcher.liveConfigs.delete` `videostitcher.liveConfigs.get` `videostitcher.liveConfigs.list`
Workflows	The following permissions have been added: `workflows.stepEntries.get` `workflows.stepEntries.list`
Workflows	The following permissions are supported in custom roles: `workflows.stepEntries.get` `workflows.stepEntries.list`
Workflows	The following permissions have reached General Availability (GA): `workflows.stepEntries.get` `workflows.stepEntries.list`
Workload Manager	The following permissions have been added: `workloadmanager.insights.write`
Workload Manager	The following permissions are supported in custom roles: `workloadmanager.insights.write`

IAM changes as of 2023-11-17

Service	Description
Vertex AI	The following permissions have been added to the Vertex AI Service Agent role (`roles/aiplatform.serviceAgent`): `compute.disks.createSnapshot` `compute.globalOperations.get` `compute.instances.useReadOnly` `compute.snapshots.create` `compute.snapshots.delete`
Backup and Disaster Recovery	The following permissions have been added to the Backup and DR Compute Engine Operator role (`roles/backupdr.computeEngineOperator`): `compute.addresses.use`
Backup and Disaster Recovery	The following permissions have been added to the Backup and DR Service Agent role (`roles/backupdr.serviceAgent`): `compute.addresses.use`
Capacity Planner	The following permissions have been added to the Capacity Planner Usage Viewer role (`roles/capacityplanner.viewer`): `monitoring.timeSeries.list` `serviceusage.quotas.get` `serviceusage.services.get`
Workload Manager	The following permissions have been added to the Workload Manager Admin role (`roles/workloadmanager.admin`): `orgpolicy.policy.get`
Workload Manager	The following permissions have been added to the Workload Manager Viewer role (`roles/workloadmanager.viewer`): `orgpolicy.policy.get`
Workload Manager	The following permissions have been added to the Workload Manager Worker role (`roles/workloadmanager.worker`): `orgpolicy.policy.get`
Dataform	The following permissions have been added: `dataform.workspaces.searchFiles`
Dataform	The following permissions have reached General Availability (GA): `dataform.workspaces.searchFiles`
Identity-Aware Proxy	The following permissions have been added: `iap.tunnelDestGroups.remediate` `iap.tunnelinstances.remediate` `iap.webServiceVersions.remediate`

IAM changes as of 2023-11-10

Service	Description
Content Warehouse	The following permissions have been added to the Content Warehouse Admin role (`roles/contentwarehouse.admin`): `contentwarehouse.documents.list`
Content Warehouse	The following permissions have been added to the Content Warehouse Document Admin role (`roles/contentwarehouse.documentAdmin`): `contentwarehouse.locations.getStatus`
Content Warehouse	The following permissions have been added to the Content Warehouse document creator role (`roles/contentwarehouse.documentCreator`): `contentwarehouse.locations.getStatus`
Content Warehouse	The following permissions have been added to the Content Warehouse Document Editor role (`roles/contentwarehouse.documentEditor`): `contentwarehouse.locations.getStatus`
Content Warehouse	The following permissions have been added to the Content Warehouse document schema viewer role (`roles/contentwarehouse.documentSchemaViewer`): `contentwarehouse.locations.getStatus`
Content Warehouse	The following permissions have been added to the Content Warehouse Viewer role (`roles/contentwarehouse.documentViewer`): `contentwarehouse.locations.getStatus`
GKE Multi-Cloud	The Anthos Multi-Cloud Container Service Agent role (`roles/gkemulticloud.containerServiceAgent`) has reached General Availability (GA).
GKE Multi-Cloud	The Anthos Multi-Cloud Control Plane Machine Service Agent role (`roles/gkemulticloud.controlPlaneMachineServiceAgent`) has reached General Availability (GA).
GKE Multi-Cloud	The Anthos Multi-Cloud Node Pool Machine Service Agent role (`roles/gkemulticloud.nodePoolMachineServiceAgent`) has reached General Availability (GA).
Cloud Run	The following permissions have been added to the Cloud Run Service Agent role (`roles/run.serviceAgent`): `artifactregistry.repositories.uploadArtifacts`
Storage Insights	The Storage Insights Analyst role (`roles/storageinsights.analyst`) has reached General Availability (GA).
App Hub	The following permissions have been added: `apphub.applications.create` `apphub.applications.delete` `apphub.applications.get` `apphub.applications.getIamPolicy` `apphub.applications.list` `apphub.applications.setIamPolicy` `apphub.applications.update` `apphub.discoveredServices.get` `apphub.discoveredServices.list` `apphub.discoveredServices.register` `apphub.discoveredWorkloads.get` `apphub.discoveredWorkloads.list` `apphub.discoveredWorkloads.register` `apphub.locations.get` `apphub.locations.list` `apphub.operations.cancel` `apphub.operations.delete` `apphub.operations.get` `apphub.operations.list` `apphub.serviceProjectAttachments.attach` `apphub.serviceProjectAttachments.create` `apphub.serviceProjectAttachments.delete` `apphub.serviceProjectAttachments.detach` `apphub.serviceProjectAttachments.get` `apphub.serviceProjectAttachments.list` `apphub.serviceProjectAttachments.lookup` `apphub.services.create` `apphub.services.delete` `apphub.services.get` `apphub.services.list` `apphub.services.update` `apphub.workloads.create` `apphub.workloads.delete` `apphub.workloads.get` `apphub.workloads.list` `apphub.workloads.update`
App Hub	The following permissions are supported in custom roles: `apphub.applications.create` `apphub.applications.delete` `apphub.applications.get` `apphub.applications.getIamPolicy` `apphub.applications.list` `apphub.applications.setIamPolicy` `apphub.applications.update` `apphub.discoveredServices.get` `apphub.discoveredServices.list` `apphub.discoveredServices.register` `apphub.discoveredWorkloads.get` `apphub.discoveredWorkloads.list` `apphub.discoveredWorkloads.register` `apphub.locations.get` `apphub.locations.list` `apphub.operations.cancel` `apphub.operations.delete` `apphub.operations.get` `apphub.operations.list` `apphub.serviceProjectAttachments.attach` `apphub.serviceProjectAttachments.create` `apphub.serviceProjectAttachments.delete` `apphub.serviceProjectAttachments.detach` `apphub.serviceProjectAttachments.get` `apphub.serviceProjectAttachments.list` `apphub.serviceProjectAttachments.lookup` `apphub.services.create` `apphub.services.delete` `apphub.services.get` `apphub.services.list` `apphub.services.update` `apphub.workloads.create` `apphub.workloads.delete` `apphub.workloads.get` `apphub.workloads.list` `apphub.workloads.update`
Commerce Org Governance	The following permissions have been added: `commerceorggovernance.populateCollectionJobs.create` `commerceorggovernance.populateCollectionJobs.list` `commerceorggovernance.populateCollectionJobs.run` `commerceorggovernance.populateCollectionJobs.update`
Commerce Org Governance	The following permissions are supported in custom roles: `commerceorggovernance.populateCollectionJobs.create` `commerceorggovernance.populateCollectionJobs.list` `commerceorggovernance.populateCollectionJobs.run` `commerceorggovernance.populateCollectionJobs.update`
Content Warehouse	The following permissions have been added: `contentwarehouse.corpora.create` `contentwarehouse.corpora.delete` `contentwarehouse.corpora.get` `contentwarehouse.corpora.list` `contentwarehouse.corpora.update` `contentwarehouse.documents.list` `contentwarehouse.locations.getStatus`
Content Warehouse	The following permissions have reached General Availability (GA): `contentwarehouse.corpora.create` `contentwarehouse.corpora.delete` `contentwarehouse.corpora.get` `contentwarehouse.corpora.list` `contentwarehouse.corpora.update` `contentwarehouse.documents.list` `contentwarehouse.locations.getStatus`
Looker Studio	The following permissions are supported in custom roles: `lookerstudio.pro.manage`
Network Security	The following permissions have been added: `networksecurity.addressGroups.create` `networksecurity.addressGroups.delete` `networksecurity.addressGroups.get` `networksecurity.addressGroups.getIamPolicy` `networksecurity.addressGroups.list` `networksecurity.addressGroups.setIamPolicy` `networksecurity.addressGroups.update` `networksecurity.addressGroups.use`
Network Security	The following permissions are supported in custom roles: `networksecurity.addressGroups.create` `networksecurity.addressGroups.delete` `networksecurity.addressGroups.get` `networksecurity.addressGroups.getIamPolicy` `networksecurity.addressGroups.list` `networksecurity.addressGroups.setIamPolicy` `networksecurity.addressGroups.update` `networksecurity.addressGroups.use`
Storage Insights	The following permissions have been added: `storageinsights.datasetConfigs.create` `storageinsights.datasetConfigs.delete` `storageinsights.datasetConfigs.get` `storageinsights.datasetConfigs.linkDataset` `storageinsights.datasetConfigs.list` `storageinsights.datasetConfigs.unlinkDataset` `storageinsights.datasetConfigs.update`
Storage Insights	The following permissions are supported in custom roles: `storageinsights.datasetConfigs.create` `storageinsights.datasetConfigs.delete` `storageinsights.datasetConfigs.get` `storageinsights.datasetConfigs.linkDataset` `storageinsights.datasetConfigs.list` `storageinsights.datasetConfigs.unlinkDataset` `storageinsights.datasetConfigs.update`
Storage Insights	The following permissions have reached General Availability (GA): `storageinsights.datasetConfigs.create` `storageinsights.datasetConfigs.delete` `storageinsights.datasetConfigs.get` `storageinsights.datasetConfigs.linkDataset` `storageinsights.datasetConfigs.list` `storageinsights.datasetConfigs.unlinkDataset` `storageinsights.datasetConfigs.update`

IAM changes as of 2023-11-03

Service	Description
Google Security Operations	The following permissions have been added to the Chronicle API Limited Viewer role (`roles/chronicle.limitedViewer`): `chronicle.dashboards.schedule` `chronicle.entities.find` `chronicle.entities.findRelatedEntities` `chronicle.entities.get` `chronicle.entities.searchEntities` `chronicle.entities.summarize` `chronicle.entities.summarizeFromQuery` `chronicle.events.batchGet` `chronicle.events.findUdmFieldValues` `chronicle.events.get` `chronicle.events.queryProductSourceStats` `chronicle.events.udmSearch` `chronicle.events.validateQuery` `chronicle.findingsGraphs.exploreNode` `chronicle.findingsGraphs.initializeGraph` `chronicle.legacies.legacyBatchGetCases` `chronicle.legacies.legacyCalculateAlertStats` `chronicle.legacies.legacyFetchAlertsView` `chronicle.legacies.legacyFetchUdmSearchCsv` `chronicle.legacies.legacyFetchUdmSearchView` `chronicle.legacies.legacyFindAssetEvents` `chronicle.legacies.legacyFindRawLogs` `chronicle.legacies.legacyFindUdmEvents` `chronicle.legacies.legacyGetAlert` `chronicle.legacies.legacyGetFinding` `chronicle.legacies.legacySearchArtifactEvents` `chronicle.legacies.legacySearchArtifactIoCDetails` `chronicle.legacies.legacySearchAssetEvents` `chronicle.legacies.legacySearchDomainsRecentlyRegistered` `chronicle.legacies.legacySearchDomainsTimingStats` `chronicle.legacies.legacySearchFindings` `chronicle.legacies.legacySearchIoCInsights` `chronicle.legacies.legacySearchRawLogs` `chronicle.legacies.legacySearchUserEvents` `chronicle.logTypeSchemas.list` `chronicle.operations.get` `chronicle.operations.list` `chronicle.operations.wait` `resourcemanager.projects.get` `resourcemanager.projects.list`
Google Security Operations	The following permissions have been added to the Chronicle API Restricted Data Access Viewer role (`roles/chronicle.restrictedDataAccessViewer`): `chronicle.findingsGraphs.exploreNode` `chronicle.findingsGraphs.initializeGraph`
Gemini for Google Cloud API	The following permissions have been added to the Cloud AI Companion User role (`roles/cloudaicompanion.user`): `resourcemanager.projects.get` `resourcemanager.projects.list`
Dataproc	The following permissions have been added to the Dataproc Service Agent role (`roles/dataproc.serviceAgent`): `compute.disks.createTagBinding`
Distributed Cloud Edge Container	The Edge Container Cluster Service Agent role (`roles/edgecontainer.clusterServiceAgent`) has reached General Availability (GA).
Distributed Cloud Edge Container	The Edge Container Cluster offline Credential User role (`roles/edgecontainer.offlineCredentialUser`) has reached General Availability (GA).
Looker	The Looker Service Agent role (`roles/looker.serviceAgent`) has reached General Availability (GA).
Subscription Linking	The Subscription Linking Admin role (`roles/readerrevenuesubscriptionlinking.admin`) has reached General Availability (GA).
Subscription Linking	The Subscription Linking Entitlements Viewer role (`roles/readerrevenuesubscriptionlinking.entitlementsViewer`) has reached General Availability (GA).
Subscription Linking	The Subscription Linking Viewer role (`roles/readerrevenuesubscriptionlinking.viewer`) has reached General Availability (GA).
Apigee	The following permissions have been added: `apigee.securityIncidents.update`
Apigee	The following permissions are supported in custom roles: `apigee.securityIncidents.update`
Apigee	The following permissions have reached General Availability (GA): `apigee.securityIncidents.update`
Google Security Operations	The following permissions have been added: `chronicle.findingsGraphs.exploreNode` `chronicle.findingsGraphs.initializeGraph` `chronicle.legacies.legacySearchArtifactIoCDetails` `chronicle.legacies.legacySearchDomainsRecentlyRegistered` `chronicle.legacies.legacySearchDomainsTimingStats` `chronicle.legacies.legacySearchIoCInsights`
Google Security Operations	The following permissions are supported in custom roles: `chronicle.findingsGraphs.exploreNode` `chronicle.findingsGraphs.initializeGraph` `chronicle.legacies.legacySearchArtifactIoCDetails` `chronicle.legacies.legacySearchDomainsRecentlyRegistered` `chronicle.legacies.legacySearchDomainsTimingStats` `chronicle.legacies.legacySearchIoCInsights`
Distributed Cloud Edge Container	The following permissions have been added: `edgecontainer.clusters.generateOfflineCredential`
Distributed Cloud Edge Container	The following permissions are supported in custom roles: `edgecontainer.clusters.generateOfflineCredential`
Distributed Cloud Edge Container	The following permissions have reached General Availability (GA): `edgecontainer.clusters.generateOfflineCredential`
Subscription Linking	The following permissions have been added: `readerrevenuesubscriptionlinking.readerEntitlements.get` `readerrevenuesubscriptionlinking.readerEntitlements.update` `readerrevenuesubscriptionlinking.readers.delete` `readerrevenuesubscriptionlinking.readers.get`
Subscription Linking	The following permissions have reached General Availability (GA): `readerrevenuesubscriptionlinking.readerEntitlements.get` `readerrevenuesubscriptionlinking.readerEntitlements.update` `readerrevenuesubscriptionlinking.readers.delete` `readerrevenuesubscriptionlinking.readers.get`
Security Command Center	The following permissions have been added: `securitycenter.exposurepathexplan.get` `securitycenter.findingexplanations.get`
Security Command Center	The following permissions are supported in custom roles: `securitycenter.exposurepathexplan.get` `securitycenter.findingexplanations.get`
Security Command Center	The following permissions have reached General Availability (GA): `securitycenter.exposurepathexplan.get` `securitycenter.findingexplanations.get`

IAM changes as of 2023-10-27

Service	Description
BigQuery	The following permissions have been added to the Bigquery Studio User role (`roles/bigquery.studioUser`): `bigquery.readsessions.create` `bigquery.readsessions.getData` `bigquery.readsessions.update`
BigQuery Data Transfer Service	The following permissions have been added to the BigQuery Data Transfer Service Agent role (`roles/bigquerydatatransfer.serviceAgent`): `compute.networkAttachments.get`
Cloud Asset Inventory	The Other Cloud Config Service Agent role (`roles/cloudasset.otherCloudConfigServiceAgent`) has reached General Availability (GA).
Cloud Composer	The following permissions have been added to the Cloud Composer API Service Agent role (`roles/composer.serviceAgent`): `composer.dags.get` `composer.environments.get` `iam.serviceAccounts.getAccessToken`
Connectors	The following permissions have been added to the Connectors Platform Service Agent role (`roles/connectors.serviceAgent`): `connectors.actions.list` `connectors.entityTypes.list`
Datastream	The Datastream Admin role (`roles/datastream.admin`) has reached General Availability (GA).
Datastream	The Datastream Viewer role (`roles/datastream.viewer`) has reached General Availability (GA).
Looker Studio	The following permissions have been added to the Data Studio Workspace Content Manager role (`roles/datastudio.contentManager`): `datastudio.datasources.move` `datastudio.reports.move`
GKE Hub	The GKE Hub Cross Project Service Agent role (`roles/gkehub.crossProjectServiceAgent`) has reached General Availability (GA).
Basic Role	The following permissions have been removed from the Viewer role (`roles/viewer`): `dialogflow.sessions.detectIntent` `dialogflow.sessions.streamingDetectIntent`
VM Migration	The following permissions have been added to the VM Migration Service Agent role (`roles/vmmigration.serviceAgent`): `compute.images.setLabels`
Capacity Planner	The following permissions have been added: `capacityplanner.forecasts.list` `capacityplanner.usageHistories.list` `capacityplanner.usageHistories.summarize`
Cloud Key Management Service	The following permissions have been added: `cloudkms.locations.optOutKeyDeletionMsa`
Cloud Key Management Service	The following permissions have reached General Availability (GA): `cloudkms.locations.optOutKeyDeletionMsa`
Cloud Tasks	The following permissions have been added: `cloudtasks.cmekConfig.get` `cloudtasks.cmekConfig.update`
Cloud Tasks	The following permissions are supported in custom roles: `cloudtasks.cmekConfig.get` `cloudtasks.cmekConfig.update`
Datastream	The following permissions have reached General Availability (GA): `datastream.connectionProfiles.create` `datastream.connectionProfiles.createTagBinding` `datastream.connectionProfiles.delete` `datastream.connectionProfiles.deleteTagBinding` `datastream.connectionProfiles.destinationTypes` `datastream.connectionProfiles.discover` `datastream.connectionProfiles.get` `datastream.connectionProfiles.getIamPolicy` `datastream.connectionProfiles.list` `datastream.connectionProfiles.listEffectiveTags` `datastream.connectionProfiles.listStaticServiceIps` `datastream.connectionProfiles.listTagBindings` `datastream.connectionProfiles.setIamPolicy` `datastream.connectionProfiles.sourceTypes` `datastream.connectionProfiles.update` `datastream.locations.fetchStaticIps` `datastream.locations.get` `datastream.locations.list` `datastream.objects.get` `datastream.objects.list` `datastream.objects.startBackfillJob` `datastream.objects.stopBackfillJob` `datastream.operations.cancel` `datastream.operations.delete` `datastream.operations.get` `datastream.operations.list` `datastream.privateConnections.create` `datastream.privateConnections.createTagBinding` `datastream.privateConnections.delete` `datastream.privateConnections.deleteTagBinding` `datastream.privateConnections.get` `datastream.privateConnections.getIamPolicy` `datastream.privateConnections.list` `datastream.privateConnections.listEffectiveTags` `datastream.privateConnections.listTagBindings` `datastream.privateConnections.setIamPolicy` `datastream.routes.create` `datastream.routes.delete` `datastream.routes.get` `datastream.routes.getIamPolicy` `datastream.routes.list` `datastream.routes.setIamPolicy` `datastream.streams.computeState` `datastream.streams.create` `datastream.streams.createTagBinding` `datastream.streams.delete` `datastream.streams.deleteTagBinding` `datastream.streams.fetchErrors` `datastream.streams.get` `datastream.streams.getIamPolicy` `datastream.streams.list` `datastream.streams.listEffectiveTags` `datastream.streams.listTagBindings` `datastream.streams.pause` `datastream.streams.resume` `datastream.streams.setIamPolicy` `datastream.streams.start` `datastream.streams.update`
Financial Services	The following permissions have been added: `financialservices.locations.get` `financialservices.locations.list` `financialservices.operations.cancel` `financialservices.operations.delete` `financialservices.operations.get` `financialservices.operations.list` `financialservices.v1backtests.create` `financialservices.v1backtests.delete` `financialservices.v1backtests.exportMetadata` `financialservices.v1backtests.get` `financialservices.v1backtests.list` `financialservices.v1backtests.update` `financialservices.v1datasets.create` `financialservices.v1datasets.delete` `financialservices.v1datasets.get` `financialservices.v1datasets.list` `financialservices.v1datasets.update` `financialservices.v1engineconfigs.create` `financialservices.v1engineconfigs.delete` `financialservices.v1engineconfigs.exportMetadata` `financialservices.v1engineconfigs.get` `financialservices.v1engineconfigs.list` `financialservices.v1engineconfigs.update` `financialservices.v1engineversions.get` `financialservices.v1engineversions.list` `financialservices.v1instances.create` `financialservices.v1instances.delete` `financialservices.v1instances.exportRegisteredParties` `financialservices.v1instances.get` `financialservices.v1instances.importRegisteredParties` `financialservices.v1instances.list` `financialservices.v1instances.update` `financialservices.v1models.create` `financialservices.v1models.delete` `financialservices.v1models.exportMetadata` `financialservices.v1models.get` `financialservices.v1models.list` `financialservices.v1models.update` `financialservices.v1predictions.create` `financialservices.v1predictions.delete` `financialservices.v1predictions.exportMetadata` `financialservices.v1predictions.get` `financialservices.v1predictions.list` `financialservices.v1predictions.update`
GKE Hub	The following permissions have been added: `gkehub.fleet.createFreeTrial` `gkehub.fleet.getFreeTrial` `gkehub.fleet.updateFreeTrial`
GKE Hub	The following permissions are supported in custom roles: `gkehub.fleet.createFreeTrial` `gkehub.fleet.getFreeTrial` `gkehub.fleet.updateFreeTrial`
GKE Hub	The following permissions have reached General Availability (GA): `gkehub.fleet.createFreeTrial` `gkehub.fleet.getFreeTrial` `gkehub.fleet.updateFreeTrial`
Cloud Healthcare API	The following permissions are supported in custom roles: `healthcare.fhirStores.applyConsents`

IAM changes as of 2023-10-20

Service	Description
Vertex AI	The following permissions have been added to the Colab Enterprise Admin role (`roles/aiplatform.colabEnterpriseAdmin`): `aiplatform.operations.list`
Vertex AI	The following permissions have been added to the Colab Enterprise User role (`roles/aiplatform.colabEnterpriseUser`): `aiplatform.operations.list`
Vertex AI	The following permissions have been added to the Notebook Runtime Admin role (`roles/aiplatform.notebookRuntimeAdmin`): `aiplatform.operations.list`
Vertex AI	The following permissions have been added to the Notebook Runtime User role (`roles/aiplatform.notebookRuntimeUser`): `aiplatform.operations.list`
BigQuery	The following permissions have been added to the Bigquery Studio Admin role (`roles/bigquery.studioAdmin`): `aiplatform.operations.list`
BigQuery	The following permissions have been added to the Bigquery Studio User role (`roles/bigquery.studioUser`): `aiplatform.operations.list`
BigQuery	The following permissions have been removed from the Bigquery Studio User role (`roles/bigquery.studioUser`): `bigquery.bireservations.get` `bigquery.capacityCommitments.get` `bigquery.capacityCommitments.list` `bigquery.datasets.create` `bigquery.datasets.get` `bigquery.datasets.getIamPolicy` `bigquery.jobs.list` `bigquery.models.list` `bigquery.readsessions.create` `bigquery.readsessions.getData` `bigquery.readsessions.update` `bigquery.reservationAssignments.list` `bigquery.reservationAssignments.search` `bigquery.reservations.get` `bigquery.reservations.list` `bigquery.routines.list` `bigquery.savedqueries.get` `bigquery.savedqueries.list` `bigquery.tables.list` `bigquery.transfers.get` `bigquerymigration.translation.translate` `bigqueryreservation.googleapis.com/reservations.get` `bigqueryreservation.googleapis.com/reservations.list`
Dataproc	The following permissions have been added to the Dataproc Service Agent role (`roles/dataproc.serviceAgent`): `serviceusage.services.use`
Dialogflow	The Dialogflow Agent Assist Client role (`roles/dialogflow.agentAssistClient`) has reached General Availability (GA).
Sensitive Data Protection	The DLP Data Profiles Admin role (`roles/dlp.dataProfilesAdmin`) has reached General Availability (GA).
Sensitive Data Protection	The DLP Table Data Profiles Admin role (`roles/dlp.tableDataProfilesAdmin`) has reached General Availability (GA).
Storage Insights	The following permissions have been added to the StorageInsights Service Agent role (`roles/storageinsights.serviceAgent`): `bigquery.datasets.create` `serviceusage.services.use`
Commerce Business Enablement	The following permissions have been added: `commercebusinessenablement.resellerPrivateOfferPlans.cancel` `commercebusinessenablement.resellerPrivateOfferPlans.create` `commercebusinessenablement.resellerPrivateOfferPlans.delete` `commercebusinessenablement.resellerPrivateOfferPlans.get` `commercebusinessenablement.resellerPrivateOfferPlans.list` `commercebusinessenablement.resellerPrivateOfferPlans.publish` `commercebusinessenablement.resellerPrivateOfferPlans.update`
Commerce Business Enablement	The following permissions are supported in custom roles: `commercebusinessenablement.resellerPrivateOfferPlans.cancel` `commercebusinessenablement.resellerPrivateOfferPlans.create` `commercebusinessenablement.resellerPrivateOfferPlans.delete` `commercebusinessenablement.resellerPrivateOfferPlans.get` `commercebusinessenablement.resellerPrivateOfferPlans.list` `commercebusinessenablement.resellerPrivateOfferPlans.publish` `commercebusinessenablement.resellerPrivateOfferPlans.update`
Compute Engine	The following permissions have reached General Availability (GA): `compute.snapshotSettings.get` `compute.snapshotSettings.update`
Sensitive Data Protection	The following permissions have been added: `dlp.tableDataProfiles.delete`
Sensitive Data Protection	The following permissions have reached General Availability (GA): `dlp.tableDataProfiles.delete`
Looker Studio	The following permissions have been added: `lookerstudio.pro.manage`
Cloud Storage	The following permissions have been added: `storage.managedFolders.create` `storage.managedFolders.delete` `storage.managedFolders.get` `storage.managedFolders.getIamPolicy` `storage.managedFolders.list` `storage.managedFolders.setIamPolicy`
Cloud Storage	The following permissions are supported in custom roles: `storage.managedFolders.create` `storage.managedFolders.delete` `storage.managedFolders.get` `storage.managedFolders.getIamPolicy` `storage.managedFolders.list` `storage.managedFolders.setIamPolicy`
Telco Automation API	The following permissions have been added: `telcoautomation.blueprints.approve` `telcoautomation.blueprints.create` `telcoautomation.blueprints.delete` `telcoautomation.blueprints.get` `telcoautomation.blueprints.list` `telcoautomation.blueprints.propose` `telcoautomation.blueprints.update` `telcoautomation.deployments.apply` `telcoautomation.deployments.computeStatus` `telcoautomation.deployments.create` `telcoautomation.deployments.delete` `telcoautomation.deployments.get` `telcoautomation.deployments.list` `telcoautomation.deployments.rollback` `telcoautomation.deployments.update` `telcoautomation.edgeSlms.create` `telcoautomation.edgeSlms.delete` `telcoautomation.edgeSlms.get` `telcoautomation.edgeSlms.list` `telcoautomation.hydratedDeployments.apply` `telcoautomation.hydratedDeployments.get` `telcoautomation.hydratedDeployments.list` `telcoautomation.hydratedDeployments.update` `telcoautomation.locations.get` `telcoautomation.locations.list` `telcoautomation.operations.cancel` `telcoautomation.operations.delete` `telcoautomation.operations.get` `telcoautomation.operations.list` `telcoautomation.orchestrationClusters.create` `telcoautomation.orchestrationClusters.delete` `telcoautomation.orchestrationClusters.get` `telcoautomation.orchestrationClusters.list` `telcoautomation.publicBlueprints.get` `telcoautomation.publicBlueprints.list`
Telco Automation API	The following permissions are supported in custom roles: `telcoautomation.blueprints.approve` `telcoautomation.blueprints.create` `telcoautomation.blueprints.delete` `telcoautomation.blueprints.get` `telcoautomation.blueprints.list` `telcoautomation.blueprints.propose` `telcoautomation.blueprints.update` `telcoautomation.deployments.apply` `telcoautomation.deployments.computeStatus` `telcoautomation.deployments.create` `telcoautomation.deployments.delete` `telcoautomation.deployments.get` `telcoautomation.deployments.list` `telcoautomation.deployments.rollback` `telcoautomation.deployments.update` `telcoautomation.edgeSlms.delete` `telcoautomation.edgeSlms.get` `telcoautomation.edgeSlms.list` `telcoautomation.hydratedDeployments.apply` `telcoautomation.hydratedDeployments.get` `telcoautomation.hydratedDeployments.list` `telcoautomation.hydratedDeployments.update` `telcoautomation.locations.get` `telcoautomation.locations.list` `telcoautomation.operations.cancel` `telcoautomation.operations.delete` `telcoautomation.operations.get` `telcoautomation.operations.list` `telcoautomation.orchestrationClusters.create` `telcoautomation.orchestrationClusters.delete` `telcoautomation.orchestrationClusters.get` `telcoautomation.orchestrationClusters.list` `telcoautomation.publicBlueprints.get` `telcoautomation.publicBlueprints.list`

IAM changes as of 2023-10-13

Service	Description
Vertex AI	The following permissions have been added to the Colab Enterprise Admin role (`roles/aiplatform.colabEnterpriseAdmin`): `aiplatform.pipelineJobs.create` `aiplatform.schedules.create` `aiplatform.schedules.delete` `aiplatform.schedules.get` `aiplatform.schedules.list` `aiplatform.schedules.update`
Vertex AI	The following permissions have been added to the Colab Enterprise User role (`roles/aiplatform.colabEnterpriseUser`): `aiplatform.pipelineJobs.create` `aiplatform.schedules.create` `aiplatform.schedules.delete` `aiplatform.schedules.get` `aiplatform.schedules.list` `aiplatform.schedules.update`
App Engine	The following permissions have been added to the App Engine Standard Environment Service Agent role (`roles/appengine.serviceAgent`): `artifactregistry.aptartifacts.create` `artifactregistry.dockerimages.get` `artifactregistry.dockerimages.list` `artifactregistry.files.get` `artifactregistry.files.list` `artifactregistry.kfpartifacts.create` `artifactregistry.locations.get` `artifactregistry.locations.list` `artifactregistry.mavenartifacts.get` `artifactregistry.mavenartifacts.list` `artifactregistry.npmpackages.get` `artifactregistry.npmpackages.list` `artifactregistry.packages.get` `artifactregistry.packages.list` `artifactregistry.projectsettings.get` `artifactregistry.pythonpackages.get` `artifactregistry.pythonpackages.list` `artifactregistry.repositories.downloadArtifacts` `artifactregistry.repositories.get` `artifactregistry.repositories.list` `artifactregistry.repositories.listEffectiveTags` `artifactregistry.repositories.listTagBindings` `artifactregistry.repositories.readViaVirtualRepository` `artifactregistry.repositories.uploadArtifacts` `artifactregistry.tags.create` `artifactregistry.tags.get` `artifactregistry.tags.list` `artifactregistry.tags.update` `artifactregistry.versions.get` `artifactregistry.versions.list` `artifactregistry.yumartifacts.create`
Cloud Deploy	The following permissions have been added to the Cloud Deploy Approver role (`roles/clouddeploy.approver`): `clouddeploy.config.get`
Cloud Deploy	The following permissions have been added to the Cloud Deploy Developer role (`roles/clouddeploy.developer`): `clouddeploy.config.get`
Cloud Deploy	The following permissions have been added to the Cloud Deploy Runner role (`roles/clouddeploy.jobRunner`): `clouddeploy.config.get`
Cloud Deploy	The following permissions have been added to the Cloud Deploy Operator role (`roles/clouddeploy.operator`): `clouddeploy.config.get`
Cloud Deploy	The following permissions have been added to the Cloud Deploy Releaser role (`roles/clouddeploy.releaser`): `clouddeploy.config.get`
Compute Engine	The following permissions have been added to the Compute Engine Service Agent role (`roles/compute.serviceAgent`): `iam.serviceAccounts.implicitDelegation`
Vision AI	The following permissions have been added to the VisionAI Editor role (`roles/visionai.editor`): `visionai.indexEndpoints.create` `visionai.indexEndpoints.delete` `visionai.indexEndpoints.deploy` `visionai.indexEndpoints.undeploy` `visionai.indexEndpoints.update`
Workload Manager	The following permissions have been added to the Workload Manager Admin role (`roles/workloadmanager.admin`): `monitoring.timeSeries.list` `serviceusage.quotas.get` `serviceusage.services.get`
Cloud Config Manager API	The following permissions have been added: `config.deployments.deleteState` `config.deployments.getLock` `config.deployments.getState` `config.deployments.lock` `config.deployments.unlock` `config.deployments.updateState` `config.revisions.getState`
Cloud Config Manager API	The following permissions are supported in custom roles: `config.deployments.deleteState` `config.deployments.getLock` `config.deployments.getState` `config.deployments.lock` `config.deployments.unlock` `config.deployments.updateState` `config.revisions.getState`
Distributed Cloud Edge Container	The following permissions have been added: `edgecontainer.clusters.upgrade`
Distributed Cloud Edge Container	The following permissions are supported in custom roles: `edgecontainer.clusters.upgrade`
Distributed Cloud Edge Container	The following permissions have reached General Availability (GA): `edgecontainer.clusters.upgrade`
Vision AI	The following permissions have been added: `visionai.assets.analyze` `visionai.assets.index` `visionai.assets.removeIndex` `visionai.assets.upload` `visionai.corpora.analyze` `visionai.corpora.import` `visionai.indexEndpoints.create` `visionai.indexEndpoints.delete` `visionai.indexEndpoints.deploy` `visionai.indexEndpoints.get` `visionai.indexEndpoints.list` `visionai.indexEndpoints.search` `visionai.indexEndpoints.undeploy` `visionai.indexEndpoints.update` `visionai.indexes.create` `visionai.indexes.delete` `visionai.indexes.get` `visionai.indexes.list` `visionai.indexes.update` `visionai.indexes.viewAssets`
Vision AI	The following permissions are supported in custom roles: `visionai.assets.analyze` `visionai.assets.index` `visionai.assets.removeIndex` `visionai.assets.upload` `visionai.corpora.analyze` `visionai.corpora.import` `visionai.indexEndpoints.create` `visionai.indexEndpoints.delete` `visionai.indexEndpoints.deploy` `visionai.indexEndpoints.get` `visionai.indexEndpoints.list` `visionai.indexEndpoints.search` `visionai.indexEndpoints.undeploy` `visionai.indexEndpoints.update` `visionai.indexes.create` `visionai.indexes.delete` `visionai.indexes.get` `visionai.indexes.list` `visionai.indexes.update` `visionai.indexes.viewAssets`
Google Cloud VMware Engine	The following permissions have been added: `vmwareengine.dnsBindPermission.get` `vmwareengine.dnsBindPermission.grant` `vmwareengine.dnsBindPermission.revoke` `vmwareengine.dnsForwarding.get` `vmwareengine.dnsForwarding.update` `vmwareengine.externalAccessRules.create` `vmwareengine.externalAccessRules.delete` `vmwareengine.externalAccessRules.get` `vmwareengine.externalAccessRules.list` `vmwareengine.externalAccessRules.update` `vmwareengine.externalAddresses.create` `vmwareengine.externalAddresses.delete` `vmwareengine.externalAddresses.get` `vmwareengine.externalAddresses.list` `vmwareengine.externalAddresses.update` `vmwareengine.loggingServers.create` `vmwareengine.loggingServers.delete` `vmwareengine.loggingServers.get` `vmwareengine.loggingServers.list` `vmwareengine.loggingServers.update` `vmwareengine.managementDnsZoneBindings.create` `vmwareengine.managementDnsZoneBindings.delete` `vmwareengine.managementDnsZoneBindings.get` `vmwareengine.managementDnsZoneBindings.list` `vmwareengine.managementDnsZoneBindings.repair` `vmwareengine.managementDnsZoneBindings.update` `vmwareengine.networkPeerings.create` `vmwareengine.networkPeerings.delete` `vmwareengine.networkPeerings.get` `vmwareengine.networkPeerings.list` `vmwareengine.networkPeerings.listPeeringRoutes` `vmwareengine.networkPeerings.update` `vmwareengine.networkPolicies.fetchExternalAddresses` `vmwareengine.nodes.get` `vmwareengine.nodes.list`
Google Cloud VMware Engine	The following permissions are supported in custom roles: `vmwareengine.dnsBindPermission.get` `vmwareengine.dnsBindPermission.grant` `vmwareengine.dnsBindPermission.revoke` `vmwareengine.dnsForwarding.get` `vmwareengine.dnsForwarding.update` `vmwareengine.externalAccessRules.create` `vmwareengine.externalAccessRules.delete` `vmwareengine.externalAccessRules.get` `vmwareengine.externalAccessRules.list` `vmwareengine.externalAccessRules.update` `vmwareengine.externalAddresses.create` `vmwareengine.externalAddresses.delete` `vmwareengine.externalAddresses.get` `vmwareengine.externalAddresses.list` `vmwareengine.externalAddresses.update` `vmwareengine.loggingServers.create` `vmwareengine.loggingServers.delete` `vmwareengine.loggingServers.get` `vmwareengine.loggingServers.list` `vmwareengine.loggingServers.update` `vmwareengine.managementDnsZoneBindings.create` `vmwareengine.managementDnsZoneBindings.delete` `vmwareengine.managementDnsZoneBindings.get` `vmwareengine.managementDnsZoneBindings.list` `vmwareengine.managementDnsZoneBindings.repair` `vmwareengine.managementDnsZoneBindings.update` `vmwareengine.networkPeerings.create` `vmwareengine.networkPeerings.delete` `vmwareengine.networkPeerings.get` `vmwareengine.networkPeerings.list` `vmwareengine.networkPeerings.listPeeringRoutes` `vmwareengine.networkPeerings.update` `vmwareengine.networkPolicies.fetchExternalAddresses` `vmwareengine.nodes.get` `vmwareengine.nodes.list`
Google Cloud VMware Engine	The following permissions have reached General Availability (GA): `vmwareengine.dnsBindPermission.get` `vmwareengine.dnsBindPermission.grant` `vmwareengine.dnsBindPermission.revoke` `vmwareengine.dnsForwarding.get` `vmwareengine.dnsForwarding.update` `vmwareengine.externalAccessRules.create` `vmwareengine.externalAccessRules.delete` `vmwareengine.externalAccessRules.get` `vmwareengine.externalAccessRules.list` `vmwareengine.externalAccessRules.update` `vmwareengine.externalAddresses.create` `vmwareengine.externalAddresses.delete` `vmwareengine.externalAddresses.get` `vmwareengine.externalAddresses.list` `vmwareengine.externalAddresses.update` `vmwareengine.loggingServers.create` `vmwareengine.loggingServers.delete` `vmwareengine.loggingServers.get` `vmwareengine.loggingServers.list` `vmwareengine.loggingServers.update` `vmwareengine.managementDnsZoneBindings.create` `vmwareengine.managementDnsZoneBindings.delete` `vmwareengine.managementDnsZoneBindings.get` `vmwareengine.managementDnsZoneBindings.list` `vmwareengine.managementDnsZoneBindings.repair` `vmwareengine.managementDnsZoneBindings.update` `vmwareengine.networkPeerings.create` `vmwareengine.networkPeerings.delete` `vmwareengine.networkPeerings.get` `vmwareengine.networkPeerings.list` `vmwareengine.networkPeerings.listPeeringRoutes` `vmwareengine.networkPeerings.update` `vmwareengine.networkPolicies.fetchExternalAddresses` `vmwareengine.nodes.get` `vmwareengine.nodes.list`

IAM changes as of 2023-10-06

Service	Description
Advisory Notifications	The following permissions have been added to the Advisory Notifications Admin role (`roles/advisorynotifications.admin`): `resourcemanager.projects.get`
Advisory Notifications	The following permissions have been added to the Advisory Notifications Viewer role (`roles/advisorynotifications.viewer`): `resourcemanager.projects.get`
Policy Controller	The Anthos Policy Controller Service Agent role (`roles/anthospolicycontroller.serviceAgent`) has reached General Availability (GA).
Cloud Service Mesh	The following permissions have been added to the Anthos Service Mesh Service Agent role (`roles/anthosservicemesh.serviceAgent`): `compute.networkEndpointGroups.list`
Spark connector for BigQuery	The BigQuery Spark Service Agent role (`roles/bigqueryspark.serviceAgent`) has reached General Availability (GA).
Database Migration Service	The following permissions have been added to the Database Migration Service Agent role (`roles/datamigration.serviceAgent`): `alloydb.clusters.generateClientCertificate`
Recommender	The Network Analyzer GKE Service Account Insights Recommender Admin role (`roles/recommender.networkAnalyzerGkeServiceAccountAdmin`) has reached General Availability (GA).
Recommender	The Network Analyzer GKE Service Account Insights Recommender Viewer role (`roles/recommender.networkAnalyzerGkeServiceAccountViewer`) has reached General Availability (GA).
VM Migration	The following permissions have been added to the VM Migration Service Agent role (`roles/vmmigration.serviceAgent`): `compute.globalOperations.get` `compute.globalOperations.list`
Vertex AI	The following permissions have been added: `aiplatform.datasetVersions.create` `aiplatform.datasetVersions.delete` `aiplatform.datasetVersions.get` `aiplatform.datasetVersions.list` `aiplatform.datasetVersions.restore`
Vertex AI	The following permissions have reached General Availability (GA): `aiplatform.datasetVersions.create` `aiplatform.datasetVersions.delete` `aiplatform.datasetVersions.get` `aiplatform.datasetVersions.list` `aiplatform.datasetVersions.restore`
Cloud Billing	The following permissions have been added: `billing.resourcebudgets.read` `billing.resourcebudgets.write`
Cloud Billing	The following permissions are supported in custom roles: `billing.resourcebudgets.read` `billing.resourcebudgets.write`
Cloud Billing	The following permissions have reached General Availability (GA): `billing.resourcebudgets.read` `billing.resourcebudgets.write`
Compute Engine	The following permissions have been added: `compute.instances.pscInterfaceCreate`
Compute Engine	The following permissions are supported in custom roles: `compute.instances.pscInterfaceCreate`
Compute Engine	The following permissions have reached General Availability (GA): `compute.instances.pscInterfaceCreate`
Distributed Cloud Edge Container	The following permissions have been added: `edgecontainer.serverconfig.get`
Distributed Cloud Edge Container	The following permissions are supported in custom roles: `edgecontainer.serverconfig.get`
Distributed Cloud Edge Container	The following permissions have reached General Availability (GA): `edgecontainer.serverconfig.get`
Recommender	The following permissions have been added: `recommender.networkAnalyzerGkeServiceAccountInsights.get` `recommender.networkAnalyzerGkeServiceAccountInsights.list` `recommender.networkAnalyzerGkeServiceAccountInsights.update`
Recommender	The following permissions are supported in custom roles: `recommender.networkAnalyzerGkeServiceAccountInsights.get` `recommender.networkAnalyzerGkeServiceAccountInsights.list` `recommender.networkAnalyzerGkeServiceAccountInsights.update`
Recommender	The following permissions have reached General Availability (GA): `recommender.networkAnalyzerGkeServiceAccountInsights.get` `recommender.networkAnalyzerGkeServiceAccountInsights.list` `recommender.networkAnalyzerGkeServiceAccountInsights.update`
Retail API	The following permissions have been added: `retail.experiments.create` `retail.experiments.delete` `retail.experiments.get` `retail.experiments.list` `retail.experiments.loadExperimentLookerDashboard` `retail.experiments.queryTrafficMetrics` `retail.experiments.update`

IAM changes as of 2023-09-29

Service	Description
Google Security Operations	The following permissions have been added to the Chronicle API Restricted Data Access Viewer role (`roles/chronicle.restrictedDataAccessViewer`): `chronicle.events.findUdmFieldValues`
Database Migration Service	The following permissions have been added to the Database Migration Service Agent role (`roles/datamigration.serviceAgent`): `alloydb.instances.connect`
Dataproc Metastore	The Dataproc Metastore Metadata Editor role (`roles/metastore.metadataEditor`) has reached General Availability (GA).
Dataproc Metastore	The Dataproc Metastore Metadata Mutate Admin role (`roles/metastore.metadataMutateAdmin`) has reached General Availability (GA).
Dataproc Metastore	The Dataproc Metastore Data Owner role (`roles/metastore.metadataOwner`) has reached General Availability (GA).
Dataproc Metastore	The Dataproc Metastore Metadata Query Admin role (`roles/metastore.metadataQueryAdmin`) has reached General Availability (GA).
Dataproc Metastore	The Dataproc Metastore Metadata User role (`roles/metastore.metadataUser`) has reached General Availability (GA).
Dataproc Metastore	The Dataproc Metastore Metadata Viewer role (`roles/metastore.metadataViewer`) has reached General Availability (GA).
Network Connectivity Center	The following permissions have been added to the Network Connectivity Service Agent role (`roles/networkconnectivity.serviceAgent`): `compute.subnetworks.getIamPolicy`
Privileged Access Manager	The Privileged Access Manager Folder Service Agent role (`roles/privilegedaccessmanager.folderServiceAgent`) has reached General Availability (GA).
Privileged Access Manager	The Privileged Access Manager Organization Service Agent role (`roles/privilegedaccessmanager.organizationServiceAgent`) has reached General Availability (GA).
Privileged Access Manager	The Privileged Access Manager Project Service Agent role (`roles/privilegedaccessmanager.projectServiceAgent`) has reached General Availability (GA).
Rapid Migration Assessment	The following permissions have been added to the RMA Service Agent role (`roles/rapidmigrationassessment.serviceAgent`): `migrationcenter.sources.list`
Google Security Operations	The following permissions have been added: `chronicle.events.findUdmFieldValues`
Google Security Operations	The following permissions are supported in custom roles: `chronicle.events.findUdmFieldValues`
Memorystore for Memcached	The following permissions have been added: `memcache.instances.upgrade`
Memorystore for Memcached	The following permissions have reached General Availability (GA): `memcache.instances.upgrade`
Dataproc Metastore	The following permissions have reached General Availability (GA): `metastore.services.mutateMetadata` `metastore.services.queryMetadata`

IAM changes as of 2023-09-22

Service	Description
Vertex AI	The Colab Enterprise Admin role (`roles/aiplatform.colabEnterpriseAdmin`) has reached General Availability (GA).
Vertex AI	The Colab Enterprise User role (`roles/aiplatform.colabEnterpriseUser`) has reached General Availability (GA).
Vertex AI	The Notebook Runtime Admin role (`roles/aiplatform.notebookRuntimeAdmin`) has reached General Availability (GA).
Vertex AI	The Notebook Runtime User role (`roles/aiplatform.notebookRuntimeUser`) has reached General Availability (GA).
Cloud Service Mesh	The following permissions have been added to the Anthos Service Mesh Service Agent role (`roles/anthosservicemesh.serviceAgent`): `compute.backendServices.create` `compute.backendServices.delete` `compute.backendServices.get` `compute.backendServices.list` `compute.backendServices.update` `compute.backendServices.use` `compute.globalOperations.get` `compute.healthChecks.create` `compute.healthChecks.delete` `compute.healthChecks.get` `compute.healthChecks.list` `compute.healthChecks.update` `compute.healthChecks.use` `compute.networkEndpointGroups.use` `networksecurity.authorizationPolicies.create` `networksecurity.authorizationPolicies.delete` `networksecurity.authorizationPolicies.get` `networksecurity.authorizationPolicies.list` `networksecurity.authorizationPolicies.update` `networksecurity.authorizationPolicies.use` `networksecurity.clientTlsPolicies.create` `networksecurity.clientTlsPolicies.delete` `networksecurity.clientTlsPolicies.get` `networksecurity.clientTlsPolicies.list` `networksecurity.clientTlsPolicies.update` `networksecurity.clientTlsPolicies.use` `networksecurity.operations.cancel` `networksecurity.operations.delete` `networksecurity.operations.get` `networksecurity.operations.list` `networksecurity.serverTlsPolicies.create` `networksecurity.serverTlsPolicies.delete` `networksecurity.serverTlsPolicies.get` `networksecurity.serverTlsPolicies.list` `networksecurity.serverTlsPolicies.update` `networksecurity.serverTlsPolicies.use` `networkservices.endpointPolicies.create` `networkservices.endpointPolicies.delete` `networkservices.endpointPolicies.get` `networkservices.endpointPolicies.list` `networkservices.endpointPolicies.update` `networkservices.endpointPolicies.use` `networkservices.gateways.create` `networkservices.gateways.delete` `networkservices.gateways.get` `networkservices.gateways.list` `networkservices.gateways.update` `networkservices.gateways.use` `networkservices.grpcRoutes.create` `networkservices.grpcRoutes.delete` `networkservices.grpcRoutes.get` `networkservices.grpcRoutes.list` `networkservices.grpcRoutes.update` `networkservices.grpcRoutes.use` `networkservices.httpFilters.create` `networkservices.httpFilters.delete` `networkservices.httpFilters.get` `networkservices.httpFilters.list` `networkservices.httpFilters.update` `networkservices.httpFilters.use` `networkservices.httpRoutes.create` `networkservices.httpRoutes.delete` `networkservices.httpRoutes.get` `networkservices.httpRoutes.list` `networkservices.httpRoutes.update` `networkservices.httpRoutes.use` `networkservices.meshes.create` `networkservices.meshes.delete` `networkservices.meshes.get` `networkservices.meshes.list` `networkservices.meshes.update` `networkservices.meshes.use` `networkservices.operations.cancel` `networkservices.operations.delete` `networkservices.operations.get` `networkservices.operations.list` `networkservices.serviceLbPolicies.create` `networkservices.serviceLbPolicies.delete` `networkservices.serviceLbPolicies.get` `networkservices.serviceLbPolicies.list` `networkservices.serviceLbPolicies.update` `networkservices.tcpRoutes.create` `networkservices.tcpRoutes.delete` `networkservices.tcpRoutes.get` `networkservices.tcpRoutes.list` `networkservices.tcpRoutes.update` `networkservices.tcpRoutes.use` `networkservices.tlsRoutes.create` `networkservices.tlsRoutes.delete` `networkservices.tlsRoutes.get` `networkservices.tlsRoutes.list` `networkservices.tlsRoutes.update` `networkservices.tlsRoutes.use`
Dataform	The Dataform Admin role (`roles/dataform.admin`) has reached General Availability (GA).
Dataform	The Dataform Editor role (`roles/dataform.editor`) has reached General Availability (GA).
Dataform	The Dataform Viewer role (`roles/dataform.viewer`) has reached General Availability (GA).
Cloud Data Fusion	The following permissions have been removed from the Cloud Data Fusion Developer role (`roles/datafusion.developer`): `datafusion.instances.runtime`
Cloud Data Fusion	The following permissions have been removed from the Cloud Data Fusion Operator role (`roles/datafusion.operator`): `datafusion.instances.runtime`
Cloud Data Fusion	The following permissions have been removed from the Cloud Data Fusion Viewer role (`roles/datafusion.viewer`): `datafusion.instances.runtime`
Dataplex	The Dataplex DataScan Creator role (`roles/dataplex.dataScanCreator`) has reached General Availability (GA).
Basic Role	The following permissions have been removed from the Viewer role (`roles/viewer`): `datafusion.instances.runtime`
VM Migration	The following permissions have been added to the VM Migration Service Agent role (`roles/vmmigration.serviceAgent`): `compute.images.useReadOnly`
Cloud Workstations	The following permissions have been added to the Cloud Workstations Admin role (`roles/workstations.admin`): `compute.acceleratorTypes.get` `compute.acceleratorTypes.list` `compute.zones.get` `compute.zones.list`
Advisory Notifications	The following permissions have been added: `advisorynotifications.settings.get` `advisorynotifications.settings.update`
Advisory Notifications	The following permissions are supported in custom roles: `advisorynotifications.settings.get` `advisorynotifications.settings.update`
Vertex AI	The following permissions have been added: `aiplatform.featureGroups.create` `aiplatform.featureGroups.delete` `aiplatform.featureGroups.get` `aiplatform.featureGroups.list` `aiplatform.featureGroups.update`
Vertex AI	The following permissions have reached General Availability (GA): `aiplatform.notebookRuntimeTemplates.apply` `aiplatform.notebookRuntimeTemplates.create` `aiplatform.notebookRuntimeTemplates.delete` `aiplatform.notebookRuntimeTemplates.get` `aiplatform.notebookRuntimeTemplates.getIamPolicy` `aiplatform.notebookRuntimeTemplates.list` `aiplatform.notebookRuntimeTemplates.setIamPolicy` `aiplatform.notebookRuntimes.assign` `aiplatform.notebookRuntimes.delete` `aiplatform.notebookRuntimes.get` `aiplatform.notebookRuntimes.list` `aiplatform.notebookRuntimes.start` `aiplatform.notebookRuntimes.update` `aiplatform.notebookRuntimes.upgrade`
Apigee	The following permissions have been added: `apigee.addonsconfig.get` `apigee.addonsconfig.update`
Apigee	The following permissions are supported in custom roles: `apigee.addonsconfig.get` `apigee.addonsconfig.update`
Apigee	The following permissions have reached General Availability (GA): `apigee.addonsconfig.get` `apigee.addonsconfig.update`
Google Security Operations	The following permissions have been added: `chronicle.dataAccessLabels.create` `chronicle.dataAccessLabels.delete` `chronicle.dataAccessLabels.get` `chronicle.dataAccessLabels.list` `chronicle.dataAccessLabels.update` `chronicle.dataAccessScopes.create` `chronicle.dataAccessScopes.delete` `chronicle.dataAccessScopes.get` `chronicle.dataAccessScopes.list` `chronicle.dataAccessScopes.permit` `chronicle.dataAccessScopes.update` `chronicle.entities.find` `chronicle.entities.findRelatedEntities` `chronicle.entities.get` `chronicle.entities.import` `chronicle.entities.searchEntities` `chronicle.entities.summarize` `chronicle.entities.summarizeFromQuery` `chronicle.events.batchGet` `chronicle.events.get` `chronicle.events.import` `chronicle.events.queryProductSourceStats` `chronicle.events.udmSearch` `chronicle.events.validateQuery` `chronicle.globalDataAccessScopes.permit` `chronicle.legacies.legacyBatchGetCases` `chronicle.legacies.legacyCalculateAlertStats` `chronicle.legacies.legacyFetchAlertsView` `chronicle.legacies.legacyFetchUdmSearchCsv` `chronicle.legacies.legacyFetchUdmSearchView` `chronicle.legacies.legacyFindAssetEvents` `chronicle.legacies.legacyFindRawLogs` `chronicle.legacies.legacyFindUdmEvents` `chronicle.legacies.legacyGetAlert` `chronicle.legacies.legacyGetFinding` `chronicle.legacies.legacyRunTestRule` `chronicle.legacies.legacySearchArtifactEvents` `chronicle.legacies.legacySearchAssetEvents` `chronicle.legacies.legacySearchFindings` `chronicle.legacies.legacySearchRawLogs` `chronicle.legacies.legacySearchRuleDetectionCountBuckets` `chronicle.legacies.legacySearchRuleDetectionEvents` `chronicle.legacies.legacySearchRuleResults` `chronicle.legacies.legacySearchRulesAlerts` `chronicle.legacies.legacySearchUserEvents`
Google Security Operations	The following permissions are supported in custom roles: `chronicle.dataAccessLabels.create` `chronicle.dataAccessLabels.delete` `chronicle.dataAccessLabels.get` `chronicle.dataAccessLabels.list` `chronicle.dataAccessLabels.update` `chronicle.dataAccessScopes.create` `chronicle.dataAccessScopes.delete` `chronicle.dataAccessScopes.get` `chronicle.dataAccessScopes.list` `chronicle.dataAccessScopes.permit` `chronicle.dataAccessScopes.update` `chronicle.entities.find` `chronicle.entities.findRelatedEntities` `chronicle.entities.get` `chronicle.entities.import` `chronicle.entities.searchEntities` `chronicle.entities.summarize` `chronicle.entities.summarizeFromQuery` `chronicle.events.batchGet` `chronicle.events.get` `chronicle.events.import` `chronicle.events.queryProductSourceStats` `chronicle.events.udmSearch` `chronicle.events.validateQuery` `chronicle.globalDataAccessScopes.permit` `chronicle.legacies.legacyFetchUdmSearchCsv` `chronicle.legacies.legacyFetchUdmSearchView` `chronicle.legacies.legacyFindAssetEvents` `chronicle.legacies.legacyFindRawLogs` `chronicle.legacies.legacyFindUdmEvents` `chronicle.legacies.legacyRunTestRule` `chronicle.legacies.legacySearchArtifactEvents` `chronicle.legacies.legacySearchAssetEvents` `chronicle.legacies.legacySearchRawLogs` `chronicle.legacies.legacySearchRuleDetectionCountBuckets` `chronicle.legacies.legacySearchRuleDetectionEvents` `chronicle.legacies.legacySearchRuleResults` `chronicle.legacies.legacySearchRulesAlerts` `chronicle.legacies.legacySearchUserEvents`
Compute Engine	The following permissions have been added: `compute.instanceSettings.get` `compute.instanceSettings.update` `compute.interconnects.getMacsecConfig` `compute.projects.setManagedProtectionTier`
Compute Engine	The following permissions are supported in custom roles: `compute.instanceSettings.get` `compute.instanceSettings.update` `compute.interconnects.getMacsecConfig`
Compute Engine	The following permissions have reached General Availability (GA): `compute.interconnects.getMacsecConfig` `compute.projects.setManagedProtectionTier`
Dataform	The following permissions are supported in custom roles: `dataform.compilationResults.create` `dataform.compilationResults.get` `dataform.compilationResults.list` `dataform.compilationResults.query` `dataform.locations.get` `dataform.locations.list` `dataform.repositories.create` `dataform.repositories.delete` `dataform.repositories.fetchRemoteBranches` `dataform.repositories.get` `dataform.repositories.list` `dataform.repositories.update` `dataform.workflowInvocations.cancel` `dataform.workflowInvocations.create` `dataform.workflowInvocations.delete` `dataform.workflowInvocations.get` `dataform.workflowInvocations.list` `dataform.workflowInvocations.query` `dataform.workspaces.commit` `dataform.workspaces.create` `dataform.workspaces.delete` `dataform.workspaces.fetchFileDiff` `dataform.workspaces.fetchFileGitStatuses` `dataform.workspaces.fetchGitAheadBehind` `dataform.workspaces.get` `dataform.workspaces.installNpmPackages` `dataform.workspaces.list` `dataform.workspaces.makeDirectory` `dataform.workspaces.moveDirectory` `dataform.workspaces.moveFile` `dataform.workspaces.pull` `dataform.workspaces.push` `dataform.workspaces.queryDirectoryContents` `dataform.workspaces.readFile` `dataform.workspaces.removeDirectory` `dataform.workspaces.removeFile` `dataform.workspaces.reset` `dataform.workspaces.writeFile`
Dataform	The following permissions have reached General Availability (GA): `dataform.compilationResults.create` `dataform.compilationResults.get` `dataform.compilationResults.list` `dataform.compilationResults.query` `dataform.locations.get` `dataform.locations.list` `dataform.releaseConfigs.create` `dataform.releaseConfigs.delete` `dataform.releaseConfigs.get` `dataform.releaseConfigs.list` `dataform.releaseConfigs.update` `dataform.repositories.commit` `dataform.repositories.computeAccessTokenStatus` `dataform.repositories.create` `dataform.repositories.delete` `dataform.repositories.fetchHistory` `dataform.repositories.fetchRemoteBranches` `dataform.repositories.get` `dataform.repositories.getIamPolicy` `dataform.repositories.list` `dataform.repositories.queryDirectoryContents` `dataform.repositories.readFile` `dataform.repositories.setIamPolicy` `dataform.repositories.update` `dataform.workflowConfigs.create` `dataform.workflowConfigs.delete` `dataform.workflowConfigs.get` `dataform.workflowConfigs.list` `dataform.workflowConfigs.update` `dataform.workflowInvocations.cancel` `dataform.workflowInvocations.create` `dataform.workflowInvocations.delete` `dataform.workflowInvocations.get` `dataform.workflowInvocations.list` `dataform.workflowInvocations.query` `dataform.workspaces.commit` `dataform.workspaces.create` `dataform.workspaces.delete` `dataform.workspaces.fetchFileDiff` `dataform.workspaces.fetchFileGitStatuses` `dataform.workspaces.fetchGitAheadBehind` `dataform.workspaces.get` `dataform.workspaces.getIamPolicy` `dataform.workspaces.installNpmPackages` `dataform.workspaces.list` `dataform.workspaces.makeDirectory` `dataform.workspaces.moveDirectory` `dataform.workspaces.moveFile` `dataform.workspaces.pull` `dataform.workspaces.push` `dataform.workspaces.queryDirectoryContents` `dataform.workspaces.readFile` `dataform.workspaces.removeDirectory` `dataform.workspaces.removeFile` `dataform.workspaces.reset` `dataform.workspaces.setIamPolicy` `dataform.workspaces.writeFile`
Dialogflow	The following permissions have been added: `dialogflow.generators.create` `dialogflow.generators.delete` `dialogflow.generators.get` `dialogflow.generators.list` `dialogflow.generators.update`
Dialogflow	The following permissions have reached General Availability (GA): `dialogflow.generators.create` `dialogflow.generators.delete` `dialogflow.generators.get` `dialogflow.generators.list` `dialogflow.generators.update`
Network Services	The following permissions have been added: `networkservices.lbRouteExtensions.create` `networkservices.lbRouteExtensions.delete` `networkservices.lbRouteExtensions.get` `networkservices.lbRouteExtensions.list` `networkservices.lbRouteExtensions.update` `networkservices.lbTrafficExtensions.create` `networkservices.lbTrafficExtensions.delete` `networkservices.lbTrafficExtensions.get` `networkservices.lbTrafficExtensions.list` `networkservices.lbTrafficExtensions.update`
Network Services	The following permissions are supported in custom roles: `networkservices.lbRouteExtensions.create` `networkservices.lbRouteExtensions.delete` `networkservices.lbRouteExtensions.get` `networkservices.lbRouteExtensions.list` `networkservices.lbRouteExtensions.update` `networkservices.lbTrafficExtensions.create` `networkservices.lbTrafficExtensions.delete` `networkservices.lbTrafficExtensions.get` `networkservices.lbTrafficExtensions.list` `networkservices.lbTrafficExtensions.update`
Cloud OS Config	The following permissions have been added: `osconfig.osPolicyAssignmentReports.searchSummaries` `osconfig.osPolicyAssignments.searchPolicies` `osconfig.upgradeReports.get` `osconfig.upgradeReports.getSummary` `osconfig.upgradeReports.list` `osconfig.upgradeReports.searchSummaries`
Cloud OS Config	The following permissions are supported in custom roles: `osconfig.osPolicyAssignmentReports.searchSummaries` `osconfig.osPolicyAssignments.searchPolicies` `osconfig.upgradeReports.get` `osconfig.upgradeReports.getSummary` `osconfig.upgradeReports.list` `osconfig.upgradeReports.searchSummaries`
Policy Remediator Manager	The following permissions have been added: `policyremediatormanager.locations.get` `policyremediatormanager.locations.list` `policyremediatormanager.operations.cancel` `policyremediatormanager.operations.delete` `policyremediatormanager.operations.get` `policyremediatormanager.operations.list` `policyremediatormanager.remediatorServices.disable` `policyremediatormanager.remediatorServices.enable` `policyremediatormanager.remediatorServices.get`
Policy Remediator Manager	The following permissions are supported in custom roles: `policyremediatormanager.locations.get` `policyremediatormanager.locations.list` `policyremediatormanager.operations.cancel` `policyremediatormanager.operations.delete` `policyremediatormanager.operations.get` `policyremediatormanager.operations.list` `policyremediatormanager.remediatorServices.disable` `policyremediatormanager.remediatorServices.enable` `policyremediatormanager.remediatorServices.get`
Workflows	The following permissions have been added: `workflows.callbacks.list` `workflows.workflows.listRevision`
Workflows	The following permissions have reached General Availability (GA): `workflows.callbacks.list` `workflows.workflows.listRevision`

IAM changes as of 2023-09-17

Service	Description
Vertex AI	The following permissions have been added to the Vertex AI Administrator role (`roles/aiplatform.admin`): `aiplatform.notebookRuntimes.start` `aiplatform.notebookRuntimes.update`
Vertex AI	The following permissions have been added to the Vertex AI Custom Code Service Agent role (`roles/aiplatform.customCodeServiceAgent`): `aiplatform.notebookRuntimes.start` `aiplatform.notebookRuntimes.update`
Vertex AI	The following permissions have been added to the Vertex AI Service Agent role (`roles/aiplatform.serviceAgent`): `aiplatform.notebookRuntimes.start` `aiplatform.notebookRuntimes.update`
Vertex AI	The following permissions have been added to the Vertex AI User role (`roles/aiplatform.user`): `aiplatform.notebookRuntimes.start` `aiplatform.notebookRuntimes.update`
Cloud Service Mesh	The following permissions have been added to the Anthos Service Mesh Service Agent role (`roles/anthosservicemesh.serviceAgent`): `trafficdirector.networks.getConfigs` `trafficdirector.networks.reportMetrics`
Assured Workloads	The Assured Workloads Monitoring Service Agent role (`roles/assuredworkloads.monitoringServiceAgent`) has reached General Availability (GA).
Assured Workloads	The following permissions have been added to the Assured Workloads Reader role (`roles/assuredworkloads.reader`): `orgpolicy.policy.get`
Bare Metal Solution	The following permissions have been added to the Bare Metal Solution Editor role (`roles/baremetalsolution.editor`): `baremetalsolution.osimages.list`
Bare Metal Solution	The following permissions have been added to the Bare Metal Solution Instances Admin role (`roles/baremetalsolution.instancesadmin`): `baremetalsolution.osimages.list`
Google Security Operations	The Chronicle API Restricted Data Access role (`roles/chronicle.restrictedDataAccess`) has been added with the following permissions: `chronicle.dataAccessScopes.permit` `chronicle.googleapis.com/dataAccessScopes.permit`
Google Security Operations	The Chronicle API Restricted Data Access Viewer role (`roles/chronicle.restrictedDataAccessViewer`) has been added with the following permissions: `chronicle.entities.find` `chronicle.entities.findRelatedEntities` `chronicle.entities.get` `chronicle.entities.searchEntities` `chronicle.entities.summarize` `chronicle.entities.summarizeFromQuery` `chronicle.entityRiskScores.queryEntityRiskScores` `chronicle.events.batchGet` `chronicle.events.get` `chronicle.events.queryProductSourceStats` `chronicle.events.udmSearch` `chronicle.events.validateQuery` `chronicle.googleapis.com/entities.find` `chronicle.googleapis.com/entities.findRelatedEntities` `chronicle.googleapis.com/entities.get` `chronicle.googleapis.com/entities.searchEntities` `chronicle.googleapis.com/entities.summarize` `chronicle.googleapis.com/entities.summarizeFromQuery` `chronicle.googleapis.com/entityRiskScores.queryEntityRiskScores` `chronicle.googleapis.com/events.batchGet` `chronicle.googleapis.com/events.get` `chronicle.googleapis.com/events.queryProductSourceStats` `chronicle.googleapis.com/events.udmSearch` `chronicle.googleapis.com/events.validateQuery` `chronicle.googleapis.com/instances.get` `chronicle.googleapis.com/instances.report` `chronicle.googleapis.com/legacies.legacyBatchGetCases` `chronicle.googleapis.com/legacies.legacyCalculateAlertStats` `chronicle.googleapis.com/legacies.legacyFetchAlertsView` `chronicle.googleapis.com/legacies.legacyFetchUdmSearchCsv` `chronicle.googleapis.com/legacies.legacyFetchUdmSearchView` `chronicle.googleapis.com/legacies.legacyFindAssetEvents` `chronicle.googleapis.com/legacies.legacyFindRawLogs` `chronicle.googleapis.com/legacies.legacyFindUdmEvents` `chronicle.googleapis.com/legacies.legacyGetAlert` `chronicle.googleapis.com/legacies.legacyGetFinding` `chronicle.googleapis.com/legacies.legacyGetRuleCounts` `chronicle.googleapis.com/legacies.legacyGetRulesTrends` `chronicle.googleapis.com/legacies.legacyRunTestRule` `chronicle.googleapis.com/legacies.legacySearchArtifactEvents` `chronicle.googleapis.com/legacies.legacySearchAssetEvents` `chronicle.googleapis.com/legacies.legacySearchFindings` `chronicle.googleapis.com/legacies.legacySearchRawLogs` `chronicle.googleapis.com/legacies.legacySearchRuleDetectionCountBuckets` `chronicle.googleapis.com/legacies.legacySearchRuleDetectionEvents` `chronicle.googleapis.com/legacies.legacySearchRuleResults` `chronicle.googleapis.com/legacies.legacySearchRulesAlerts` `chronicle.googleapis.com/legacies.legacySearchUserEvents` `chronicle.googleapis.com/logs.get` `chronicle.googleapis.com/logs.list` `chronicle.googleapis.com/operations.get` `chronicle.googleapis.com/operations.list` `chronicle.googleapis.com/operations.wait` `chronicle.googleapis.com/retrohunts.get` `chronicle.googleapis.com/retrohunts.list` `chronicle.googleapis.com/ruleDeployments.get` `chronicle.googleapis.com/ruleDeployments.list` `chronicle.googleapis.com/ruleExecutionErrors.list` `chronicle.googleapis.com/rules.get` `chronicle.googleapis.com/rules.list` `chronicle.googleapis.com/rules.listRevisions` `chronicle.googleapis.com/rules.verifyRuleText` `chronicle.googleapis.com/signalGraphs.exploreNode` `chronicle.googleapis.com/signalGraphs.initializeGraph` `chronicle.instances.get` `chronicle.instances.report` `chronicle.legacies.legacyBatchGetCases` `chronicle.legacies.legacyCalculateAlertStats` `chronicle.legacies.legacyFetchAlertsView` `chronicle.legacies.legacyFetchUdmSearchCsv` `chronicle.legacies.legacyFetchUdmSearchView` `chronicle.legacies.legacyFindAssetEvents` `chronicle.legacies.legacyFindRawLogs` `chronicle.legacies.legacyFindUdmEvents` `chronicle.legacies.legacyGetAlert` `chronicle.legacies.legacyGetFinding` `chronicle.legacies.legacyGetRuleCounts` `chronicle.legacies.legacyGetRulesTrends` `chronicle.legacies.legacyRunTestRule` `chronicle.legacies.legacySearchArtifactEvents` `chronicle.legacies.legacySearchAssetEvents` `chronicle.legacies.legacySearchFindings` `chronicle.legacies.legacySearchRawLogs` `chronicle.legacies.legacySearchRuleDetectionCountBuckets` `chronicle.legacies.legacySearchRuleDetectionEvents` `chronicle.legacies.legacySearchRuleResults` `chronicle.legacies.legacySearchRulesAlerts` `chronicle.legacies.legacySearchUserEvents` `chronicle.logs.get` `chronicle.logs.list` `chronicle.operations.get` `chronicle.operations.list` `chronicle.operations.wait` `chronicle.retrohunts.get` `chronicle.retrohunts.list` `chronicle.ruleDeployments.get` `chronicle.ruleDeployments.list` `chronicle.ruleExecutionErrors.list` `chronicle.rules.get` `chronicle.rules.list` `chronicle.rules.listRevisions` `chronicle.rules.verifyRuleText` `chronicle.signalGraphs.exploreNode` `chronicle.signalGraphs.initializeGraph` `cloudresourcemanager.googleapis.com/projects.get` `cloudresourcemanager.googleapis.com/projects.list` `resourcemanager.projects.get` `resourcemanager.projects.list`
Cloud Controls Partner API	The Cloud Controls Partner Access Approval Service Agent role (`roles/cloudcontrolspartner.accessApprovalServiceAgent`) has reached General Availability (GA).
Cloud Controls Partner API	The following permissions have been added to the Cloud Controls Partner Admin role (`roles/cloudcontrolspartner.admin`): `cloudcontrolspartner.inspectabilityevents.get` `cloudcontrolspartner.platformcontrols.get`
Cloud Deploy	The following permissions have been added to the Cloud Deploy Service Agent role (`roles/clouddeploy.serviceAgent`): `storage.objects.get`
Commerce Price Management	The following permissions have been added to the Commerce Price Management Private Offers Admin role (`roles/commercepricemanagement.privateOffersAdmin`): `commerceprice.privateoffers.sendEmail`
Compute Engine	The Compute Future Reservation Admin role (`roles/compute.futureReservationAdmin`) has been added with the following permissions: `compute.futureReservations.cancel` `compute.futureReservations.create` `compute.futureReservations.delete` `compute.futureReservations.get` `compute.futureReservations.list` `compute.futureReservations.update` `compute.googleapis.com/futureReservations.cancel` `compute.googleapis.com/futureReservations.create` `compute.googleapis.com/futureReservations.delete` `compute.googleapis.com/futureReservations.get` `compute.googleapis.com/futureReservations.list` `compute.googleapis.com/futureReservations.update` `compute.googleapis.com/reservations.create` `compute.reservations.create`
Compute Engine	The Compute Future Reservation User role (`roles/compute.futureReservationUser`) has been added with the following permissions: `compute.futureReservations.create` `compute.futureReservations.delete` `compute.futureReservations.get` `compute.futureReservations.list` `compute.futureReservations.update` `compute.googleapis.com/futureReservations.create` `compute.googleapis.com/futureReservations.delete` `compute.googleapis.com/futureReservations.get` `compute.googleapis.com/futureReservations.list` `compute.googleapis.com/futureReservations.update` `compute.googleapis.com/reservations.create` `compute.reservations.create`
Compute Engine	The Compute Future Reservation Viewer role (`roles/compute.futureReservationViewer`) has been added with the following permissions: `compute.futureReservations.get` `compute.futureReservations.list` `compute.googleapis.com/futureReservations.get` `compute.googleapis.com/futureReservations.list`
Connectors	The following permissions have been added to the Connectors Endpoint Attachment Admin role (`roles/connectors.endpointAttachmentAdmin`): `connectors.locations.get` `connectors.locations.list`
Connectors	The following permissions have been added to the Connectors Endpoint Attachment Viewer role (`roles/connectors.endpointAttachmentViewer`): `connectors.locations.get` `connectors.locations.list`
Connectors	The following permissions have been added to the Connectors Managed Zone Admin role (`roles/connectors.managedZoneAdmin`): `connectors.locations.get` `connectors.locations.list`
Connectors	The following permissions have been added to the Connectors Managed Zone Viewer role (`roles/connectors.managedZoneViewer`): `connectors.locations.get` `connectors.locations.list`
Data Catalog	The following permissions have been added to the DataCatalog Data Steward role (`roles/datacatalog.dataSteward`): `datacatalog.relationships.list`
Data Catalog	The following permissions have been added to the DataCatalog Entry Viewer role (`roles/datacatalog.entryViewer`): `datacatalog.relationships.list`
Dataplex	The following permissions have been added to the Dataplex Metadata Reader role (`roles/dataplex.metadataReader`): `resourcemanager.projects.get` `resourcemanager.projects.list`
Dataplex	The following permissions have been added to the Dataplex Metadata Writer role (`roles/dataplex.metadataWriter`): `resourcemanager.projects.get` `resourcemanager.projects.list`
Datastore	The Cloud Datastore Backups Admin role (`roles/datastore.backupsAdmin`) has reached General Availability (GA).
Datastore	The Cloud Datastore Backup Schedules Admin role (`roles/datastore.backupSchedulesAdmin`) has reached General Availability (GA).
Datastore	The Cloud Datastore Backup Schedules Viewer role (`roles/datastore.backupSchedulesViewer`) has reached General Availability (GA).
Datastore	The Cloud Datastore Backups Viewer role (`roles/datastore.backupsViewer`) has reached General Availability (GA).
Datastore	The Cloud Datastore Restore Admin role (`roles/datastore.restoreAdmin`) has reached General Availability (GA).
Discovery Engine	The following permissions have been added to the Discovery Engine Service Agent role (`roles/discoveryengine.serviceAgent`): `discoveryengine.conversations.create`
Sensitive Data Protection	The DLP Connections Admin role (`roles/dlp.connectionsAdmin`) has reached General Availability (GA).
Sensitive Data Protection	The DLP Connections Viewer role (`roles/dlp.connectionsReader`) has reached General Availability (GA).
Basic Role	The following permissions have been added to the Editor role (`roles/editor`): `commerceprice.privateoffers.sendEmail`
Firebase	The following permissions have been added to the Firebase Service Management Service Agent role (`roles/firebase.managementServiceAgent`): `bigquery.datasets.update`
Multi-Cluster Ingress	The following permissions have been added to the Multi Cluster Ingress Service Agent role (`roles/multiclusteringress.serviceAgent`): `compute.networkEndpointGroups.list`
Network Connectivity Center	The following permissions have been added to the Network Connectivity Service Agent role (`roles/networkconnectivity.serviceAgent`): `compute.subnetworks.setIamPolicy`
Basic Role	The following permissions have been added to the Owner role (`roles/owner`): `commerceprice.privateoffers.sendEmail`
Visual Inspection AI	The following permissions have been added to the Visual Inspection AI Service Agent role (`roles/visualinspection.serviceAgent`): `aiplatform.notebookRuntimes.start` `aiplatform.notebookRuntimes.update`
VM Migration	The following permissions have been added to the VM Migration Service Agent role (`roles/vmmigration.serviceAgent`): `compute.images.create` `compute.images.get`
Cloud Workstations	The following permissions have been added to the Workstations Service Agent role (`roles/workstations.serviceAgent`): `compute.disks.useReadOnly`
Vertex AI	The following permissions have been added: `aiplatform.notebookRuntimeTemplates.apply` `aiplatform.notebookRuntimeTemplates.create` `aiplatform.notebookRuntimeTemplates.delete` `aiplatform.notebookRuntimeTemplates.get` `aiplatform.notebookRuntimeTemplates.getIamPolicy` `aiplatform.notebookRuntimeTemplates.list` `aiplatform.notebookRuntimeTemplates.setIamPolicy` `aiplatform.notebookRuntimeTemplates.update` `aiplatform.notebookRuntimes.assign` `aiplatform.notebookRuntimes.delete` `aiplatform.notebookRuntimes.get` `aiplatform.notebookRuntimes.list` `aiplatform.notebookRuntimes.start` `aiplatform.notebookRuntimes.update` `aiplatform.notebookRuntimes.upgrade`
Chrome Enterprise Premium	The following permissions have been added: `beyondcorp.partnerTenants.create` `beyondcorp.partnerTenants.delete` `beyondcorp.partnerTenants.get` `beyondcorp.partnerTenants.list` `beyondcorp.partnerTenants.update` `beyondcorp.proxyConfigs.create` `beyondcorp.proxyConfigs.delete` `beyondcorp.proxyConfigs.get` `beyondcorp.proxyConfigs.list` `beyondcorp.proxyConfigs.update`
Chrome Enterprise Premium	The following permissions are supported in custom roles: `beyondcorp.partnerTenants.create` `beyondcorp.partnerTenants.delete` `beyondcorp.partnerTenants.get` `beyondcorp.partnerTenants.list` `beyondcorp.partnerTenants.update` `beyondcorp.proxyConfigs.create` `beyondcorp.proxyConfigs.delete` `beyondcorp.proxyConfigs.get` `beyondcorp.proxyConfigs.list` `beyondcorp.proxyConfigs.update`
Certificate Manager	The following permissions have reached General Availability (GA): `certificatemanager.trustconfigs.create` `certificatemanager.trustconfigs.delete` `certificatemanager.trustconfigs.get` `certificatemanager.trustconfigs.list` `certificatemanager.trustconfigs.update` `certificatemanager.trustconfigs.use`
Gemini for Google Cloud API	The following permissions have been added: `cloudaicompanion.companions.generateChat` `cloudaicompanion.companions.generateCode`
Gemini for Google Cloud API	The following permissions are supported in custom roles: `cloudaicompanion.companions.generateChat` `cloudaicompanion.companions.generateCode`
Cloud Deploy	The following permissions have been added: `clouddeploy.rollouts.rollback`
Cloud Deploy	The following permissions are supported in custom roles: `clouddeploy.rollouts.rollback`
Cloud Deploy	The following permissions have reached General Availability (GA): `clouddeploy.jobRuns.get` `clouddeploy.jobRuns.list` `clouddeploy.jobRuns.terminate` `clouddeploy.rollouts.advance` `clouddeploy.rollouts.cancel` `clouddeploy.rollouts.ignoreJob` `clouddeploy.rollouts.retryJob`
Cloud Quotas	The following permissions have been added: `cloudquotas.quotas.get` `cloudquotas.quotas.update`
Cloud Quotas	The following permissions are supported in custom roles: `cloudquotas.quotas.get` `cloudquotas.quotas.update`
Commerce Business Enablement	The following permissions have been added: `commercebusinessenablement.operations.cancel` `commercebusinessenablement.operations.delete` `commercebusinessenablement.operations.get` `commercebusinessenablement.operations.list` `commercebusinessenablement.resellerDiscountConfig.get`
Commerce Business Enablement	The following permissions are supported in custom roles: `commercebusinessenablement.operations.cancel` `commercebusinessenablement.operations.delete` `commercebusinessenablement.operations.get` `commercebusinessenablement.operations.list` `commercebusinessenablement.resellerDiscountConfig.get`
Commerce Price Management	The following permissions have been added: `commerceprice.privateoffers.sendEmail`
Compute Engine	The following permissions have been added: `compute.nodeGroups.performMaintenance`
Compute Engine	The following permissions are supported in custom roles: `compute.nodeGroups.performMaintenance`
Compute Engine	The following permissions have reached General Availability (GA): `compute.instantSnapshots.create` `compute.instantSnapshots.delete` `compute.instantSnapshots.export` `compute.instantSnapshots.get` `compute.instantSnapshots.getIamPolicy` `compute.instantSnapshots.list` `compute.instantSnapshots.setIamPolicy` `compute.instantSnapshots.setLabels` `compute.instantSnapshots.useReadOnly`
Google Cloud Contact Center as a Service	The following permissions have reached General Availability (GA): `contactcenteraiplatform.contactCenters.program`
Conversational Insights	The following permissions have been added: `contactcenterinsights.faqEntries.delete` `contactcenterinsights.faqEntries.get` `contactcenterinsights.faqEntries.list` `contactcenterinsights.faqEntries.update` `contactcenterinsights.faqModels.create` `contactcenterinsights.faqModels.delete` `contactcenterinsights.faqModels.get` `contactcenterinsights.faqModels.list` `contactcenterinsights.faqModels.update` `contactcenterinsights.issueModels.import`
Conversational Insights	The following permissions are supported in custom roles: `contactcenterinsights.faqEntries.delete` `contactcenterinsights.faqEntries.get` `contactcenterinsights.faqEntries.list` `contactcenterinsights.faqEntries.update` `contactcenterinsights.faqModels.create` `contactcenterinsights.faqModels.delete` `contactcenterinsights.faqModels.get` `contactcenterinsights.faqModels.list` `contactcenterinsights.faqModels.update` `contactcenterinsights.issueModels.import`
Conversational Insights	The following permissions have reached General Availability (GA): `contactcenterinsights.faqEntries.delete` `contactcenterinsights.faqEntries.get` `contactcenterinsights.faqEntries.list` `contactcenterinsights.faqEntries.update` `contactcenterinsights.faqModels.create` `contactcenterinsights.faqModels.delete` `contactcenterinsights.faqModels.get` `contactcenterinsights.faqModels.list` `contactcenterinsights.faqModels.update`
Dataproc	The following permissions have been added: `dataproc.sessionTemplates.create` `dataproc.sessionTemplates.delete` `dataproc.sessionTemplates.get` `dataproc.sessionTemplates.list` `dataproc.sessionTemplates.update` `dataproc.sessions.create` `dataproc.sessions.delete` `dataproc.sessions.get` `dataproc.sessions.list` `dataproc.sessions.terminate`
Dataproc	The following permissions are supported in custom roles: `dataproc.sessionTemplates.create` `dataproc.sessionTemplates.delete` `dataproc.sessionTemplates.get` `dataproc.sessionTemplates.list` `dataproc.sessionTemplates.update` `dataproc.sessions.create` `dataproc.sessions.delete` `dataproc.sessions.get` `dataproc.sessions.list` `dataproc.sessions.terminate`
Dataproc	The following permissions have reached General Availability (GA): `dataproc.sessionTemplates.create` `dataproc.sessionTemplates.delete` `dataproc.sessionTemplates.get` `dataproc.sessionTemplates.list` `dataproc.sessionTemplates.update` `dataproc.sessions.create` `dataproc.sessions.delete` `dataproc.sessions.get` `dataproc.sessions.list` `dataproc.sessions.terminate`
Datastore	The following permissions have been added: `datastore.backupSchedules.create` `datastore.backupSchedules.delete` `datastore.backupSchedules.get` `datastore.backupSchedules.list` `datastore.backupSchedules.update` `datastore.backups.delete` `datastore.backups.get` `datastore.backups.list` `datastore.backups.restoreDatabase`
Datastore	The following permissions are supported in custom roles: `datastore.backupSchedules.create` `datastore.backupSchedules.delete` `datastore.backupSchedules.get` `datastore.backupSchedules.list` `datastore.backupSchedules.update` `datastore.backups.delete` `datastore.backups.get` `datastore.backups.list` `datastore.backups.restoreDatabase`
Datastore	The following permissions have reached General Availability (GA): `datastore.backupSchedules.create` `datastore.backupSchedules.delete` `datastore.backupSchedules.get` `datastore.backupSchedules.list` `datastore.backupSchedules.update` `datastore.backups.delete` `datastore.backups.get` `datastore.backups.list` `datastore.backups.restoreDatabase`
Sensitive Data Protection	The following permissions have been added: `dlp.connections.create` `dlp.connections.delete` `dlp.connections.get` `dlp.connections.list` `dlp.connections.search` `dlp.connections.update`
Sensitive Data Protection	The following permissions have reached General Availability (GA): `dlp.connections.create` `dlp.connections.delete` `dlp.connections.get` `dlp.connections.list` `dlp.connections.search` `dlp.connections.update`
GDC Hardware Management API	The following permissions have been added: `gdchardwaremanagement.changeLogEntries.get` `gdchardwaremanagement.changeLogEntries.list` `gdchardwaremanagement.comments.create` `gdchardwaremanagement.comments.get` `gdchardwaremanagement.comments.list` `gdchardwaremanagement.hardware.get` `gdchardwaremanagement.hardware.list` `gdchardwaremanagement.hardware.update` `gdchardwaremanagement.hardwareGroups.create` `gdchardwaremanagement.hardwareGroups.delete` `gdchardwaremanagement.hardwareGroups.get` `gdchardwaremanagement.hardwareGroups.list` `gdchardwaremanagement.hardwareGroups.update` `gdchardwaremanagement.locations.get` `gdchardwaremanagement.locations.list` `gdchardwaremanagement.operations.cancel` `gdchardwaremanagement.operations.delete` `gdchardwaremanagement.operations.get` `gdchardwaremanagement.operations.list` `gdchardwaremanagement.orders.create` `gdchardwaremanagement.orders.delete` `gdchardwaremanagement.orders.get` `gdchardwaremanagement.orders.list` `gdchardwaremanagement.orders.submit` `gdchardwaremanagement.orders.update` `gdchardwaremanagement.sites.create` `gdchardwaremanagement.sites.get` `gdchardwaremanagement.sites.list` `gdchardwaremanagement.sites.update` `gdchardwaremanagement.skus.get` `gdchardwaremanagement.skus.list`
GDC Hardware Management API	The following permissions are supported in custom roles: `gdchardwaremanagement.changeLogEntries.get` `gdchardwaremanagement.changeLogEntries.list` `gdchardwaremanagement.comments.create` `gdchardwaremanagement.comments.get` `gdchardwaremanagement.comments.list` `gdchardwaremanagement.hardware.get` `gdchardwaremanagement.hardware.list` `gdchardwaremanagement.hardware.update` `gdchardwaremanagement.hardwareGroups.create` `gdchardwaremanagement.hardwareGroups.delete` `gdchardwaremanagement.hardwareGroups.get` `gdchardwaremanagement.hardwareGroups.list` `gdchardwaremanagement.hardwareGroups.update` `gdchardwaremanagement.locations.get` `gdchardwaremanagement.locations.list` `gdchardwaremanagement.operations.cancel` `gdchardwaremanagement.operations.delete` `gdchardwaremanagement.operations.get` `gdchardwaremanagement.operations.list` `gdchardwaremanagement.orders.create` `gdchardwaremanagement.orders.delete` `gdchardwaremanagement.orders.get` `gdchardwaremanagement.orders.list` `gdchardwaremanagement.orders.submit` `gdchardwaremanagement.orders.update` `gdchardwaremanagement.sites.create` `gdchardwaremanagement.sites.get` `gdchardwaremanagement.sites.list` `gdchardwaremanagement.sites.update` `gdchardwaremanagement.skus.get` `gdchardwaremanagement.skus.list`
Cloud Healthcare API	The following permissions have been added: `healthcare.fhirStores.applyConsents` `healthcare.fhirStores.rollback`
Cloud Healthcare API	The following permissions are supported in custom roles: `healthcare.fhirStores.rollback`
Payment Gateway issuer switch	The following permissions have been added: `issuerswitch.accountManagerTransactions.update` `issuerswitch.managedAccounts.get` `issuerswitch.managedAccounts.update`
Payment Gateway issuer switch	The following permissions are supported in custom roles: `issuerswitch.accountManagerTransactions.update` `issuerswitch.managedAccounts.get` `issuerswitch.managedAccounts.update`
Network Services	The following permissions have been added: `networkservices.serviceLbPolicies.create` `networkservices.serviceLbPolicies.delete` `networkservices.serviceLbPolicies.get` `networkservices.serviceLbPolicies.list` `networkservices.serviceLbPolicies.update`
Network Services	The following permissions are supported in custom roles: `networkservices.serviceLbPolicies.create` `networkservices.serviceLbPolicies.delete` `networkservices.serviceLbPolicies.get` `networkservices.serviceLbPolicies.list` `networkservices.serviceLbPolicies.update`
Recommender	The following permissions have been added: `recommender.cloudDeprecationGeneralInsights.get` `recommender.cloudDeprecationGeneralInsights.list` `recommender.cloudDeprecationGeneralInsights.update` `recommender.cloudDeprecationGeneralRecommendations.get` `recommender.cloudDeprecationGeneralRecommendations.list` `recommender.cloudDeprecationGeneralRecommendations.update`
Recommender	The following permissions are supported in custom roles: `recommender.cloudDeprecationGeneralInsights.get` `recommender.cloudDeprecationGeneralInsights.list` `recommender.cloudDeprecationGeneralInsights.update` `recommender.cloudDeprecationGeneralRecommendations.get` `recommender.cloudDeprecationGeneralRecommendations.list` `recommender.cloudDeprecationGeneralRecommendations.update`
Cloud Run	The following permissions have been added: `run.jobs.createTagBinding` `run.jobs.deleteTagBinding` `run.jobs.listEffectiveTags` `run.jobs.listTagBindings`
Cloud Run	The following permissions are supported in custom roles: `run.jobs.createTagBinding` `run.jobs.deleteTagBinding` `run.jobs.listEffectiveTags` `run.jobs.listTagBindings`
Cloud Run	The following permissions have reached General Availability (GA): `run.jobs.createTagBinding` `run.jobs.deleteTagBinding` `run.jobs.listEffectiveTags` `run.jobs.listTagBindings`
Secure Source Manager	The following permissions have been added: `securesourcemanager.instances.access` `securesourcemanager.instances.create` `securesourcemanager.instances.createRepository` `securesourcemanager.instances.delete` `securesourcemanager.instances.get` `securesourcemanager.instances.getIamPolicy` `securesourcemanager.instances.list` `securesourcemanager.instances.setIamPolicy` `securesourcemanager.locations.get` `securesourcemanager.locations.list` `securesourcemanager.operations.cancel` `securesourcemanager.operations.delete` `securesourcemanager.operations.get` `securesourcemanager.operations.list` `securesourcemanager.repositories.create` `securesourcemanager.repositories.delete` `securesourcemanager.repositories.fetch` `securesourcemanager.repositories.get` `securesourcemanager.repositories.getIamPolicy` `securesourcemanager.repositories.list` `securesourcemanager.repositories.push` `securesourcemanager.repositories.readIssues` `securesourcemanager.repositories.readPullRequests` `securesourcemanager.repositories.setIamPolicy` `securesourcemanager.repositories.update` `securesourcemanager.repositories.writeIssues` `securesourcemanager.repositories.writePullRequests` `securesourcemanager.sshkeys.create` `securesourcemanager.sshkeys.createAny` `securesourcemanager.sshkeys.delete` `securesourcemanager.sshkeys.deleteAny` `securesourcemanager.sshkeys.get` `securesourcemanager.sshkeys.list` `securesourcemanager.sshkeys.listAny`
Secure Source Manager	The following permissions are supported in custom roles: `securesourcemanager.instances.access` `securesourcemanager.instances.create` `securesourcemanager.instances.createRepository` `securesourcemanager.instances.delete` `securesourcemanager.instances.get` `securesourcemanager.instances.getIamPolicy` `securesourcemanager.instances.list` `securesourcemanager.instances.setIamPolicy` `securesourcemanager.locations.get` `securesourcemanager.locations.list` `securesourcemanager.operations.cancel` `securesourcemanager.operations.delete` `securesourcemanager.operations.get` `securesourcemanager.operations.list` `securesourcemanager.repositories.create` `securesourcemanager.repositories.delete` `securesourcemanager.repositories.fetch` `securesourcemanager.repositories.get` `securesourcemanager.repositories.getIamPolicy` `securesourcemanager.repositories.list` `securesourcemanager.repositories.push` `securesourcemanager.repositories.readIssues` `securesourcemanager.repositories.readPullRequests` `securesourcemanager.repositories.setIamPolicy` `securesourcemanager.repositories.update` `securesourcemanager.repositories.writeIssues` `securesourcemanager.repositories.writePullRequests` `securesourcemanager.sshkeys.create` `securesourcemanager.sshkeys.createAny` `securesourcemanager.sshkeys.delete` `securesourcemanager.sshkeys.deleteAny` `securesourcemanager.sshkeys.get` `securesourcemanager.sshkeys.list` `securesourcemanager.sshkeys.listAny`
Workload Manager	The following permissions have been added: `workloadmanager.actuations.create` `workloadmanager.actuations.delete` `workloadmanager.actuations.get` `workloadmanager.actuations.list` `workloadmanager.deployments.create` `workloadmanager.deployments.delete` `workloadmanager.deployments.get` `workloadmanager.deployments.list`

IAM changes as of 2023-08-18

Service	Description
Cloud Deploy	The following permissions have been added to the Cloud Deploy Service Agent role (`roles/clouddeploy.serviceAgent`): `iam.serviceAccounts.getAccessToken`
Conversational Insights	The following permissions have been added to the Contact Center AI Insights Service Agent role (`roles/contactcenterinsights.serviceAgent`): `storage.objects.create` `storage.objects.update`
Dataplex	The following permissions have been added to the Dataplex DataScan Administrator role (`roles/dataplex.dataScanAdmin`): `dataplex.operations.get` `dataplex.operations.list`
Dataplex	The following permissions have been added to the Dataplex DataScan Editor role (`roles/dataplex.dataScanEditor`): `dataplex.operations.get` `dataplex.operations.list`
Eventarc	The following permissions have been added to the Eventarc Service Agent role (`roles/eventarc.serviceAgent`): `compute.regionOperations.get`
Cloud Storage	The Storage Object User role (`roles/storage.objectUser`) has reached General Availability (GA).
Vertex AI	The following permissions have been added: `aiplatform.endpoints.getIamPolicy` `aiplatform.endpoints.setIamPolicy`
Commerce Business Enablement	The following permissions have been added: `commercebusinessenablement.refunds.cancel` `commercebusinessenablement.refunds.create` `commercebusinessenablement.refunds.delete` `commercebusinessenablement.refunds.get` `commercebusinessenablement.refunds.list` `commercebusinessenablement.refunds.start` `commercebusinessenablement.refunds.update`
Commerce Business Enablement	The following permissions are supported in custom roles: `commercebusinessenablement.refunds.cancel` `commercebusinessenablement.refunds.create` `commercebusinessenablement.refunds.delete` `commercebusinessenablement.refunds.get` `commercebusinessenablement.refunds.list` `commercebusinessenablement.refunds.start` `commercebusinessenablement.refunds.update`
Google Cloud Contact Center as a Service	The following permissions have been added: `contactcenteraiplatform.contactCenters.program`
Google Cloud Contact Center as a Service	The following permissions are supported in custom roles: `contactcenteraiplatform.contactCenters.program`
GKE Hub	The following permissions have been added: `gkehub.membershipbindings.create` `gkehub.membershipbindings.delete` `gkehub.membershipbindings.get` `gkehub.membershipbindings.list` `gkehub.membershipbindings.update` `gkehub.namespaces.create` `gkehub.namespaces.delete` `gkehub.namespaces.get` `gkehub.namespaces.list` `gkehub.namespaces.update` `gkehub.rbacrolebindings.create` `gkehub.rbacrolebindings.delete` `gkehub.rbacrolebindings.get` `gkehub.rbacrolebindings.list` `gkehub.rbacrolebindings.update` `gkehub.scopes.create` `gkehub.scopes.delete` `gkehub.scopes.get` `gkehub.scopes.getIamPolicy` `gkehub.scopes.list` `gkehub.scopes.setIamPolicy` `gkehub.scopes.update`
GKE Hub	The following permissions are supported in custom roles: `gkehub.membershipbindings.create` `gkehub.membershipbindings.delete` `gkehub.membershipbindings.get` `gkehub.membershipbindings.list` `gkehub.membershipbindings.update` `gkehub.namespaces.create` `gkehub.namespaces.delete` `gkehub.namespaces.get` `gkehub.namespaces.list` `gkehub.namespaces.update` `gkehub.rbacrolebindings.create` `gkehub.rbacrolebindings.delete` `gkehub.rbacrolebindings.get` `gkehub.rbacrolebindings.list` `gkehub.rbacrolebindings.update` `gkehub.scopes.create` `gkehub.scopes.delete` `gkehub.scopes.get` `gkehub.scopes.getIamPolicy` `gkehub.scopes.list` `gkehub.scopes.setIamPolicy` `gkehub.scopes.update`
GKE Hub	The following permissions have reached General Availability (GA): `gkehub.membershipbindings.create` `gkehub.membershipbindings.delete` `gkehub.membershipbindings.get` `gkehub.membershipbindings.list` `gkehub.membershipbindings.update` `gkehub.namespaces.create` `gkehub.namespaces.delete` `gkehub.namespaces.get` `gkehub.namespaces.list` `gkehub.namespaces.update` `gkehub.rbacrolebindings.create` `gkehub.rbacrolebindings.delete` `gkehub.rbacrolebindings.get` `gkehub.rbacrolebindings.list` `gkehub.rbacrolebindings.update` `gkehub.scopes.create` `gkehub.scopes.delete` `gkehub.scopes.get` `gkehub.scopes.getIamPolicy` `gkehub.scopes.list` `gkehub.scopes.setIamPolicy` `gkehub.scopes.update`
Payment Gateway issuer switch	The following permissions have been added: `issuerswitch.accountManagerTransactions.list` `issuerswitch.issuerParticipants.get` `issuerswitch.issuerParticipants.update`
Payment Gateway issuer switch	The following permissions are supported in custom roles: `issuerswitch.accountManagerTransactions.list` `issuerswitch.issuerParticipants.get` `issuerswitch.issuerParticipants.update`
Recommender	The following permissions have been added: `recommender.iamPolicyChangeRiskInsights.get` `recommender.iamPolicyChangeRiskInsights.list` `recommender.iamPolicyChangeRiskInsights.update` `recommender.iamPolicyChangeRiskRecommendations.get` `recommender.iamPolicyChangeRiskRecommendations.list` `recommender.iamPolicyChangeRiskRecommendations.update` `recommender.iamServiceAccountChangeRiskInsights.get` `recommender.iamServiceAccountChangeRiskInsights.list` `recommender.iamServiceAccountChangeRiskInsights.update` `recommender.iamServiceAccountChangeRiskRecommendations.get` `recommender.iamServiceAccountChangeRiskRecommendations.list` `recommender.iamServiceAccountChangeRiskRecommendations.update` `recommender.resourcemanagerProjectChangeRiskInsights.get` `recommender.resourcemanagerProjectChangeRiskInsights.list` `recommender.resourcemanagerProjectChangeRiskInsights.update` `recommender.resourcemanagerProjectChangeRiskRecommendations.get` `recommender.resourcemanagerProjectChangeRiskRecommendations.list` `recommender.resourcemanagerProjectChangeRiskRecommendations.update`
Recommender	The following permissions are supported in custom roles: `recommender.iamPolicyChangeRiskInsights.get` `recommender.iamPolicyChangeRiskInsights.list` `recommender.iamPolicyChangeRiskInsights.update` `recommender.iamPolicyChangeRiskRecommendations.get` `recommender.iamPolicyChangeRiskRecommendations.list` `recommender.iamPolicyChangeRiskRecommendations.update` `recommender.iamServiceAccountChangeRiskInsights.get` `recommender.iamServiceAccountChangeRiskInsights.list` `recommender.iamServiceAccountChangeRiskInsights.update` `recommender.iamServiceAccountChangeRiskRecommendations.get` `recommender.iamServiceAccountChangeRiskRecommendations.list` `recommender.iamServiceAccountChangeRiskRecommendations.update` `recommender.resourcemanagerProjectChangeRiskInsights.get` `recommender.resourcemanagerProjectChangeRiskInsights.list` `recommender.resourcemanagerProjectChangeRiskInsights.update` `recommender.resourcemanagerProjectChangeRiskRecommendations.get` `recommender.resourcemanagerProjectChangeRiskRecommendations.list` `recommender.resourcemanagerProjectChangeRiskRecommendations.update`

IAM changes as of 2023-08-11

Service	Description
Vertex AI	The following permissions have been added to the Vertex AI Service Agent role (`roles/aiplatform.serviceAgent`): `run.routes.invoke` `run.services.create` `run.services.delete` `run.services.get`
Firebase Remote Config	The following permissions have been removed from the Cloud Config Service Agent role (`roles/cloudconfig.serviceAgent`): `krmapihosting.krmApiHosts.create` `krmapihosting.krmApiHosts.delete` `krmapihosting.krmApiHosts.get` `krmapihosting.krmApiHosts.list` `krmapihosting.krmApiHosts.update` `krmapihosting.locations.get` `krmapihosting.locations.list` `krmapihosting.operations.get` `krmapihosting.operations.list`
Database Migration Service	The following permissions have been added to the Database Migration Service Agent role (`roles/datamigration.serviceAgent`): `compute.networks.list` `compute.routers.list`
Google Cloud Migration Center	The following permissions have been added to the Migration Center Admin role (`roles/migrationcenter.admin`): `serviceusage.quotas.get`
Google Cloud Migration Center	The following permissions have been added to the Migration Center Viewer role (`roles/migrationcenter.viewer`): `serviceusage.quotas.get`
Serverless Integrations	The following permissions have been added to the Serverless Integrations Service Agent role (`roles/runapps.serviceAgent`): `run.jobs.get` `run.jobs.list`
Security Command Center	The Security Center Attack Paths Reader role (`roles/securitycenter.attackPathsViewer`) has reached General Availability (GA).
Security Command Center	The Security Center Resource Value Configurations Editor role (`roles/securitycenter.resourceValueConfigsEditor`) has reached General Availability (GA).
Security Command Center	The Security Center Resource Value Configurations Viewer role (`roles/securitycenter.resourceValueConfigsViewer`) has reached General Availability (GA).
Security Command Center	The Security Center Simulations Reader role (`roles/securitycenter.simulationsViewer`) has reached General Availability (GA).
Security Command Center	The Security Center Valued Resources Reader role (`roles/securitycenter.valuedResourcesViewer`) has reached General Availability (GA).
BigQuery Reservation API	The following permissions have been added: `bigqueryreservation.googleapis.com/reservations.create` `bigqueryreservation.googleapis.com/reservations.delete` `bigqueryreservation.googleapis.com/reservations.get` `bigqueryreservation.googleapis.com/reservations.list` `bigqueryreservation.googleapis.com/reservations.update`
Commerce Agreement Publishing	The following permissions have been added: `commerceagreementpublishing.agreements.create` `commerceagreementpublishing.agreements.delete` `commerceagreementpublishing.agreements.get` `commerceagreementpublishing.agreements.list` `commerceagreementpublishing.agreements.update` `commerceagreementpublishing.documents.create` `commerceagreementpublishing.documents.delete` `commerceagreementpublishing.documents.get` `commerceagreementpublishing.documents.list` `commerceagreementpublishing.documents.update`
Compute Engine	The following permissions have been added: `compute.futureReservations.cancel` `compute.futureReservations.create` `compute.futureReservations.delete` `compute.futureReservations.get` `compute.futureReservations.getIamPolicy` `compute.futureReservations.list` `compute.futureReservations.setIamPolicy` `compute.futureReservations.update` `compute.networkAttachments.getIamPolicy` `compute.networkAttachments.setIamPolicy`
Compute Engine	The following permissions are supported in custom roles: `compute.futureReservations.getIamPolicy` `compute.futureReservations.setIamPolicy` `compute.networkAttachments.getIamPolicy` `compute.networkAttachments.setIamPolicy` `compute.subnetworks.expandIpCidrRange` `compute.subnetworks.get` `compute.subnetworks.setPrivateIpGoogleAccess` `compute.subnetworks.update`
Compute Engine	The following permissions have reached General Availability (GA): `compute.networkAttachments.create` `compute.networkAttachments.delete` `compute.networkAttachments.get` `compute.networkAttachments.getIamPolicy` `compute.networkAttachments.list` `compute.networkAttachments.setIamPolicy` `compute.regionNetworkEndpointGroups.attachNetworkEndpoints` `compute.regionNetworkEndpointGroups.detachNetworkEndpoints`
Conversational Insights	The following permissions have been added: `contactcenterinsights.issueModels.export`
Conversational Insights	The following permissions are supported in custom roles: `contactcenterinsights.issueModels.export`
Conversational Insights	The following permissions have reached General Availability (GA): `contactcenterinsights.issueModels.export`
Datastore	The following permissions have been added: `datastore.databases.delete`
Datastore	The following permissions have reached General Availability (GA): `datastore.databases.delete`
Recommender	The following permissions have been added: `recommender.cloudCostGeneralInsights.get` `recommender.cloudCostGeneralInsights.list` `recommender.cloudCostGeneralInsights.update` `recommender.cloudCostGeneralRecommendations.get` `recommender.cloudCostGeneralRecommendations.list` `recommender.cloudCostGeneralRecommendations.update` `recommender.cloudManageabilityGeneralInsights.get` `recommender.cloudManageabilityGeneralInsights.list` `recommender.cloudManageabilityGeneralInsights.update` `recommender.cloudManageabilityGeneralRecommendations.get` `recommender.cloudManageabilityGeneralRecommendations.list` `recommender.cloudManageabilityGeneralRecommendations.update` `recommender.cloudPerformanceGeneralInsights.get` `recommender.cloudPerformanceGeneralInsights.list` `recommender.cloudPerformanceGeneralInsights.update` `recommender.cloudPerformanceGeneralRecommendations.get` `recommender.cloudPerformanceGeneralRecommendations.list` `recommender.cloudPerformanceGeneralRecommendations.update` `recommender.cloudReliabilityGeneralInsights.get` `recommender.cloudReliabilityGeneralInsights.list` `recommender.cloudReliabilityGeneralInsights.update` `recommender.cloudReliabilityGeneralRecommendations.get` `recommender.cloudReliabilityGeneralRecommendations.list` `recommender.cloudReliabilityGeneralRecommendations.update` `recommender.cloudSecurityGeneralInsights.get` `recommender.cloudSecurityGeneralInsights.list` `recommender.cloudSecurityGeneralInsights.update` `recommender.cloudSecurityGeneralRecommendations.get` `recommender.cloudSecurityGeneralRecommendations.list` `recommender.cloudSecurityGeneralRecommendations.update`
Recommender	The following permissions are supported in custom roles: `recommender.cloudCostGeneralInsights.get` `recommender.cloudCostGeneralInsights.list` `recommender.cloudCostGeneralInsights.update` `recommender.cloudCostGeneralRecommendations.get` `recommender.cloudCostGeneralRecommendations.list` `recommender.cloudCostGeneralRecommendations.update` `recommender.cloudManageabilityGeneralInsights.get` `recommender.cloudManageabilityGeneralInsights.list` `recommender.cloudManageabilityGeneralInsights.update` `recommender.cloudManageabilityGeneralRecommendations.get` `recommender.cloudManageabilityGeneralRecommendations.list` `recommender.cloudManageabilityGeneralRecommendations.update` `recommender.cloudPerformanceGeneralInsights.get` `recommender.cloudPerformanceGeneralInsights.list` `recommender.cloudPerformanceGeneralInsights.update` `recommender.cloudPerformanceGeneralRecommendations.get` `recommender.cloudPerformanceGeneralRecommendations.list` `recommender.cloudPerformanceGeneralRecommendations.update` `recommender.cloudReliabilityGeneralInsights.get` `recommender.cloudReliabilityGeneralInsights.list` `recommender.cloudReliabilityGeneralInsights.update` `recommender.cloudReliabilityGeneralRecommendations.get` `recommender.cloudReliabilityGeneralRecommendations.list` `recommender.cloudReliabilityGeneralRecommendations.update` `recommender.cloudSecurityGeneralInsights.get` `recommender.cloudSecurityGeneralInsights.list` `recommender.cloudSecurityGeneralInsights.update` `recommender.cloudSecurityGeneralRecommendations.get` `recommender.cloudSecurityGeneralRecommendations.list` `recommender.cloudSecurityGeneralRecommendations.update`
Security Command Center	The following permissions have been added: `securitycenter.attackpaths.list` `securitycenter.resourcevalueconfigs.create` `securitycenter.resourcevalueconfigs.delete` `securitycenter.resourcevalueconfigs.get` `securitycenter.resourcevalueconfigs.list` `securitycenter.resourcevalueconfigs.update` `securitycenter.simulations.get` `securitycenter.valuedresources.list`
Security Command Center	The following permissions are supported in custom roles: `securitycenter.attackpaths.list` `securitycenter.resourcevalueconfigs.create` `securitycenter.resourcevalueconfigs.delete` `securitycenter.resourcevalueconfigs.get` `securitycenter.resourcevalueconfigs.list` `securitycenter.resourcevalueconfigs.update` `securitycenter.simulations.get` `securitycenter.valuedresources.list`
Security Command Center	The following permissions have reached General Availability (GA): `securitycenter.attackpaths.list` `securitycenter.resourcevalueconfigs.create` `securitycenter.resourcevalueconfigs.delete` `securitycenter.resourcevalueconfigs.get` `securitycenter.resourcevalueconfigs.list` `securitycenter.resourcevalueconfigs.update` `securitycenter.simulations.get` `securitycenter.valuedresources.list`

IAM changes as of 2023-08-04

Service	Description
Cloud Billing	The following permissions have been added to the Billing Account Administrator role (`roles/billing.admin`): `cloudasset.assets.searchAllResources`
Firebase Remote Config	The following permissions have been added to the Cloud Config Service Agent role (`roles/cloudconfig.serviceAgent`): `iam.serviceAccounts.actAs`
Google Cloud Support	The following permissions have been added to the Tech Support Editor role (`roles/cloudsupport.techSupportEditor`): `cloudasset.assets.searchAllResources`
Dialogflow	The following permissions have been added to the Dialogflow Service Agent role (`roles/dialogflow.serviceAgent`): `bigquery.jobs.create` `bigquery.tables.getData`
Discovery Engine	The following permissions have been added to the Discovery Engine Admin role (`roles/discoveryengine.admin`): `discoveryengine.engines.update`
Eventarc	The following permissions have been added to the Eventarc Service Agent role (`roles/eventarc.serviceAgent`): `iam.serviceAccounts.getOpenIdToken`
GKE Dataplane Management	The Warp Run Service Agent role (`roles/gkedataplanemanagement.warpRunServiceAgent`) has reached General Availability (GA).
Cloud Integrations	The following permissions have been added to the Application Integration Service Agent role (`roles/integrations.serviceAgent`): `cloudscheduler.jobs.create` `cloudscheduler.jobs.delete` `cloudscheduler.jobs.enable` `cloudscheduler.jobs.fullView` `cloudscheduler.jobs.get` `cloudscheduler.jobs.pause` `cloudscheduler.jobs.run` `cloudscheduler.jobs.update` `cloudscheduler.locations.get` `cloudscheduler.locations.list`
Recommender	The Recommendations Exporter role (`roles/recommender.exporter`) has reached General Availability (GA).
Workload Manager	The following permissions have been added to the Workload Manager Service Agent role (`roles/workloadmanager.serviceAgent`): `config.resources.list`
Cloud Workstations	The following permissions have been added to the Cloud Workstations User role (`roles/workstations.user`): `workstations.workstations.update`
Apigee	The following permissions have been added: `apigee.securityProfiles.create` `apigee.securityProfiles.delete` `apigee.securityProfiles.update`
Apigee	The following permissions are supported in custom roles: `apigee.securityProfiles.create` `apigee.securityProfiles.delete` `apigee.securityProfiles.update`
Apigee	The following permissions have reached General Availability (GA): `apigee.securityProfiles.create` `apigee.securityProfiles.delete` `apigee.securityProfiles.update`
Content Warehouse	The following permissions have been added: `contentwarehouse.dataExportJobs.create` `contentwarehouse.dataExportJobs.update` `contentwarehouse.links.create` `contentwarehouse.links.delete` `contentwarehouse.links.get` `contentwarehouse.links.update` `contentwarehouse.schemas.create` `contentwarehouse.schemas.delete` `contentwarehouse.schemas.get` `contentwarehouse.schemas.list` `contentwarehouse.schemas.update`
Content Warehouse	The following permissions have reached General Availability (GA): `contentwarehouse.dataExportJobs.create` `contentwarehouse.dataExportJobs.update` `contentwarehouse.links.create` `contentwarehouse.links.delete` `contentwarehouse.links.get` `contentwarehouse.links.update` `contentwarehouse.schemas.create` `contentwarehouse.schemas.delete` `contentwarehouse.schemas.get` `contentwarehouse.schemas.list` `contentwarehouse.schemas.update`
Discovery Engine	The following permissions have been added: `discoveryengine.completionConfigs.get` `discoveryengine.completionConfigs.update` `discoveryengine.controls.create` `discoveryengine.controls.delete` `discoveryengine.controls.get` `discoveryengine.controls.list` `discoveryengine.controls.update` `discoveryengine.conversations.create` `discoveryengine.conversations.delete` `discoveryengine.conversations.get` `discoveryengine.conversations.list` `discoveryengine.conversations.update` `discoveryengine.dataStores.create` `discoveryengine.dataStores.delete` `discoveryengine.dataStores.enrollSolutions` `discoveryengine.dataStores.get` `discoveryengine.dataStores.list` `discoveryengine.dataStores.update` `discoveryengine.documents.purge` `discoveryengine.engines.create` `discoveryengine.engines.delete` `discoveryengine.engines.get` `discoveryengine.engines.list` `discoveryengine.engines.update` `discoveryengine.models.create` `discoveryengine.models.delete` `discoveryengine.models.get` `discoveryengine.models.list` `discoveryengine.models.pause` `discoveryengine.models.resume` `discoveryengine.models.tune` `discoveryengine.models.update` `discoveryengine.projects.get` `discoveryengine.projects.provision` `discoveryengine.projects.reportConsentChange` `discoveryengine.schemas.create` `discoveryengine.schemas.delete` `discoveryengine.schemas.get` `discoveryengine.schemas.list` `discoveryengine.schemas.update` `discoveryengine.servingConfigs.create` `discoveryengine.servingConfigs.delete` `discoveryengine.servingConfigs.get` `discoveryengine.servingConfigs.list` `discoveryengine.servingConfigs.update` `discoveryengine.siteSearchEngines.get` `discoveryengine.targetSites.batchCreate` `discoveryengine.targetSites.create` `discoveryengine.targetSites.delete` `discoveryengine.targetSites.get` `discoveryengine.targetSites.list` `discoveryengine.targetSites.update` `discoveryengine.userEvents.fetchStats` `discoveryengine.userEvents.purge` `discoveryengine.widgetConfigs.get` `discoveryengine.widgetConfigs.update`
Discovery Engine	The following permissions are supported in custom roles: `discoveryengine.completionConfigs.get` `discoveryengine.completionConfigs.update` `discoveryengine.controls.create` `discoveryengine.controls.delete` `discoveryengine.controls.get` `discoveryengine.controls.list` `discoveryengine.controls.update` `discoveryengine.conversations.create` `discoveryengine.conversations.delete` `discoveryengine.conversations.get` `discoveryengine.conversations.list` `discoveryengine.conversations.update` `discoveryengine.documents.purge` `discoveryengine.engines.create` `discoveryengine.engines.delete` `discoveryengine.engines.get` `discoveryengine.engines.list` `discoveryengine.engines.update` `discoveryengine.targetSites.batchCreate` `discoveryengine.widgetConfigs.get` `discoveryengine.widgetConfigs.update`
Network Connectivity Center	The following permissions are supported in custom roles: `networkconnectivity.groups.acceptSpoke` `networkconnectivity.groups.rejectSpoke` `networkconnectivity.groups.use`
Network Connectivity Center	The following permissions have reached General Availability (GA): `networkconnectivity.groups.acceptSpoke` `networkconnectivity.groups.rejectSpoke` `networkconnectivity.groups.use`
Recommender	The following permissions have reached General Availability (GA): `recommender.resources.export`

IAM changes as of 2023-07-28

Service	Description
Discovery Engine	The following permissions have been added to the Discovery Engine Service Agent role (`roles/discoveryengine.serviceAgent`): `discoveryengine.userEvents.create`
Apigee	The following permissions have been added: `apigee.securityActions.create` `apigee.securityActions.get` `apigee.securityActions.list` `apigee.securityActions.update` `apigee.securityActionsConfig.get` `apigee.securityActionsConfig.update`
Apigee	The following permissions are supported in custom roles: `apigee.securityActions.create` `apigee.securityActions.get` `apigee.securityActions.list` `apigee.securityActions.update` `apigee.securityActionsConfig.get` `apigee.securityActionsConfig.update`
Apigee	The following permissions have reached General Availability (GA): `apigee.securityActions.create` `apigee.securityActions.get` `apigee.securityActions.list` `apigee.securityActions.update` `apigee.securityActionsConfig.get` `apigee.securityActionsConfig.update`
BigQuery	The following permissions have been added: `bigquery.tables.replicateData`
BigQuery	The following permissions are supported in custom roles: `bigquery.tables.replicateData`
Compute Engine	The following permissions are supported in custom roles: `compute.subnetworks.create` `compute.subnetworks.delete` `compute.subnetworks.list`
Compute Engine	The following permissions have reached General Availability (GA): `compute.serviceAttachments.create` `compute.serviceAttachments.delete` `compute.serviceAttachments.get` `compute.serviceAttachments.getIamPolicy` `compute.serviceAttachments.list` `compute.serviceAttachments.setIamPolicy` `compute.serviceAttachments.update` `compute.serviceAttachments.use`

IAM changes as of 2023-07-21

Service	Description
Vertex AI	The Vertex AI Notebook Service Agent role (`roles/aiplatform.notebookServiceAgent`) has reached General Availability (GA).
Analytics Hub	The Analytics Hub Subscription Owner role (`roles/analyticshub.subscriptionOwner`) has reached General Availability (GA).
Assured Workloads	The following permissions have been added to the Assured Workloads Editor role (`roles/assuredworkloads.editor`): `logging.cmekSettings.update` `logging.googleapis.com/settings.update` `logging.settings.update`
Bare Metal Solution	The OS Images Viewer role (`roles/baremetalsolution.osimagesviewer`) has reached General Availability (GA).
Cloud Billing	The following permissions have been added to the Billing Account Administrator role (`roles/billing.admin`): `recommender.cloudsqlIdleInstanceRecommendations.get` `recommender.cloudsqlIdleInstanceRecommendations.list` `recommender.cloudsqlOverprovisionedInstanceRecommendations.get` `recommender.cloudsqlOverprovisionedInstanceRecommendations.list` `recommender.computeAddressIdleResourceRecommendations.get` `recommender.computeAddressIdleResourceRecommendations.list` `recommender.computeDiskIdleResourceRecommendations.get` `recommender.computeDiskIdleResourceRecommendations.list` `recommender.computeImageIdleResourceRecommendations.get` `recommender.computeImageIdleResourceRecommendations.list` `recommender.computeInstanceGroupManagerMachineTypeRecommendations.get` `recommender.computeInstanceGroupManagerMachineTypeRecommendations.list` `recommender.computeInstanceIdleResourceRecommendations.get` `recommender.computeInstanceIdleResourceRecommendations.list` `recommender.computeInstanceMachineTypeRecommendations.get` `recommender.computeInstanceMachineTypeRecommendations.list` `recommender.resourcemanagerProjectUtilizationRecommendations.get` `recommender.resourcemanagerProjectUtilizationRecommendations.list`
Cloud Asset Inventory	The Effective Policies Service Agent role (`roles/cloudasset.effectivePolicyServiceAgent`) has reached General Availability (GA).
Cloud Build	The Cloud Build Connection Admin role (`roles/cloudbuild.connectionAdmin`) has reached General Availability (GA).
Cloud Build	The Cloud Build Connection Viewer role (`roles/cloudbuild.connectionViewer`) has reached General Availability (GA).
Cloud Build	The Cloud Build Read Only Token Accessor role (`roles/cloudbuild.readTokenAccessor`) has reached General Availability (GA).
Cloud Build	The Cloud Build Token Accessor role (`roles/cloudbuild.tokenAccessor`) has reached General Availability (GA).
Commerce Business Enablement	The following permissions have been added to the Commerce Business Enablement PaymentConfig Admin role (`roles/commercebusinessenablement.paymentConfigAdmin`): `commercebusinessenablement.partnerInfo.get`
Commerce Business Enablement	The following permissions have been added to the Commerce Business Enablement PaymentConfig Viewer role (`roles/commercebusinessenablement.paymentConfigViewer`): `commercebusinessenablement.partnerInfo.get`
Discovery Engine	The following permissions have been added to the Discovery Engine Service Agent role (`roles/discoveryengine.serviceAgent`): `discoveryengine.conversations.converse`
Basic Role	The following permissions have been added to the Editor role (`roles/editor`): `datastore.operations.get` `datastore.operations.list`
Basic Role	The following permissions have been added to the Viewer role (`roles/viewer`): `datastore.operations.get` `datastore.operations.list`
Analytics Hub	The following permissions have been added: `analyticshub.dataExchanges.subscribe` `analyticshub.dataExchanges.viewSubscriptions` `analyticshub.listings.viewSubscriptions` `analyticshub.subscriptions.create` `analyticshub.subscriptions.delete` `analyticshub.subscriptions.get` `analyticshub.subscriptions.list` `analyticshub.subscriptions.update`
Analytics Hub	The following permissions are supported in custom roles: `analyticshub.dataExchanges.subscribe` `analyticshub.dataExchanges.viewSubscriptions` `analyticshub.listings.viewSubscriptions` `analyticshub.subscriptions.create` `analyticshub.subscriptions.delete` `analyticshub.subscriptions.get` `analyticshub.subscriptions.list` `analyticshub.subscriptions.update`
Analytics Hub	The following permissions have reached General Availability (GA): `analyticshub.dataExchanges.subscribe` `analyticshub.dataExchanges.viewSubscriptions` `analyticshub.listings.viewSubscriptions` `analyticshub.subscriptions.create` `analyticshub.subscriptions.delete` `analyticshub.subscriptions.get` `analyticshub.subscriptions.list` `analyticshub.subscriptions.update`
Bare Metal Solution	The following permissions have been added: `baremetalsolution.osimages.list`
Bare Metal Solution	The following permissions are supported in custom roles: `baremetalsolution.osimages.list`
Bare Metal Solution	The following permissions have reached General Availability (GA): `baremetalsolution.osimages.list`
Cloud Billing	The following permissions have been added: `billing.billingAccountPrice.get` `billing.billingAccountServices.get` `billing.billingAccountServices.list` `billing.billingAccountSkuGroupSkus.get` `billing.billingAccountSkuGroupSkus.list` `billing.billingAccountSkuGroups.get` `billing.billingAccountSkuGroups.list` `billing.billingAccountSkus.get` `billing.billingAccountSkus.list`
Cloud Billing	The following permissions are supported in custom roles: `billing.billingAccountPrice.get` `billing.billingAccountServices.get` `billing.billingAccountServices.list` `billing.billingAccountSkuGroupSkus.get` `billing.billingAccountSkuGroupSkus.list` `billing.billingAccountSkuGroups.get` `billing.billingAccountSkuGroups.list` `billing.billingAccountSkus.get` `billing.billingAccountSkus.list`
Cloud Billing	The following permissions have reached General Availability (GA): `billing.billingAccountPrice.get` `billing.billingAccountServices.get` `billing.billingAccountServices.list` `billing.billingAccountSkuGroupSkus.get` `billing.billingAccountSkuGroupSkus.list` `billing.billingAccountSkuGroups.get` `billing.billingAccountSkuGroups.list` `billing.billingAccountSkus.get` `billing.billingAccountSkus.list`
Cloud Build	The following permissions have been added: `cloudbuild.operations.get` `cloudbuild.operations.list`
Cloud Build	The following permissions are supported in custom roles: `cloudbuild.operations.get` `cloudbuild.operations.list`
Cloud Build	The following permissions have reached General Availability (GA): `cloudbuild.connections.create` `cloudbuild.connections.delete` `cloudbuild.connections.fetchLinkableRepositories` `cloudbuild.connections.get` `cloudbuild.connections.getIamPolicy` `cloudbuild.connections.list` `cloudbuild.connections.setIamPolicy` `cloudbuild.connections.update` `cloudbuild.operations.get` `cloudbuild.operations.list` `cloudbuild.repositories.accessReadToken` `cloudbuild.repositories.accessReadWriteToken` `cloudbuild.repositories.create` `cloudbuild.repositories.delete` `cloudbuild.repositories.fetchGitRefs` `cloudbuild.repositories.get` `cloudbuild.repositories.list`
Compute Engine	The following permissions have been added: `compute.backendBuckets.createTagBinding` `compute.backendBuckets.deleteTagBinding` `compute.backendBuckets.listEffectiveTags` `compute.backendBuckets.listTagBindings` `compute.backendServices.createTagBinding` `compute.backendServices.deleteTagBinding` `compute.backendServices.listEffectiveTags` `compute.backendServices.listTagBindings` `compute.firewallPolicies.createTagBinding` `compute.firewallPolicies.deleteTagBinding` `compute.firewallPolicies.listEffectiveTags` `compute.firewallPolicies.listTagBindings` `compute.firewalls.createTagBinding` `compute.firewalls.deleteTagBinding` `compute.firewalls.listEffectiveTags` `compute.firewalls.listTagBindings` `compute.forwardingRules.createTagBinding` `compute.forwardingRules.deleteTagBinding` `compute.forwardingRules.listEffectiveTags` `compute.forwardingRules.listTagBindings` `compute.globalForwardingRules.createTagBinding` `compute.globalForwardingRules.deleteTagBinding` `compute.globalForwardingRules.listEffectiveTags` `compute.globalForwardingRules.listTagBindings` `compute.globalNetworkEndpointGroups.createTagBinding` `compute.globalNetworkEndpointGroups.deleteTagBinding` `compute.globalNetworkEndpointGroups.listEffectiveTags` `compute.globalNetworkEndpointGroups.listTagBindings` `compute.healthChecks.createTagBinding` `compute.healthChecks.deleteTagBinding` `compute.healthChecks.listEffectiveTags` `compute.healthChecks.listTagBindings` `compute.httpHealthChecks.createTagBinding` `compute.httpHealthChecks.deleteTagBinding` `compute.httpHealthChecks.listEffectiveTags` `compute.httpHealthChecks.listTagBindings` `compute.httpsHealthChecks.createTagBinding` `compute.httpsHealthChecks.deleteTagBinding` `compute.httpsHealthChecks.listEffectiveTags` `compute.httpsHealthChecks.listTagBindings` `compute.networkEndpointGroups.createTagBinding` `compute.networkEndpointGroups.deleteTagBinding` `compute.networkEndpointGroups.listEffectiveTags` `compute.networkEndpointGroups.listTagBindings` `compute.networks.createTagBinding` `compute.networks.deleteTagBinding` `compute.networks.listEffectiveTags` `compute.networks.listTagBindings` `compute.regionBackendServices.createTagBinding` `compute.regionBackendServices.deleteTagBinding` `compute.regionBackendServices.listEffectiveTags` `compute.regionBackendServices.listTagBindings` `compute.regionFirewallPolicies.createTagBinding` `compute.regionFirewallPolicies.deleteTagBinding` `compute.regionFirewallPolicies.listEffectiveTags` `compute.regionFirewallPolicies.listTagBindings` `compute.regionHealthChecks.createTagBinding` `compute.regionHealthChecks.deleteTagBinding` `compute.regionHealthChecks.listEffectiveTags` `compute.regionHealthChecks.listTagBindings` `compute.regionNetworkEndpointGroups.createTagBinding` `compute.regionNetworkEndpointGroups.deleteTagBinding` `compute.regionNetworkEndpointGroups.listEffectiveTags` `compute.regionNetworkEndpointGroups.listTagBindings` `compute.regionSecurityPolicies.createTagBinding` `compute.regionSecurityPolicies.deleteTagBinding` `compute.regionSecurityPolicies.listEffectiveTags` `compute.regionSecurityPolicies.listTagBindings` `compute.regionSslCertificates.createTagBinding` `compute.regionSslCertificates.deleteTagBinding` `compute.regionSslCertificates.listEffectiveTags` `compute.regionSslCertificates.listTagBindings` `compute.regionTargetHttpProxies.createTagBinding` `compute.regionTargetHttpProxies.deleteTagBinding` `compute.regionTargetHttpProxies.listEffectiveTags` `compute.regionTargetHttpProxies.listTagBindings` `compute.regionTargetHttpsProxies.createTagBinding` `compute.regionTargetHttpsProxies.deleteTagBinding` `compute.regionTargetHttpsProxies.listEffectiveTags` `compute.regionTargetHttpsProxies.listTagBindings` `compute.regionUrlMaps.createTagBinding` `compute.regionUrlMaps.deleteTagBinding` `compute.regionUrlMaps.listEffectiveTags` `compute.regionUrlMaps.listTagBindings` `compute.routes.createTagBinding` `compute.routes.deleteTagBinding` `compute.routes.listEffectiveTags` `compute.routes.listTagBindings` `compute.securityPolicies.createTagBinding` `compute.securityPolicies.deleteTagBinding` `compute.securityPolicies.listEffectiveTags` `compute.securityPolicies.listTagBindings` `compute.sslCertificates.createTagBinding` `compute.sslCertificates.deleteTagBinding` `compute.sslCertificates.listEffectiveTags` `compute.sslCertificates.listTagBindings` `compute.sslPolicies.createTagBinding` `compute.sslPolicies.deleteTagBinding` `compute.sslPolicies.listEffectiveTags` `compute.sslPolicies.listTagBindings` `compute.subnetworks.createTagBinding` `compute.subnetworks.deleteTagBinding` `compute.subnetworks.listEffectiveTags` `compute.subnetworks.listTagBindings` `compute.targetHttpProxies.createTagBinding` `compute.targetHttpProxies.deleteTagBinding` `compute.targetHttpProxies.listEffectiveTags` `compute.targetHttpProxies.listTagBindings` `compute.targetHttpsProxies.createTagBinding` `compute.targetHttpsProxies.deleteTagBinding` `compute.targetHttpsProxies.listEffectiveTags` `compute.targetHttpsProxies.listTagBindings` `compute.targetInstances.createTagBinding` `compute.targetInstances.deleteTagBinding` `compute.targetInstances.listEffectiveTags` `compute.targetInstances.listTagBindings` `compute.targetPools.createTagBinding` `compute.targetPools.deleteTagBinding` `compute.targetPools.listEffectiveTags` `compute.targetPools.listTagBindings` `compute.targetSslProxies.createTagBinding` `compute.targetSslProxies.deleteTagBinding` `compute.targetSslProxies.listEffectiveTags` `compute.targetSslProxies.listTagBindings` `compute.targetTcpProxies.createTagBinding` `compute.targetTcpProxies.deleteTagBinding` `compute.targetTcpProxies.listEffectiveTags` `compute.targetTcpProxies.listTagBindings` `compute.urlMaps.createTagBinding` `compute.urlMaps.deleteTagBinding` `compute.urlMaps.listEffectiveTags` `compute.urlMaps.listTagBindings`
Compute Engine	The following permissions have reached General Availability (GA): `compute.backendBuckets.createTagBinding` `compute.backendBuckets.deleteTagBinding` `compute.backendBuckets.listEffectiveTags` `compute.backendBuckets.listTagBindings` `compute.backendServices.createTagBinding` `compute.backendServices.deleteTagBinding` `compute.backendServices.listEffectiveTags` `compute.backendServices.listTagBindings` `compute.firewallPolicies.createTagBinding` `compute.firewallPolicies.deleteTagBinding` `compute.firewallPolicies.listEffectiveTags` `compute.firewallPolicies.listTagBindings` `compute.firewalls.createTagBinding` `compute.firewalls.deleteTagBinding` `compute.firewalls.listEffectiveTags` `compute.firewalls.listTagBindings` `compute.forwardingRules.createTagBinding` `compute.forwardingRules.deleteTagBinding` `compute.forwardingRules.listEffectiveTags` `compute.forwardingRules.listTagBindings` `compute.globalForwardingRules.createTagBinding` `compute.globalForwardingRules.deleteTagBinding` `compute.globalForwardingRules.listEffectiveTags` `compute.globalForwardingRules.listTagBindings` `compute.globalNetworkEndpointGroups.createTagBinding` `compute.globalNetworkEndpointGroups.deleteTagBinding` `compute.globalNetworkEndpointGroups.listEffectiveTags` `compute.globalNetworkEndpointGroups.listTagBindings` `compute.healthChecks.createTagBinding` `compute.healthChecks.deleteTagBinding` `compute.healthChecks.listEffectiveTags` `compute.healthChecks.listTagBindings` `compute.httpHealthChecks.createTagBinding` `compute.httpHealthChecks.deleteTagBinding` `compute.httpHealthChecks.listEffectiveTags` `compute.httpHealthChecks.listTagBindings` `compute.httpsHealthChecks.createTagBinding` `compute.httpsHealthChecks.deleteTagBinding` `compute.httpsHealthChecks.listEffectiveTags` `compute.httpsHealthChecks.listTagBindings` `compute.networkEndpointGroups.createTagBinding` `compute.networkEndpointGroups.deleteTagBinding` `compute.networkEndpointGroups.listEffectiveTags` `compute.networkEndpointGroups.listTagBindings` `compute.networks.createTagBinding` `compute.networks.deleteTagBinding` `compute.networks.listEffectiveTags` `compute.networks.listTagBindings` `compute.regionBackendServices.createTagBinding` `compute.regionBackendServices.deleteTagBinding` `compute.regionBackendServices.listEffectiveTags` `compute.regionBackendServices.listTagBindings` `compute.regionFirewallPolicies.createTagBinding` `compute.regionFirewallPolicies.deleteTagBinding` `compute.regionFirewallPolicies.listEffectiveTags` `compute.regionFirewallPolicies.listTagBindings` `compute.regionHealthChecks.createTagBinding` `compute.regionHealthChecks.deleteTagBinding` `compute.regionHealthChecks.listEffectiveTags` `compute.regionHealthChecks.listTagBindings` `compute.regionNetworkEndpointGroups.createTagBinding` `compute.regionNetworkEndpointGroups.deleteTagBinding` `compute.regionNetworkEndpointGroups.listEffectiveTags` `compute.regionNetworkEndpointGroups.listTagBindings` `compute.regionSslCertificates.createTagBinding` `compute.regionSslCertificates.deleteTagBinding` `compute.regionSslCertificates.listEffectiveTags` `compute.regionSslCertificates.listTagBindings` `compute.regionTargetHttpProxies.createTagBinding` `compute.regionTargetHttpProxies.deleteTagBinding` `compute.regionTargetHttpProxies.listEffectiveTags` `compute.regionTargetHttpProxies.listTagBindings` `compute.regionTargetHttpsProxies.createTagBinding` `compute.regionTargetHttpsProxies.deleteTagBinding` `compute.regionTargetHttpsProxies.listEffectiveTags` `compute.regionTargetHttpsProxies.listTagBindings` `compute.regionUrlMaps.createTagBinding` `compute.regionUrlMaps.deleteTagBinding` `compute.regionUrlMaps.listEffectiveTags` `compute.regionUrlMaps.listTagBindings` `compute.routes.createTagBinding` `compute.routes.deleteTagBinding` `compute.routes.listEffectiveTags` `compute.routes.listTagBindings` `compute.securityPolicies.createTagBinding` `compute.securityPolicies.deleteTagBinding` `compute.securityPolicies.listEffectiveTags` `compute.securityPolicies.listTagBindings` `compute.sslCertificates.createTagBinding` `compute.sslCertificates.deleteTagBinding` `compute.sslCertificates.listEffectiveTags` `compute.sslCertificates.listTagBindings` `compute.sslPolicies.createTagBinding` `compute.sslPolicies.deleteTagBinding` `compute.sslPolicies.listEffectiveTags` `compute.sslPolicies.listTagBindings` `compute.subnetworks.createTagBinding` `compute.subnetworks.deleteTagBinding` `compute.subnetworks.listEffectiveTags` `compute.subnetworks.listTagBindings` `compute.targetHttpProxies.createTagBinding` `compute.targetHttpProxies.deleteTagBinding` `compute.targetHttpProxies.listEffectiveTags` `compute.targetHttpProxies.listTagBindings` `compute.targetHttpsProxies.createTagBinding` `compute.targetHttpsProxies.deleteTagBinding` `compute.targetHttpsProxies.listEffectiveTags` `compute.targetHttpsProxies.listTagBindings` `compute.targetInstances.createTagBinding` `compute.targetInstances.deleteTagBinding` `compute.targetInstances.listEffectiveTags` `compute.targetInstances.listTagBindings` `compute.targetPools.createTagBinding` `compute.targetPools.deleteTagBinding` `compute.targetPools.listEffectiveTags` `compute.targetPools.listTagBindings` `compute.targetSslProxies.createTagBinding` `compute.targetSslProxies.deleteTagBinding` `compute.targetSslProxies.listEffectiveTags` `compute.targetSslProxies.listTagBindings` `compute.targetTcpProxies.createTagBinding` `compute.targetTcpProxies.deleteTagBinding` `compute.targetTcpProxies.listEffectiveTags` `compute.targetTcpProxies.listTagBindings` `compute.urlMaps.createTagBinding` `compute.urlMaps.deleteTagBinding` `compute.urlMaps.listEffectiveTags` `compute.urlMaps.listTagBindings`
Data Catalog	The following permissions have been added: `datacatalog.entries.createGlossaryCategory` `datacatalog.entries.deleteGlossaryCategory` `datacatalog.entries.updateGlossaryCategory` `datacatalog.operations.list` `datacatalog.relationships.createBelongsTo` `datacatalog.relationships.deleteBelongsTo`
Data Catalog	The following permissions are supported in custom roles: `datacatalog.entries.createGlossaryCategory` `datacatalog.entries.deleteGlossaryCategory` `datacatalog.entries.updateGlossaryCategory` `datacatalog.relationships.createBelongsTo` `datacatalog.relationships.deleteBelongsTo`
Google Cloud NetApp Volumes	The following permissions have been added: `netapp.activeDirectories.create` `netapp.activeDirectories.delete` `netapp.activeDirectories.get` `netapp.activeDirectories.list` `netapp.activeDirectories.update` `netapp.kmsConfigs.create` `netapp.kmsConfigs.delete` `netapp.kmsConfigs.encrypt` `netapp.kmsConfigs.get` `netapp.kmsConfigs.list` `netapp.kmsConfigs.update` `netapp.kmsConfigs.verify` `netapp.replications.create` `netapp.replications.delete` `netapp.replications.get` `netapp.replications.list` `netapp.replications.resume` `netapp.replications.reverse` `netapp.replications.stop` `netapp.replications.update` `netapp.snapshots.create` `netapp.snapshots.delete` `netapp.snapshots.get` `netapp.snapshots.list` `netapp.snapshots.update` `netapp.storagePools.create` `netapp.storagePools.delete` `netapp.storagePools.get` `netapp.storagePools.list` `netapp.storagePools.update` `netapp.volumes.create` `netapp.volumes.delete` `netapp.volumes.get` `netapp.volumes.list` `netapp.volumes.revert` `netapp.volumes.update`
Google Cloud NetApp Volumes	The following permissions are supported in custom roles: `netapp.kmsConfigs.create` `netapp.kmsConfigs.delete` `netapp.kmsConfigs.encrypt` `netapp.kmsConfigs.get` `netapp.kmsConfigs.list` `netapp.kmsConfigs.update` `netapp.kmsConfigs.verify` `netapp.replications.create` `netapp.replications.delete` `netapp.replications.get` `netapp.replications.list` `netapp.replications.resume` `netapp.replications.reverse` `netapp.replications.stop` `netapp.replications.update`
Policy Simulator	The following permissions have been added: `policysimulator.orgPolicyViolations.list` `policysimulator.orgPolicyViolationsPreviews.create` `policysimulator.orgPolicyViolationsPreviews.get` `policysimulator.orgPolicyViolationsPreviews.list`
Recommender	The following permissions have been added: `recommender.runServiceCostInsights.get` `recommender.runServiceCostInsights.list` `recommender.runServiceCostInsights.update` `recommender.runServiceCostRecommendations.get` `recommender.runServiceCostRecommendations.list` `recommender.runServiceCostRecommendations.update`
Recommender	The following permissions are supported in custom roles: `recommender.runServiceCostInsights.get` `recommender.runServiceCostInsights.list` `recommender.runServiceCostInsights.update` `recommender.runServiceCostRecommendations.get` `recommender.runServiceCostRecommendations.list` `recommender.runServiceCostRecommendations.update`
Recommender	The following permissions have reached General Availability (GA): `recommender.runServiceCostInsights.get` `recommender.runServiceCostInsights.list` `recommender.runServiceCostInsights.update` `recommender.runServiceCostRecommendations.get` `recommender.runServiceCostRecommendations.list` `recommender.runServiceCostRecommendations.update`

IAM changes as of 2023-07-14

Service	Description
Vertex AI	The following permissions have been added to the Vertex AI Administrator role (`roles/aiplatform.admin`): `aiplatform.featureViews.searchNearestEntities`
Vertex AI	The following permissions have been added to the Vertex AI Custom Code Service Agent role (`roles/aiplatform.customCodeServiceAgent`): `aiplatform.featureViews.searchNearestEntities`
Vertex AI	The following permissions have been added to the Vertex AI Feature Store EntityType owner role (`roles/aiplatform.entityTypeOwner`): `aiplatform.featureOnlineStores.get` `aiplatform.featureOnlineStores.list` `aiplatform.featureViewSyncs.get` `aiplatform.featureViewSyncs.list` `aiplatform.featureViews.fetchFeatureValues` `aiplatform.featureViews.get` `aiplatform.featureViews.list`
Vertex AI	The following permissions have been added to the Vertex AI Feature Store Admin role (`roles/aiplatform.featurestoreAdmin`): `aiplatform.featureOnlineStores.create` `aiplatform.featureOnlineStores.delete` `aiplatform.featureOnlineStores.get` `aiplatform.featureOnlineStores.list` `aiplatform.featureOnlineStores.update` `aiplatform.featureViewSyncs.get` `aiplatform.featureViewSyncs.list` `aiplatform.featureViews.create` `aiplatform.featureViews.delete` `aiplatform.featureViews.fetchFeatureValues` `aiplatform.featureViews.get` `aiplatform.featureViews.list` `aiplatform.featureViews.sync` `aiplatform.featureViews.update`
Vertex AI	The following permissions have been added to the Vertex AI Feature Store Data Viewer role (`roles/aiplatform.featurestoreDataViewer`): `aiplatform.featureOnlineStores.get` `aiplatform.featureOnlineStores.list` `aiplatform.featureViewSyncs.get` `aiplatform.featureViewSyncs.list` `aiplatform.featureViews.fetchFeatureValues` `aiplatform.featureViews.get` `aiplatform.featureViews.list`
Vertex AI	The following permissions have been added to the Vertex AI Feature Store Data Writer role (`roles/aiplatform.featurestoreDataWriter`): `aiplatform.featureOnlineStores.get` `aiplatform.featureOnlineStores.list` `aiplatform.featureViewSyncs.get` `aiplatform.featureViewSyncs.list` `aiplatform.featureViews.fetchFeatureValues` `aiplatform.featureViews.get` `aiplatform.featureViews.list`
Vertex AI	The following permissions have been added to the Vertex AI Service Agent role (`roles/aiplatform.serviceAgent`): `aiplatform.featureViews.searchNearestEntities`
Vertex AI	The following permissions have been added to the Vertex AI User role (`roles/aiplatform.user`): `aiplatform.featureViews.searchNearestEntities`
Vertex AI	The following permissions have been added to the Vertex AI Viewer role (`roles/aiplatform.viewer`): `aiplatform.featureViews.searchNearestEntities`
Backup and Disaster Recovery	The following permissions have been added to the Backup and DR Mount User role (`roles/backupdr.mountUser`): `backupdr.managementServers.viewBackupPlans`
Backup and Disaster Recovery	The following permissions have been added to the Backup and DR Restore User role (`roles/backupdr.restoreUser`): `backupdr.managementServers.viewBackupPlans`
Backup and Disaster Recovery	The following permissions have been added to the Backup and DR Service Agent role (`roles/backupdr.serviceAgent`): `compute.nodeGroups.get` `compute.nodeGroups.list` `compute.nodeTemplates.get` `compute.regionOperations.get` `compute.regions.get` `compute.snapshots.delete` `iam.serviceAccounts.actAs` `iam.serviceAccounts.get` `iam.serviceAccounts.list` `resourcemanager.projects.get` `resourcemanager.projects.list`
Compute Engine	The following permissions have been removed from the Compute Engine Service Agent role (`roles/compute.serviceAgent`): `compute.zoneOperations.get`
Connectors	The Connectors Event Subscriptions Admin role (`roles/connectors.eventSubscriptionAdmin`) has reached General Availability (GA).
Connectors	The Connectors Event Subscriptions Viewer role (`roles/connectors.eventSubscriptionViewer`) has reached General Availability (GA).
Basic Role	The following permissions have been added to the Editor role (`roles/editor`): `aiplatform.featureViews.searchNearestEntities`
Network Connectivity Center	The following permissions have been added to the Network Connectivity Service Agent role (`roles/networkconnectivity.serviceAgent`): `compute.projects.get`
Basic Role	The following permissions have been added to the Owner role (`roles/owner`): `aiplatform.featureViews.searchNearestEntities`
Basic Role	The following permissions have been added to the Viewer role (`roles/viewer`): `aiplatform.featureViews.searchNearestEntities`
Visual Inspection AI	The following permissions have been added to the Visual Inspection AI Service Agent role (`roles/visualinspection.serviceAgent`): `aiplatform.featureViews.searchNearestEntities`
Vertex AI	The following permissions have been added: `aiplatform.featureOnlineStores.create` `aiplatform.featureOnlineStores.delete` `aiplatform.featureOnlineStores.get` `aiplatform.featureOnlineStores.list` `aiplatform.featureOnlineStores.update` `aiplatform.featureViewSyncs.get` `aiplatform.featureViewSyncs.list` `aiplatform.featureViews.create` `aiplatform.featureViews.delete` `aiplatform.featureViews.fetchFeatureValues` `aiplatform.featureViews.get` `aiplatform.featureViews.list` `aiplatform.featureViews.searchNearestEntities` `aiplatform.featureViews.sync` `aiplatform.featureViews.update`
Commerce Offer Catalog	The following permissions have been added: `commerceoffercatalog.agreements.get` `commerceoffercatalog.agreements.list` `commerceoffercatalog.documents.list`
Commerce Offer Catalog	The following permissions are supported in custom roles: `commerceoffercatalog.agreements.get` `commerceoffercatalog.agreements.list` `commerceoffercatalog.documents.list`
Connectors	The following permissions have been added: `connectors.eventSubscriptions.create` `connectors.eventSubscriptions.delete` `connectors.eventSubscriptions.get` `connectors.eventSubscriptions.list` `connectors.eventSubscriptions.update` `connectors.eventtypes.get` `connectors.eventtypes.list`
Connectors	The following permissions have reached General Availability (GA): `connectors.eventSubscriptions.create` `connectors.eventSubscriptions.delete` `connectors.eventSubscriptions.get` `connectors.eventSubscriptions.list` `connectors.eventSubscriptions.update` `connectors.eventtypes.get` `connectors.eventtypes.list`
Data Catalog	The following permissions have been added: `datacatalog.catalogs.searchAll`
Discovery Engine	The following permissions have been added: `discoveryengine.conversations.converse` `discoveryengine.servingConfigs.search`
Discovery Engine	The following permissions are supported in custom roles: `discoveryengine.conversations.converse`
Network Connectivity Center	The following permissions have been added: `networkconnectivity.serviceClasses.create` `networkconnectivity.serviceClasses.delete` `networkconnectivity.serviceClasses.get` `networkconnectivity.serviceClasses.list` `networkconnectivity.serviceClasses.update` `networkconnectivity.serviceClasses.use` `networkconnectivity.serviceConnectionMaps.create` `networkconnectivity.serviceConnectionMaps.delete` `networkconnectivity.serviceConnectionMaps.get` `networkconnectivity.serviceConnectionMaps.list` `networkconnectivity.serviceConnectionMaps.update` `networkconnectivity.serviceConnectionPolicies.create` `networkconnectivity.serviceConnectionPolicies.delete` `networkconnectivity.serviceConnectionPolicies.get` `networkconnectivity.serviceConnectionPolicies.list` `networkconnectivity.serviceConnectionPolicies.update`
Network Connectivity Center	The following permissions are supported in custom roles: `networkconnectivity.serviceClasses.create` `networkconnectivity.serviceClasses.delete` `networkconnectivity.serviceClasses.get` `networkconnectivity.serviceClasses.list` `networkconnectivity.serviceClasses.update` `networkconnectivity.serviceClasses.use` `networkconnectivity.serviceConnectionMaps.create` `networkconnectivity.serviceConnectionMaps.delete` `networkconnectivity.serviceConnectionMaps.get` `networkconnectivity.serviceConnectionMaps.list` `networkconnectivity.serviceConnectionMaps.update` `networkconnectivity.serviceConnectionPolicies.create` `networkconnectivity.serviceConnectionPolicies.delete` `networkconnectivity.serviceConnectionPolicies.get` `networkconnectivity.serviceConnectionPolicies.list` `networkconnectivity.serviceConnectionPolicies.update`
Network Connectivity Center	The following permissions have reached General Availability (GA): `networkconnectivity.serviceClasses.create` `networkconnectivity.serviceClasses.delete` `networkconnectivity.serviceClasses.get` `networkconnectivity.serviceClasses.list` `networkconnectivity.serviceClasses.update` `networkconnectivity.serviceClasses.use` `networkconnectivity.serviceConnectionMaps.create` `networkconnectivity.serviceConnectionMaps.delete` `networkconnectivity.serviceConnectionMaps.get` `networkconnectivity.serviceConnectionMaps.list` `networkconnectivity.serviceConnectionMaps.update` `networkconnectivity.serviceConnectionPolicies.create` `networkconnectivity.serviceConnectionPolicies.delete` `networkconnectivity.serviceConnectionPolicies.get` `networkconnectivity.serviceConnectionPolicies.list` `networkconnectivity.serviceConnectionPolicies.update`
Personalized Service Health	The following permissions have been added: `servicehealth.events.get` `servicehealth.events.list` `servicehealth.locations.get` `servicehealth.locations.list` `servicehealth.organizationEvents.get` `servicehealth.organizationEvents.list` `servicehealth.organizationImpacts.get` `servicehealth.organizationImpacts.list`
Personalized Service Health	The following permissions are supported in custom roles: `servicehealth.locations.get` `servicehealth.locations.list` `servicehealth.organizationEvents.get` `servicehealth.organizationEvents.list` `servicehealth.organizationImpacts.get` `servicehealth.organizationImpacts.list`

IAM changes as of 2023-06-30

Service	Description
Cloud Key Management Service	The Cloud KMS Expert Raw AES-CBC Key Manager role (`roles/cloudkms.expertRawAesCbc`) has reached General Availability (GA).
Cloud Key Management Service	The Cloud KMS Expert Raw AES-CTR Key Manager role (`roles/cloudkms.expertRawAesCtr`) has reached General Availability (GA).
Eventarc	The following permissions have been added to the Eventarc Service Agent role (`roles/eventarc.serviceAgent`): `compute.networkAttachments.get` `dns.networks.targetWithPeeringZone`
Network Connectivity Center	The Group User role (`roles/networkconnectivity.groupUser`) has reached General Availability (GA).
Workload Certificate	The following permissions have been added to the Workload Certificate Service Agent role (`roles/workloadcertificate.serviceAgent`): `container.thirdPartyObjects.update`
Workload Manager	The following permissions have been added to the Workload Manager Admin role (`roles/workloadmanager.admin`): `compute.acceleratorTypes.list` `compute.diskTypes.list` `compute.machineTypes.list` `compute.networks.list` `compute.projects.get` `compute.regions.list` `compute.subnetworks.list` `compute.zones.list` `storage.buckets.list`
BigQuery	The following permissions have been added: `bigquery.datasets.listSharedDatasetUsage`
BigQuery	The following permissions are supported in custom roles: `bigquery.datasets.listSharedDatasetUsage`
Cloud Key Management Service	The following permissions have been added: `cloudkms.cryptoKeyVersions.manageRawAesCbcKeys` `cloudkms.cryptoKeyVersions.manageRawAesCtrKeys`
Cloud Key Management Service	The following permissions have reached General Availability (GA): `cloudkms.cryptoKeyVersions.manageRawAesCbcKeys` `cloudkms.cryptoKeyVersions.manageRawAesCtrKeys`
Translation	The following permissions have been added: `cloudtranslate.customModels.create` `cloudtranslate.customModels.delete` `cloudtranslate.customModels.get` `cloudtranslate.customModels.list` `cloudtranslate.customModels.predict` `cloudtranslate.datasets.create` `cloudtranslate.datasets.delete` `cloudtranslate.datasets.export` `cloudtranslate.datasets.get` `cloudtranslate.datasets.import` `cloudtranslate.datasets.list`
Translation	The following permissions are supported in custom roles: `cloudtranslate.customModels.create` `cloudtranslate.customModels.delete` `cloudtranslate.customModels.get` `cloudtranslate.customModels.list` `cloudtranslate.customModels.predict` `cloudtranslate.datasets.create` `cloudtranslate.datasets.delete` `cloudtranslate.datasets.export` `cloudtranslate.datasets.get` `cloudtranslate.datasets.import` `cloudtranslate.datasets.list`
Translation	The following permissions have reached General Availability (GA): `cloudtranslate.customModels.create` `cloudtranslate.customModels.delete` `cloudtranslate.customModels.get` `cloudtranslate.customModels.list` `cloudtranslate.customModels.predict` `cloudtranslate.datasets.create` `cloudtranslate.datasets.delete` `cloudtranslate.datasets.export` `cloudtranslate.datasets.get` `cloudtranslate.datasets.import` `cloudtranslate.datasets.list`
Cloud Config Manager API	The following permissions have been added: `config.resources.get` `config.resources.list`
Cloud Config Manager API	The following permissions are supported in custom roles: `config.resources.get` `config.resources.list`
Network Connectivity Center	The following permissions have been added: `networkconnectivity.groups.acceptSpoke` `networkconnectivity.groups.get` `networkconnectivity.groups.getIamPolicy` `networkconnectivity.groups.list` `networkconnectivity.groups.rejectSpoke` `networkconnectivity.groups.setIamPolicy` `networkconnectivity.groups.use` `networkconnectivity.hubRouteTables.get` `networkconnectivity.hubRouteTables.getIamPolicy` `networkconnectivity.hubRouteTables.list` `networkconnectivity.hubRouteTables.setIamPolicy` `networkconnectivity.hubRoutes.get` `networkconnectivity.hubRoutes.getIamPolicy` `networkconnectivity.hubRoutes.list` `networkconnectivity.hubRoutes.setIamPolicy` `networkconnectivity.hubs.listSpokes`
Network Connectivity Center	The following permissions are supported in custom roles: `networkconnectivity.groups.get` `networkconnectivity.groups.getIamPolicy` `networkconnectivity.groups.list` `networkconnectivity.groups.setIamPolicy` `networkconnectivity.hubs.listSpokes`
Network Connectivity Center	The following permissions have reached General Availability (GA): `networkconnectivity.groups.get` `networkconnectivity.groups.getIamPolicy` `networkconnectivity.groups.list` `networkconnectivity.groups.setIamPolicy` `networkconnectivity.hubRouteTables.get` `networkconnectivity.hubRouteTables.getIamPolicy` `networkconnectivity.hubRouteTables.list` `networkconnectivity.hubRouteTables.setIamPolicy` `networkconnectivity.hubRoutes.get` `networkconnectivity.hubRoutes.getIamPolicy` `networkconnectivity.hubRoutes.list` `networkconnectivity.hubRoutes.setIamPolicy` `networkconnectivity.hubs.listSpokes`
Network Security	The following permissions have been added: `networksecurity.firewallEndpointAssociations.create` `networksecurity.firewallEndpointAssociations.delete` `networksecurity.firewallEndpointAssociations.get` `networksecurity.firewallEndpointAssociations.list` `networksecurity.firewallEndpointAssociations.update` `networksecurity.firewallEndpoints.create` `networksecurity.firewallEndpoints.delete` `networksecurity.firewallEndpoints.get` `networksecurity.firewallEndpoints.list` `networksecurity.firewallEndpoints.update` `networksecurity.firewallEndpoints.use` `networksecurity.securityProfileGroups.create` `networksecurity.securityProfileGroups.delete` `networksecurity.securityProfileGroups.get` `networksecurity.securityProfileGroups.list` `networksecurity.securityProfileGroups.update` `networksecurity.securityProfileGroups.use` `networksecurity.securityProfiles.create` `networksecurity.securityProfiles.delete` `networksecurity.securityProfiles.get` `networksecurity.securityProfiles.list` `networksecurity.securityProfiles.update` `networksecurity.securityProfiles.use`
Spanner	The following permissions are supported in custom roles: `spanner.databases.update`

IAM changes as of 2023-06-23

Service	Description
Access Approval	The Access Approval Approver role (`roles/accessapproval.approver`) has reached General Availability (GA).
Access Approval	The Access Approval Config Editor role (`roles/accessapproval.configEditor`) has reached General Availability (GA).
Access Approval	The Access Approval Invalidator role (`roles/accessapproval.invalidator`) has reached General Availability (GA).
Access Approval	The Access Approval Viewer role (`roles/accessapproval.viewer`) has reached General Availability (GA).
Compute Engine	The following permissions have been added to the Compute Security Admin role (`roles/compute.securityAdmin`): `compute.routers.get` `compute.routers.list`
Security Command Center	The following permissions have been removed from the Security Center Control Service Agent role (`roles/securitycenter.controlServiceAgent`): `apikeys.keys.get` `apikeys.keys.getKeyString` `apikeys.keys.list` `apikeys.keys.lookup` `appengine.applications.get` `appengine.instances.get` `appengine.instances.list` `appengine.operations.get` `appengine.operations.list` `appengine.services.get` `appengine.services.list` `appengine.versions.get` `appengine.versions.list` `cloudsecurityscanner.crawledurls.list` `cloudsecurityscanner.results.get` `cloudsecurityscanner.results.list` `cloudsecurityscanner.scanruns.get` `cloudsecurityscanner.scanruns.getSummary` `cloudsecurityscanner.scanruns.list` `cloudsecurityscanner.scanruns.stop` `cloudsecurityscanner.scans.create` `cloudsecurityscanner.scans.delete` `cloudsecurityscanner.scans.get` `cloudsecurityscanner.scans.list` `cloudsecurityscanner.scans.run` `cloudsecurityscanner.scans.update` `cloudsql.instances.get` `compute.acceleratorTypes.get` `compute.acceleratorTypes.list` `compute.addresses.get` `compute.addresses.list` `compute.autoscalers.get` `compute.autoscalers.list` `compute.backendBuckets.get` `compute.backendBuckets.getIamPolicy` `compute.backendBuckets.list` `compute.backendServices.get` `compute.backendServices.getIamPolicy` `compute.backendServices.list` `compute.commitments.get` `compute.commitments.list` `compute.diskTypes.get` `compute.diskTypes.list` `compute.disks.get` `compute.disks.getIamPolicy` `compute.disks.list` `compute.disks.listEffectiveTags` `compute.disks.listTagBindings` `compute.externalVpnGateways.get` `compute.externalVpnGateways.list` `compute.firewallPolicies.get` `compute.firewallPolicies.getIamPolicy` `compute.firewallPolicies.list` `compute.firewalls.get` `compute.firewalls.list` `compute.forwardingRules.get` `compute.forwardingRules.list` `compute.globalAddresses.get` `compute.globalAddresses.list` `compute.globalForwardingRules.get` `compute.globalForwardingRules.list` `compute.globalForwardingRules.pscGet` `compute.globalNetworkEndpointGroups.get` `compute.globalNetworkEndpointGroups.list` `compute.globalOperations.getIamPolicy` `compute.globalOperations.list` `compute.globalPublicDelegatedPrefixes.get` `compute.globalPublicDelegatedPrefixes.list` `compute.healthChecks.get` `compute.healthChecks.list` `compute.httpHealthChecks.get` `compute.httpHealthChecks.list` `compute.httpsHealthChecks.get` `compute.httpsHealthChecks.list` `compute.images.get` `compute.images.getFromFamily` `compute.images.getIamPolicy` `compute.images.list` `compute.images.listEffectiveTags` `compute.images.listTagBindings` `compute.instanceGroupManagers.get` `compute.instanceGroupManagers.list` `compute.instanceGroups.get` `compute.instanceGroups.list` `compute.instanceTemplates.get` `compute.instanceTemplates.getIamPolicy` `compute.instanceTemplates.list` `compute.instances.getEffectiveFirewalls` `compute.instances.getGuestAttributes` `compute.instances.getIamPolicy` `compute.instances.getScreenshot` `compute.instances.getSerialPortOutput` `compute.instances.getShieldedInstanceIdentity` `compute.instances.getShieldedVmIdentity` `compute.instances.listEffectiveTags` `compute.instances.listReferrers` `compute.instances.listTagBindings` `compute.instantSnapshots.get` `compute.instantSnapshots.getIamPolicy` `compute.instantSnapshots.list` `compute.interconnectAttachments.get` `compute.interconnectAttachments.list` `compute.interconnectLocations.get` `compute.interconnectLocations.list` `compute.interconnectRemoteLocations.get` `compute.interconnectRemoteLocations.list` `compute.interconnects.get` `compute.interconnects.list` `compute.licenseCodes.get` `compute.licenseCodes.getIamPolicy` `compute.licenseCodes.list` `compute.licenses.get` `compute.licenses.getIamPolicy` `compute.licenses.list` `compute.machineImages.get` `compute.machineImages.getIamPolicy` `compute.machineImages.list` `compute.machineTypes.get` `compute.machineTypes.list` `compute.maintenancePolicies.get` `compute.maintenancePolicies.getIamPolicy` `compute.maintenancePolicies.list` `compute.networkAttachments.get` `compute.networkAttachments.list` `compute.networkEdgeSecurityServices.get` `compute.networkEdgeSecurityServices.list` `compute.networkEndpointGroups.getIamPolicy` `compute.networkEndpointGroups.list` `compute.networks.get` `compute.networks.getEffectiveFirewalls` `compute.networks.getRegionEffectiveFirewalls` `compute.networks.list` `compute.networks.listPeeringRoutes` `compute.nodeGroups.get` `compute.nodeGroups.getIamPolicy` `compute.nodeGroups.list` `compute.nodeTemplates.get` `compute.nodeTemplates.getIamPolicy` `compute.nodeTemplates.list` `compute.nodeTypes.get` `compute.nodeTypes.list` `compute.organizations.listAssociations` `compute.packetMirrorings.get` `compute.packetMirrorings.list` `compute.publicAdvertisedPrefixes.get` `compute.publicAdvertisedPrefixes.list` `compute.publicDelegatedPrefixes.get` `compute.publicDelegatedPrefixes.list` `compute.regionBackendServices.get` `compute.regionBackendServices.getIamPolicy` `compute.regionBackendServices.list` `compute.regionFirewallPolicies.get` `compute.regionFirewallPolicies.getIamPolicy` `compute.regionFirewallPolicies.list` `compute.regionHealthCheckServices.get` `compute.regionHealthCheckServices.list` `compute.regionHealthChecks.get` `compute.regionHealthChecks.list` `compute.regionNetworkEndpointGroups.get` `compute.regionNetworkEndpointGroups.list` `compute.regionNotificationEndpoints.get` `compute.regionNotificationEndpoints.list` `compute.regionOperations.get` `compute.regionOperations.getIamPolicy` `compute.regionOperations.list` `compute.regionSecurityPolicies.get` `compute.regionSecurityPolicies.list` `compute.regionSslCertificates.get` `compute.regionSslCertificates.list` `compute.regionSslPolicies.get` `compute.regionSslPolicies.list` `compute.regionSslPolicies.listAvailableFeatures` `compute.regionTargetHttpProxies.get` `compute.regionTargetHttpProxies.list` `compute.regionTargetHttpsProxies.get` `compute.regionTargetHttpsProxies.list` `compute.regionTargetTcpProxies.get` `compute.regionTargetTcpProxies.list` `compute.regionUrlMaps.get` `compute.regionUrlMaps.list` `compute.regionUrlMaps.validate` `compute.regions.get` `compute.regions.list` `compute.reservations.get` `compute.reservations.list` `compute.resourcePolicies.get` `compute.resourcePolicies.getIamPolicy` `compute.resourcePolicies.list` `compute.routers.get` `compute.routers.list` `compute.routes.get` `compute.routes.list` `compute.securityPolicies.get` `compute.securityPolicies.getIamPolicy` `compute.securityPolicies.list` `compute.serviceAttachments.get` `compute.serviceAttachments.getIamPolicy` `compute.serviceAttachments.list` `compute.snapshots.get` `compute.snapshots.getIamPolicy` `compute.snapshots.list` `compute.snapshots.listEffectiveTags` `compute.snapshots.listTagBindings` `compute.sslCertificates.get` `compute.sslCertificates.list` `compute.sslPolicies.get` `compute.sslPolicies.list` `compute.sslPolicies.listAvailableFeatures` `compute.subnetworks.get` `compute.subnetworks.getIamPolicy` `compute.subnetworks.list` `compute.targetGrpcProxies.get` `compute.targetGrpcProxies.list` `compute.targetHttpProxies.get` `compute.targetHttpProxies.list` `compute.targetHttpsProxies.get` `compute.targetHttpsProxies.list` `compute.targetInstances.get` `compute.targetInstances.list` `compute.targetPools.get` `compute.targetPools.list` `compute.targetSslProxies.get` `compute.targetSslProxies.list` `compute.targetTcpProxies.get` `compute.targetTcpProxies.list` `compute.targetVpnGateways.get` `compute.targetVpnGateways.list` `compute.urlMaps.get` `compute.urlMaps.list` `compute.urlMaps.validate` `compute.vpnGateways.get` `compute.vpnGateways.list` `compute.vpnTunnels.get` `compute.vpnTunnels.list` `compute.zoneOperations.get` `compute.zoneOperations.getIamPolicy` `compute.zoneOperations.list` `compute.zones.get` `compute.zones.list` `container.apiServices.get` `container.apiServices.getStatus` `container.apiServices.list` `container.auditSinks.get` `container.auditSinks.list` `container.backendConfigs.get` `container.backendConfigs.list` `container.bindings.get` `container.bindings.list` `container.certificateSigningRequests.get` `container.certificateSigningRequests.getStatus` `container.certificateSigningRequests.list` `container.clusterRoleBindings.get` `container.clusterRoleBindings.list` `container.clusterRoles.get` `container.clusterRoles.list` `container.clusters.list` `container.componentStatuses.get` `container.componentStatuses.list` `container.configMaps.get` `container.configMaps.list` `container.controllerRevisions.get` `container.controllerRevisions.list` `container.cronJobs.get` `container.cronJobs.getStatus` `container.cronJobs.list` `container.csiDrivers.get` `container.csiDrivers.list` `container.csiNodeInfos.get` `container.csiNodeInfos.list` `container.csiNodes.get` `container.csiNodes.list` `container.customResourceDefinitions.get` `container.customResourceDefinitions.getStatus` `container.customResourceDefinitions.list` `container.daemonSets.get` `container.daemonSets.getStatus` `container.daemonSets.list` `container.deployments.get` `container.deployments.getScale` `container.deployments.getStatus` `container.deployments.list` `container.endpointSlices.get` `container.endpointSlices.list` `container.endpoints.get` `container.endpoints.list` `container.events.get` `container.events.list` `container.frontendConfigs.get` `container.frontendConfigs.list` `container.horizontalPodAutoscalers.get` `container.horizontalPodAutoscalers.getStatus` `container.horizontalPodAutoscalers.list` `container.ingresses.get` `container.ingresses.getStatus` `container.ingresses.list` `container.initializerConfigurations.get` `container.initializerConfigurations.list` `container.jobs.get` `container.jobs.getStatus` `container.jobs.list` `container.leases.get` `container.leases.list` `container.limitRanges.get` `container.limitRanges.list` `container.managedCertificates.get` `container.managedCertificates.list` `container.mutatingWebhookConfigurations.get` `container.mutatingWebhookConfigurations.list` `container.namespaces.get` `container.namespaces.getStatus` `container.namespaces.list` `container.networkPolicies.get` `container.networkPolicies.list` `container.nodes.get` `container.nodes.getStatus` `container.nodes.list` `container.operations.get` `container.operations.list` `container.persistentVolumeClaims.get` `container.persistentVolumeClaims.getStatus` `container.persistentVolumeClaims.list` `container.persistentVolumes.get` `container.persistentVolumes.getStatus` `container.persistentVolumes.list` `container.petSets.get` `container.petSets.list` `container.podDisruptionBudgets.get` `container.podDisruptionBudgets.getStatus` `container.podDisruptionBudgets.list` `container.podPresets.get` `container.podPresets.list` `container.podSecurityPolicies.get` `container.podSecurityPolicies.list` `container.podTemplates.get` `container.podTemplates.list` `container.pods.get` `container.pods.getStatus` `container.pods.list` `container.priorityClasses.get` `container.priorityClasses.list` `container.replicaSets.get` `container.replicaSets.getScale` `container.replicaSets.getStatus` `container.replicaSets.list` `container.replicationControllers.get` `container.replicationControllers.getScale` `container.replicationControllers.getStatus` `container.replicationControllers.list` `container.resourceQuotas.get` `container.resourceQuotas.getStatus` `container.resourceQuotas.list` `container.roleBindings.get` `container.roleBindings.list` `container.roles.get` `container.roles.list` `container.runtimeClasses.get` `container.runtimeClasses.list` `container.scheduledJobs.get` `container.scheduledJobs.list` `container.serviceAccounts.get` `container.serviceAccounts.list` `container.services.get` `container.services.getStatus` `container.services.list` `container.statefulSets.get` `container.statefulSets.getScale` `container.statefulSets.getStatus` `container.statefulSets.list` `container.storageClasses.get` `container.storageClasses.list` `container.storageStates.get` `container.storageStates.getStatus` `container.storageStates.list` `container.storageVersionMigrations.get` `container.storageVersionMigrations.getStatus` `container.storageVersionMigrations.list` `container.thirdPartyObjects.get` `container.thirdPartyObjects.list` `container.thirdPartyResources.get` `container.thirdPartyResources.list` `container.tokenReviews.create` `container.updateInfos.get` `container.updateInfos.list` `container.validatingWebhookConfigurations.get` `container.validatingWebhookConfigurations.list` `container.volumeAttachments.get` `container.volumeAttachments.getStatus` `container.volumeAttachments.list` `container.volumeSnapshotClasses.get` `container.volumeSnapshotClasses.list` `container.volumeSnapshotContents.get` `container.volumeSnapshotContents.getStatus` `container.volumeSnapshotContents.list` `container.volumeSnapshots.get` `container.volumeSnapshots.list` `dlp.jobs.get` `dlp.jobs.list` `logging.buckets.get` `logging.buckets.list` `logging.exclusions.get` `logging.exclusions.list` `logging.links.get` `logging.links.list` `logging.locations.get` `logging.locations.list` `logging.logMetrics.get` `logging.logMetrics.list` `logging.logServiceIndexes.list` `logging.logServices.list` `logging.logs.list` `logging.operations.get` `logging.operations.list` `logging.queries.create` `logging.queries.delete` `logging.queries.get` `logging.queries.list` `logging.queries.listShared` `logging.queries.update` `logging.sinks.get` `logging.sinks.list` `logging.usage.get` `logging.views.get` `logging.views.list` `monitoring.alertPolicies.get` `recommender.containerDiagnosisInsights.get` `recommender.containerDiagnosisInsights.list` `recommender.containerDiagnosisRecommendations.get` `recommender.containerDiagnosisRecommendations.list` `recommender.networkAnalyzerGkeConnectivityInsights.get` `recommender.networkAnalyzerGkeConnectivityInsights.list` `recommender.networkAnalyzerGkeIpAddressInsights.get` `recommender.networkAnalyzerGkeIpAddressInsights.list` `securitycenter.assets.group` `securitycenter.assets.listAssetPropertyNames` `securitycenter.assets.runDiscovery` `securitycenter.bigQueryExports.create` `securitycenter.bigQueryExports.delete` `securitycenter.bigQueryExports.get` `securitycenter.bigQueryExports.list` `securitycenter.bigQueryExports.update` `securitycenter.containerthreatdetectionsettings.calculate` `securitycenter.containerthreatdetectionsettings.get` `securitycenter.effectivesecurityhealthanalyticscustommodules.get` `securitycenter.effectivesecurityhealthanalyticscustommodules.list` `securitycenter.eventthreatdetectionsettings.calculate` `securitycenter.eventthreatdetectionsettings.get` `securitycenter.findingexternalsystems.update` `securitycenter.findings.bulkMuteUpdate` `securitycenter.findings.group` `securitycenter.findings.listFindingPropertyNames` `securitycenter.findings.setMute` `securitycenter.findings.setState` `securitycenter.findings.setWorkflowState` `securitycenter.findings.update` `securitycenter.findingsecuritymarks.update` `securitycenter.integratedvulnerabilityscannersettings.calculate` `securitycenter.integratedvulnerabilityscannersettings.get` `securitycenter.muteconfigs.create` `securitycenter.muteconfigs.delete` `securitycenter.muteconfigs.get` `securitycenter.muteconfigs.list` `securitycenter.muteconfigs.update` `securitycenter.notificationconfig.get` `securitycenter.notificationconfig.list` `securitycenter.rapidvulnerabilitydetectionsettings.calculate` `securitycenter.rapidvulnerabilitydetectionsettings.get` `securitycenter.securitycentersettings.get` `securitycenter.securityhealthanalyticscustommodules.get` `securitycenter.securityhealthanalyticscustommodules.list` `securitycenter.securityhealthanalyticscustommodules.test` `securitycenter.securityhealthanalyticssettings.calculate` `securitycenter.securityhealthanalyticssettings.get` `securitycenter.sources.get` `securitycenter.sources.update` `securitycenter.subscription.get` `securitycenter.userinterfacemetadata.get` `securitycenter.virtualmachinethreatdetectionsettings.calculate` `securitycenter.virtualmachinethreatdetectionsettings.get` `securitycenter.websecurityscannersettings.calculate` `securitycenter.websecurityscannersettings.get` `serviceusage.apiKeys.get` `serviceusage.apiKeys.getProjectForKey` `serviceusage.apiKeys.list`
Security Command Center	The following permissions have been removed from the Security Health Analytics Service Agent role (`roles/securitycenter.securityHealthAnalyticsServiceAgent`): `apikeys.keys.get` `apikeys.keys.getKeyString` `apikeys.keys.list` `apikeys.keys.lookup` `appengine.applications.get` `cloudsecurityscanner.crawledurls.list` `cloudsecurityscanner.results.get` `cloudsecurityscanner.results.list` `cloudsecurityscanner.scanruns.get` `cloudsecurityscanner.scanruns.getSummary` `cloudsecurityscanner.scanruns.list` `cloudsecurityscanner.scanruns.stop` `cloudsecurityscanner.scans.create` `cloudsecurityscanner.scans.delete` `cloudsecurityscanner.scans.get` `cloudsecurityscanner.scans.list` `cloudsecurityscanner.scans.run` `cloudsecurityscanner.scans.update` `cloudsql.instances.get` `compute.acceleratorTypes.get` `compute.acceleratorTypes.list` `compute.addresses.get` `compute.addresses.list` `compute.autoscalers.get` `compute.autoscalers.list` `compute.backendBuckets.get` `compute.backendBuckets.getIamPolicy` `compute.backendBuckets.list` `compute.backendServices.get` `compute.backendServices.getIamPolicy` `compute.backendServices.list` `compute.commitments.get` `compute.commitments.list` `compute.diskTypes.get` `compute.diskTypes.list` `compute.disks.get` `compute.disks.getIamPolicy` `compute.disks.list` `compute.disks.listEffectiveTags` `compute.disks.listTagBindings` `compute.externalVpnGateways.get` `compute.externalVpnGateways.list` `compute.firewallPolicies.get` `compute.firewallPolicies.getIamPolicy` `compute.firewallPolicies.list` `compute.firewalls.get` `compute.firewalls.list` `compute.forwardingRules.get` `compute.forwardingRules.list` `compute.globalAddresses.get` `compute.globalAddresses.list` `compute.globalForwardingRules.get` `compute.globalForwardingRules.list` `compute.globalForwardingRules.pscGet` `compute.globalNetworkEndpointGroups.get` `compute.globalNetworkEndpointGroups.list` `compute.globalOperations.getIamPolicy` `compute.globalOperations.list` `compute.globalPublicDelegatedPrefixes.get` `compute.globalPublicDelegatedPrefixes.list` `compute.healthChecks.get` `compute.healthChecks.list` `compute.httpHealthChecks.get` `compute.httpHealthChecks.list` `compute.httpsHealthChecks.get` `compute.httpsHealthChecks.list` `compute.images.get` `compute.images.getFromFamily` `compute.images.getIamPolicy` `compute.images.list` `compute.images.listEffectiveTags` `compute.images.listTagBindings` `compute.instanceGroupManagers.get` `compute.instanceGroupManagers.list` `compute.instanceGroups.get` `compute.instanceGroups.list` `compute.instanceTemplates.get` `compute.instanceTemplates.getIamPolicy` `compute.instanceTemplates.list` `compute.instances.getEffectiveFirewalls` `compute.instances.getGuestAttributes` `compute.instances.getIamPolicy` `compute.instances.getScreenshot` `compute.instances.getSerialPortOutput` `compute.instances.getShieldedInstanceIdentity` `compute.instances.getShieldedVmIdentity` `compute.instances.listEffectiveTags` `compute.instances.listReferrers` `compute.instances.listTagBindings` `compute.instantSnapshots.get` `compute.instantSnapshots.getIamPolicy` `compute.instantSnapshots.list` `compute.interconnectAttachments.get` `compute.interconnectAttachments.list` `compute.interconnectLocations.get` `compute.interconnectLocations.list` `compute.interconnectRemoteLocations.get` `compute.interconnectRemoteLocations.list` `compute.interconnects.get` `compute.interconnects.list` `compute.licenseCodes.get` `compute.licenseCodes.getIamPolicy` `compute.licenseCodes.list` `compute.licenses.get` `compute.licenses.getIamPolicy` `compute.licenses.list` `compute.machineImages.get` `compute.machineImages.getIamPolicy` `compute.machineImages.list` `compute.machineTypes.get` `compute.machineTypes.list` `compute.maintenancePolicies.get` `compute.maintenancePolicies.getIamPolicy` `compute.maintenancePolicies.list` `compute.networkAttachments.get` `compute.networkAttachments.list` `compute.networkEdgeSecurityServices.get` `compute.networkEdgeSecurityServices.list` `compute.networkEndpointGroups.getIamPolicy` `compute.networkEndpointGroups.list` `compute.networks.get` `compute.networks.getEffectiveFirewalls` `compute.networks.getRegionEffectiveFirewalls` `compute.networks.list` `compute.networks.listPeeringRoutes` `compute.nodeGroups.get` `compute.nodeGroups.getIamPolicy` `compute.nodeGroups.list` `compute.nodeTemplates.get` `compute.nodeTemplates.getIamPolicy` `compute.nodeTemplates.list` `compute.nodeTypes.get` `compute.nodeTypes.list` `compute.organizations.listAssociations` `compute.packetMirrorings.get` `compute.packetMirrorings.list` `compute.publicAdvertisedPrefixes.get` `compute.publicAdvertisedPrefixes.list` `compute.publicDelegatedPrefixes.get` `compute.publicDelegatedPrefixes.list` `compute.regionBackendServices.get` `compute.regionBackendServices.getIamPolicy` `compute.regionBackendServices.list` `compute.regionFirewallPolicies.get` `compute.regionFirewallPolicies.getIamPolicy` `compute.regionFirewallPolicies.list` `compute.regionHealthCheckServices.get` `compute.regionHealthCheckServices.list` `compute.regionHealthChecks.get` `compute.regionHealthChecks.list` `compute.regionNetworkEndpointGroups.get` `compute.regionNetworkEndpointGroups.list` `compute.regionNotificationEndpoints.get` `compute.regionNotificationEndpoints.list` `compute.regionOperations.get` `compute.regionOperations.getIamPolicy` `compute.regionOperations.list` `compute.regionSecurityPolicies.get` `compute.regionSecurityPolicies.list` `compute.regionSslCertificates.get` `compute.regionSslCertificates.list` `compute.regionSslPolicies.get` `compute.regionSslPolicies.list` `compute.regionSslPolicies.listAvailableFeatures` `compute.regionTargetHttpProxies.get` `compute.regionTargetHttpProxies.list` `compute.regionTargetHttpsProxies.get` `compute.regionTargetHttpsProxies.list` `compute.regionTargetTcpProxies.get` `compute.regionTargetTcpProxies.list` `compute.regionUrlMaps.get` `compute.regionUrlMaps.list` `compute.regionUrlMaps.validate` `compute.regions.get` `compute.regions.list` `compute.reservations.get` `compute.reservations.list` `compute.resourcePolicies.get` `compute.resourcePolicies.getIamPolicy` `compute.resourcePolicies.list` `compute.routers.get` `compute.routers.list` `compute.routes.get` `compute.routes.list` `compute.securityPolicies.get` `compute.securityPolicies.getIamPolicy` `compute.securityPolicies.list` `compute.serviceAttachments.get` `compute.serviceAttachments.getIamPolicy` `compute.serviceAttachments.list` `compute.snapshots.get` `compute.snapshots.getIamPolicy` `compute.snapshots.list` `compute.snapshots.listEffectiveTags` `compute.snapshots.listTagBindings` `compute.sslCertificates.get` `compute.sslCertificates.list` `compute.sslPolicies.get` `compute.sslPolicies.list` `compute.sslPolicies.listAvailableFeatures` `compute.subnetworks.get` `compute.subnetworks.getIamPolicy` `compute.subnetworks.list` `compute.targetGrpcProxies.get` `compute.targetGrpcProxies.list` `compute.targetHttpProxies.get` `compute.targetHttpProxies.list` `compute.targetHttpsProxies.get` `compute.targetHttpsProxies.list` `compute.targetInstances.get` `compute.targetInstances.list` `compute.targetPools.get` `compute.targetPools.list` `compute.targetSslProxies.get` `compute.targetSslProxies.list` `compute.targetTcpProxies.get` `compute.targetTcpProxies.list` `compute.targetVpnGateways.get` `compute.targetVpnGateways.list` `compute.urlMaps.get` `compute.urlMaps.list` `compute.urlMaps.validate` `compute.vpnGateways.get` `compute.vpnGateways.list` `compute.vpnTunnels.get` `compute.vpnTunnels.list` `compute.zoneOperations.get` `compute.zoneOperations.getIamPolicy` `compute.zoneOperations.list` `compute.zones.get` `compute.zones.list` `container.clusters.list` `logging.buckets.get` `logging.buckets.list` `logging.exclusions.get` `logging.exclusions.list` `logging.links.get` `logging.links.list` `logging.locations.get` `logging.locations.list` `logging.logEntries.list` `logging.logMetrics.get` `logging.logMetrics.list` `logging.logServiceIndexes.list` `logging.logServices.list` `logging.logs.list` `logging.operations.get` `logging.operations.list` `logging.queries.create` `logging.queries.delete` `logging.queries.get` `logging.queries.list` `logging.queries.listShared` `logging.queries.update` `logging.sinks.get` `logging.sinks.list` `logging.usage.get` `logging.views.get` `logging.views.list` `monitoring.alertPolicies.get` `resourcemanager.folders.get` `resourcemanager.folders.list` `resourcemanager.organizations.get` `resourcemanager.tagValues.get` `securitycenter.assets.group` `securitycenter.assets.list` `securitycenter.assets.listAssetPropertyNames` `securitycenter.assets.runDiscovery` `securitycenter.assetsecuritymarks.update` `securitycenter.bigQueryExports.create` `securitycenter.bigQueryExports.delete` `securitycenter.bigQueryExports.get` `securitycenter.bigQueryExports.list` `securitycenter.bigQueryExports.update` `securitycenter.containerthreatdetectionsettings.calculate` `securitycenter.containerthreatdetectionsettings.get` `securitycenter.effectivesecurityhealthanalyticscustommodules.get` `securitycenter.effectivesecurityhealthanalyticscustommodules.list` `securitycenter.eventthreatdetectionsettings.calculate` `securitycenter.eventthreatdetectionsettings.get` `securitycenter.findingexternalsystems.update` `securitycenter.findings.bulkMuteUpdate` `securitycenter.findings.group` `securitycenter.findings.list` `securitycenter.findings.listFindingPropertyNames` `securitycenter.findings.setMute` `securitycenter.findings.setState` `securitycenter.findings.setWorkflowState` `securitycenter.findings.update` `securitycenter.findingsecuritymarks.update` `securitycenter.integratedvulnerabilityscannersettings.calculate` `securitycenter.integratedvulnerabilityscannersettings.get` `securitycenter.muteconfigs.create` `securitycenter.muteconfigs.delete` `securitycenter.muteconfigs.get` `securitycenter.muteconfigs.list` `securitycenter.muteconfigs.update` `securitycenter.notificationconfig.create` `securitycenter.notificationconfig.delete` `securitycenter.notificationconfig.get` `securitycenter.notificationconfig.list` `securitycenter.notificationconfig.update` `securitycenter.rapidvulnerabilitydetectionsettings.calculate` `securitycenter.rapidvulnerabilitydetectionsettings.get` `securitycenter.securitycentersettings.get` `securitycenter.securityhealthanalyticscustommodules.get` `securitycenter.securityhealthanalyticscustommodules.list` `securitycenter.securityhealthanalyticscustommodules.test` `securitycenter.securityhealthanalyticssettings.calculate` `securitycenter.securityhealthanalyticssettings.get` `securitycenter.sources.get` `securitycenter.sources.list` `securitycenter.sources.update` `securitycenter.subscription.get` `securitycenter.userinterfacemetadata.get` `securitycenter.virtualmachinethreatdetectionsettings.calculate` `securitycenter.virtualmachinethreatdetectionsettings.get` `securitycenter.websecurityscannersettings.calculate` `securitycenter.websecurityscannersettings.get` `serviceusage.apiKeys.get` `serviceusage.apiKeys.getProjectForKey` `serviceusage.apiKeys.list`
Security Command Center	The following permissions have been removed from the Security Center Service Agent role (`roles/securitycenter.serviceAgent`): `apikeys.keys.get` `apikeys.keys.getKeyString` `apikeys.keys.list` `apikeys.keys.lookup` `appengine.applications.get` `appengine.instances.get` `appengine.instances.list` `appengine.operations.get` `appengine.operations.list` `appengine.services.get` `appengine.services.list` `appengine.versions.get` `appengine.versions.list` `cloudsecurityscanner.crawledurls.list` `cloudsecurityscanner.results.get` `cloudsecurityscanner.results.list` `cloudsecurityscanner.scanruns.get` `cloudsecurityscanner.scanruns.getSummary` `cloudsecurityscanner.scanruns.list` `cloudsecurityscanner.scanruns.stop` `cloudsecurityscanner.scans.create` `cloudsecurityscanner.scans.delete` `cloudsecurityscanner.scans.get` `cloudsecurityscanner.scans.list` `cloudsecurityscanner.scans.run` `cloudsecurityscanner.scans.update` `cloudsql.instances.get` `compute.acceleratorTypes.get` `compute.acceleratorTypes.list` `compute.addresses.get` `compute.addresses.list` `compute.autoscalers.get` `compute.autoscalers.list` `compute.backendBuckets.get` `compute.backendBuckets.getIamPolicy` `compute.backendBuckets.list` `compute.backendServices.get` `compute.backendServices.getIamPolicy` `compute.backendServices.list` `compute.commitments.get` `compute.commitments.list` `compute.diskTypes.get` `compute.diskTypes.list` `compute.disks.get` `compute.disks.getIamPolicy` `compute.disks.list` `compute.disks.listEffectiveTags` `compute.disks.listTagBindings` `compute.externalVpnGateways.get` `compute.externalVpnGateways.list` `compute.firewallPolicies.get` `compute.firewallPolicies.getIamPolicy` `compute.firewallPolicies.list` `compute.firewalls.get` `compute.firewalls.list` `compute.forwardingRules.get` `compute.forwardingRules.list` `compute.globalAddresses.get` `compute.globalAddresses.list` `compute.globalForwardingRules.get` `compute.globalForwardingRules.list` `compute.globalForwardingRules.pscGet` `compute.globalNetworkEndpointGroups.get` `compute.globalNetworkEndpointGroups.list` `compute.globalOperations.getIamPolicy` `compute.globalOperations.list` `compute.globalPublicDelegatedPrefixes.get` `compute.globalPublicDelegatedPrefixes.list` `compute.healthChecks.get` `compute.healthChecks.list` `compute.httpHealthChecks.get` `compute.httpHealthChecks.list` `compute.httpsHealthChecks.get` `compute.httpsHealthChecks.list` `compute.images.get` `compute.images.getFromFamily` `compute.images.getIamPolicy` `compute.images.list` `compute.images.listEffectiveTags` `compute.images.listTagBindings` `compute.instanceGroupManagers.get` `compute.instanceGroupManagers.list` `compute.instanceGroups.get` `compute.instanceGroups.list` `compute.instanceTemplates.get` `compute.instanceTemplates.getIamPolicy` `compute.instanceTemplates.list` `compute.instances.getEffectiveFirewalls` `compute.instances.getGuestAttributes` `compute.instances.getIamPolicy` `compute.instances.getScreenshot` `compute.instances.getSerialPortOutput` `compute.instances.getShieldedInstanceIdentity` `compute.instances.getShieldedVmIdentity` `compute.instances.listEffectiveTags` `compute.instances.listReferrers` `compute.instances.listTagBindings` `compute.instantSnapshots.get` `compute.instantSnapshots.getIamPolicy` `compute.instantSnapshots.list` `compute.interconnectAttachments.get` `compute.interconnectAttachments.list` `compute.interconnectLocations.get` `compute.interconnectLocations.list` `compute.interconnectRemoteLocations.get` `compute.interconnectRemoteLocations.list` `compute.interconnects.get` `compute.interconnects.list` `compute.licenseCodes.get` `compute.licenseCodes.getIamPolicy` `compute.licenseCodes.list` `compute.licenses.get` `compute.licenses.getIamPolicy` `compute.licenses.list` `compute.machineImages.get` `compute.machineImages.getIamPolicy` `compute.machineImages.list` `compute.machineTypes.get` `compute.machineTypes.list` `compute.maintenancePolicies.get` `compute.maintenancePolicies.getIamPolicy` `compute.maintenancePolicies.list` `compute.networkAttachments.get` `compute.networkAttachments.list` `compute.networkEdgeSecurityServices.get` `compute.networkEdgeSecurityServices.list` `compute.networkEndpointGroups.getIamPolicy` `compute.networkEndpointGroups.list` `compute.networks.get` `compute.networks.getEffectiveFirewalls` `compute.networks.getRegionEffectiveFirewalls` `compute.networks.list` `compute.networks.listPeeringRoutes` `compute.nodeGroups.get` `compute.nodeGroups.getIamPolicy` `compute.nodeGroups.list` `compute.nodeTemplates.get` `compute.nodeTemplates.getIamPolicy` `compute.nodeTemplates.list` `compute.nodeTypes.get` `compute.nodeTypes.list` `compute.organizations.listAssociations` `compute.packetMirrorings.get` `compute.packetMirrorings.list` `compute.publicAdvertisedPrefixes.get` `compute.publicAdvertisedPrefixes.list` `compute.publicDelegatedPrefixes.get` `compute.publicDelegatedPrefixes.list` `compute.regionBackendServices.get` `compute.regionBackendServices.getIamPolicy` `compute.regionBackendServices.list` `compute.regionFirewallPolicies.get` `compute.regionFirewallPolicies.getIamPolicy` `compute.regionFirewallPolicies.list` `compute.regionHealthCheckServices.get` `compute.regionHealthCheckServices.list` `compute.regionHealthChecks.get` `compute.regionHealthChecks.list` `compute.regionNetworkEndpointGroups.get` `compute.regionNetworkEndpointGroups.list` `compute.regionNotificationEndpoints.get` `compute.regionNotificationEndpoints.list` `compute.regionOperations.get` `compute.regionOperations.getIamPolicy` `compute.regionOperations.list` `compute.regionSecurityPolicies.get` `compute.regionSecurityPolicies.list` `compute.regionSslCertificates.get` `compute.regionSslCertificates.list` `compute.regionSslPolicies.get` `compute.regionSslPolicies.list` `compute.regionSslPolicies.listAvailableFeatures` `compute.regionTargetHttpProxies.get` `compute.regionTargetHttpProxies.list` `compute.regionTargetHttpsProxies.get` `compute.regionTargetHttpsProxies.list` `compute.regionTargetTcpProxies.get` `compute.regionTargetTcpProxies.list` `compute.regionUrlMaps.get` `compute.regionUrlMaps.list` `compute.regionUrlMaps.validate` `compute.regions.get` `compute.regions.list` `compute.reservations.get` `compute.reservations.list` `compute.resourcePolicies.get` `compute.resourcePolicies.getIamPolicy` `compute.resourcePolicies.list` `compute.routers.get` `compute.routers.list` `compute.routes.get` `compute.routes.list` `compute.securityPolicies.get` `compute.securityPolicies.getIamPolicy` `compute.securityPolicies.list` `compute.serviceAttachments.get` `compute.serviceAttachments.getIamPolicy` `compute.serviceAttachments.list` `compute.snapshots.get` `compute.snapshots.getIamPolicy` `compute.snapshots.list` `compute.snapshots.listEffectiveTags` `compute.snapshots.listTagBindings` `compute.sslCertificates.get` `compute.sslCertificates.list` `compute.sslPolicies.get` `compute.sslPolicies.list` `compute.sslPolicies.listAvailableFeatures` `compute.subnetworks.get` `compute.subnetworks.getIamPolicy` `compute.subnetworks.list` `compute.targetGrpcProxies.get` `compute.targetGrpcProxies.list` `compute.targetHttpProxies.get` `compute.targetHttpProxies.list` `compute.targetHttpsProxies.get` `compute.targetHttpsProxies.list` `compute.targetInstances.get` `compute.targetInstances.list` `compute.targetPools.get` `compute.targetPools.list` `compute.targetSslProxies.get` `compute.targetSslProxies.list` `compute.targetTcpProxies.get` `compute.targetTcpProxies.list` `compute.targetVpnGateways.get` `compute.targetVpnGateways.list` `compute.urlMaps.get` `compute.urlMaps.list` `compute.urlMaps.validate` `compute.vpnGateways.get` `compute.vpnGateways.list` `compute.vpnTunnels.get` `compute.vpnTunnels.list` `compute.zoneOperations.get` `compute.zoneOperations.getIamPolicy` `compute.zoneOperations.list` `compute.zones.get` `compute.zones.list` `container.apiServices.get` `container.apiServices.getStatus` `container.apiServices.list` `container.auditSinks.get` `container.auditSinks.list` `container.backendConfigs.get` `container.backendConfigs.list` `container.bindings.get` `container.bindings.list` `container.certificateSigningRequests.get` `container.certificateSigningRequests.getStatus` `container.certificateSigningRequests.list` `container.clusterRoleBindings.get` `container.clusterRoleBindings.list` `container.clusterRoles.get` `container.clusterRoles.list` `container.clusters.list` `container.componentStatuses.get` `container.componentStatuses.list` `container.configMaps.get` `container.configMaps.list` `container.controllerRevisions.get` `container.controllerRevisions.list` `container.cronJobs.get` `container.cronJobs.getStatus` `container.cronJobs.list` `container.csiDrivers.get` `container.csiDrivers.list` `container.csiNodeInfos.get` `container.csiNodeInfos.list` `container.csiNodes.get` `container.csiNodes.list` `container.customResourceDefinitions.get` `container.customResourceDefinitions.getStatus` `container.customResourceDefinitions.list` `container.daemonSets.get` `container.daemonSets.getStatus` `container.daemonSets.list` `container.deployments.get` `container.deployments.getScale` `container.deployments.getStatus` `container.deployments.list` `container.endpointSlices.get` `container.endpointSlices.list` `container.endpoints.get` `container.endpoints.list` `container.events.get` `container.events.list` `container.frontendConfigs.get` `container.frontendConfigs.list` `container.horizontalPodAutoscalers.get` `container.horizontalPodAutoscalers.getStatus` `container.horizontalPodAutoscalers.list` `container.ingresses.get` `container.ingresses.getStatus` `container.ingresses.list` `container.initializerConfigurations.get` `container.initializerConfigurations.list` `container.jobs.get` `container.jobs.getStatus` `container.jobs.list` `container.leases.get` `container.leases.list` `container.limitRanges.get` `container.limitRanges.list` `container.managedCertificates.get` `container.managedCertificates.list` `container.mutatingWebhookConfigurations.get` `container.mutatingWebhookConfigurations.list` `container.namespaces.get` `container.namespaces.getStatus` `container.namespaces.list` `container.networkPolicies.get` `container.networkPolicies.list` `container.nodes.get` `container.nodes.getStatus` `container.nodes.list` `container.operations.get` `container.operations.list` `container.persistentVolumeClaims.get` `container.persistentVolumeClaims.getStatus` `container.persistentVolumeClaims.list` `container.persistentVolumes.get` `container.persistentVolumes.getStatus` `container.persistentVolumes.list` `container.petSets.get` `container.petSets.list` `container.podDisruptionBudgets.get` `container.podDisruptionBudgets.getStatus` `container.podDisruptionBudgets.list` `container.podPresets.get` `container.podPresets.list` `container.podSecurityPolicies.get` `container.podSecurityPolicies.list` `container.podTemplates.get` `container.podTemplates.list` `container.pods.get` `container.pods.getStatus` `container.pods.list` `container.priorityClasses.get` `container.priorityClasses.list` `container.replicaSets.get` `container.replicaSets.getScale` `container.replicaSets.getStatus` `container.replicaSets.list` `container.replicationControllers.get` `container.replicationControllers.getScale` `container.replicationControllers.getStatus` `container.replicationControllers.list` `container.resourceQuotas.get` `container.resourceQuotas.getStatus` `container.resourceQuotas.list` `container.roleBindings.get` `container.roleBindings.list` `container.roles.get` `container.roles.list` `container.runtimeClasses.get` `container.runtimeClasses.list` `container.scheduledJobs.get` `container.scheduledJobs.list` `container.serviceAccounts.get` `container.serviceAccounts.list` `container.services.get` `container.services.getStatus` `container.services.list` `container.statefulSets.get` `container.statefulSets.getScale` `container.statefulSets.getStatus` `container.statefulSets.list` `container.storageClasses.get` `container.storageClasses.list` `container.storageStates.get` `container.storageStates.getStatus` `container.storageStates.list` `container.storageVersionMigrations.get` `container.storageVersionMigrations.getStatus` `container.storageVersionMigrations.list` `container.thirdPartyObjects.get` `container.thirdPartyObjects.list` `container.thirdPartyResources.get` `container.thirdPartyResources.list` `container.tokenReviews.create` `container.updateInfos.get` `container.updateInfos.list` `container.validatingWebhookConfigurations.get` `container.validatingWebhookConfigurations.list` `container.volumeAttachments.get` `container.volumeAttachments.getStatus` `container.volumeAttachments.list` `container.volumeSnapshotClasses.get` `container.volumeSnapshotClasses.list` `container.volumeSnapshotContents.get` `container.volumeSnapshotContents.getStatus` `container.volumeSnapshotContents.list` `container.volumeSnapshots.get` `container.volumeSnapshots.list` `dlp.jobs.get` `dlp.jobs.list` `logging.buckets.get` `logging.buckets.list` `logging.exclusions.get` `logging.exclusions.list` `logging.links.get` `logging.links.list` `logging.locations.get` `logging.locations.list` `logging.logMetrics.get` `logging.logMetrics.list` `logging.logServiceIndexes.list` `logging.logServices.list` `logging.logs.list` `logging.operations.get` `logging.operations.list` `logging.queries.create` `logging.queries.delete` `logging.queries.get` `logging.queries.list` `logging.queries.listShared` `logging.queries.update` `logging.sinks.get` `logging.sinks.list` `logging.usage.get` `logging.views.get` `logging.views.list` `monitoring.alertPolicies.get` `recommender.containerDiagnosisInsights.get` `recommender.containerDiagnosisInsights.list` `recommender.containerDiagnosisRecommendations.get` `recommender.containerDiagnosisRecommendations.list` `recommender.networkAnalyzerGkeConnectivityInsights.get` `recommender.networkAnalyzerGkeConnectivityInsights.list` `recommender.networkAnalyzerGkeIpAddressInsights.get` `recommender.networkAnalyzerGkeIpAddressInsights.list` `securitycenter.assets.group` `securitycenter.assets.listAssetPropertyNames` `securitycenter.assets.runDiscovery` `securitycenter.bigQueryExports.create` `securitycenter.bigQueryExports.delete` `securitycenter.bigQueryExports.get` `securitycenter.bigQueryExports.list` `securitycenter.bigQueryExports.update` `securitycenter.containerthreatdetectionsettings.calculate` `securitycenter.containerthreatdetectionsettings.get` `securitycenter.effectivesecurityhealthanalyticscustommodules.get` `securitycenter.effectivesecurityhealthanalyticscustommodules.list` `securitycenter.eventthreatdetectionsettings.calculate` `securitycenter.eventthreatdetectionsettings.get` `securitycenter.findingexternalsystems.update` `securitycenter.findings.bulkMuteUpdate` `securitycenter.findings.group` `securitycenter.findings.listFindingPropertyNames` `securitycenter.findings.setMute` `securitycenter.findings.setState` `securitycenter.findings.setWorkflowState` `securitycenter.findings.update` `securitycenter.findingsecuritymarks.update` `securitycenter.integratedvulnerabilityscannersettings.calculate` `securitycenter.integratedvulnerabilityscannersettings.get` `securitycenter.muteconfigs.create` `securitycenter.muteconfigs.delete` `securitycenter.muteconfigs.get` `securitycenter.muteconfigs.list` `securitycenter.muteconfigs.update` `securitycenter.notificationconfig.get` `securitycenter.notificationconfig.list` `securitycenter.rapidvulnerabilitydetectionsettings.calculate` `securitycenter.rapidvulnerabilitydetectionsettings.get` `securitycenter.securitycentersettings.get` `securitycenter.securityhealthanalyticscustommodules.get` `securitycenter.securityhealthanalyticscustommodules.list` `securitycenter.securityhealthanalyticscustommodules.test` `securitycenter.securityhealthanalyticssettings.calculate` `securitycenter.securityhealthanalyticssettings.get` `securitycenter.sources.get` `securitycenter.sources.update` `securitycenter.subscription.get` `securitycenter.userinterfacemetadata.get` `securitycenter.virtualmachinethreatdetectionsettings.calculate` `securitycenter.virtualmachinethreatdetectionsettings.get` `securitycenter.websecurityscannersettings.calculate` `securitycenter.websecurityscannersettings.get` `serviceusage.apiKeys.get` `serviceusage.apiKeys.getProjectForKey` `serviceusage.apiKeys.list`
Access Approval	The following permissions have reached General Availability (GA): `accessapproval.requests.approve` `accessapproval.requests.dismiss` `accessapproval.requests.get` `accessapproval.requests.invalidate` `accessapproval.requests.list` `accessapproval.serviceAccounts.get` `accessapproval.settings.delete` `accessapproval.settings.get` `accessapproval.settings.update`
Cloud Billing	The following permissions have been added: `billing.finOpsBenchmarkInformation.get` `billing.finOpsHealthInformation.get`
Cloud Billing	The following permissions are supported in custom roles: `billing.finOpsBenchmarkInformation.get` `billing.finOpsHealthInformation.get`
Cloud Billing	The following permissions have reached General Availability (GA): `billing.finOpsBenchmarkInformation.get` `billing.finOpsHealthInformation.get`
Cloud Controls Partner API	The following permissions have been added: `cloudcontrolspartner.ekmconnections.get` `cloudcontrolspartner.inspectabilityevents.get` `cloudcontrolspartner.platformcontrols.get`
Cloud Controls Partner API	The following permissions are supported in custom roles: `cloudcontrolspartner.ekmconnections.get` `cloudcontrolspartner.inspectabilityevents.get` `cloudcontrolspartner.platformcontrols.get`
Conversational Insights	The following permissions have been added: `contactcenterinsights.conversations.upload`
Conversational Insights	The following permissions are supported in custom roles: `contactcenterinsights.conversations.upload`
Conversational Insights	The following permissions have reached General Availability (GA): `contactcenterinsights.conversations.upload`
Google Cloud Migration Center	The following permissions have been added: `migrationcenter.reportConfigs.create` `migrationcenter.reportConfigs.delete` `migrationcenter.reportConfigs.get` `migrationcenter.reportConfigs.list` `migrationcenter.reports.create` `migrationcenter.reports.delete` `migrationcenter.reports.get` `migrationcenter.reports.list`
Google Cloud Migration Center	The following permissions are supported in custom roles: `migrationcenter.reportConfigs.create` `migrationcenter.reportConfigs.delete` `migrationcenter.reportConfigs.get` `migrationcenter.reportConfigs.list` `migrationcenter.reports.create` `migrationcenter.reports.delete` `migrationcenter.reports.get` `migrationcenter.reports.list`
Spanner	The following permissions are available in custom roles: `spanner.databases.update`

IAM changes as of 2023-06-16

Service	Description
Cloud Build	The following permissions have been added to the Cloud Build Token Accessor role (`roles/cloudbuild.tokenAccessor`): `cloudbuild.repositories.list`
Cloud Controls Partner API	The Cloud Controls Partner EKM Service Agent role (`roles/cloudcontrolspartner.ekmServiceAgent`) has reached General Availability (GA).
Cloud Controls Partner API	The Cloud Controls Partner Monitoring Service Agent role (`roles/cloudcontrolspartner.monitoringServiceAgent`) has reached General Availability (GA).
Conversational Insights	The following permissions have been added to the Contact Center AI Insights Service Agent role (`roles/contactcenterinsights.serviceAgent`): `speech.customClasses.get` `speech.phraseSets.get`
Resource Manager	The following permissions have been added to the Folder Admin role (`roles/resourcemanager.folderAdmin`): `essentialcontacts.contacts.create` `essentialcontacts.contacts.delete` `essentialcontacts.contacts.get` `essentialcontacts.contacts.list` `essentialcontacts.contacts.send` `essentialcontacts.contacts.update`
Resource Manager	The following permissions have been added to the Folder Creator role (`roles/resourcemanager.folderCreator`): `essentialcontacts.contacts.get` `essentialcontacts.contacts.list`
Resource Manager	The following permissions have been added to the Folder Editor role (`roles/resourcemanager.folderEditor`): `essentialcontacts.contacts.get` `essentialcontacts.contacts.list`
Resource Manager	The following permissions have been added to the Folder Viewer role (`roles/resourcemanager.folderViewer`): `essentialcontacts.contacts.get` `essentialcontacts.contacts.list`
Resource Manager	The following permissions have been added to the Organization Administrator role (`roles/resourcemanager.organizationAdmin`): `essentialcontacts.contacts.create` `essentialcontacts.contacts.delete` `essentialcontacts.contacts.get` `essentialcontacts.contacts.list` `essentialcontacts.contacts.send` `essentialcontacts.contacts.update`
Rapid Migration Assessment	The Rapid Migration Assessment Admin role (`roles/rma.admin`) has reached General Availability (GA).
Rapid Migration Assessment	The Rapid Migration Assessment Runner role (`roles/rma.runner`) has reached General Availability (GA).
Rapid Migration Assessment	The Rapid Migration Assessment Viewer role (`roles/rma.viewer`) has reached General Availability (GA).
Security Command Center	The following permissions have been added to the Security Center Control Service Agent role (`roles/securitycenter.controlServiceAgent`): `iam.googleapis.com/workloadIdentityPoolProviders.list` `iam.googleapis.com/workloadIdentityPools.list` `iam.workloadIdentityPoolProviders.list` `iam.workloadIdentityPools.list` `monitoring.timeSeries.list` `serviceusage.operations.cancel` `serviceusage.operations.delete` `serviceusage.operations.get` `serviceusage.operations.list` `serviceusage.services.disable`
Security Command Center	The following permissions have been added to the Security Center Service Agent role (`roles/securitycenter.serviceAgent`): `iam.googleapis.com/workloadIdentityPoolProviders.list` `iam.googleapis.com/workloadIdentityPools.list` `iam.workloadIdentityPoolProviders.list` `iam.workloadIdentityPools.list` `monitoring.timeSeries.list` `serviceusage.operations.cancel` `serviceusage.operations.delete` `serviceusage.operations.get` `serviceusage.operations.list` `serviceusage.services.disable` `serviceusage.services.enable`
AlloyDB for PostgreSQL	The following permissions have been added: `alloydb.users.login`
Firebase Extensions Publisher	The following permissions have been added: `firebaseextensionspublisher.extensions.create` `firebaseextensionspublisher.extensions.delete` `firebaseextensionspublisher.extensions.get` `firebaseextensionspublisher.extensions.list`
Firebase Extensions Publisher	The following permissions are supported in custom roles: `firebaseextensionspublisher.extensions.create` `firebaseextensionspublisher.extensions.delete` `firebaseextensionspublisher.extensions.get` `firebaseextensionspublisher.extensions.list`
Rapid Migration Assessment	The following permissions have reached General Availability (GA): `rma.annotations.create` `rma.annotations.get` `rma.collectors.create` `rma.collectors.delete` `rma.collectors.get` `rma.collectors.list` `rma.collectors.update` `rma.locations.get` `rma.locations.list` `rma.operations.cancel` `rma.operations.delete` `rma.operations.get` `rma.operations.list`

IAM changes as of 2023-06-09

Service	Change	Description
Firebase Remote Config	Role Updated	The following permissions have been added to the role `roles/cloudconfig.serviceAgent` (Cloud Config Service Agent): `cloudbuild.workerpools.use`
Cloud SQL	Role Updated	The following permissions have been removed from the role `roles/cloudsql.editor` (Cloud SQL Editor): `recommender.cloudsqlInstanceSecurityInsights.get` `recommender.cloudsqlInstanceSecurityInsights.list` `recommender.cloudsqlInstanceSecurityInsights.update` `recommender.cloudsqlInstanceSecurityRecommendations.get` `recommender.cloudsqlInstanceSecurityRecommendations.list` `recommender.cloudsqlInstanceSecurityRecommendations.update`
Cloud SQL	Role Updated	The following permissions have been removed from the role `roles/cloudsql.viewer` (Cloud SQL Viewer): `recommender.cloudsqlInstanceSecurityInsights.get` `recommender.cloudsqlInstanceSecurityInsights.list` `recommender.cloudsqlInstanceSecurityRecommendations.get` `recommender.cloudsqlInstanceSecurityRecommendations.list`
Dataplex	Role Updated	The following permissions have been added to the role `roles/dataplex.serviceAgent` (Cloud Dataplex Service Agent): `dataplex.environments.list`
Discovery Engine	Role Updated	The following permissions have been added to the role `roles/discoveryengine.serviceAgent` (Discovery Engine Service Agent): `discoveryengine.dataStores.completeQuery`
Network Connectivity Center	Role Updated	The following permissions have been added to the role `roles/networkconnectivity.serviceAgent` (Network Connectivity Service Agent): `networkconnectivity.operations.get`
Serverless Integrations	Role Updated	The following permissions have been added to the role `roles/runapps.serviceAgent` (Serverless Integrations Service Agent): `compute.targetHttpProxies.get` `compute.targetHttpProxies.list`
Speaker ID	Now GA	The role `roles/speakerid.admin` (Speaker ID Admin) is now GA.
Speaker ID	Now GA	The role `roles/speakerid.editor` (Speaker ID Editor) is now GA.
Speaker ID	Now GA	The role `roles/speakerid.verifier` (Speaker ID Verifier) is now GA.
Speaker ID	Now GA	The role `roles/speakerid.viewer` (Speaker ID Viewer) is now GA.
Workload Manager	Role Updated	The following permissions have been added to the role `roles/workloadmanager.serviceAgent` (Workload Manager Service Agent): `config.deployments.create` `config.locations.get` `config.locations.list` `config.operations.cancel` `config.operations.delete` `config.operations.get` `config.operations.list`
Vertex AI	Added	`aiplatform.modelEvaluationSlices.import` `aiplatform.modelEvaluations.import` `aiplatform.schedules.create` `aiplatform.schedules.delete` `aiplatform.schedules.get` `aiplatform.schedules.list` `aiplatform.schedules.update`
Cloud Asset Inventory	Added	`cloudasset.assets.analyzeOrgPolicy`
Compute Engine	Added	`compute.regionNetworkEndpointGroups.attachNetworkEndpoints` `compute.regionNetworkEndpointGroups.detachNetworkEndpoints`
Datastore	Added	`datastore.databases.createTagBinding` `datastore.databases.deleteTagBinding` `datastore.databases.listEffectiveTags` `datastore.databases.listTagBindings`
Datastore	Now GA	`datastore.databases.createTagBinding` `datastore.databases.deleteTagBinding` `datastore.databases.listEffectiveTags` `datastore.databases.listTagBindings`
Discovery Engine	Added	`discoveryengine.dataStores.completeQuery`
Discovery Engine	Supported In Custom Roles	`discoveryengine.dataStores.completeQuery`
Google Cloud Migration Center	Added	`migrationcenter.errorFrames.get` `migrationcenter.errorFrames.list` `migrationcenter.importDataFiles.create` `migrationcenter.importDataFiles.delete` `migrationcenter.importDataFiles.get` `migrationcenter.importDataFiles.list`
Google Cloud Migration Center	Supported In Custom Roles	`migrationcenter.errorFrames.get` `migrationcenter.errorFrames.list` `migrationcenter.importDataFiles.create` `migrationcenter.importDataFiles.delete` `migrationcenter.importDataFiles.get` `migrationcenter.importDataFiles.list`
Recommender	Added	`recommender.cloudsqlInstanceReliabilityInsights.get` `recommender.cloudsqlInstanceReliabilityInsights.list` `recommender.cloudsqlInstanceReliabilityInsights.update` `recommender.cloudsqlInstanceReliabilityRecommendations.get` `recommender.cloudsqlInstanceReliabilityRecommendations.list` `recommender.cloudsqlInstanceReliabilityRecommendations.update`
Recommender	Supported In Custom Roles	`recommender.cloudsqlInstanceReliabilityInsights.get` `recommender.cloudsqlInstanceReliabilityInsights.list` `recommender.cloudsqlInstanceReliabilityInsights.update` `recommender.cloudsqlInstanceReliabilityRecommendations.get` `recommender.cloudsqlInstanceReliabilityRecommendations.list` `recommender.cloudsqlInstanceReliabilityRecommendations.update`
Speaker ID	Added	`speakerid.phrases.create` `speakerid.phrases.delete` `speakerid.phrases.get` `speakerid.phrases.list` `speakerid.settings.get` `speakerid.settings.update` `speakerid.speakers.create` `speakerid.speakers.delete` `speakerid.speakers.get` `speakerid.speakers.list` `speakerid.speakers.verify`
Speaker ID	Now GA	`speakerid.phrases.create` `speakerid.phrases.delete` `speakerid.phrases.get` `speakerid.phrases.list` `speakerid.settings.get` `speakerid.settings.update` `speakerid.speakers.create` `speakerid.speakers.delete` `speakerid.speakers.get` `speakerid.speakers.list` `speakerid.speakers.verify`

Cloud IAM changes as of 2023-06-02

Service	Change	Description
Vertex AI	Role Updated	The following permissions have been added to the role `roles/aiplatform.serviceAgent` (Vertex AI Service Agent): `compute.networks.use` `compute.networks.useExternalIp`
AlloyDB for PostgreSQL	Role Updated	The following permissions have been added to the role `roles/alloydb.admin` (Cloud AlloyDB Admin): `alloydb.instances.injectFault`
App Engine flexible environment	Role Updated	The following permissions have been added to the role `roles/appengineflex.serviceAgent` (App Engine flexible environment Service Agent): `compute.routes.create` `compute.routes.delete`
Backup and Disaster Recovery	Now GA	The role `roles/backupdr.backupUser` (Backup and DR Backup User) is now GA.
Backup and Disaster Recovery	Now GA	The role `roles/backupdr.mountUser` (Backup and DR Mount User) is now GA.
Backup and Disaster Recovery	Now GA	The role `roles/backupdr.restoreUser` (Backup and DR Restore User) is now GA.
Backup and Disaster Recovery	Now GA	The role `roles/backupdr.userv2` (Backup and DR User V2) is now GA.
Bare Metal Solution	Now GA	The role `roles/baremetalsolution.maintenanceeventsadmin` (Maintenance Events Admin) is now GA.
Bare Metal Solution	Now GA	The role `roles/baremetalsolution.maintenanceeventseditor` (Maintenance Events Editor) is now GA.
Bare Metal Solution	Now GA	The role `roles/baremetalsolution.maintenanceeventsviewer` (Maintenance Events Viewer) is now GA.
Binary Authorization	Role Updated	The following permissions have been added to the role `roles/binaryauthorization.serviceAgent` (Binary Authorization Service Agent): `artifactregistry.repositories.downloadArtifacts` `binaryauthorization.platformPolicies.evaluatePolicy` `binaryauthorization.policy.evaluatePolicy` `storage.objects.list`
Cloud Build	Role Updated	The following permissions have been added to the role `roles/cloudbuild.builds.builder` (Cloud Build Service Account): `artifactregistry.repositories.deleteArtifacts`
Cloud Build	Role Updated	The following permissions have been added to the role `roles/cloudbuild.serviceAgent` (Cloud Build Service Agent): `artifactregistry.repositories.deleteArtifacts`
Artifact Analysis	Role Updated	The following permissions have been added to the role `roles/containeranalysis.ServiceAgent` (Container Analysis Service Agent): `storage.objects.update`
Container Scanning	Role Updated	The following permissions have been added to the role `roles/containerscanning.ServiceAgent` (Container Scanner Service Agent): `storage.objects.update`
Basic Role	Role Updated	The following permissions have been added to the role `roles/editor` (Editor): `alloydb.instances.injectFault`
Cloud Integrations	Role Updated	The following permissions have been added to the role `roles/integrations.apigeeIntegrationAdminRole` (Apigee Integration Admin): `integrations.executions.get`
Cloud Integrations	Role Updated	The following permissions have been added to the role `roles/integrations.apigeeIntegrationEditorRole` (Apigee Integration Editor): `integrations.executions.get`
Cloud Integrations	Role Updated	The following permissions have been added to the role `roles/integrations.apigeeIntegrationInvokerRole` (Apigee Integration Invoker): `integrations.executions.get`
Cloud Integrations	Role Updated	The following permissions have been added to the role `roles/integrations.apigeeIntegrationsViewer` (Apigee Integration Viewer): `integrations.executions.get`
Cloud Monitoring	Now GA	The role `roles/monitoring.snoozeEditor` (Monitoring Snooze Editor) is now GA.
Cloud Monitoring	Now GA	The role `roles/monitoring.snoozeViewer` (Monitoring Snooze Viewer) is now GA.
Basic Role	Role Updated	The following permissions have been added to the role `roles/owner` (Owner): `alloydb.instances.injectFault`
Basic Role	Role Updated	The following permissions have been removed from the role `roles/viewer` (Viewer): `integrations.certificates.create` `integrations.certificates.delete` `integrations.certificates.update`
Vision AI	Role Updated	The following permissions have been added to the role `roles/visionai.corpusWriter` (VisionAI Warehouse Corpus Writer): `visionai.annotations.get` `visionai.annotations.list` `visionai.assets.clip` `visionai.assets.generateHlsUri` `visionai.assets.get` `visionai.assets.list` `visionai.assets.search`
Cloud Workstations	Now GA	The role `roles/workstations.admin` (Cloud Workstations Admin) is now GA.
Cloud Workstations	Now GA	The role `roles/workstations.networkAdmin` (Cloud Workstations Network Admin) is now GA.
Cloud Workstations	Now GA	The role `roles/workstations.operationViewer` (Cloud Workstations Operation Viewer) is now GA.
Cloud Workstations	Now GA	The role `roles/workstations.user` (Cloud Workstations User) is now GA.
Cloud Workstations	Now GA	The role `roles/workstations.workstationCreator` (Cloud Workstations Creator) is now GA.
Cloud Workstations	Now GA	The role `roles/workstations.workstationUser` (Cloud Workstations User (Deprecated)) is now GA.
AlloyDB for PostgreSQL	Added	`alloydb.instances.injectFault`
Backup and Disaster Recovery	Supported In Custom Roles	`backupdr.managementServers.access` `backupdr.managementServers.accessSensitiveData` `backupdr.managementServers.assignBackupPlans` `backupdr.managementServers.manageApplications` `backupdr.managementServers.manageBackupPlans` `backupdr.managementServers.manageBackupServers` `backupdr.managementServers.manageBackups` `backupdr.managementServers.manageClones` `backupdr.managementServers.manageExpiration` `backupdr.managementServers.manageHosts` `backupdr.managementServers.manageJobs` `backupdr.managementServers.manageLiveClones` `backupdr.managementServers.manageMigrations` `backupdr.managementServers.manageMirroring` `backupdr.managementServers.manageMounts` `backupdr.managementServers.manageRestores` `backupdr.managementServers.manageSensitiveData` `backupdr.managementServers.manageStorage` `backupdr.managementServers.manageSystem` `backupdr.managementServers.manageWorkflows` `backupdr.managementServers.refreshWorkflows` `backupdr.managementServers.runWorkflows` `backupdr.managementServers.testFailOvers` `backupdr.managementServers.viewBackupPlans` `backupdr.managementServers.viewBackupServers` `backupdr.managementServers.viewReports` `backupdr.managementServers.viewStorage` `backupdr.managementServers.viewSystem` `backupdr.managementServers.viewWorkflows`
Backup and Disaster Recovery	Now GA	`backupdr.managementServers.access` `backupdr.managementServers.accessSensitiveData` `backupdr.managementServers.assignBackupPlans` `backupdr.managementServers.manageApplications` `backupdr.managementServers.manageBackupPlans` `backupdr.managementServers.manageBackupServers` `backupdr.managementServers.manageBackups` `backupdr.managementServers.manageClones` `backupdr.managementServers.manageExpiration` `backupdr.managementServers.manageHosts` `backupdr.managementServers.manageJobs` `backupdr.managementServers.manageLiveClones` `backupdr.managementServers.manageMigrations` `backupdr.managementServers.manageMirroring` `backupdr.managementServers.manageMounts` `backupdr.managementServers.manageRestores` `backupdr.managementServers.manageSensitiveData` `backupdr.managementServers.manageStorage` `backupdr.managementServers.manageSystem` `backupdr.managementServers.manageWorkflows` `backupdr.managementServers.refreshWorkflows` `backupdr.managementServers.runWorkflows` `backupdr.managementServers.testFailOvers` `backupdr.managementServers.viewBackupPlans` `backupdr.managementServers.viewBackupServers` `backupdr.managementServers.viewReports` `backupdr.managementServers.viewStorage` `backupdr.managementServers.viewSystem` `backupdr.managementServers.viewWorkflows`
Cloud Integrations	Added	`integrations.securityIntegrationVers.delete`
Cloud Monitoring	Now GA	`monitoring.snoozes.create` `monitoring.snoozes.get` `monitoring.snoozes.list` `monitoring.snoozes.update`
Recommender	Added	`recommender.cloudFunctionsPerformanceInsights.get` `recommender.cloudFunctionsPerformanceInsights.list` `recommender.cloudFunctionsPerformanceInsights.update` `recommender.cloudFunctionsPerformanceRecommendations.get` `recommender.cloudFunctionsPerformanceRecommendations.list` `recommender.cloudFunctionsPerformanceRecommendations.update`
Recommender	Supported In Custom Roles	`recommender.cloudFunctionsPerformanceInsights.get` `recommender.cloudFunctionsPerformanceInsights.list` `recommender.cloudFunctionsPerformanceInsights.update` `recommender.cloudFunctionsPerformanceRecommendations.get` `recommender.cloudFunctionsPerformanceRecommendations.list` `recommender.cloudFunctionsPerformanceRecommendations.update`
Recommender	Now GA	`recommender.cloudFunctionsPerformanceInsights.get` `recommender.cloudFunctionsPerformanceInsights.list` `recommender.cloudFunctionsPerformanceInsights.update` `recommender.cloudFunctionsPerformanceRecommendations.get` `recommender.cloudFunctionsPerformanceRecommendations.list` `recommender.cloudFunctionsPerformanceRecommendations.update`
Cloud Workstations	Now GA	`workstations.operations.get` `workstations.workstationClusters.create` `workstations.workstationClusters.delete` `workstations.workstationClusters.get` `workstations.workstationClusters.list` `workstations.workstationClusters.update` `workstations.workstationConfigs.create` `workstations.workstationConfigs.delete` `workstations.workstationConfigs.get` `workstations.workstationConfigs.getIamPolicy` `workstations.workstationConfigs.list` `workstations.workstationConfigs.setIamPolicy` `workstations.workstationConfigs.update` `workstations.workstations.create` `workstations.workstations.delete` `workstations.workstations.get` `workstations.workstations.getIamPolicy` `workstations.workstations.list` `workstations.workstations.setIamPolicy` `workstations.workstations.start` `workstations.workstations.stop` `workstations.workstations.update` `workstations.workstations.use`

Cloud IAM changes as of 2023-05-26

Service	Change	Description
Vertex AI	Role Updated	The following permissions have been added to the role `roles/aiplatform.serviceAgent` (Vertex AI Service Agent): `compute.zoneOperations.get`
Backup and Disaster Recovery	Role Updated	The following permissions have been added to the role `roles/backupdr.mountUser` (Backup and DR Mount User): `backupdr.managementServers.viewStorage`
Backup and Disaster Recovery	Role Updated	The following permissions have been added to the role `roles/backupdr.restoreUser` (Backup and DR Restore User): `backupdr.managementServers.viewStorage`
Cloud Composer	Role Updated	The following permissions have been added to the role `roles/composer.serviceAgent` (Cloud Composer API Service Agent): `dns.managedZones.get` `dns.managedZones.list` `dns.networks.targetWithPeeringZone`
Cloud Composer	Role Updated	The following permissions have been added to the role `roles/composer.sharedVpcAgent` (Composer Shared VPC Agent): `dns.managedZones.get` `dns.managedZones.list` `dns.networks.targetWithPeeringZone`
Compute Engine	Now GA	The role `roles/compute.loadBalancerAdmin` (Compute Load Balancer Admin) is now GA.
Compute Engine	Now GA	The role `roles/compute.loadBalancerServiceUser` (Compute Load Balancer Services User) is now GA.
Data Lineage API	Now GA	The role `roles/datalineage.admin` (Data Lineage Administrator) is now GA.
Data Lineage API	Now GA	The role `roles/datalineage.editor` (Data Lineage Editor) is now GA.
Data Lineage API	Now GA	The role `roles/datalineage.producer` (Data Lineage Events Producer) is now GA.
Data Lineage API	Now GA	The role `roles/datalineage.viewer` (Data Lineage Viewer) is now GA.
Sensitive Data Protection	Now GA	The role `roles/dlp.subscriptionsAdmin` (DLP Subscription Admin) is now GA.
Sensitive Data Protection	Now GA	The role `roles/dlp.subscriptionsReader` (DLP Subscription Viewer) is now GA.
Network Connectivity Center	Role Updated	The following permissions have been added to the role `roles/networkconnectivity.serviceAgent` (Network Connectivity Service Agent): `compute.forwardingRules.get` `compute.regionOperations.get`
Security Command Center	Role Updated	The following permissions have been added to the role `roles/securitycenter.admin` (Security Center Admin): `cloudasset.assets.exportIamPolicy` `cloudasset.assets.exportOSInventories` `cloudasset.assets.exportResource` `cloudasset.assets.queryAccessPolicy` `cloudasset.assets.queryIamPolicy` `cloudasset.assets.queryOSInventories` `cloudasset.assets.queryResource` `cloudasset.assets.searchAllIamPolicies` `cloudasset.assets.searchAllResources`
Security Command Center	Role Updated	The following permissions have been added to the role `roles/securitycenter.adminEditor` (Security Center Admin Editor): `cloudasset.assets.exportIamPolicy` `cloudasset.assets.exportOSInventories` `cloudasset.assets.exportResource` `cloudasset.assets.queryAccessPolicy` `cloudasset.assets.queryIamPolicy` `cloudasset.assets.queryOSInventories` `cloudasset.assets.queryResource` `cloudasset.assets.searchAllIamPolicies` `cloudasset.assets.searchAllResources`
Security Command Center	Role Updated	The following permissions have been added to the role `roles/securitycenter.adminViewer` (Security Center Admin Viewer): `cloudasset.assets.exportIamPolicy` `cloudasset.assets.exportOSInventories` `cloudasset.assets.exportResource` `cloudasset.assets.queryAccessPolicy` `cloudasset.assets.queryIamPolicy` `cloudasset.assets.queryOSInventories` `cloudasset.assets.queryResource` `cloudasset.assets.searchAllIamPolicies` `cloudasset.assets.searchAllResources`
Security Command Center	Role Updated	The following permissions have been added to the role `roles/securitycenter.assetsViewer` (Security Center Assets Viewer): `cloudasset.assets.exportIamPolicy` `cloudasset.assets.exportOSInventories` `cloudasset.assets.exportResource` `cloudasset.assets.queryAccessPolicy` `cloudasset.assets.queryIamPolicy` `cloudasset.assets.queryOSInventories` `cloudasset.assets.queryResource` `cloudasset.assets.searchAllIamPolicies` `cloudasset.assets.searchAllResources`
Vision AI	Role Updated	The following permissions have been added to the role `roles/visionai.serviceAgent` (Cloud Vision AI Service Agent): `visionai.operators.create` `visionai.operators.delete` `visionai.operators.get` `visionai.operators.list` `visionai.operators.update`
Compute Engine	Now GA	`compute.disks.startAsyncReplication` `compute.disks.stopAsyncReplication` `compute.disks.stopGroupAsyncReplication` `compute.resourcePolicies.useReadOnly`
Data Lineage API	Now GA	`datalineage.events.create` `datalineage.events.delete` `datalineage.events.get` `datalineage.events.list` `datalineage.locations.searchLinks` `datalineage.operations.get` `datalineage.processes.create` `datalineage.processes.delete` `datalineage.processes.get` `datalineage.processes.list` `datalineage.processes.update` `datalineage.runs.create` `datalineage.runs.delete` `datalineage.runs.get` `datalineage.runs.list` `datalineage.runs.update`
Sensitive Data Protection	Added	`dlp.subscriptions.cancel` `dlp.subscriptions.create` `dlp.subscriptions.get` `dlp.subscriptions.list` `dlp.subscriptions.update`
Sensitive Data Protection	Supported In Custom Roles	`dlp.subscriptions.cancel` `dlp.subscriptions.create` `dlp.subscriptions.get` `dlp.subscriptions.list` `dlp.subscriptions.update`
Sensitive Data Protection	Now GA	`dlp.subscriptions.cancel` `dlp.subscriptions.create` `dlp.subscriptions.get` `dlp.subscriptions.list` `dlp.subscriptions.update`

Cloud IAM changes as of 2023-05-19

Service	Change	Description
Vertex AI	Role Updated	The following permissions have been added to the role `roles/aiplatform.serviceAgent` (Vertex AI Service Agent): `compute.networks.get` `compute.subnetworks.list`
Backup and Disaster Recovery	Now GA	The role `roles/backupdr.serviceAgent` (Backup and DR Service Agent) is now GA.
Cloud Build	Role Updated	The following permissions have been removed from the role `roles/cloudbuild.builds.builder` (Cloud Build Service Account): `logging.privateLogEntries.list`
Cloud Build	Role Updated	The following permissions have been removed from the role `roles/cloudbuild.serviceAgent` (Cloud Build Service Agent): `logging.privateLogEntries.list`
Cloud Composer	Role Updated	The following permissions have been removed from the role `roles/composer.worker` (Composer Worker): `logging.privateLogEntries.list`
Artifact Analysis	Role Updated	The following permissions have been added to the role `roles/containeranalysis.ServiceAgent` (Container Analysis Service Agent): `containeranalysis.notes.list`
Container Scanning	Role Updated	The following permissions have been added to the role `roles/containerscanning.ServiceAgent` (Container Scanner Service Agent): `containeranalysis.notes.list`
AlloyDB for PostgreSQL	Added	`alloydb.users.create` `alloydb.users.delete` `alloydb.users.get` `alloydb.users.list` `alloydb.users.update`
Apigee	Added	`apigee.appgroupapps.create` `apigee.appgroupapps.delete` `apigee.appgroupapps.get` `apigee.appgroupapps.list` `apigee.appgroupapps.manage` `apigee.appgroups.create` `apigee.appgroups.delete` `apigee.appgroups.get` `apigee.appgroups.list` `apigee.appgroups.update`
Apigee	Supported In Custom Roles	`apigee.appgroupapps.create` `apigee.appgroupapps.delete` `apigee.appgroupapps.get` `apigee.appgroupapps.list` `apigee.appgroupapps.manage` `apigee.appgroups.create` `apigee.appgroups.delete` `apigee.appgroups.get` `apigee.appgroups.list` `apigee.appgroups.update`
Apigee	Now GA	`apigee.appgroupapps.create` `apigee.appgroupapps.delete` `apigee.appgroupapps.get` `apigee.appgroupapps.list` `apigee.appgroupapps.manage` `apigee.appgroups.create` `apigee.appgroups.delete` `apigee.appgroups.get` `apigee.appgroups.list` `apigee.appgroups.update`
Commerce Price Management	Added	`commerceprice.events.get` `commerceprice.events.list`
Compute Engine	Added	`compute.instances.setSecurityPolicy` `compute.targetInstances.setSecurityPolicy` `compute.targetPools.setSecurityPolicy`
Compute Engine	Supported In Custom Roles	`compute.instances.setSecurityPolicy` `compute.targetInstances.setSecurityPolicy` `compute.targetPools.setSecurityPolicy`
Cloud Commerce Consumer Procurement	Added	`consumerprocurement.events.get` `consumerprocurement.events.list`
Cloud Logging	Now GA	`logging.logEntries.route`
Google Cloud VMware Engine	Added	`vmwareengine.privateConnections.create` `vmwareengine.privateConnections.delete` `vmwareengine.privateConnections.get` `vmwareengine.privateConnections.list` `vmwareengine.privateConnections.listPeeringRoutes` `vmwareengine.privateConnections.update` `vmwareengine.subnets.get` `vmwareengine.subnets.update`
Google Cloud VMware Engine	Supported In Custom Roles	`vmwareengine.privateConnections.create` `vmwareengine.privateConnections.delete` `vmwareengine.privateConnections.get` `vmwareengine.privateConnections.list` `vmwareengine.privateConnections.listPeeringRoutes` `vmwareengine.privateConnections.update` `vmwareengine.subnets.get` `vmwareengine.subnets.update`
Google Cloud VMware Engine	Now GA	`vmwareengine.privateConnections.create` `vmwareengine.privateConnections.delete` `vmwareengine.privateConnections.get` `vmwareengine.privateConnections.list` `vmwareengine.privateConnections.listPeeringRoutes` `vmwareengine.privateConnections.update` `vmwareengine.subnets.get` `vmwareengine.subnets.update`

Cloud IAM changes as of 2023-05-12

Service	Change	Description
Vertex AI	Role Updated	The following permissions have been added to the role `roles/aiplatform.serviceAgent` (Vertex AI Service Agent): `compute.instances.attachDisk` `compute.instances.detachDisk` `compute.instances.start` `compute.instances.stop`
Network Connectivity Center	Role Updated	The following permissions have been added to the role `roles/networkconnectivity.serviceAgent` (Network Connectivity Service Agent): `dns.managedZones.create` `dns.networks.bindPrivateDNSZone` `servicedirectory.namespaces.associatePrivateZone` `servicedirectory.namespaces.create` `servicedirectory.namespaces.delete` `servicedirectory.services.create` `servicedirectory.services.delete`
Cloud Composer	Added	`composer.environments.executeAirflowCommand`
Cloud Composer	Now GA	`composer.environments.executeAirflowCommand`
Compute Engine	Added	`compute.instantSnapshots.create` `compute.instantSnapshots.delete` `compute.instantSnapshots.export` `compute.instantSnapshots.get` `compute.instantSnapshots.getIamPolicy` `compute.instantSnapshots.list` `compute.instantSnapshots.setIamPolicy` `compute.instantSnapshots.setLabels` `compute.instantSnapshots.useReadOnly`
Compute Engine	Supported In Custom Roles	`compute.instantSnapshots.create` `compute.instantSnapshots.delete` `compute.instantSnapshots.get` `compute.instantSnapshots.getIamPolicy` `compute.instantSnapshots.list` `compute.instantSnapshots.setIamPolicy` `compute.instantSnapshots.setLabels` `compute.instantSnapshots.useReadOnly`
Security Command Center	Added	`securitycenter.securityhealthanalyticscustommodules.create` `securitycenter.securityhealthanalyticscustommodules.delete` `securitycenter.securityhealthanalyticscustommodules.get` `securitycenter.securityhealthanalyticscustommodules.list` `securitycenter.securityhealthanalyticscustommodules.test` `securitycenter.securityhealthanalyticscustommodules.update`
Security Command Center	Now GA	`securitycenter.securityhealthanalyticscustommodules.create` `securitycenter.securityhealthanalyticscustommodules.delete` `securitycenter.securityhealthanalyticscustommodules.get` `securitycenter.securityhealthanalyticscustommodules.list` `securitycenter.securityhealthanalyticscustommodules.test` `securitycenter.securityhealthanalyticscustommodules.update`

Cloud IAM changes as of 2023-05-05

Service	Change	Description
Apigee	Role Updated	The following permissions have been added to the role `roles/apigee.analyticsEditor` (Apigee Analytics Editor): `apigee.entitlements.get` `apigee.projectorganizations.get`
Apigee	Role Updated	The following permissions have been added to the role `roles/apigee.analyticsViewer` (Apigee Analytics Viewer): `apigee.entitlements.get` `apigee.projectorganizations.get`
Apigee	Role Updated	The following permissions have been added to the role `roles/apigee.apiAdminV2` (Apigee API Admin): `apigee.entitlements.get` `apigee.projectorganizations.get`
Apigee	Role Updated	The following permissions have been added to the role `roles/apigee.apiReaderV2` (Apigee API Reader): `apigee.entitlements.get` `apigee.projectorganizations.get`
Apigee	Role Updated	The following permissions have been added to the role `roles/apigee.developerAdmin` (Apigee Developer Admin): `apigee.entitlements.get` `apigee.projectorganizations.get`
Apigee	Role Updated	The following permissions have been added to the role `roles/apigee.environmentAdmin` (Apigee Environment Admin): `apigee.entitlements.get` `apigee.projectorganizations.get`
Apigee	Role Updated	The following permissions have been added to the role `roles/apigee.monetizationAdmin` (Apigee Monetization Admin): `apigee.entitlements.get` `apigee.projectorganizations.get`
Apigee	Role Updated	The following permissions have been added to the role `roles/apigee.portalAdmin` (Apigee Portal Admin): `apigee.entitlements.get` `apigee.projectorganizations.get`
Apigee	Role Updated	The following permissions have been added to the role `roles/apigee.runtimeAgent` (Apigee Runtime Agent): `apigee.entitlements.get` `apigee.projectorganizations.get`
Apigee	Role Updated	The following permissions have been added to the role `roles/apigee.securityAdmin` (Apigee Security Admin): `apigee.entitlements.get` `apigee.projectorganizations.get`
Apigee	Role Updated	The following permissions have been added to the role `roles/apigee.securityViewer` (Apigee Security Viewer): `apigee.entitlements.get` `apigee.projectorganizations.get`
Cloud Composer	Now GA	The role `roles/composer.environmentAndStorageObjectUser` (Environment and Storage Object User) is now GA.
Cloud Composer	Role Updated	The following permissions have been added to the role `roles/composer.sharedVpcAgent` (Composer Shared VPC Agent): `compute.networkAttachments.create` `compute.networkAttachments.delete` `compute.networkAttachments.get`
Google Distributed Cloud	Role Updated	The following permissions have been added to the role `roles/gkeonprem.serviceAgent` (GKE On-Prem Service Agent): `gkehub.memberships.delete`
Looker	Now GA	The role `roles/looker.admin` (Looker Admin) is now GA.
Looker	Now GA	The role `roles/looker.instanceUser` (Looker Instance User) is now GA.
Looker	Now GA	The role `roles/looker.viewer` (Looker Viewer) is now GA.
Cloud Monitoring	Now GA	The role `roles/monitoring.alertPolicyEditor` (Monitoring AlertPolicy Editor) is now GA.
Cloud Monitoring	Now GA	The role `roles/monitoring.alertPolicyViewer` (Monitoring AlertPolicy Viewer) is now GA.
Vision AI	Role Updated	The following permissions have been added to the role `roles/visionai.serviceAgent` (Cloud Vision AI Service Agent): `visionai.events.create` `visionai.events.update`
Cloud Controls Partner API	Added	`cloudcontrolspartner.customers.get` `cloudcontrolspartner.customers.list` `cloudcontrolspartner.partners.get` `cloudcontrolspartner.violations.get` `cloudcontrolspartner.violations.list` `cloudcontrolspartner.workloads.get` `cloudcontrolspartner.workloads.list`
Cloud Controls Partner API	Supported In Custom Roles	`cloudcontrolspartner.customers.get` `cloudcontrolspartner.customers.list` `cloudcontrolspartner.partners.get` `cloudcontrolspartner.violations.get` `cloudcontrolspartner.violations.list` `cloudcontrolspartner.workloads.get` `cloudcontrolspartner.workloads.list`
Looker	Added	`looker.backups.create` `looker.backups.delete` `looker.backups.get` `looker.backups.list` `looker.backups.restore` `looker.instances.create` `looker.instances.delete` `looker.instances.export` `looker.instances.get` `looker.instances.import` `looker.instances.list` `looker.instances.login` `looker.instances.update` `looker.locations.get` `looker.locations.list` `looker.operations.cancel` `looker.operations.delete` `looker.operations.get` `looker.operations.list`
Looker	Supported In Custom Roles	`looker.backups.create` `looker.backups.delete` `looker.backups.get` `looker.backups.list` `looker.backups.restore` `looker.instances.create` `looker.instances.delete` `looker.instances.export` `looker.instances.get` `looker.instances.import` `looker.instances.list` `looker.instances.login` `looker.instances.update` `looker.locations.get` `looker.locations.list` `looker.operations.cancel` `looker.operations.delete` `looker.operations.get` `looker.operations.list`
Looker	Now GA	`looker.backups.create` `looker.backups.delete` `looker.backups.get` `looker.backups.list` `looker.backups.restore` `looker.instances.create` `looker.instances.delete` `looker.instances.export` `looker.instances.get` `looker.instances.import` `looker.instances.list` `looker.instances.login` `looker.instances.update` `looker.locations.get` `looker.locations.list` `looker.operations.cancel` `looker.operations.delete` `looker.operations.get` `looker.operations.list`
Cloud Monitoring	Supported In Custom Roles	`monitoring.alertPolicies.create` `monitoring.alertPolicies.delete` `monitoring.alertPolicies.get` `monitoring.alertPolicies.list` `monitoring.alertPolicies.update`
Cloud Monitoring	Now GA	`monitoring.alertPolicies.create` `monitoring.alertPolicies.delete` `monitoring.alertPolicies.get` `monitoring.alertPolicies.list` `monitoring.alertPolicies.update`
Security Command Center	Added	`securitycenter.integratedvulnerabilityscannersettings.calculate` `securitycenter.integratedvulnerabilityscannersettings.get` `securitycenter.integratedvulnerabilityscannersettings.update`
Security Command Center	Supported In Custom Roles	`securitycenter.integratedvulnerabilityscannersettings.calculate` `securitycenter.integratedvulnerabilityscannersettings.get` `securitycenter.integratedvulnerabilityscannersettings.update`
Security Command Center	Now GA	`securitycenter.integratedvulnerabilityscannersettings.calculate` `securitycenter.integratedvulnerabilityscannersettings.get` `securitycenter.integratedvulnerabilityscannersettings.update`

Cloud IAM changes as of 2023-04-28

Service	Change	Description
Vertex AI	Role Updated	The following permissions have been added to the role `roles/aiplatform.serviceAgent` (Vertex AI Service Agent): `compute.subnetworks.get`
Bare Metal Solution	Now GA	The role `roles/baremetalsolution.procurementsadmin` (Procurements Admin) is now GA.
Bare Metal Solution	Now GA	The role `roles/baremetalsolution.procurementseditor` (Procurements Editor) is now GA.
Bare Metal Solution	Now GA	The role `roles/baremetalsolution.procurementsviewer` (Procurements Viewer) is now GA.
Cloud Key Management Service	Now GA	The role `roles/cloudkms.protectedResourcesViewer` (Cloud KMS Protected Resources Viewer) is now GA.
Commerce Business Enablement	Role Updated	The following permissions have been added to the role `roles/commercebusinessenablement.admin` (Commerce Business Enablement Configuration Admin): `resourcemanager.organizations.get`
Commerce Business Enablement	Role Updated	The following permissions have been added to the role `roles/commercebusinessenablement.resellerDiscountAdmin` (Commerce Business Enablement Reseller Discount Admin): `resourcemanager.organizations.get`
Commerce Business Enablement	Role Updated	The following permissions have been added to the role `roles/commercebusinessenablement.resellerDiscountViewer` (Commerce Business Enablement Reseller Discount Viewer): `resourcemanager.organizations.get`
Commerce Business Enablement	Role Updated	The following permissions have been added to the role `roles/commercebusinessenablement.viewer` (Commerce Business Enablement Configuration Viewer): `resourcemanager.organizations.get`
Cloud Commerce Consumer Procurement	Role Updated	The following permissions have been added to the role `roles/consumerprocurement.entitlementManager` (Consumer Procurement Entitlement Manager): `consumerprocurement.consents.check` `consumerprocurement.consents.grant` `consumerprocurement.consents.list` `consumerprocurement.consents.revoke` `orgpolicy.policy.get`
Cloud Commerce Consumer Procurement	Role Updated	The following permissions have been added to the role `roles/consumerprocurement.entitlementViewer` (Consumer Procurement Entitlement Viewer): `consumerprocurement.consents.check` `consumerprocurement.consents.list` `orgpolicy.policy.get`
Cloud Commerce Consumer Procurement	Role Updated	The following permissions have been added to the role `roles/consumerprocurement.procurementAdmin` (Consumer Procurement Administrator): `orgpolicy.policy.get`
Cloud Commerce Consumer Procurement	Role Updated	The following permissions have been added to the role `roles/consumerprocurement.procurementViewer` (Consumer Procurement Viewer): `orgpolicy.policy.get`
Firebase App Check	Now GA	The role `roles/firebaseappcheck.tokenVerifier` (Firebase App Check Token Verifier) is now GA.
Workflows	Role Updated	The following permissions have been added to the role `roles/workflows.serviceAgent` (Cloud Workflows Service Agent): `serviceusage.services.use`
Workload Certificate	Role Updated	The following permissions have been added to the role `roles/workloadcertificate.serviceAgent` (Workload Certificate Service Agent): `workloadcertificate.workloadRegistrations.list`
Bare Metal Solution	Added	`baremetalsolution.procurements.create` `baremetalsolution.procurements.get` `baremetalsolution.procurements.list` `baremetalsolution.skus.list`
Bare Metal Solution	Supported In Custom Roles	`baremetalsolution.procurements.create` `baremetalsolution.procurements.get` `baremetalsolution.procurements.list` `baremetalsolution.skus.list`
Bare Metal Solution	Now GA	`baremetalsolution.procurements.create` `baremetalsolution.procurements.get` `baremetalsolution.procurements.list` `baremetalsolution.skus.list`
Certificate Manager	Now GA	`certificatemanager.certissuanceconfigs.create` `certificatemanager.certissuanceconfigs.delete` `certificatemanager.certissuanceconfigs.get` `certificatemanager.certissuanceconfigs.list` `certificatemanager.certissuanceconfigs.update` `certificatemanager.certissuanceconfigs.use`
Cloud Build	Added	`cloudbuild.repositories.fetchGitRefs`
Cloud Build	Supported In Custom Roles	`cloudbuild.repositories.fetchGitRefs`
Cloud Key Management Service	Now GA	`cloudkms.protectedResources.search`
Firebase App Check	Added	`firebaseappcheck.appCheckTokens.verify`
Firebase App Check	Supported In Custom Roles	`firebaseappcheck.appCheckTokens.verify`
Firebase App Check	Now GA	`firebaseappcheck.appCheckTokens.verify`

Cloud IAM changes as of 2023-04-21

Service	Change	Description
BigLake	Now GA	The role `roles/biglake.admin` (BigLake Admin) is now GA.
BigLake	Now GA	The role `roles/biglake.viewer` (BigLake Viewer) is now GA.
Google Security Operations	Role Updated	The following permissions have been added to the role `roles/chronicle.editor` (Chronicle API Editor): `chronicle.operations.cancel`
Service Catalog	Role Updated	The following permissions have been added to the role `roles/cloudprivatecatalogproducer.orgAdmin` (Catalog Org Admin): `commerceorggovernance.organizationSettings.get` `commerceorggovernance.organizationSettings.update`
Connectors	Now GA	The role `roles/connectors.endpointAttachmentAdmin` (Connectors Endpoint Attachment Admin) is now GA.
Connectors	Now GA	The role `roles/connectors.endpointAttachmentViewer` (Connectors Endpoint Attachment Viewer) is now GA.
Connectors	Now GA	The role `roles/connectors.managedZoneAdmin` (Connectors Managed Zone Admin) is now GA.
Connectors	Now GA	The role `roles/connectors.managedZoneViewer` (Connectors Managed Zone Viewer) is now GA.
Identity and Access Management	Role Updated	The following permissions have been added to the role `roles/iam.securityAdmin` (Security Admin): `advisorynotifications.notifications.get`
Identity and Access Management	Role Updated	The following permissions have been added to the role `roles/iam.securityReviewer` (Security Reviewer): `advisorynotifications.notifications.get`
Network Connectivity Center	Role Updated	The following permissions have been added to the role `roles/networkconnectivity.serviceAgent` (Network Connectivity Service Agent): `compute.addresses.createInternal` `compute.addresses.deleteInternal` `compute.addresses.get`
Pub/Sub Lite	Role Updated	The following permissions have been added to the role `roles/pubsublite.serviceAgent` (Pub/Sub Lite Service Agent): `pubsublite.topics.computeHeadCursor`
Serverless Integrations	Role Updated	The following permissions have been added to the role `roles/runapps.serviceAgent` (Serverless Integrations Service Agent): `firebasehosting.sites.get`
Cloud Storage	Now GA	The role `roles/storage.insightsCollectorService` (Storage Insights Collector Service) is now GA.
BigLake	Now GA	`biglake.catalogs.create` `biglake.catalogs.delete` `biglake.catalogs.get` `biglake.catalogs.list` `biglake.databases.create` `biglake.databases.delete` `biglake.databases.get` `biglake.databases.list` `biglake.databases.update` `biglake.locks.check` `biglake.locks.create` `biglake.locks.delete` `biglake.locks.list` `biglake.tables.create` `biglake.tables.delete` `biglake.tables.get` `biglake.tables.list` `biglake.tables.lock` `biglake.tables.update`
Google Security Operations	Added	`chronicle.dashboards.edit` `chronicle.dashboards.schedule`
Google Security Operations	Supported In Custom Roles	`chronicle.dashboards.edit` `chronicle.dashboards.schedule`
Commerce Business Enablement	Added	`commercebusinessenablement.resellerDiscountOffers.cancel` `commercebusinessenablement.resellerDiscountOffers.create` `commercebusinessenablement.resellerDiscountOffers.list`
Commerce Business Enablement	Supported In Custom Roles	`commercebusinessenablement.resellerDiscountOffers.cancel` `commercebusinessenablement.resellerDiscountOffers.create` `commercebusinessenablement.resellerDiscountOffers.list`
Connectors	Added	`connectors.endpointAttachments.create` `connectors.endpointAttachments.delete` `connectors.endpointAttachments.get` `connectors.endpointAttachments.getIamPolicy` `connectors.endpointAttachments.list` `connectors.endpointAttachments.setIamPolicy` `connectors.endpointAttachments.update` `connectors.managedZones.create` `connectors.managedZones.delete` `connectors.managedZones.get` `connectors.managedZones.getIamPolicy` `connectors.managedZones.list` `connectors.managedZones.setIamPolicy` `connectors.managedZones.update`
Connectors	Now GA	`connectors.endpointAttachments.create` `connectors.endpointAttachments.delete` `connectors.endpointAttachments.get` `connectors.endpointAttachments.getIamPolicy` `connectors.endpointAttachments.list` `connectors.endpointAttachments.setIamPolicy` `connectors.endpointAttachments.update` `connectors.managedZones.create` `connectors.managedZones.delete` `connectors.managedZones.get` `connectors.managedZones.getIamPolicy` `connectors.managedZones.list` `connectors.managedZones.setIamPolicy` `connectors.managedZones.update`
Dataform	Added	`dataform.releaseConfigs.create` `dataform.releaseConfigs.delete` `dataform.releaseConfigs.get` `dataform.releaseConfigs.list` `dataform.releaseConfigs.update` `dataform.workflowConfigs.create` `dataform.workflowConfigs.delete` `dataform.workflowConfigs.get` `dataform.workflowConfigs.list` `dataform.workflowConfigs.update`
Datastore	Supported In Custom Roles	`datastore.keyVisualizerScans.get` `datastore.keyVisualizerScans.list`
Transfer Appliance	Added	`transferappliance.credentials.get`

Cloud IAM changes as of 2023-04-14

Service	Change	Description
Backup and Disaster Recovery	Role Updated	The following permissions have been added to the role `roles/backupdr.admin` (Backup and DR Admin): `backupdr.managementServers.viewBackupServers`
Backup and Disaster Recovery	Role Updated	The following permissions have been added to the role `roles/backupdr.user` (Backup and DR User): `backupdr.managementServers.viewBackupServers`
Backup and Disaster Recovery	Role Updated	The following permissions have been removed from the role `roles/backupdr.user` (Backup and DR User): `backupdr.managementServers.accessSensitiveData` `backupdr.managementServers.assignBackupPlans` `backupdr.managementServers.manageApplications` `backupdr.managementServers.manageBackupPlans` `backupdr.managementServers.manageBackups` `backupdr.managementServers.manageClones` `backupdr.managementServers.manageExpiration` `backupdr.managementServers.manageHosts` `backupdr.managementServers.manageJobs` `backupdr.managementServers.manageLiveClones` `backupdr.managementServers.manageMigrations` `backupdr.managementServers.manageMirroring` `backupdr.managementServers.manageMounts` `backupdr.managementServers.manageRestores` `backupdr.managementServers.manageWorkflows` `backupdr.managementServers.refreshWorkflows` `backupdr.managementServers.runWorkflows` `backupdr.managementServers.testFailOvers`
Backup and Disaster Recovery	Role Updated	The following permissions have been added to the role `roles/backupdr.userv2` (Backup and DR User V2): `backupdr.managementServers.viewBackupServers`
Backup and Disaster Recovery	Role Updated	The following permissions have been added to the role `roles/backupdr.viewer` (Backup and DR Viewer): `backupdr.managementServers.viewBackupServers`
Google Security Operations	Now GA	The role `roles/chronicle.limitedViewer` (Chronicle API Limited Viewer) is now GA.
Google Security Operations	Role Updated	The following permissions have been added to the role `roles/chronicle.serviceAgent` (Chronicle Service Agent): `monitoring.alertPolicies.create` `monitoring.alertPolicies.delete` `monitoring.alertPolicies.get` `monitoring.alertPolicies.list` `monitoring.alertPolicies.update`
Cloud Run functions	Role Updated	The following permissions have been added to the role `roles/cloudfunctions.viewer` (Cloud Functions Viewer): `cloudfunctions.functions.getIamPolicy`
Dataform	Role Updated	The following permissions have been added to the role `roles/dataform.admin` (Dataform Admin): `dataform.repositories.commit` `dataform.repositories.computeAccessTokenStatus` `dataform.repositories.fetchHistory` `dataform.repositories.queryDirectoryContents` `dataform.repositories.readFile`
Dataform	Role Updated	The following permissions have been added to the role `roles/dataform.editor` (Dataform Editor): `dataform.repositories.computeAccessTokenStatus` `dataform.repositories.fetchHistory` `dataform.repositories.queryDirectoryContents` `dataform.repositories.readFile`
Dataform	Role Updated	The following permissions have been added to the role `roles/dataform.viewer` (Dataform Viewer): `dataform.repositories.computeAccessTokenStatus` `dataform.repositories.fetchHistory` `dataform.repositories.queryDirectoryContents` `dataform.repositories.readFile`
Basic Role	Role Updated	The following permissions have been added to the role `roles/editor` (Editor): `backupdr.managementServers.viewBackupServers` `dataform.repositories.commit` `dataform.repositories.computeAccessTokenStatus` `dataform.repositories.fetchHistory` `dataform.repositories.queryDirectoryContents` `dataform.repositories.readFile`
Firebase	Role Updated	The following permissions have been added to the role `roles/firebase.developViewer` (Firebase Develop Viewer): `cloudfunctions.functions.getIamPolicy`
Firebase	Role Updated	The following permissions have been added to the role `roles/firebase.viewer` (Firebase Viewer): `cloudfunctions.functions.getIamPolicy`
Google Distributed Cloud	Role Updated	The following permissions have been added to the role `roles/gkeonprem.serviceAgent` (GKE On-Prem Service Agent): `gkeonprem.operations.get` `gkeonprem.operations.list`
Basic Role	Role Updated	The following permissions have been added to the role `roles/owner` (Owner): `backupdr.managementServers.viewBackupServers` `dataform.repositories.commit` `dataform.repositories.computeAccessTokenStatus` `dataform.repositories.fetchHistory` `dataform.repositories.queryDirectoryContents` `dataform.repositories.readFile`
Storage Insights	Now GA	The role `roles/storageinsights.serviceAgent` (StorageInsights Service Agent) is now GA.
Basic Role	Role Updated	The following permissions have been added to the role `roles/viewer` (Viewer): `backupdr.managementServers.viewBackupServers` `dataform.repositories.computeAccessTokenStatus` `dataform.repositories.fetchHistory` `dataform.repositories.queryDirectoryContents` `dataform.repositories.readFile`
Artifact Registry	Added	`artifactregistry.repositories.readViaVirtualRepository`
Artifact Registry	Supported In Custom Roles	`artifactregistry.repositories.readViaVirtualRepository`
Artifact Registry	Now GA	`artifactregistry.repositories.readViaVirtualRepository`
Backup and Disaster Recovery	Added	`backupdr.managementServers.viewBackupServers`
Cloud SQL	Added	`cloudsql.instances.reencrypt`
Cloud SQL	Supported In Custom Roles	`cloudsql.instances.reencrypt`
Cloud SQL	Now GA	`cloudsql.instances.reencrypt`
Dataform	Added	`dataform.repositories.commit` `dataform.repositories.computeAccessTokenStatus` `dataform.repositories.fetchHistory` `dataform.repositories.queryDirectoryContents` `dataform.repositories.readFile`

Cloud IAM changes as of 2023-04-07

Service	Change	Description
Firebase Remote Config	Role Updated	The following permissions have been added to the role `roles/cloudconfig.serviceAgent` (Cloud Config Service Agent): `logging.logEntries.create` `logging.logEntries.route`
Google Distributed Cloud	Role Updated	The following permissions have been added to the role `roles/gkeonprem.serviceAgent` (GKE On-Prem Service Agent): `gkeonprem.bareMetalAdminClusters.get` `gkeonprem.bareMetalClusters.get` `gkeonprem.bareMetalNodePools.get` `gkeonprem.vmwareAdminClusters.get` `gkeonprem.vmwareClusters.get` `gkeonprem.vmwareNodePools.get`
Cloud Integrations	Role Updated	The following permissions have been added to the role `roles/integrations.serviceAgent` (Application Integration Service Agent): `iam.serviceAccounts.getAccessToken` `iam.serviceAccounts.getOpenIdToken`
Cloud Service Mesh control plane	Role Updated	The following permissions have been added to the role `roles/meshcontrolplane.serviceAgent` (Mesh Managed Control Plane Service Agent): `trafficdirector.networks.getConfigs` `trafficdirector.networks.reportMetrics`
Security Command Center	Now GA	The role `roles/securitycenter.securityHealthAnalyticsCustomModulesTester` (Security Health Analytics Custom Modules Tester) is now GA.
Cloud TPU	Role Updated	The following permissions have been added to the role `roles/tpu.xpnAgent` (TPU Shared VPC Agent): `compute.addresses.createInternal` `compute.addresses.deleteInternal` `compute.addresses.get` `compute.addresses.list` `compute.addresses.useInternal`
Compute Engine	Added	`compute.interconnectRemoteLocations.get` `compute.interconnectRemoteLocations.list`
Compute Engine	Supported In Custom Roles	`compute.interconnectRemoteLocations.get` `compute.interconnectRemoteLocations.list`
Compute Engine	Now GA	`compute.interconnectRemoteLocations.get` `compute.interconnectRemoteLocations.list`
Network Security	Added	`networksecurity.gatewaySecurityPolicies.create` `networksecurity.gatewaySecurityPolicies.delete` `networksecurity.gatewaySecurityPolicies.get` `networksecurity.gatewaySecurityPolicies.list` `networksecurity.gatewaySecurityPolicies.update` `networksecurity.gatewaySecurityPolicies.use` `networksecurity.gatewaySecurityPolicyRules.create` `networksecurity.gatewaySecurityPolicyRules.delete` `networksecurity.gatewaySecurityPolicyRules.get` `networksecurity.gatewaySecurityPolicyRules.list` `networksecurity.gatewaySecurityPolicyRules.update` `networksecurity.gatewaySecurityPolicyRules.use` `networksecurity.tlsInspectionPolicies.create` `networksecurity.tlsInspectionPolicies.delete` `networksecurity.tlsInspectionPolicies.get` `networksecurity.tlsInspectionPolicies.list` `networksecurity.tlsInspectionPolicies.update` `networksecurity.tlsInspectionPolicies.use` `networksecurity.urlLists.create` `networksecurity.urlLists.delete` `networksecurity.urlLists.get` `networksecurity.urlLists.list` `networksecurity.urlLists.update` `networksecurity.urlLists.use`
Network Security	Supported In Custom Roles	`networksecurity.gatewaySecurityPolicies.create` `networksecurity.gatewaySecurityPolicies.delete` `networksecurity.gatewaySecurityPolicies.get` `networksecurity.gatewaySecurityPolicies.list` `networksecurity.gatewaySecurityPolicies.update` `networksecurity.gatewaySecurityPolicies.use` `networksecurity.gatewaySecurityPolicyRules.create` `networksecurity.gatewaySecurityPolicyRules.delete` `networksecurity.gatewaySecurityPolicyRules.get` `networksecurity.gatewaySecurityPolicyRules.list` `networksecurity.gatewaySecurityPolicyRules.update` `networksecurity.gatewaySecurityPolicyRules.use` `networksecurity.tlsInspectionPolicies.create` `networksecurity.tlsInspectionPolicies.delete` `networksecurity.tlsInspectionPolicies.get` `networksecurity.tlsInspectionPolicies.list` `networksecurity.tlsInspectionPolicies.update` `networksecurity.tlsInspectionPolicies.use` `networksecurity.urlLists.create` `networksecurity.urlLists.delete` `networksecurity.urlLists.get` `networksecurity.urlLists.list` `networksecurity.urlLists.update` `networksecurity.urlLists.use`
Cloud Storage	Added	`storage.buckets.getObjectInsights`
Cloud Storage	Now GA	`storage.buckets.getObjectInsights`

Cloud IAM changes as of 2023-03-31

Service	Change	Description
Appliance Activation Service	Role Updated	The following permissions have been added to the role `roles/applianceactivation.approver` (Appliance troubleshooting commands approver): `applianceactivation.rttCommands.get`
Assured Workloads	Role Updated	The following permissions have been added to the role `roles/assuredworkloads.admin` (Assured Workloads Administrator): `bigquery.config.update`
Assured Workloads	Role Updated	The following permissions have been added to the role `roles/assuredworkloads.editor` (Assured Workloads Editor): `bigquery.config.update`
Bigtable	Role Updated	The following permissions have been added to the role `roles/bigtable.admin` (Bigtable Administrator): `monitoring.timeSeries.create`
Bigtable	Role Updated	The following permissions have been added to the role `roles/bigtable.reader` (Bigtable Reader): `monitoring.timeSeries.create`
Bigtable	Role Updated	The following permissions have been added to the role `roles/bigtable.user` (Bigtable User): `monitoring.timeSeries.create`
Google Security Operations	Now GA	The role `roles/chronicle.editor` (Chronicle API Editor) is now GA.
Conversational Insights	Role Updated	The following permissions have been added to the role `roles/contactcenterinsights.serviceAgent` (Contact Center AI Insights Service Agent): `dialogflow.conversationProfiles.get`
Cloud Data Fusion	Now GA	The role `roles/datafusion.admin` (Cloud Data Fusion Admin) is now GA.
Cloud Data Fusion	Now GA	The role `roles/datafusion.runner` (Cloud Data Fusion Runner) is now GA.
Cloud Data Fusion	Now GA	The role `roles/datafusion.viewer` (Cloud Data Fusion Viewer) is now GA.
Google Distributed Cloud	Role Updated	The following permissions have been added to the role `roles/gkeonprem.serviceAgent` (GKE On-Prem Service Agent): `gkeonprem.bareMetalAdminClusters.enroll` `gkeonprem.bareMetalAdminClusters.unenroll` `gkeonprem.bareMetalClusters.enroll` `gkeonprem.bareMetalClusters.unenroll` `gkeonprem.bareMetalNodePools.enroll` `gkeonprem.bareMetalNodePools.unenroll` `gkeonprem.vmwareAdminClusters.enroll` `gkeonprem.vmwareAdminClusters.unenroll` `gkeonprem.vmwareClusters.enroll` `gkeonprem.vmwareClusters.unenroll` `gkeonprem.vmwareNodePools.enroll` `gkeonprem.vmwareNodePools.unenroll`
Backup and Disaster Recovery	Added	`backupdr.managementServers.access` `backupdr.managementServers.accessSensitiveData` `backupdr.managementServers.assignBackupPlans` `backupdr.managementServers.manageApplications` `backupdr.managementServers.manageBackupPlans` `backupdr.managementServers.manageBackupServers` `backupdr.managementServers.manageBackups` `backupdr.managementServers.manageClones` `backupdr.managementServers.manageExpiration` `backupdr.managementServers.manageHosts` `backupdr.managementServers.manageJobs` `backupdr.managementServers.manageLiveClones` `backupdr.managementServers.manageMigrations` `backupdr.managementServers.manageMirroring` `backupdr.managementServers.manageMounts` `backupdr.managementServers.manageRestores` `backupdr.managementServers.manageSensitiveData` `backupdr.managementServers.manageStorage` `backupdr.managementServers.manageSystem` `backupdr.managementServers.manageWorkflows` `backupdr.managementServers.refreshWorkflows` `backupdr.managementServers.runWorkflows` `backupdr.managementServers.testFailOvers` `backupdr.managementServers.viewBackupPlans` `backupdr.managementServers.viewReports` `backupdr.managementServers.viewStorage` `backupdr.managementServers.viewSystem` `backupdr.managementServers.viewWorkflows`
Google Security Operations	Added	`chronicle.collectors.create` `chronicle.collectors.delete` `chronicle.collectors.get` `chronicle.collectors.list` `chronicle.collectors.update` `chronicle.curatedRuleSetCategories.countAllCuratedRuleSetDetections` `chronicle.curatedRuleSetCategories.get` `chronicle.curatedRuleSetCategories.list` `chronicle.curatedRuleSetDeployments.batchUpdate` `chronicle.curatedRuleSetDeployments.get` `chronicle.curatedRuleSetDeployments.list` `chronicle.curatedRuleSetDeployments.update` `chronicle.curatedRuleSets.countCuratedRuleSetDetections` `chronicle.curatedRuleSets.get` `chronicle.curatedRuleSets.list` `chronicle.curatedRules.get` `chronicle.curatedRules.list` `chronicle.dashboards.copy` `chronicle.dashboards.create` `chronicle.dashboards.delete` `chronicle.dashboards.get` `chronicle.dashboards.list` `chronicle.extensionValidationReports.get` `chronicle.extensionValidationReports.list` `chronicle.feedSourceTypeSchemas.list` `chronicle.feeds.create` `chronicle.feeds.delete` `chronicle.feeds.disable` `chronicle.feeds.enable` `chronicle.feeds.get` `chronicle.feeds.list` `chronicle.feeds.update` `chronicle.forwarders.create` `chronicle.forwarders.delete` `chronicle.forwarders.generate` `chronicle.forwarders.get` `chronicle.forwarders.list` `chronicle.forwarders.update` `chronicle.instances.get` `chronicle.instances.report` `chronicle.legacies.legacyGetCuratedRulesTrends` `chronicle.legacies.legacyGetRuleCounts` `chronicle.legacies.legacyGetRulesTrends` `chronicle.legacies.legacyUpdateFinding` `chronicle.logTypeSchemas.list` `chronicle.multitenantDirectories.get` `chronicle.operations.cancel` `chronicle.operations.delete` `chronicle.operations.get` `chronicle.operations.list` `chronicle.operations.wait` `chronicle.parserExtensions.activate` `chronicle.parserExtensions.create` `chronicle.parserExtensions.delete` `chronicle.parserExtensions.generateKeyValueMappings` `chronicle.parserExtensions.get` `chronicle.parserExtensions.legacySubmitParserExtension` `chronicle.parserExtensions.list` `chronicle.parserExtensions.removeSyslog` `chronicle.parsers.activate` `chronicle.parsers.activateReleaseCandidate` `chronicle.parsers.copyPrebuiltParser` `chronicle.parsers.create` `chronicle.parsers.deactivate` `chronicle.parsers.delete` `chronicle.parsers.get` `chronicle.parsers.list` `chronicle.parsers.runParser` `chronicle.parsingErrors.list` `chronicle.referenceLists.create` `chronicle.referenceLists.get` `chronicle.referenceLists.list` `chronicle.referenceLists.update` `chronicle.referenceLists.verifyReferenceList` `chronicle.retrohunts.create` `chronicle.retrohunts.get` `chronicle.retrohunts.list` `chronicle.ruleDeployments.get` `chronicle.ruleDeployments.list` `chronicle.ruleDeployments.update` `chronicle.ruleExecutionErrors.list` `chronicle.rules.create` `chronicle.rules.get` `chronicle.rules.list` `chronicle.rules.listRevisions` `chronicle.rules.update` `chronicle.rules.verifyRuleText` `chronicle.validationErrors.list` `chronicle.validationReports.get`
Google Security Operations	Supported In Custom Roles	`chronicle.collectors.create` `chronicle.collectors.delete` `chronicle.collectors.get` `chronicle.collectors.list` `chronicle.collectors.update` `chronicle.dashboards.copy` `chronicle.dashboards.create` `chronicle.dashboards.delete` `chronicle.dashboards.get` `chronicle.dashboards.list` `chronicle.forwarders.create` `chronicle.forwarders.delete` `chronicle.forwarders.generate` `chronicle.forwarders.get` `chronicle.forwarders.list` `chronicle.forwarders.update` `chronicle.multitenantDirectories.get` `chronicle.parserExtensions.activate` `chronicle.parserExtensions.legacySubmitParserExtension` `chronicle.parsers.activateReleaseCandidate` `chronicle.parsers.create` `chronicle.parsers.deactivate` `chronicle.parsers.get` `chronicle.parsingErrors.list` `chronicle.validationReports.get`
Cloud Data Fusion	Now GA	`datafusion.instances.create` `datafusion.instances.delete` `datafusion.instances.get` `datafusion.instances.getIamPolicy` `datafusion.instances.list` `datafusion.instances.restart` `datafusion.instances.runtime` `datafusion.instances.setIamPolicy` `datafusion.instances.update` `datafusion.instances.upgrade` `datafusion.locations.get` `datafusion.locations.list` `datafusion.operations.cancel` `datafusion.operations.delete` `datafusion.operations.get` `datafusion.operations.list`

Cloud IAM changes as of 2023-03-24

Service	Change	Description
App Engine	Role Updated	The following permissions have been added to the role `roles/appengine.deployer` (App Engine Deployer): `artifactregistry.repositories.deleteArtifacts` `artifactregistry.repositories.downloadArtifacts` `artifactregistry.repositories.uploadArtifacts`
Bare Metal Solution	Role Updated	The following permissions have been added to the role `roles/baremetalsolution.instancesadmin` (Bare Metal Solution Instances Admin): `baremetalsolution.operations.get`
Bare Metal Solution	Role Updated	The following permissions have been added to the role `roles/baremetalsolution.instancesviewer` (Bare Metal Solution Instances Viewer): `baremetalsolution.operations.get`
Bare Metal Solution	Role Updated	The following permissions have been added to the role `roles/baremetalsolution.lunsadmin` (Luns Admin): `baremetalsolution.operations.get`
Bare Metal Solution	Role Updated	The following permissions have been added to the role `roles/baremetalsolution.lunsviewer` (Luns Viewer): `baremetalsolution.operations.get`
Bare Metal Solution	Role Updated	The following permissions have been added to the role `roles/baremetalsolution.networksadmin` (Networks Admin): `baremetalsolution.operations.get`
Bare Metal Solution	Role Updated	The following permissions have been added to the role `roles/baremetalsolution.nfssharesadmin` (NFS Shares Admin): `baremetalsolution.operations.get`
Bare Metal Solution	Role Updated	The following permissions have been added to the role `roles/baremetalsolution.nfsshareseditor` (NFS Shares Editor): `baremetalsolution.operations.get`
Bare Metal Solution	Role Updated	The following permissions have been added to the role `roles/baremetalsolution.nfssharesviewer` (NFS Shares Viewer): `baremetalsolution.operations.get`
Bare Metal Solution	Role Updated	The following permissions have been added to the role `roles/baremetalsolution.storageadmin` (Bare Metal Solution Storage Admin): `baremetalsolution.operations.get`
Bare Metal Solution	Role Updated	The following permissions have been added to the role `roles/baremetalsolution.volumesadmin` (Volume Admin): `baremetalsolution.operations.get`
Bare Metal Solution	Role Updated	The following permissions have been added to the role `roles/baremetalsolution.volumeseditor` (Volumes Editor): `baremetalsolution.operations.get`
Bare Metal Solution	Role Updated	The following permissions have been added to the role `roles/baremetalsolution.volumesnapshotsadmin` (Snapshots Admin): `baremetalsolution.operations.get`
Bare Metal Solution	Role Updated	The following permissions have been added to the role `roles/baremetalsolution.volumesnapshotseditor` (Snapshots Editor): `baremetalsolution.operations.get`
Bare Metal Solution	Role Updated	The following permissions have been added to the role `roles/baremetalsolution.volumesnapshotsviewer` (Snapshots Viewer): `baremetalsolution.operations.get`
Bare Metal Solution	Role Updated	The following permissions have been added to the role `roles/baremetalsolution.volumessviewer` (Volumes Viewer): `baremetalsolution.operations.get`
Artifact Analysis	Role Updated	The following permissions have been added to the role `roles/containeranalysis.ServiceAgent` (Container Analysis Service Agent): `storage.buckets.create` `storage.buckets.get` `storage.buckets.list` `storage.objects.create` `storage.objects.delete`
Container Scanning	Role Updated	The following permissions have been added to the role `roles/containerscanning.ServiceAgent` (Container Scanner Service Agent): `storage.buckets.create` `storage.buckets.get` `storage.buckets.list` `storage.objects.create` `storage.objects.delete`
Dataproc	Role Updated	The following permissions have been added to the role `roles/dataproc.serviceAgent` (Dataproc Service Agent): `dataproc.operations.cancel`
Live Stream	Now GA	The role `roles/livestream.editor` (Live Stream Editor) is now GA.
Live Stream	Now GA	The role `roles/livestream.viewer` (Live Stream Viewer) is now GA.
Cloud Workstations	Role Updated	The following permissions have been added to the role `roles/workstations.serviceAgent` (Workstations Service Agent): `compute.instances.getGuestAttributes`
Appliance Activation Service	Added	`applianceactivation.rttCommands.approve` `applianceactivation.rttCommands.create` `applianceactivation.rttCommands.get` `applianceactivation.rttCommands.list` `applianceactivation.rttCommands.sendResult`
Appliance Activation Service	Supported In Custom Roles	`applianceactivation.rttCommands.approve` `applianceactivation.rttCommands.create` `applianceactivation.rttCommands.get` `applianceactivation.rttCommands.list` `applianceactivation.rttCommands.sendResult`
Bare Metal Solution	Added	`baremetalsolution.operations.get`
Bare Metal Solution	Supported In Custom Roles	`baremetalsolution.operations.get`
Bare Metal Solution	Now GA	`baremetalsolution.operations.get`
Cloud SQL	Added	`cloudsql.instances.getDiskShrinkConfig` `cloudsql.instances.performDiskShrink` `cloudsql.instances.resetReplicaSize`
Cloud SQL	Supported In Custom Roles	`cloudsql.instances.getDiskShrinkConfig` `cloudsql.instances.performDiskShrink` `cloudsql.instances.resetReplicaSize`
Cloud SQL	Now GA	`cloudsql.instances.getDiskShrinkConfig` `cloudsql.instances.performDiskShrink` `cloudsql.instances.resetReplicaSize`
Conversational Insights	Now GA	`contactcenterinsights.issues.create`
Database Migration Service	Added	`datamigration.migrationjobs.generateTcpProxyScript`
Database Migration Service	Supported In Custom Roles	`datamigration.migrationjobs.generateTcpProxyScript`
Database Migration Service	Now GA	`datamigration.migrationjobs.generateTcpProxyScript`
Google Distributed Cloud	Added	`gkeonprem.bareMetalNodePools.enroll` `gkeonprem.bareMetalNodePools.unenroll` `gkeonprem.vmwareNodePools.enroll` `gkeonprem.vmwareNodePools.unenroll`
Google Distributed Cloud	Now GA	`gkeonprem.bareMetalNodePools.enroll` `gkeonprem.bareMetalNodePools.unenroll` `gkeonprem.vmwareNodePools.enroll` `gkeonprem.vmwareNodePools.unenroll`
Live Stream	Now GA	`livestream.channels.create` `livestream.channels.delete` `livestream.channels.get` `livestream.channels.list` `livestream.channels.start` `livestream.channels.stop` `livestream.channels.update` `livestream.events.create` `livestream.events.delete` `livestream.events.get` `livestream.events.list` `livestream.inputs.create` `livestream.inputs.delete` `livestream.inputs.get` `livestream.inputs.list` `livestream.inputs.update` `livestream.locations.get` `livestream.locations.list` `livestream.operations.cancel` `livestream.operations.delete` `livestream.operations.get` `livestream.operations.list`
Maps Platform Datasets	Added	`mapsplatformdatasets.datasets.export`
Maps Platform Datasets	Supported In Custom Roles	`mapsplatformdatasets.datasets.export`
Google Cloud Migration Center	Added	`migrationcenter.preferenceSets.create` `migrationcenter.preferenceSets.delete` `migrationcenter.preferenceSets.get` `migrationcenter.preferenceSets.list` `migrationcenter.preferenceSets.update` `migrationcenter.settings.get` `migrationcenter.settings.update`
Google Cloud Migration Center	Supported In Custom Roles	`migrationcenter.preferenceSets.create` `migrationcenter.preferenceSets.delete` `migrationcenter.preferenceSets.get` `migrationcenter.preferenceSets.list` `migrationcenter.preferenceSets.update` `migrationcenter.settings.get` `migrationcenter.settings.update`
Spanner	Added	`spanner.databases.updateTag` `spanner.databases.useDataBoost` `spanner.instances.updateTag`
Spanner	Now GA	`spanner.databases.useDataBoost`

Cloud IAM changes as of 2023-03-17

Service	Change	Description
Vertex AI	Role Updated	The following permissions have been added to the role `roles/aiplatform.admin` (Vertex AI Administrator): `aiplatform.indexEndpoints.queryVectors`
Vertex AI	Role Updated	The following permissions have been added to the role `roles/aiplatform.customCodeServiceAgent` (Vertex AI Custom Code Service Agent): `aiplatform.indexEndpoints.queryVectors`
Vertex AI	Role Updated	The following permissions have been added to the role `roles/aiplatform.serviceAgent` (Vertex AI Service Agent): `aiplatform.indexEndpoints.queryVectors`
Vertex AI	Role Updated	The following permissions have been added to the role `roles/aiplatform.user` (Vertex AI User): `aiplatform.indexEndpoints.queryVectors`
Vertex AI	Role Updated	The following permissions have been added to the role `roles/aiplatform.viewer` (Vertex AI Viewer): `aiplatform.indexEndpoints.queryVectors`
Apigee	Role Updated	The following permissions have been added to the role `roles/apigee.developerAdmin` (Apigee Developer Admin): `apigee.environments.list`
Google Security Operations	Role Updated	The following permissions have been removed from the role `roles/chronicle.serviceAgent` (Chronicle Service Agent): `logging.logEntries.create` `storage.buckets.get` `storage.objects.create` `storage.objects.get`
Cloud Key Management Service	Now GA	The role `roles/cloudkms.ekmConnectionsAdmin` (Cloud KMS EkmConnections Admin) is now GA.
Conversational Insights	Role Updated	The following permissions have been added to the role `roles/contactcenterinsights.serviceAgent` (Contact Center AI Insights Service Agent): `dlp.deidentifyTemplates.get` `dlp.deidentifyTemplates.list` `dlp.inspectTemplates.get` `dlp.inspectTemplates.list` `dlp.locations.list` `speech.recognizers.update`
Content Warehouse	Role Updated	The following permissions have been added to the role `roles/contentwarehouse.serviceAgent` (Content Warehouse Service Agent): `documentai.datasets.createDocuments` `documentai.processors.get` `documentai.processors.processBatch` `storage.buckets.get` `storage.buckets.list` `storage.objects.create` `storage.objects.delete` `storage.objects.update`
Visual Inspection AI	Role Updated	The following permissions have been added to the role `roles/visualinspection.serviceAgent` (Visual Inspection AI Service Agent): `aiplatform.indexEndpoints.queryVectors`
Vertex AI	Added	`aiplatform.indexEndpoints.queryVectors`
Cloud Key Management Service	Added	`cloudkms.ekmConfigs.get` `cloudkms.ekmConfigs.getIamPolicy` `cloudkms.ekmConfigs.setIamPolicy` `cloudkms.ekmConfigs.update`
Cloud Key Management Service	Now GA	`cloudkms.ekmConfigs.get` `cloudkms.ekmConfigs.getIamPolicy` `cloudkms.ekmConfigs.setIamPolicy` `cloudkms.ekmConfigs.update`
Commerce Business Enablement	Added	`commercebusinessenablement.partnerAccounts.get` `commercebusinessenablement.partnerAccounts.list` `commercebusinessenablement.resellerConfig.get`
Commerce Business Enablement	Supported In Custom Roles	`commercebusinessenablement.partnerAccounts.get` `commercebusinessenablement.partnerAccounts.list` `commercebusinessenablement.resellerConfig.get`
Connectors	Added	`connectors.settings.get` `connectors.settings.update`
Connectors	Supported In Custom Roles	`connectors.settings.get` `connectors.settings.update`
Connectors	Now GA	`connectors.settings.get` `connectors.settings.update`
Cloud DNS	Added	`dns.networks.useHealthSignals`
Cloud DNS	Supported In Custom Roles	`dns.networks.useHealthSignals`
Cloud DNS	Now GA	`dns.networks.useHealthSignals`
Identity and Access Management	Added	`iam.workforcePoolProviderKeys.create` `iam.workforcePoolProviderKeys.delete` `iam.workforcePoolProviderKeys.get` `iam.workforcePoolProviderKeys.list` `iam.workforcePoolProviderKeys.undelete` `iam.workloadIdentityPoolProviderKeys.create` `iam.workloadIdentityPoolProviderKeys.delete` `iam.workloadIdentityPoolProviderKeys.get` `iam.workloadIdentityPoolProviderKeys.list` `iam.workloadIdentityPoolProviderKeys.undelete`
Identity and Access Management	Supported In Custom Roles	`iam.workforcePoolProviderKeys.create` `iam.workforcePoolProviderKeys.delete` `iam.workforcePoolProviderKeys.get` `iam.workforcePoolProviderKeys.list` `iam.workforcePoolProviderKeys.undelete` `iam.workloadIdentityPoolProviderKeys.create` `iam.workloadIdentityPoolProviderKeys.delete` `iam.workloadIdentityPoolProviderKeys.get` `iam.workloadIdentityPoolProviderKeys.list` `iam.workloadIdentityPoolProviderKeys.undelete`
Identity and Access Management	Added	`iam.googleapis.com/workforcePoolProviderKeys.create` `iam.googleapis.com/workforcePoolProviderKeys.delete` `iam.googleapis.com/workforcePoolProviderKeys.get` `iam.googleapis.com/workforcePoolProviderKeys.list` `iam.googleapis.com/workforcePoolProviderKeys.undelete` `iam.googleapis.com/workloadIdentityPoolProviderKeys.create` `iam.googleapis.com/workloadIdentityPoolProviderKeys.delete` `iam.googleapis.com/workloadIdentityPoolProviderKeys.get` `iam.googleapis.com/workloadIdentityPoolProviderKeys.list` `iam.googleapis.com/workloadIdentityPoolProviderKeys.undelete`
Identity and Access Management	Supported In Custom Roles	`iam.googleapis.com/workforcePoolProviderKeys.create` `iam.googleapis.com/workforcePoolProviderKeys.delete` `iam.googleapis.com/workforcePoolProviderKeys.get` `iam.googleapis.com/workforcePoolProviderKeys.list` `iam.googleapis.com/workforcePoolProviderKeys.undelete` `iam.googleapis.com/workloadIdentityPoolProviderKeys.create` `iam.googleapis.com/workloadIdentityPoolProviderKeys.delete` `iam.googleapis.com/workloadIdentityPoolProviderKeys.get` `iam.googleapis.com/workloadIdentityPoolProviderKeys.list` `iam.googleapis.com/workloadIdentityPoolProviderKeys.undelete`
Cloud Run	Added	`run.jobs.runWithOverrides`
Cloud Run	Now GA	`run.jobs.runWithOverrides`

Cloud IAM changes as of 2023-03-10

Service	Change	Description
App Engine	Role Updated	The following permissions have been added to the role `roles/appengine.serviceAgent` (App Engine Standard Environment Service Agent): `serviceusage.services.enable` `serviceusage.services.get`
Commerce Business Enablement	Role Updated	The following permissions have been added to the role `roles/commercebusinessenablement.admin` (Commerce Business Enablement Configuration Admin): `commercebusinessenablement.partnerInfo.get`
Commerce Business Enablement	Role Updated	The following permissions have been added to the role `roles/commercebusinessenablement.viewer` (Commerce Business Enablement Configuration Viewer): `commercebusinessenablement.partnerInfo.get`
Confidential Computing	Now GA	The role `roles/confidentialcomputing.workloadUser` (Confidential Space Workload User) is now GA.
Conversational Insights	Role Updated	The following permissions have been added to the role `roles/contactcenterinsights.editor` (Contact Center AI Insights editor): `contactcenterinsights.issues.create`
Data Pipelines	Role Updated	The following permissions have been added to the role `roles/datapipelines.serviceAgent` (Datapipelines Service Agent): `bigquery.tables.get` `bigtable.tables.get` `pubsub.schemas.get` `pubsub.topics.get`
Basic Role	Role Updated	The following permissions have been added to the role `roles/editor` (Editor): `contactcenterinsights.issues.create`
FleetEngine	Role Updated	The following permissions have been added to the role `roles/fleetengine.deliveryFleetReader` (Fleet Engine Delivery Fleet Reader User): `fleetengine.tasktrackinginfo.get`
Basic Role	Role Updated	The following permissions have been added to the role `roles/owner` (Owner): `contactcenterinsights.issues.create`
Speech-to-Text	Role Updated	The following permissions have been added to the role `roles/speech.serviceAgent` (Cloud Speech-to-Text Service Agent): `storage.buckets.get` `storage.buckets.list`
Bare Metal Solution	Added	`baremetalsolution.luns.evict` `baremetalsolution.volumes.evict`
Bare Metal Solution	Supported In Custom Roles	`baremetalsolution.luns.evict` `baremetalsolution.volumes.evict`
Bare Metal Solution	Now GA	`baremetalsolution.luns.evict` `baremetalsolution.volumes.evict`
Cloud Deploy	Added	`clouddeploy.jobRuns.terminate` `clouddeploy.rollouts.advance` `clouddeploy.rollouts.cancel` `clouddeploy.rollouts.ignoreJob`
Cloud Deploy	Supported In Custom Roles	`clouddeploy.jobRuns.terminate` `clouddeploy.rollouts.advance` `clouddeploy.rollouts.cancel` `clouddeploy.rollouts.ignoreJob`
Commerce Business Enablement	Added	`commercebusinessenablement.partnerInfo.get`
Compute Engine	Added	`compute.disks.startAsyncReplication` `compute.disks.stopAsyncReplication` `compute.disks.stopGroupAsyncReplication` `compute.resourcePolicies.useReadOnly`
Compute Engine	Supported In Custom Roles	`compute.disks.startAsyncReplication` `compute.disks.stopAsyncReplication` `compute.disks.stopGroupAsyncReplication` `compute.resourcePolicies.useReadOnly`
Confidential Computing	Supported In Custom Roles	`confidentialcomputing.challenges.create` `confidentialcomputing.challenges.verify` `confidentialcomputing.locations.get` `confidentialcomputing.locations.list`
Confidential Computing	Now GA	`confidentialcomputing.challenges.create` `confidentialcomputing.challenges.verify` `confidentialcomputing.locations.get` `confidentialcomputing.locations.list`
Conversational Insights	Added	`contactcenterinsights.issues.create`
Retail API	Now GA	`retail.models.get`
Spanner	Added	`spanner.instances.createTagBinding` `spanner.instances.deleteTagBinding` `spanner.instances.listEffectiveTags` `spanner.instances.listTagBindings`
Spanner	Now GA	`spanner.instances.createTagBinding` `spanner.instances.deleteTagBinding` `spanner.instances.listEffectiveTags` `spanner.instances.listTagBindings`
Transfer Appliance	Added	`transferappliance.savedAddresses.create` `transferappliance.savedAddresses.delete` `transferappliance.savedAddresses.get` `transferappliance.savedAddresses.list` `transferappliance.savedAddresses.update`
Transfer Appliance	Supported In Custom Roles	`transferappliance.savedAddresses.create` `transferappliance.savedAddresses.delete` `transferappliance.savedAddresses.get` `transferappliance.savedAddresses.list` `transferappliance.savedAddresses.update`

Cloud IAM changes as of 2023-03-03

Service	Change	Description
Conversational Insights	Role Updated	The following permissions have been added to the role `roles/contactcenterinsights.serviceAgent` (Contact Center AI Insights Service Agent): `dlp.kms.encrypt` `dlp.locations.get` `speech.operations.get` `speech.recognizers.create` `speech.recognizers.get` `speech.recognizers.recognize`
Google Kubernetes Engine	Role Updated	The following permissions have been added to the role `roles/container.nodeServiceAccount` (Kubernetes Engine Node Service Account): `monitoring.timeSeries.list`
Google Kubernetes Engine	Role Updated	The following permissions have been added to the role `roles/container.nodeServiceAgent` (Kubernetes Engine Node Service Agent): `monitoring.timeSeries.list`
Basic Role	Role Updated	The following permissions have been added to the role `roles/editor` (Editor): `speech.locations.get` `speech.locations.list`
Identity and Access Management	Role Updated	The following permissions have been added to the role `roles/iam.securityAdmin` (Security Admin): `speech.locations.list`
Identity and Access Management	Role Updated	The following permissions have been added to the role `roles/iam.securityReviewer` (Security Reviewer): `speech.locations.list`
Network Connectivity Center	Role Updated	The following permissions have been added to the role `roles/networkconnectivity.serviceAgent` (Network Connectivity Service Agent): `compute.forwardingRules.pscSetLabels` `compute.forwardingRules.pscSetTarget` `compute.forwardingRules.pscUpdate`
Basic Role	Role Updated	The following permissions have been added to the role `roles/owner` (Owner): `speech.locations.get` `speech.locations.list`
Speech-to-Text	Role Updated	The following permissions have been added to the role `roles/speech.admin` (Cloud Speech Administrator): `speech.locations.get` `speech.locations.list`
Speech-to-Text	Role Updated	The following permissions have been added to the role `roles/speech.client` (Cloud Speech Client): `speech.locations.get` `speech.locations.list`
Speech-to-Text	Role Updated	The following permissions have been added to the role `roles/speech.editor` (Cloud Speech Editor): `speech.locations.get` `speech.locations.list`
Basic Role	Role Updated	The following permissions have been added to the role `roles/viewer` (Viewer): `speech.locations.get` `speech.locations.list`
Workload Certificate	Role Updated	The following permissions have been added to the role `roles/workloadcertificate.serviceAgent` (Workload Certificate Service Agent): `container.operations.get`
Chrome Enterprise Premium	Added	`beyondcorp.subscriptions.create` `beyondcorp.subscriptions.get` `beyondcorp.subscriptions.list`
Chrome Enterprise Premium	Supported In Custom Roles	`beyondcorp.subscriptions.create` `beyondcorp.subscriptions.get` `beyondcorp.subscriptions.list`
Compute Engine	Now GA	`compute.nodeGroups.simulateMaintenanceEvent`
Conversational Insights	Now GA	`contactcenterinsights.issues.delete`
Google Kubernetes Engine	Added	`container.clusters.impersonate`
Dataform	Added	`dataform.repositories.getIamPolicy` `dataform.repositories.setIamPolicy` `dataform.workspaces.getIamPolicy` `dataform.workspaces.setIamPolicy`
Speech-to-Text	Added	`speech.locations.get` `speech.locations.list`

Cloud IAM changes as of 2023-02-24

Service	Change	Description
Vertex AI	Role Updated	The following permissions have been added to the role `roles/aiplatform.serviceAgent` (Vertex AI Service Agent): `monitoring.notificationChannels.get`
Apigee	Role Updated	The following permissions have been added to the role `roles/apigee.environmentAdmin` (Apigee Environment Admin): `apigee.keyvaluemapentries.create` `apigee.keyvaluemapentries.delete` `apigee.keyvaluemapentries.get` `apigee.keyvaluemapentries.list`
App Engine flexible environment	Role Updated	The following permissions have been added to the role `roles/appengineflex.serviceAgent` (App Engine flexible environment Service Agent): `compute.disks.create` `compute.subnetworks.use` `compute.subnetworks.useExternalIp`
Cloud Build	Role Updated	The following permissions have been added to the role `roles/cloudbuild.builds.builder` (Cloud Build Service Account): `artifactregistry.repositories.createOnPush`
Cloud Build	Role Updated	The following permissions have been added to the role `roles/cloudbuild.serviceAgent` (Cloud Build Service Agent): `artifactregistry.repositories.createOnPush`
Firebase Remote Config	Role Updated	The following permissions have been added to the role `roles/cloudconfig.serviceAgent` (Cloud Config Service Agent): `iam.serviceAccounts.getAccessToken`
Cloud Deploy	Role Updated	The following permissions have been added to the role `roles/clouddeploy.serviceAgent` (Cloud Deploy Service Agent): `cloudbuild.builds.update`
Cloud Composer	Role Updated	The following permissions have been added to the role `roles/composer.worker` (Composer Worker): `artifactregistry.repositories.createOnPush`
GKE Hub	Role Updated	The following permissions have been added to the role `roles/gkehub.serviceAgent` (GKE Hub Service Agent): `logging.buckets.create` `logging.buckets.get` `logging.buckets.list` `logging.buckets.update` `logging.exclusions.create` `logging.exclusions.delete` `logging.exclusions.get` `logging.exclusions.list` `logging.exclusions.update` `logging.sinks.create` `logging.sinks.delete` `logging.sinks.get` `logging.sinks.list` `logging.sinks.update` `logging.views.create` `logging.views.get` `logging.views.list` `logging.views.update`
Identity and Access Management	Now GA	The role `roles/iam.workforcePoolAdmin` (IAM Workforce Pool Admin) is now GA.
Identity and Access Management	Now GA	The role `roles/iam.workforcePoolEditor` (IAM Workforce Pool Editor) is now GA.
Identity and Access Management	Now GA	The role `roles/iam.workforcePoolViewer` (IAM Workforce Pool Viewer) is now GA.
Cloud Logging	Now GA	The role `roles/logging.linkViewer` (Log Link Accessor) is now GA.
Network Connectivity Center	Role Updated	The following permissions have been added to the role `roles/networkconnectivity.serviceAgent` (Network Connectivity Service Agent): `compute.addresses.create` `compute.addresses.delete` `compute.addresses.use` `compute.forwardingRules.create` `compute.forwardingRules.delete` `compute.forwardingRules.pscCreate` `compute.forwardingRules.pscDelete` `compute.subnetworks.use`
Certificate Authority Service	Now GA	The role `roles/privateca.poolReader` (CA Service Pool Reader) is now GA.
Pub/Sub Lite	Role Updated	The following permissions have been added to the role `roles/pubsublite.serviceAgent` (Pub/Sub Lite Service Agent): `pubsublite.subscriptions.getCursor`
Apigee	Added	`apigee.nataddresses.activate` `apigee.nataddresses.create` `apigee.nataddresses.delete` `apigee.nataddresses.get` `apigee.nataddresses.list` `apigee.securityIncidents.get` `apigee.securityIncidents.list`
Apigee	Supported In Custom Roles	`apigee.nataddresses.activate` `apigee.nataddresses.create` `apigee.nataddresses.delete` `apigee.nataddresses.get` `apigee.nataddresses.list` `apigee.securityIncidents.get` `apigee.securityIncidents.list`
Apigee	Now GA	`apigee.nataddresses.activate` `apigee.nataddresses.create` `apigee.nataddresses.delete` `apigee.nataddresses.get` `apigee.nataddresses.list` `apigee.securityIncidents.get` `apigee.securityIncidents.list`
Bare Metal Solution	Added	`baremetalsolution.maintenanceevents.addProposal` `baremetalsolution.maintenanceevents.approve` `baremetalsolution.maintenanceevents.get` `baremetalsolution.maintenanceevents.list`
Bare Metal Solution	Supported In Custom Roles	`baremetalsolution.maintenanceevents.addProposal` `baremetalsolution.maintenanceevents.approve` `baremetalsolution.maintenanceevents.get` `baremetalsolution.maintenanceevents.list`
Bare Metal Solution	Now GA	`baremetalsolution.maintenanceevents.addProposal` `baremetalsolution.maintenanceevents.approve` `baremetalsolution.maintenanceevents.get` `baremetalsolution.maintenanceevents.list`
Compute Engine	Now GA	`compute.instances.setName`
Confidential Computing	Added	`confidentialcomputing.challenges.create` `confidentialcomputing.challenges.verify` `confidentialcomputing.locations.get` `confidentialcomputing.locations.list`
Dialogflow	Added	`dialogflow.deployments.get` `dialogflow.deployments.list` `dialogflow.environments.runContinuousTest`
Cloud DNS	Added	`dns.gkeClusters.bindDNSResponsePolicy` `dns.gkeClusters.bindPrivateDNSZone`
Cloud DNS	Supported In Custom Roles	`dns.gkeClusters.bindDNSResponsePolicy` `dns.gkeClusters.bindPrivateDNSZone`
Cloud DNS	Now GA	`dns.gkeClusters.bindDNSResponsePolicy` `dns.gkeClusters.bindPrivateDNSZone` `dns.managedZones.getIamPolicy` `dns.managedZones.setIamPolicy` `dns.networks.bindDNSResponsePolicy` `dns.responsePolicies.create` `dns.responsePolicies.delete` `dns.responsePolicies.get` `dns.responsePolicies.list` `dns.responsePolicies.update` `dns.responsePolicyRules.create` `dns.responsePolicyRules.delete` `dns.responsePolicyRules.get` `dns.responsePolicyRules.list` `dns.responsePolicyRules.update`
Distributed Cloud Edge Network	Added	`edgenetwork.routes.create` `edgenetwork.routes.delete` `edgenetwork.routes.get` `edgenetwork.routes.list`
Distributed Cloud Edge Network	Now GA	`edgenetwork.routes.create` `edgenetwork.routes.delete` `edgenetwork.routes.get` `edgenetwork.routes.list`
FleetEngine	Added	`fleetengine.tasktrackinginfo.get`
FleetEngine	Supported In Custom Roles	`fleetengine.tasktrackinginfo.get`
Google Distributed Cloud	Added	`gkeonprem.bareMetalAdminClusters.connect` `gkeonprem.vmwareAdminClusters.connect`
Google Distributed Cloud	Supported In Custom Roles	`gkeonprem.bareMetalAdminClusters.connect` `gkeonprem.vmwareAdminClusters.connect`
Google Distributed Cloud	Now GA	`gkeonprem.bareMetalAdminClusters.connect` `gkeonprem.vmwareAdminClusters.connect`
Identity and Access Management	Now GA	`iam.workforcePoolProviders.create` `iam.workforcePoolProviders.delete` `iam.workforcePoolProviders.get` `iam.workforcePoolProviders.list` `iam.workforcePoolProviders.undelete` `iam.workforcePoolProviders.update` `iam.workforcePoolSubjects.delete` `iam.workforcePoolSubjects.undelete` `iam.workforcePools.create` `iam.workforcePools.delete` `iam.workforcePools.get` `iam.workforcePools.getIamPolicy` `iam.workforcePools.list` `iam.workforcePools.setIamPolicy` `iam.workforcePools.undelete` `iam.workforcePools.update`
Identity and Access Management	Now GA	`iam.googleapis.com/workforcePoolProviders.create` `iam.googleapis.com/workforcePoolProviders.delete` `iam.googleapis.com/workforcePoolProviders.get` `iam.googleapis.com/workforcePoolProviders.list` `iam.googleapis.com/workforcePoolProviders.undelete` `iam.googleapis.com/workforcePoolProviders.update` `iam.googleapis.com/workforcePoolSubjects.delete` `iam.googleapis.com/workforcePoolSubjects.undelete` `iam.googleapis.com/workforcePools.create` `iam.googleapis.com/workforcePools.delete` `iam.googleapis.com/workforcePools.get` `iam.googleapis.com/workforcePools.getIamPolicy` `iam.googleapis.com/workforcePools.list` `iam.googleapis.com/workforcePools.setIamPolicy` `iam.googleapis.com/workforcePools.undelete` `iam.googleapis.com/workforcePools.update`
Cloud Logging	Now GA	`logging.links.create` `logging.links.delete` `logging.links.get` `logging.links.list`
Recommender	Added	`recommender.resourcemanagerServiceLimitInsights.get` `recommender.resourcemanagerServiceLimitInsights.list` `recommender.resourcemanagerServiceLimitInsights.update` `recommender.resourcemanagerServiceLimitRecommendations.get` `recommender.resourcemanagerServiceLimitRecommendations.list` `recommender.resourcemanagerServiceLimitRecommendations.update`
Recommender	Supported In Custom Roles	`recommender.resourcemanagerServiceLimitInsights.get` `recommender.resourcemanagerServiceLimitInsights.list` `recommender.resourcemanagerServiceLimitInsights.update` `recommender.resourcemanagerServiceLimitRecommendations.get` `recommender.resourcemanagerServiceLimitRecommendations.list` `recommender.resourcemanagerServiceLimitRecommendations.update`
Risk Manager	Added	`riskmanager.controlScoreBreakdowns.get` `riskmanager.controlScoreBreakdowns.list`
Risk Manager	Supported In Custom Roles	`riskmanager.controlScoreBreakdowns.get` `riskmanager.controlScoreBreakdowns.list`
Security Command Center	Added	`securitycenter.effectivesecurityhealthanalyticscustommodules.get` `securitycenter.effectivesecurityhealthanalyticscustommodules.list`
Security Command Center	Supported In Custom Roles	`securitycenter.effectivesecurityhealthanalyticscustommodules.get` `securitycenter.effectivesecurityhealthanalyticscustommodules.list`
Security Command Center	Now GA	`securitycenter.effectivesecurityhealthanalyticscustommodules.get` `securitycenter.effectivesecurityhealthanalyticscustommodules.list`

Cloud IAM changes as of 2023-02-17

Service	Change	Description
Advisory Notifications	Now GA	The role `roles/advisorynotifications.viewer` (Advisory Notifications Viewer) is now GA.
Vertex AI	Role Updated	The following permissions have been added to the role `roles/aiplatform.serviceAgent` (Vertex AI Service Agent): `compute.disks.createTagBinding` `compute.instances.createTagBinding` `notebooks.instances.create` `notebooks.instances.delete` `notebooks.instances.get`
Cloud Service Mesh	Role Updated	The following permissions have been added to the role `roles/anthosservicemesh.serviceAgent` (Anthos Service Mesh Service Agent): `workloadcertificate.locations.get` `workloadcertificate.locations.list` `workloadcertificate.operations.get` `workloadcertificate.workloadCertificateFeature.get` `workloadcertificate.workloadRegistrations.create` `workloadcertificate.workloadRegistrations.get` `workloadcertificate.workloadRegistrations.list`
Artifact Registry	Now GA	The role `roles/artifactregistry.createOnPushRepoAdmin` () is now GA.
Artifact Registry	Now GA	The role `roles/artifactregistry.createOnPushWriter` () is now GA.
Certificate Manager	Now GA	The role `roles/certificatemanager.serviceAgent` (Certificate Manager Service Agent) is now GA.
Google Security Operations	Now GA	The role `roles/chronicle.serviceAgent` (Chronicle Service Agent) is now GA.
Cloud Build	Now GA	The role `roles/cloudbuild.loggingServiceAgent` (Cloud Build Logging Service Agent) is now GA.
Compute Engine	Role Updated	The following permissions have been added to the role `roles/compute.serviceAgent` (Compute Engine Service Agent): `compute.disks.createTagBinding`
Dataform	Role Updated	The following permissions have been added to the role `roles/dataform.serviceAgent` (Dataform Service Agent): `dataform.compilationResults.create` `dataform.workflowInvocations.create`
Database Migration Service	Role Updated	The following permissions have been added to the role `roles/datamigration.serviceAgent` (Database Migration Service Agent): `cloudsql.instances.demoteMaster`
Firebase Realtime Database	Now GA	The role `roles/firebasedatabase.serviceAgent` (Firebase Realtime Database Service Agent) is now GA.
Backup for GKE	Role Updated	The following permissions have been added to the role `roles/gkebackup.serviceAgent` (Backup for GKE Service Agent): `container.clusters.update` `container.operations.get` `container.operations.list`
Google Distributed Cloud	Now GA	The role `roles/gkeonprem.serviceAgent` (GKE On-Prem Service Agent) is now GA.
Identity Toolkit	Now GA	The role `roles/identitytoolkit.serviceAgent` (Identity Platform Service Agent) is now GA.
Cloud Workstations	Now GA	The role `roles/workstations.serviceAgent` (Workstations Service Agent) is now GA.
Access Context Manager	Added	`accesscontextmanager.authorizedOrgsDescs.create` `accesscontextmanager.authorizedOrgsDescs.delete` `accesscontextmanager.authorizedOrgsDescs.get` `accesscontextmanager.authorizedOrgsDescs.list` `accesscontextmanager.authorizedOrgsDescs.update`
Access Context Manager	Supported In Custom Roles	`accesscontextmanager.authorizedOrgsDescs.create` `accesscontextmanager.authorizedOrgsDescs.delete` `accesscontextmanager.authorizedOrgsDescs.get` `accesscontextmanager.authorizedOrgsDescs.list` `accesscontextmanager.authorizedOrgsDescs.update`
Access Context Manager	Now GA	`accesscontextmanager.authorizedOrgsDescs.create` `accesscontextmanager.authorizedOrgsDescs.delete` `accesscontextmanager.authorizedOrgsDescs.get` `accesscontextmanager.authorizedOrgsDescs.list` `accesscontextmanager.authorizedOrgsDescs.update`
Advisory Notifications	Now GA	`advisorynotifications.notifications.get` `advisorynotifications.notifications.list`
Artifact Registry	Added	`artifactregistry.repositories.createOnPush`
Artifact Registry	Supported In Custom Roles	`artifactregistry.repositories.createOnPush`
Artifact Registry	Now GA	`artifactregistry.repositories.createOnPush`
Bare Metal Solution	Added	`baremetalsolution.storageaggregatepools.list`
Bare Metal Solution	Supported In Custom Roles	`baremetalsolution.storageaggregatepools.list`
Bare Metal Solution	Now GA	`baremetalsolution.storageaggregatepools.list`
BigQuery	Added	`bigquery.datasets.listEffectiveTags`
BigQuery	Now GA	`bigquery.datasets.listEffectiveTags`
Cloud Logging	Added	`logging.logEntries.route`
Cloud Logging	Supported In Custom Roles	`logging.logEntries.route`

Cloud IAM changes as of 2023-02-03

Service	Change	Description
Connectors	Now GA	The role `roles/connectors.serviceAgent` (Connectors Platform Service Agent) is now GA.
Google Kubernetes Engine	Role Updated	The following permissions have been added to the role `roles/container.viewer` (Kubernetes Engine Viewer): `recommender.containerDiagnosisInsights.get` `recommender.containerDiagnosisInsights.list` `recommender.containerDiagnosisRecommendations.get` `recommender.containerDiagnosisRecommendations.list` `recommender.locations.get` `recommender.locations.list` `recommender.networkAnalyzerGkeConnectivityInsights.get` `recommender.networkAnalyzerGkeConnectivityInsights.list` `recommender.networkAnalyzerGkeIpAddressInsights.get` `recommender.networkAnalyzerGkeIpAddressInsights.list`
Container Threat Detection	Role Updated	The following permissions have been added to the role `roles/containerthreatdetection.serviceAgent` (Container Threat Detection Service Agent): `recommender.containerDiagnosisInsights.get` `recommender.containerDiagnosisInsights.list` `recommender.containerDiagnosisRecommendations.get` `recommender.containerDiagnosisRecommendations.list` `recommender.locations.get` `recommender.locations.list` `recommender.networkAnalyzerGkeConnectivityInsights.get` `recommender.networkAnalyzerGkeConnectivityInsights.list` `recommender.networkAnalyzerGkeIpAddressInsights.get` `recommender.networkAnalyzerGkeIpAddressInsights.list`
Identity and Access Management	Now GA	The role `roles/iam.denyAdmin` (Deny Admin) is now GA.
Identity and Access Management	Now GA	The role `roles/iam.denyReviewer` (Deny Reviewer) is now GA.
Cloud Integrations	Role Updated	The following permissions have been added to the role `roles/integrations.apigeeIntegrationAdminRole` (Apigee Integration Admin): `connectors.actions.execute` `connectors.actions.list` `connectors.connections.executeSqlQuery` `connectors.entities.create` `connectors.entities.delete` `connectors.entities.deleteEntitiesWithConditions` `connectors.entities.get` `connectors.entities.list` `connectors.entities.update` `connectors.entities.updateEntitiesWithConditions` `connectors.entityTypes.list`
Cloud Integrations	Role Updated	The following permissions have been added to the role `roles/integrations.apigeeIntegrationEditorRole` (Apigee Integration Editor): `connectors.actions.execute` `connectors.actions.list` `connectors.connections.executeSqlQuery` `connectors.entities.create` `connectors.entities.delete` `connectors.entities.deleteEntitiesWithConditions` `connectors.entities.get` `connectors.entities.list` `connectors.entities.update` `connectors.entities.updateEntitiesWithConditions` `connectors.entityTypes.list`
Cloud Integrations	Role Updated	The following permissions have been added to the role `roles/integrations.apigeeIntegrationInvokerRole` (Apigee Integration Invoker): `connectors.actions.execute` `connectors.actions.list` `connectors.connections.executeSqlQuery` `connectors.entities.create` `connectors.entities.delete` `connectors.entities.deleteEntitiesWithConditions` `connectors.entities.get` `connectors.entities.list` `connectors.entities.update` `connectors.entities.updateEntitiesWithConditions` `connectors.entityTypes.list`
Service Extensions	Now GA	The role `roles/networkactions.serviceAgent` (Network Actions Service Agent) is now GA.
Pub/Sub Lite	Role Updated	The following permissions have been added to the role `roles/pubsublite.serviceAgent` (Pub/Sub Lite Service Agent): `pubsublite.subscriptions.get`
Recommender	Now GA	The role `roles/recommender.viewer` (Recommender Viewer) is now GA.
Security Command Center	Role Updated	The following permissions have been added to the role `roles/securitycenter.controlServiceAgent` (Security Center Control Service Agent): `recommender.containerDiagnosisInsights.get` `recommender.containerDiagnosisInsights.list` `recommender.containerDiagnosisRecommendations.get` `recommender.containerDiagnosisRecommendations.list` `recommender.networkAnalyzerGkeConnectivityInsights.get` `recommender.networkAnalyzerGkeConnectivityInsights.list` `recommender.networkAnalyzerGkeIpAddressInsights.get` `recommender.networkAnalyzerGkeIpAddressInsights.list`
Security Command Center	Role Updated	The following permissions have been added to the role `roles/securitycenter.serviceAgent` (Security Center Service Agent): `recommender.containerDiagnosisInsights.get` `recommender.containerDiagnosisInsights.list` `recommender.containerDiagnosisRecommendations.get` `recommender.containerDiagnosisRecommendations.list` `recommender.networkAnalyzerGkeConnectivityInsights.get` `recommender.networkAnalyzerGkeConnectivityInsights.list` `recommender.networkAnalyzerGkeIpAddressInsights.get` `recommender.networkAnalyzerGkeIpAddressInsights.list`
Service Management	Role Updated	The following permissions have been added to the role `roles/servicemanagement.quotaAdmin` (Quota Administrator): `monitoring.alertPolicies.create` `monitoring.alertPolicies.delete` `monitoring.alertPolicies.get` `monitoring.alertPolicies.list` `monitoring.alertPolicies.update`
BigLake	Added	`biglake.catalogs.create` `biglake.catalogs.delete` `biglake.catalogs.get` `biglake.catalogs.list` `biglake.databases.create` `biglake.databases.delete` `biglake.databases.get` `biglake.databases.list` `biglake.databases.update` `biglake.locks.check` `biglake.locks.create` `biglake.locks.delete` `biglake.locks.list` `biglake.tables.create` `biglake.tables.delete` `biglake.tables.get` `biglake.tables.list` `biglake.tables.lock` `biglake.tables.update`
Blockchain Node Engine	Added	`blockchainnodeengine.blockchainNodes.create` `blockchainnodeengine.blockchainNodes.delete` `blockchainnodeengine.blockchainNodes.get` `blockchainnodeengine.blockchainNodes.list` `blockchainnodeengine.blockchainNodes.update` `blockchainnodeengine.locations.get` `blockchainnodeengine.locations.list` `blockchainnodeengine.operations.cancel` `blockchainnodeengine.operations.delete` `blockchainnodeengine.operations.get` `blockchainnodeengine.operations.list`
Identity and Access Management	Now GA	`iam.denypolicies.create` `iam.denypolicies.delete` `iam.denypolicies.get` `iam.denypolicies.list` `iam.denypolicies.replace` `iam.denypolicies.update`
Identity and Access Management	Now GA	`iam.googleapis.com/denypolicies.create` `iam.googleapis.com/denypolicies.delete` `iam.googleapis.com/denypolicies.get` `iam.googleapis.com/denypolicies.list` `iam.googleapis.com/denypolicies.replace`
Serverless VPC Access	Added	`vpcaccess.connectors.update`
Serverless VPC Access	Supported In Custom Roles	`vpcaccess.connectors.update`

Cloud IAM changes as of 2023-01-27

Service	Change	Description
Batch	Role Updated	The following permissions have been added to the role `roles/batch.serviceAgent` (Google Batch Service Agent): `compute.backendBuckets.get` `compute.backendBuckets.list` `compute.backendServices.get` `compute.backendServices.list` `compute.disks.addResourcePolicies` `compute.disks.createTagBinding` `compute.disks.deleteTagBinding` `compute.disks.getIamPolicy` `compute.disks.listEffectiveTags` `compute.disks.listTagBindings` `compute.disks.removeResourcePolicies` `compute.externalVpnGateways.get` `compute.externalVpnGateways.list` `compute.firewalls.get` `compute.firewalls.list` `compute.forwardingRules.get` `compute.forwardingRules.list` `compute.globalForwardingRules.get` `compute.globalForwardingRules.list` `compute.globalForwardingRules.pscGet` `compute.healthChecks.get` `compute.healthChecks.list` `compute.httpHealthChecks.get` `compute.httpHealthChecks.list` `compute.httpsHealthChecks.get` `compute.httpsHealthChecks.list` `compute.images.create` `compute.images.createTagBinding` `compute.images.delete` `compute.images.deleteTagBinding` `compute.images.deprecate` `compute.images.getIamPolicy` `compute.images.listEffectiveTags` `compute.images.listTagBindings` `compute.images.setLabels` `compute.images.update` `compute.interconnectAttachments.get` `compute.interconnectAttachments.list` `compute.interconnectLocations.get` `compute.interconnectLocations.list` `compute.interconnects.get` `compute.interconnects.list` `compute.licenseCodes.get` `compute.licenseCodes.getIamPolicy` `compute.licenseCodes.list` `compute.licenseCodes.update` `compute.licenseCodes.use` `compute.licenses.create` `compute.licenses.delete` `compute.licenses.getIamPolicy` `compute.networkAttachments.get` `compute.networkAttachments.list` `compute.projects.setCommonInstanceMetadata` `compute.regionBackendServices.get` `compute.regionBackendServices.list` `compute.regionHealthCheckServices.get` `compute.regionHealthCheckServices.list` `compute.regionHealthChecks.get` `compute.regionHealthChecks.list` `compute.regionNotificationEndpoints.get` `compute.regionNotificationEndpoints.list` `compute.regionSslCertificates.get` `compute.regionSslCertificates.list` `compute.regionSslPolicies.get` `compute.regionSslPolicies.list` `compute.regionSslPolicies.listAvailableFeatures` `compute.regionTargetHttpProxies.get` `compute.regionTargetHttpProxies.list` `compute.regionTargetHttpsProxies.get` `compute.regionTargetHttpsProxies.list` `compute.regionTargetTcpProxies.get` `compute.regionTargetTcpProxies.list` `compute.regionUrlMaps.get` `compute.regionUrlMaps.list` `compute.resourcePolicies.create` `compute.resourcePolicies.delete` `compute.resourcePolicies.get` `compute.resourcePolicies.getIamPolicy` `compute.resourcePolicies.list` `compute.resourcePolicies.update` `compute.resourcePolicies.use` `compute.routers.get` `compute.routers.list` `compute.routes.get` `compute.routes.list` `compute.serviceAttachments.get` `compute.serviceAttachments.list` `compute.snapshots.create` `compute.snapshots.createTagBinding` `compute.snapshots.delete` `compute.snapshots.deleteTagBinding` `compute.snapshots.get` `compute.snapshots.getIamPolicy` `compute.snapshots.list` `compute.snapshots.listEffectiveTags` `compute.snapshots.listTagBindings` `compute.snapshots.setLabels` `compute.snapshots.useReadOnly` `compute.sslCertificates.get` `compute.sslCertificates.list` `compute.sslPolicies.get` `compute.sslPolicies.list` `compute.sslPolicies.listAvailableFeatures` `compute.targetGrpcProxies.get` `compute.targetGrpcProxies.list` `compute.targetHttpProxies.get` `compute.targetHttpProxies.list` `compute.targetHttpsProxies.get` `compute.targetHttpsProxies.list` `compute.targetInstances.get` `compute.targetInstances.list` `compute.targetSslProxies.get` `compute.targetSslProxies.list` `compute.targetTcpProxies.get` `compute.targetTcpProxies.list` `compute.targetVpnGateways.get` `compute.targetVpnGateways.list` `compute.urlMaps.get` `compute.urlMaps.list` `compute.vpnGateways.get` `compute.vpnGateways.list` `compute.vpnTunnels.get` `compute.vpnTunnels.list`
Firebase Remote Config	Now GA	The role `roles/cloudconfig.serviceAgent` (Cloud Config Service Agent) is now GA.
Dataplex	Now GA	The role `roles/dataplex.bindingAdmin` (Dataplex Binding Administrator) is now GA.
Dataplex	Now GA	The role `roles/dataplex.securityAdmin` (Dataplex Security Administrator) is now GA.
Dataplex	Now GA	The role `roles/dataplex.taxonomyAdmin` (Dataplex Taxonomy Administrator) is now GA.
Dataplex	Now GA	The role `roles/dataplex.taxonomyViewer` (Dataplex Taxonomy Viewer) is now GA.
Firebase	Role Updated	The following permissions have been added to the role `roles/firebase.admin` (Firebase Admin): `oauthconfig.verification.get` `oauthpolicymetadata.brandpolicy.get`
Firebase	Role Updated	The following permissions have been added to the role `roles/firebase.developAdmin` (Firebase Develop Admin): `oauthconfig.verification.get` `oauthpolicymetadata.brandpolicy.get`
Firebase	Role Updated	The following permissions have been added to the role `roles/firebase.developViewer` (Firebase Develop Viewer): `oauthconfig.verification.get` `oauthpolicymetadata.brandpolicy.get`
Firebase	Role Updated	The following permissions have been added to the role `roles/firebase.viewer` (Firebase Viewer): `oauthconfig.verification.get` `oauthpolicymetadata.brandpolicy.get`
BigQuery	Now GA	`bigquery.datasets.createTagBinding` `bigquery.datasets.deleteTagBinding` `bigquery.datasets.listTagBindings`
Cloud SQL	Added	`cloudsql.instances.migrate`
Cloud SQL	Supported In Custom Roles	`cloudsql.instances.migrate`
Cloud SQL	Now GA	`cloudsql.instances.migrate`
Dataplex	Added	`dataplex.dataAttributeBindings.create` `dataplex.dataAttributeBindings.delete` `dataplex.dataAttributeBindings.get` `dataplex.dataAttributeBindings.getIamPolicy` `dataplex.dataAttributeBindings.list` `dataplex.dataAttributeBindings.setIamPolicy` `dataplex.dataAttributeBindings.update` `dataplex.dataAttributes.bind` `dataplex.dataAttributes.create` `dataplex.dataAttributes.delete` `dataplex.dataAttributes.get` `dataplex.dataAttributes.getIamPolicy` `dataplex.dataAttributes.list` `dataplex.dataAttributes.setIamPolicy` `dataplex.dataAttributes.update` `dataplex.dataTaxonomies.configureDataAccess` `dataplex.dataTaxonomies.configureResourceAccess` `dataplex.dataTaxonomies.create` `dataplex.dataTaxonomies.delete` `dataplex.dataTaxonomies.get` `dataplex.dataTaxonomies.getIamPolicy` `dataplex.dataTaxonomies.list` `dataplex.dataTaxonomies.setIamPolicy` `dataplex.dataTaxonomies.update`
Dataplex	Now GA	`dataplex.dataAttributeBindings.create` `dataplex.dataAttributeBindings.delete` `dataplex.dataAttributeBindings.get` `dataplex.dataAttributeBindings.getIamPolicy` `dataplex.dataAttributeBindings.list` `dataplex.dataAttributeBindings.setIamPolicy` `dataplex.dataAttributeBindings.update` `dataplex.dataAttributes.bind` `dataplex.dataAttributes.create` `dataplex.dataAttributes.delete` `dataplex.dataAttributes.get` `dataplex.dataAttributes.getIamPolicy` `dataplex.dataAttributes.list` `dataplex.dataAttributes.setIamPolicy` `dataplex.dataAttributes.update` `dataplex.dataTaxonomies.configureDataAccess` `dataplex.dataTaxonomies.configureResourceAccess` `dataplex.dataTaxonomies.create` `dataplex.dataTaxonomies.delete` `dataplex.dataTaxonomies.get` `dataplex.dataTaxonomies.getIamPolicy` `dataplex.dataTaxonomies.list` `dataplex.dataTaxonomies.setIamPolicy` `dataplex.dataTaxonomies.update`
Dialogflow	Added	`dialogflow.experiments.create` `dialogflow.experiments.delete` `dialogflow.experiments.get` `dialogflow.experiments.list` `dialogflow.experiments.update` `dialogflow.testcases.calculateCoverage` `dialogflow.testcases.create` `dialogflow.testcases.delete` `dialogflow.testcases.export` `dialogflow.testcases.get` `dialogflow.testcases.import` `dialogflow.testcases.list` `dialogflow.testcases.run` `dialogflow.testcases.update`
Pub/Sub	Added	`pubsub.schemas.commit` `pubsub.schemas.listRevisions` `pubsub.schemas.rollback`
Pub/Sub	Now GA	`pubsub.schemas.commit` `pubsub.schemas.listRevisions` `pubsub.schemas.rollback`
Pub/Sub Lite	Added	`pubsublite.locations.openKafkaStream`
Pub/Sub Lite	Now GA	`pubsublite.locations.openKafkaStream`
Workload Certificate	Added	`workloadcertificate.locations.get` `workloadcertificate.locations.list` `workloadcertificate.operations.cancel` `workloadcertificate.operations.delete` `workloadcertificate.operations.get` `workloadcertificate.operations.list` `workloadcertificate.workloadCertificateFeature.get` `workloadcertificate.workloadCertificateFeature.update` `workloadcertificate.workloadRegistrations.create` `workloadcertificate.workloadRegistrations.delete` `workloadcertificate.workloadRegistrations.get` `workloadcertificate.workloadRegistrations.list` `workloadcertificate.workloadRegistrations.update`

Cloud IAM changes as of 2023-01-20

Service	Change	Description
Vertex AI	Role Updated	The following permissions have been added to the role `roles/aiplatform.admin` (Vertex AI Administrator): `aiplatform.humanInTheLoops.cancel`
Vertex AI	Role Updated	The following permissions have been added to the role `roles/aiplatform.customCodeServiceAgent` (Vertex AI Custom Code Service Agent): `aiplatform.humanInTheLoops.cancel`
Vertex AI	Role Updated	The following permissions have been added to the role `roles/aiplatform.serviceAgent` (Vertex AI Service Agent): `aiplatform.humanInTheLoops.cancel` `compute.addresses.get` `compute.addresses.list` `compute.addresses.use` `compute.addresses.useInternal` `compute.disks.create` `compute.disks.delete` `compute.disks.get` `compute.disks.setLabels` `compute.disks.use` `compute.disks.useReadOnly` `compute.instances.create` `compute.instances.delete` `compute.instances.get` `compute.instances.setLabels` `compute.instances.setMetadata` `compute.instances.setServiceAccount` `compute.instances.setTags` `compute.subnetworks.use` `compute.subnetworks.useExternalIp`
Vertex AI	Role Updated	The following permissions have been added to the role `roles/aiplatform.user` (Vertex AI User): `aiplatform.humanInTheLoops.cancel`
Cloud Build	Role Updated	The following permissions have been added to the role `roles/cloudbuild.serviceAgent` (Cloud Build Service Agent): `pubsub.topics.get`
Distributed Cloud Edge Network	Now GA	The role `roles/edgenetwork.admin` (Edge Network Admin) is now GA.
Distributed Cloud Edge Network	Now GA	The role `roles/edgenetwork.viewer` (Edge Network Viewer) is now GA.
Firebase Security Rules	Now GA	The role `roles/firebaserules.system` (Firebase Rules System) is now GA.
Maps Platform Datasets	Role Updated	The following permissions have been added to the role `roles/mapsplatformdatasets.admin` (Maps Platform Datasets Admin): `mapsadmin.clientStyles.create` `mapsadmin.clientStyles.delete` `mapsadmin.clientStyles.get` `mapsadmin.clientStyles.list` `mapsadmin.clientStyles.update`
Maps Platform Datasets	Role Updated	The following permissions have been added to the role `roles/mapsplatformdatasets.viewer` (Maps Platform Datasets Viewer): `mapsadmin.clientStyles.get` `mapsadmin.clientStyles.list`
Cloud Monitoring	Role Updated	The following permissions have been added to the role `roles/monitoring.notificationServiceAgent` (Monitoring Service Agent): `monitoring.timeSeries.list`
Stream	Now GA	The role `roles/stream.serviceAgent` (Stream Service Agent) is now GA.
Vision AI	Now GA	The role `roles/visionai.serviceAgent` (Cloud Vision AI Service Agent) is now GA.
Visual Inspection AI	Role Updated	The following permissions have been added to the role `roles/visualinspection.serviceAgent` (Visual Inspection AI Service Agent): `aiplatform.humanInTheLoops.cancel`
Vertex AI	Added	`aiplatform.humanInTheLoops.cancel`
Apigee	Added	`apigee.entitlements.get` `apigee.projectorganizations.get` `apigee.setupcontexts.get` `apigee.setupcontexts.update`
Apigee	Now GA	`apigee.entitlements.get` `apigee.projectorganizations.get` `apigee.setupcontexts.get` `apigee.setupcontexts.update`
Recommendations	Added	`automlrecommendations.eventStores.list` `automlrecommendations.events.get`
Recommendations	Supported In Custom Roles	`automlrecommendations.eventStores.list` `automlrecommendations.events.get`
Google Security Operations	Added	`chronicle.parserExtensions.create` `chronicle.parserExtensions.delete` `chronicle.parserExtensions.get` `chronicle.parserExtensions.list`
Google Security Operations	Now GA	`chronicle.parserExtensions.create` `chronicle.parserExtensions.delete` `chronicle.parserExtensions.get` `chronicle.parserExtensions.list`
Compute Engine	Added	`compute.resourcePolicies.update`
Compute Engine	Supported In Custom Roles	`compute.resourcePolicies.update`
Compute Engine	Now GA	`compute.resourcePolicies.update`
Data Catalog	Added	`datacatalog.entries.createGlossary` `datacatalog.entries.createGlossaryTerm` `datacatalog.entries.deleteGlossary` `datacatalog.entries.deleteGlossaryTerm` `datacatalog.entries.updateGlossary` `datacatalog.entries.updateGlossaryTerm` `datacatalog.relationships.create` `datacatalog.relationships.createIsDescribedBy` `datacatalog.relationships.createIsRelatedTo` `datacatalog.relationships.createIsSynonymousTo` `datacatalog.relationships.delete` `datacatalog.relationships.deleteIsDescribedBy` `datacatalog.relationships.deleteIsRelatedTo` `datacatalog.relationships.deleteIsSynonymousTo` `datacatalog.relationships.list`
Data Catalog	Supported In Custom Roles	`datacatalog.entries.createGlossary` `datacatalog.entries.createGlossaryTerm` `datacatalog.entries.deleteGlossary` `datacatalog.entries.deleteGlossaryTerm` `datacatalog.entries.updateGlossary` `datacatalog.entries.updateGlossaryTerm` `datacatalog.relationships.create` `datacatalog.relationships.createIsDescribedBy` `datacatalog.relationships.createIsRelatedTo` `datacatalog.relationships.createIsSynonymousTo` `datacatalog.relationships.delete` `datacatalog.relationships.deleteIsDescribedBy` `datacatalog.relationships.deleteIsRelatedTo` `datacatalog.relationships.deleteIsSynonymousTo` `datacatalog.relationships.list`
Database Migration Service	Added	`datamigration.locations.fetchStaticIps`
Database Migration Service	Supported In Custom Roles	`datamigration.locations.fetchStaticIps`
Database Migration Service	Now GA	`datamigration.locations.fetchStaticIps`
Distributed Cloud Edge Network	Added	`edgenetwork.interconnectAttachments.create` `edgenetwork.interconnectAttachments.delete` `edgenetwork.interconnectAttachments.get` `edgenetwork.interconnectAttachments.getIamPolicy` `edgenetwork.interconnectAttachments.list` `edgenetwork.interconnectAttachments.setIamPolicy` `edgenetwork.interconnectAttachments.update` `edgenetwork.interconnects.get` `edgenetwork.interconnects.getDiagnostics` `edgenetwork.interconnects.getIamPolicy` `edgenetwork.interconnects.list` `edgenetwork.interconnects.setIamPolicy` `edgenetwork.locations.get` `edgenetwork.locations.list` `edgenetwork.networks.create` `edgenetwork.networks.delete` `edgenetwork.networks.get` `edgenetwork.networks.getIamPolicy` `edgenetwork.networks.getStatus` `edgenetwork.networks.list` `edgenetwork.networks.setIamPolicy` `edgenetwork.networks.update` `edgenetwork.operations.cancel` `edgenetwork.operations.delete` `edgenetwork.operations.get` `edgenetwork.operations.list` `edgenetwork.routers.create` `edgenetwork.routers.delete` `edgenetwork.routers.get` `edgenetwork.routers.getIamPolicy` `edgenetwork.routers.getRouterStatus` `edgenetwork.routers.list` `edgenetwork.routers.patch` `edgenetwork.routers.setIamPolicy` `edgenetwork.routers.update` `edgenetwork.subnetworks.create` `edgenetwork.subnetworks.delete` `edgenetwork.subnetworks.get` `edgenetwork.subnetworks.getIamPolicy` `edgenetwork.subnetworks.getStatus` `edgenetwork.subnetworks.list` `edgenetwork.subnetworks.setIamPolicy` `edgenetwork.subnetworks.update` `edgenetwork.zones.get` `edgenetwork.zones.initialize` `edgenetwork.zones.list`
Distributed Cloud Edge Network	Supported In Custom Roles	`edgenetwork.interconnectAttachments.create` `edgenetwork.interconnectAttachments.delete` `edgenetwork.interconnectAttachments.get` `edgenetwork.interconnectAttachments.getIamPolicy` `edgenetwork.interconnectAttachments.list` `edgenetwork.interconnectAttachments.setIamPolicy` `edgenetwork.interconnectAttachments.update` `edgenetwork.interconnects.get` `edgenetwork.interconnects.getDiagnostics` `edgenetwork.interconnects.getIamPolicy` `edgenetwork.interconnects.list` `edgenetwork.interconnects.setIamPolicy` `edgenetwork.locations.get` `edgenetwork.locations.list` `edgenetwork.networks.create` `edgenetwork.networks.delete` `edgenetwork.networks.get` `edgenetwork.networks.getIamPolicy` `edgenetwork.networks.getStatus` `edgenetwork.networks.list` `edgenetwork.networks.setIamPolicy` `edgenetwork.networks.update` `edgenetwork.operations.cancel` `edgenetwork.operations.delete` `edgenetwork.operations.get` `edgenetwork.operations.list` `edgenetwork.routers.create` `edgenetwork.routers.delete` `edgenetwork.routers.get` `edgenetwork.routers.getIamPolicy` `edgenetwork.routers.getRouterStatus` `edgenetwork.routers.list` `edgenetwork.routers.patch` `edgenetwork.routers.setIamPolicy` `edgenetwork.routers.update` `edgenetwork.subnetworks.create` `edgenetwork.subnetworks.delete` `edgenetwork.subnetworks.get` `edgenetwork.subnetworks.getIamPolicy` `edgenetwork.subnetworks.getStatus` `edgenetwork.subnetworks.list` `edgenetwork.subnetworks.setIamPolicy` `edgenetwork.subnetworks.update` `edgenetwork.zones.get` `edgenetwork.zones.initialize` `edgenetwork.zones.list`
Distributed Cloud Edge Network	Now GA	`edgenetwork.interconnectAttachments.create` `edgenetwork.interconnectAttachments.delete` `edgenetwork.interconnectAttachments.get` `edgenetwork.interconnectAttachments.getIamPolicy` `edgenetwork.interconnectAttachments.list` `edgenetwork.interconnectAttachments.setIamPolicy` `edgenetwork.interconnectAttachments.update` `edgenetwork.interconnects.get` `edgenetwork.interconnects.getDiagnostics` `edgenetwork.interconnects.getIamPolicy` `edgenetwork.interconnects.list` `edgenetwork.interconnects.setIamPolicy` `edgenetwork.locations.get` `edgenetwork.locations.list` `edgenetwork.networks.create` `edgenetwork.networks.delete` `edgenetwork.networks.get` `edgenetwork.networks.getIamPolicy` `edgenetwork.networks.getStatus` `edgenetwork.networks.list` `edgenetwork.networks.setIamPolicy` `edgenetwork.networks.update` `edgenetwork.operations.cancel` `edgenetwork.operations.delete` `edgenetwork.operations.get` `edgenetwork.operations.list` `edgenetwork.routers.create` `edgenetwork.routers.delete` `edgenetwork.routers.get` `edgenetwork.routers.getIamPolicy` `edgenetwork.routers.getRouterStatus` `edgenetwork.routers.list` `edgenetwork.routers.patch` `edgenetwork.routers.setIamPolicy` `edgenetwork.routers.update` `edgenetwork.subnetworks.create` `edgenetwork.subnetworks.delete` `edgenetwork.subnetworks.get` `edgenetwork.subnetworks.getIamPolicy` `edgenetwork.subnetworks.getStatus` `edgenetwork.subnetworks.list` `edgenetwork.subnetworks.setIamPolicy` `edgenetwork.subnetworks.update` `edgenetwork.zones.get` `edgenetwork.zones.initialize` `edgenetwork.zones.list`
Firebase Authentication	Added	`firebaseauth.configs.getSecret`
Firebase Authentication	Supported In Custom Roles	`firebaseauth.configs.getSecret`
Firebase Authentication	Now GA	`firebaseauth.configs.getSecret`
Notebooks	Added	`notebooks.runtimes.upgrade`
Notebooks	Now GA	`notebooks.runtimes.upgrade`
Recommender	Added	`recommender.bigqueryPartitionClusterRecommendations.get` `recommender.bigqueryPartitionClusterRecommendations.list` `recommender.bigqueryPartitionClusterRecommendations.update` `recommender.bigqueryTableStatsInsights.get` `recommender.bigqueryTableStatsInsights.list` `recommender.bigqueryTableStatsInsights.update`
Recommender	Supported In Custom Roles	`recommender.bigqueryPartitionClusterRecommendations.get` `recommender.bigqueryPartitionClusterRecommendations.list` `recommender.bigqueryPartitionClusterRecommendations.update` `recommender.bigqueryTableStatsInsights.get` `recommender.bigqueryTableStatsInsights.list` `recommender.bigqueryTableStatsInsights.update`
Retail API	Added	`retail.models.get`
Retail API	Now GA	`retail.models.create` `retail.models.delete` `retail.models.list` `retail.models.pause` `retail.models.resume` `retail.models.tune` `retail.models.update`

Cloud IAM changes as of 2023-01-06

Service	Change	Description
Vertex AI	Now GA	The role `roles/aiplatform.entityTypeOwner` (Vertex AI Feature Store EntityType owner) is now GA.
Vertex AI	Now GA	The role `roles/aiplatform.featurestoreDataViewer` (Vertex AI Feature Store Data Viewer) is now GA.
Vertex AI	Now GA	The role `roles/aiplatform.featurestoreDataWriter` (Vertex AI Feature Store Data Writer) is now GA.
Vertex AI	Now GA	The role `roles/aiplatform.featurestoreInstanceCreator` (Vertex AI Feature Store Instance Creator) is now GA.
Vertex AI	Now GA	The role `roles/aiplatform.featurestoreResourceViewer` (Vertex AI Feature Store Resource Viewer) is now GA.
Backup and Disaster Recovery	Role Updated	The following permissions have been added to the role `roles/backupdr.computeEngineOperator` (Backup and DR Compute Engine Operator): `compute.regionOperations.get`
Cloud Build	Role Updated	The following permissions have been added to the role `roles/cloudbuild.readTokenAccessor` (Cloud Build Read Only Token Accessor): `cloudbuild.repositories.get`
Cloud Build	Role Updated	The following permissions have been added to the role `roles/cloudbuild.tokenAccessor` (Cloud Build Token Accessor): `cloudbuild.repositories.get`
Connectors	Role Updated	The following permissions have been added to the role `roles/connectors.admin` (Connector Admin): `secretmanager.secrets.getIamPolicy`
Google Cloud Contact Center as a Service	Role Updated	The following permissions have been added to the role `roles/contactcenteraiplatform.admin` (Contact Center AI Platform Admin): `contactcenteraiplatform.contactCenters.queryQuota`
Basic Role	Role Updated	The following permissions have been added to the role `roles/editor` (Editor): `contactcenteraiplatform.contactCenters.queryQuota`
GKE Hub	Role Updated	The following permissions have been added to the role `roles/gkehub.serviceAgent` (GKE Hub Service Agent): `container.operations.get`
Cloud Monitoring	Role Updated	The following permissions have been added to the role `roles/monitoring.notificationServiceAgent` (Monitoring Service Agent): `cloudfunctions.functions.get` `cloudtrace.traces.patch` `run.routes.invoke`
Basic Role	Role Updated	The following permissions have been added to the role `roles/owner` (Owner): `contactcenteraiplatform.contactCenters.queryQuota`
Recommender	Now GA	The role `roles/recommender.containerDiagnosisAdmin` (GKE Diagnosis Recommender Admin) is now GA.
Recommender	Now GA	The role `roles/recommender.containerDiagnosisViewer` (GKE Diagnosis Recommender Viewer) is now GA.
Recommender	Role Updated	The following permissions have been added to the role `roles/recommender.computeAdmin` (Compute Recommender Admin): `recommender.computeInstanceIdleResourceRecommenderConfig.get` `recommender.computeInstanceIdleResourceRecommenderConfig.update`
Basic Role	Role Updated	The following permissions have been added to the role `roles/viewer` (Viewer): `contactcenteraiplatform.contactCenters.queryQuota`
Compute Engine	Now GA	`compute.backendServices.getIamPolicy` `compute.backendServices.setIamPolicy` `compute.regionBackendServices.getIamPolicy` `compute.regionBackendServices.setIamPolicy`
Google Cloud Contact Center as a Service	Added	`contactcenteraiplatform.contactCenters.queryQuota`
Cloud Data Fusion	Added	`datafusion.artifacts.create` `datafusion.artifacts.delete` `datafusion.artifacts.get` `datafusion.artifacts.list` `datafusion.artifacts.update` `datafusion.pipelineConnections.create` `datafusion.pipelineConnections.delete` `datafusion.pipelineConnections.get` `datafusion.pipelineConnections.list` `datafusion.pipelineConnections.update` `datafusion.pipelineConnections.use` `datafusion.pipelines.create` `datafusion.pipelines.delete` `datafusion.pipelines.execute` `datafusion.pipelines.get` `datafusion.pipelines.list` `datafusion.pipelines.preview` `datafusion.pipelines.update` `datafusion.profiles.create` `datafusion.profiles.delete` `datafusion.profiles.get` `datafusion.profiles.list` `datafusion.profiles.update` `datafusion.secureKeys.create` `datafusion.secureKeys.delete` `datafusion.secureKeys.getSecret` `datafusion.secureKeys.list` `datafusion.secureKeys.update`
Data Lineage API	Added	`datalineage.events.create` `datalineage.events.delete` `datalineage.events.get` `datalineage.events.list` `datalineage.locations.searchLinks` `datalineage.operations.get` `datalineage.processes.create` `datalineage.processes.delete` `datalineage.processes.get` `datalineage.processes.list` `datalineage.processes.update` `datalineage.runs.create` `datalineage.runs.delete` `datalineage.runs.get` `datalineage.runs.list` `datalineage.runs.update`
Data Lineage API	Supported In Custom Roles	`datalineage.operations.get`
Database Migration Service	Added	`datamigration.conversionworkspaces.commit` `datamigration.conversionworkspaces.convert` `datamigration.conversionworkspaces.create` `datamigration.conversionworkspaces.delete` `datamigration.conversionworkspaces.get` `datamigration.conversionworkspaces.getIamPolicy` `datamigration.conversionworkspaces.list` `datamigration.conversionworkspaces.rollback` `datamigration.conversionworkspaces.seed` `datamigration.conversionworkspaces.setIamPolicy` `datamigration.conversionworkspaces.update` `datamigration.mappingrules.getIamPolicy` `datamigration.mappingrules.import` `datamigration.mappingrules.setIamPolicy` `datamigration.privateconnections.create` `datamigration.privateconnections.delete` `datamigration.privateconnections.get` `datamigration.privateconnections.getIamPolicy` `datamigration.privateconnections.list` `datamigration.privateconnections.setIamPolicy`
Database Migration Service	Supported In Custom Roles	`datamigration.privateconnections.create` `datamigration.privateconnections.delete` `datamigration.privateconnections.get` `datamigration.privateconnections.getIamPolicy` `datamigration.privateconnections.list` `datamigration.privateconnections.setIamPolicy`
Database Migration Service	Now GA	`datamigration.conversionworkspaces.commit` `datamigration.conversionworkspaces.convert` `datamigration.conversionworkspaces.create` `datamigration.conversionworkspaces.delete` `datamigration.conversionworkspaces.get` `datamigration.conversionworkspaces.getIamPolicy` `datamigration.conversionworkspaces.list` `datamigration.conversionworkspaces.rollback` `datamigration.conversionworkspaces.seed` `datamigration.conversionworkspaces.setIamPolicy` `datamigration.conversionworkspaces.update` `datamigration.mappingrules.getIamPolicy` `datamigration.mappingrules.import` `datamigration.mappingrules.setIamPolicy` `datamigration.privateconnections.create` `datamigration.privateconnections.delete` `datamigration.privateconnections.get` `datamigration.privateconnections.getIamPolicy` `datamigration.privateconnections.list` `datamigration.privateconnections.setIamPolicy`
Dialogflow	Added	`dialogflow.knowledgeBases.update`
Dialogflow	Supported In Custom Roles	`dialogflow.knowledgeBases.update`
Dialogflow	Now GA	`dialogflow.knowledgeBases.update`
Google Earth Engine	Added	`earthengine.featureviews.create`
ML Kit for Firebase	Added	`firebaseml.models.update`
ML Kit for Firebase	Supported In Custom Roles	`firebaseml.models.update`
Network Management API	Added	`networkmanagement.topologygraphs.read`
Network Management API	Supported In Custom Roles	`networkmanagement.topologygraphs.read`
Network Management API	Now GA	`networkmanagement.topologygraphs.read`
Recommender	Added	`recommender.computeInstanceIdleResourceRecommenderConfig.get` `recommender.computeInstanceIdleResourceRecommenderConfig.update` `recommender.iamPolicyRecommenderConfig.get` `recommender.iamPolicyRecommenderConfig.update` `recommender.spendBasedCommitmentRecommenderConfig.get` `recommender.spendBasedCommitmentRecommenderConfig.update`
Recommender	Supported In Custom Roles	`recommender.computeInstanceIdleResourceRecommenderConfig.get` `recommender.computeInstanceIdleResourceRecommenderConfig.update` `recommender.iamPolicyRecommenderConfig.get` `recommender.iamPolicyRecommenderConfig.update` `recommender.spendBasedCommitmentRecommenderConfig.get` `recommender.spendBasedCommitmentRecommenderConfig.update`
Recommender	Now GA	`recommender.computeInstanceIdleResourceRecommenderConfig.get` `recommender.computeInstanceIdleResourceRecommenderConfig.update` `recommender.containerDiagnosisInsights.get` `recommender.containerDiagnosisInsights.list` `recommender.containerDiagnosisInsights.update` `recommender.containerDiagnosisRecommendations.get` `recommender.containerDiagnosisRecommendations.list` `recommender.containerDiagnosisRecommendations.update` `recommender.iamPolicyRecommenderConfig.get` `recommender.iamPolicyRecommenderConfig.update`

Cloud IAM changes as of 2022-12-16

Service	Change	Description
Cloud Composer	Role Updated	The following permissions have been added to the role `roles/composer.serviceAgent` (Cloud Composer API Service Agent): `recommender.containerDiagnosisInsights.get` `recommender.containerDiagnosisInsights.list` `recommender.containerDiagnosisInsights.update` `recommender.containerDiagnosisRecommendations.get` `recommender.containerDiagnosisRecommendations.list` `recommender.containerDiagnosisRecommendations.update` `recommender.locations.get` `recommender.locations.list` `recommender.networkAnalyzerGkeConnectivityInsights.get` `recommender.networkAnalyzerGkeConnectivityInsights.list` `recommender.networkAnalyzerGkeConnectivityInsights.update` `recommender.networkAnalyzerGkeIpAddressInsights.get` `recommender.networkAnalyzerGkeIpAddressInsights.list` `recommender.networkAnalyzerGkeIpAddressInsights.update`
Cloud Composer	Role Updated	The following permissions have been added to the role `roles/composer.worker` (Composer Worker): `recommender.containerDiagnosisInsights.get` `recommender.containerDiagnosisInsights.list` `recommender.containerDiagnosisInsights.update` `recommender.containerDiagnosisRecommendations.get` `recommender.containerDiagnosisRecommendations.list` `recommender.containerDiagnosisRecommendations.update` `recommender.locations.get` `recommender.locations.list` `recommender.networkAnalyzerGkeConnectivityInsights.get` `recommender.networkAnalyzerGkeConnectivityInsights.list` `recommender.networkAnalyzerGkeConnectivityInsights.update` `recommender.networkAnalyzerGkeIpAddressInsights.get` `recommender.networkAnalyzerGkeIpAddressInsights.list` `recommender.networkAnalyzerGkeIpAddressInsights.update`
Google Kubernetes Engine	Role Updated	The following permissions have been added to the role `roles/container.admin` (Kubernetes Engine Admin): `recommender.containerDiagnosisInsights.get` `recommender.containerDiagnosisInsights.list` `recommender.containerDiagnosisInsights.update` `recommender.containerDiagnosisRecommendations.get` `recommender.containerDiagnosisRecommendations.list` `recommender.containerDiagnosisRecommendations.update` `recommender.locations.get` `recommender.locations.list` `recommender.networkAnalyzerGkeConnectivityInsights.get` `recommender.networkAnalyzerGkeConnectivityInsights.list` `recommender.networkAnalyzerGkeConnectivityInsights.update` `recommender.networkAnalyzerGkeIpAddressInsights.get` `recommender.networkAnalyzerGkeIpAddressInsights.list` `recommender.networkAnalyzerGkeIpAddressInsights.update`
Google Kubernetes Engine	Role Updated	The following permissions have been added to the role `roles/container.developer` (Kubernetes Engine Developer): `recommender.containerDiagnosisInsights.get` `recommender.containerDiagnosisInsights.list` `recommender.containerDiagnosisInsights.update` `recommender.containerDiagnosisRecommendations.get` `recommender.containerDiagnosisRecommendations.list` `recommender.containerDiagnosisRecommendations.update` `recommender.locations.get` `recommender.locations.list` `recommender.networkAnalyzerGkeConnectivityInsights.get` `recommender.networkAnalyzerGkeConnectivityInsights.list` `recommender.networkAnalyzerGkeConnectivityInsights.update` `recommender.networkAnalyzerGkeIpAddressInsights.get` `recommender.networkAnalyzerGkeIpAddressInsights.list` `recommender.networkAnalyzerGkeIpAddressInsights.update`
Google Kubernetes Engine	Role Updated	The following permissions have been added to the role `roles/container.serviceAgent` (Kubernetes Engine Service Agent): `recommender.containerDiagnosisInsights.get` `recommender.containerDiagnosisInsights.list` `recommender.containerDiagnosisInsights.update` `recommender.containerDiagnosisRecommendations.get` `recommender.containerDiagnosisRecommendations.list` `recommender.containerDiagnosisRecommendations.update` `recommender.locations.get` `recommender.locations.list` `recommender.networkAnalyzerGkeConnectivityInsights.get` `recommender.networkAnalyzerGkeConnectivityInsights.list` `recommender.networkAnalyzerGkeConnectivityInsights.update` `recommender.networkAnalyzerGkeIpAddressInsights.get` `recommender.networkAnalyzerGkeIpAddressInsights.list` `recommender.networkAnalyzerGkeIpAddressInsights.update`
Dataproc	Role Updated	The following permissions have been added to the role `roles/dataproc.serviceAgent` (Dataproc Service Agent): `compute.networks.getEffectiveFirewalls` `iam.serviceAccounts.getAccessToken`
Datastore	Role Updated	The following permissions have been added to the role `roles/datastore.user` (Cloud Datastore User): `datastore.databases.list`
Sensitive Data Protection	Role Updated	The following permissions have been added to the role `roles/dlp.serviceAgent` (DLP API Service Agent): `datastore.databases.list`
Game Servers	Role Updated	The following permissions have been added to the role `roles/gameservices.serviceAgent` (Game Services Service Agent): `recommender.containerDiagnosisInsights.get` `recommender.containerDiagnosisInsights.list` `recommender.containerDiagnosisInsights.update` `recommender.containerDiagnosisRecommendations.get` `recommender.containerDiagnosisRecommendations.list` `recommender.containerDiagnosisRecommendations.update` `recommender.locations.get` `recommender.locations.list` `recommender.networkAnalyzerGkeConnectivityInsights.get` `recommender.networkAnalyzerGkeConnectivityInsights.list` `recommender.networkAnalyzerGkeConnectivityInsights.update` `recommender.networkAnalyzerGkeIpAddressInsights.get` `recommender.networkAnalyzerGkeIpAddressInsights.list` `recommender.networkAnalyzerGkeIpAddressInsights.update`
Backup for GKE	Role Updated	The following permissions have been added to the role `roles/gkebackup.serviceAgent` (Backup for GKE Service Agent): `recommender.containerDiagnosisInsights.get` `recommender.containerDiagnosisInsights.list` `recommender.containerDiagnosisInsights.update` `recommender.containerDiagnosisRecommendations.get` `recommender.containerDiagnosisRecommendations.list` `recommender.containerDiagnosisRecommendations.update` `recommender.locations.get` `recommender.locations.list` `recommender.networkAnalyzerGkeConnectivityInsights.get` `recommender.networkAnalyzerGkeConnectivityInsights.list` `recommender.networkAnalyzerGkeConnectivityInsights.update` `recommender.networkAnalyzerGkeIpAddressInsights.get` `recommender.networkAnalyzerGkeIpAddressInsights.list` `recommender.networkAnalyzerGkeIpAddressInsights.update`
VM Migration	Role Updated	The following permissions have been added to the role `roles/vmmigration.admin` (VM Migration Administrator): `resourcemanager.projects.get` `resourcemanager.projects.list`
VM Migration	Role Updated	The following permissions have been added to the role `roles/vmmigration.viewer` (VM Migration Viewer): `resourcemanager.projects.get` `resourcemanager.projects.list`
Google Cloud	Added	`cloud.locations.get` `cloud.locations.list`
Google Cloud	Supported In Custom Roles	`cloud.locations.get` `cloud.locations.list`
Cloud Asset Inventory	Added	`cloudasset.assets.exportBeyondCorpAppGateways` `cloudasset.assets.listBeyondCorpAppGateways`
Cloud Asset Inventory	Supported In Custom Roles	`cloudasset.assets.exportBeyondCorpAppGateways` `cloudasset.assets.listBeyondCorpAppGateways`
Cloud Key Management Service	Added	`cloudkms.protectedResources.search`
GKE Multi-Cloud	Added	`gkemulticloud.attachedClusters.create` `gkemulticloud.attachedClusters.delete` `gkemulticloud.attachedClusters.generateInstallManifest` `gkemulticloud.attachedClusters.get` `gkemulticloud.attachedClusters.import` `gkemulticloud.attachedClusters.list` `gkemulticloud.attachedClusters.update` `gkemulticloud.attachedServerConfigs.get`
GKE Multi-Cloud	Now GA	`gkemulticloud.attachedClusters.create` `gkemulticloud.attachedClusters.delete` `gkemulticloud.attachedClusters.generateInstallManifest` `gkemulticloud.attachedClusters.get` `gkemulticloud.attachedClusters.import` `gkemulticloud.attachedClusters.list` `gkemulticloud.attachedClusters.update` `gkemulticloud.attachedServerConfigs.get`

Cloud IAM changes as of 2022-12-09

Service	Change	Description
Cloud Service Mesh	Role Updated	The following permissions have been added to the role `roles/anthosservicemesh.serviceAgent` (Anthos Service Mesh Service Agent): `container.validatingWebhookConfigurations.delete`
App Engine	Now GA	The role `roles/appengine.debugger` (App Engine Managed VM Debug Access) is now GA.
App Engine	Role Updated	The following permissions have been added to the role `roles/appengine.serviceAgent` (App Engine Standard Environment Service Agent): `storage.buckets.create` `storage.buckets.get`
App Engine flexible environment	Role Updated	The following permissions have been added to the role `roles/appengineflex.serviceAgent` (App Engine flexible environment Service Agent): `compute.instanceGroups.use`
Bare Metal Solution	Now GA	The role `roles/baremetalsolution.serviceAgent` (Bare Metal Solution Service Agent) is now GA.
Cloud Optimization	Now GA	The role `roles/cloudoptimization.admin` (Cloud Optimization AI Admin) is now GA.
Cloud Optimization	Now GA	The role `roles/cloudoptimization.editor` (Cloud Optimization AI Editor) is now GA.
Cloud Optimization	Now GA	The role `roles/cloudoptimization.viewer` (Cloud Optimization AI Viewer) is now GA.
Compute Engine	Role Updated	The following permissions have been added to the role `roles/compute.serviceAgent` (Compute Engine Service Agent): `iam.serviceAccounts.actAs`
Google Kubernetes Engine	Role Updated	The following permissions have been added to the role `roles/container.nodeServiceAccount` (Kubernetes Engine Node Service Account): `serviceusage.services.use`
Google Kubernetes Engine	Role Updated	The following permissions have been added to the role `roles/container.nodeServiceAgent` (Kubernetes Engine Node Service Agent): `serviceusage.services.use`
Dataplex	Role Updated	The following permissions have been added to the role `roles/dataplex.serviceAgent` (Cloud Dataplex Service Agent): `datacatalog.categories.getIamPolicy` `datacatalog.categories.setIamPolicy` `datacatalog.taxonomies.create` `datacatalog.taxonomies.delete` `datacatalog.taxonomies.get` `datacatalog.taxonomies.list` `datacatalog.taxonomies.update`
Dataplex	Role Updated	The following permissions have been removed from the role `roles/dataplex.serviceAgent` (Cloud Dataplex Service Agent): `dataproc.autoscalingPolicies.create` `dataproc.jobs.delete` `dataproc.jobs.get` `dataproc.workflowTemplates.instantiateInline`
Distributed Cloud Edge Container	Now GA	The role `roles/edgecontainer.serviceAgent` (Edge Container Service Agent) is now GA.
Firebase	Role Updated	The following permissions have been added to the role `roles/firebase.managementServiceAgent` (Firebase Service Management Service Agent): `bigquery.datasets.create` `bigquery.datasets.get` `bigquery.transfers.get` `bigquery.transfers.update`
Firebase Security Rules	Now GA	The role `roles/firebaserules.firestoreServiceAgent` (Firebase Rules Firestore Service Agent) is now GA.
FleetEngine	Role Updated	The following permissions have been removed from the role `roles/fleetengine.serviceSuperUser` (Fleet Engine Service Super User): `fleetengine.deliveryvehicles.create` `fleetengine.deliveryvehicles.get` `fleetengine.deliveryvehicles.list` `fleetengine.deliveryvehicles.update` `fleetengine.deliveryvehicles.updateLocation` `fleetengine.deliveryvehicles.updateVehicleStops` `fleetengine.tasks.create` `fleetengine.tasks.get` `fleetengine.tasks.list` `fleetengine.tasks.searchWithTrackingId` `fleetengine.tasks.update`
Backup for GKE	Now GA	The role `roles/gkebackup.admin` (Backup for GKE Admin) is now GA.
Backup for GKE	Now GA	The role `roles/gkebackup.backupAdmin` (Backup for GKE Backup Admin) is now GA.
Backup for GKE	Now GA	The role `roles/gkebackup.delegatedBackupAdmin` (Backup for GKE Delegated Backup Admin) is now GA.
Backup for GKE	Now GA	The role `roles/gkebackup.delegatedRestoreAdmin` (Backup for GKE Delegated Restore Admin) is now GA.
Backup for GKE	Now GA	The role `roles/gkebackup.restoreAdmin` (Backup for GKE Restore Admin) is now GA.
Backup for GKE	Now GA	The role `roles/gkebackup.viewer` (Backup for GKE Viewer) is now GA.
Dataproc Metastore	Role Updated	The following permissions have been added to the role `roles/metastore.serviceAgent` (Dataproc Metastore Service Agent): `dns.changes.create` `dns.changes.get` `dns.managedZones.create` `dns.managedZones.delete` `dns.managedZones.get` `dns.managedZones.list` `dns.networks.bindPrivateDNSZone` `dns.networks.targetWithPeeringZone` `dns.resourceRecordSets.create` `dns.resourceRecordSets.delete` `dns.resourceRecordSets.get` `dns.resourceRecordSets.list` `dns.resourceRecordSets.update`
Nest Console	Now GA	The role `roles/nestconsole.homeDeveloperAdmin` (Google Home Developer Console Admin) is now GA.
Nest Console	Now GA	The role `roles/nestconsole.homeDeveloperEditor` (Google Home Developer Console Editor) is now GA.
Nest Console	Now GA	The role `roles/nestconsole.homeDeveloperViewer` (Google Home Developer Console Reader) is now GA.
Pub/Sub Lite	Now GA	The role `roles/pubsublite.serviceAgent` (Pub/Sub Lite Service Agent) is now GA.
Storage Insights	Now GA	The role `roles/storageinsights.admin` (Storage Insights Admin) is now GA.
Storage Insights	Now GA	The role `roles/storageinsights.viewer` (Storage Insights Viewer) is now GA.
Workload Certificate	Role Updated	The following permissions have been added to the role `roles/workloadcertificate.serviceAgent` (Workload Certificate Service Agent): `gkehub.fleet.create` `gkehub.fleet.get` `gkehub.operations.get`
Apigee	Added	`apigee.instances.update` `apigee.projects.migrate` `apigee.projects.previewMigration` `apigee.traceconfig.get` `apigee.traceconfig.update` `apigee.traceconfigoverrides.create` `apigee.traceconfigoverrides.delete` `apigee.traceconfigoverrides.get` `apigee.traceconfigoverrides.list` `apigee.traceconfigoverrides.update`
Apigee	Supported In Custom Roles	`apigee.instances.update` `apigee.projects.migrate` `apigee.projects.previewMigration`
Apigee	Now GA	`apigee.instances.update` `apigee.projects.migrate` `apigee.projects.previewMigration` `apigee.traceconfig.get` `apigee.traceconfig.update` `apigee.traceconfigoverrides.create` `apigee.traceconfigoverrides.delete` `apigee.traceconfigoverrides.get` `apigee.traceconfigoverrides.list` `apigee.traceconfigoverrides.update`
App Engine	Added	`appengine.instances.enableDebug`
App Engine	Supported In Custom Roles	`appengine.instances.enableDebug`
App Engine	Now GA	`appengine.instances.enableDebug`
Cloud Asset Inventory	Added	`cloudasset.assets.queryAccessPolicy` `cloudasset.assets.queryIamPolicy` `cloudasset.assets.queryOSInventories` `cloudasset.assets.queryResource`
Cloud Build	Added	`cloudbuild.connections.create` `cloudbuild.connections.delete` `cloudbuild.connections.fetchLinkableRepositories` `cloudbuild.connections.get` `cloudbuild.connections.getIamPolicy` `cloudbuild.connections.list` `cloudbuild.connections.setIamPolicy` `cloudbuild.connections.update` `cloudbuild.repositories.accessReadToken` `cloudbuild.repositories.accessReadWriteToken` `cloudbuild.repositories.create` `cloudbuild.repositories.delete` `cloudbuild.repositories.get` `cloudbuild.repositories.list`
Cloud Build	Supported In Custom Roles	`cloudbuild.connections.create` `cloudbuild.connections.delete` `cloudbuild.connections.fetchLinkableRepositories` `cloudbuild.connections.get` `cloudbuild.connections.getIamPolicy` `cloudbuild.connections.list` `cloudbuild.connections.setIamPolicy` `cloudbuild.connections.update` `cloudbuild.repositories.accessReadToken` `cloudbuild.repositories.accessReadWriteToken` `cloudbuild.repositories.create` `cloudbuild.repositories.delete` `cloudbuild.repositories.get` `cloudbuild.repositories.list`
Cloud Optimization	Now GA	`cloudoptimization.operations.create` `cloudoptimization.operations.get`
Compute Engine	Added	`compute.instances.simulateMaintenanceEvent` `compute.nodeGroups.simulateMaintenanceEvent`
Compute Engine	Supported In Custom Roles	`compute.instances.simulateMaintenanceEvent` `compute.nodeGroups.simulateMaintenanceEvent`
Compute Engine	Now GA	`compute.instances.simulateMaintenanceEvent`
Connectors	Added	`connectors.schemaMetadata.refresh`
Connectors	Now GA	`connectors.schemaMetadata.refresh`
Cloud Commerce Consumer Procurement	Added	`consumerprocurement.consents.allowProjectGrant`
Cloud Commerce Consumer Procurement	Supported In Custom Roles	`consumerprocurement.consents.allowProjectGrant`
Conversational Insights	Added	`contactcenterinsights.issues.delete`
Cloud Data Fusion	Added	`datafusion.operations.delete`
Dataplex	Added	`dataplex.tasks.run`
Dataplex	Supported In Custom Roles	`dataplex.tasks.run`
Dataplex	Now GA	`dataplex.tasks.run`
Dataproc	Added	`dataproc.nodeGroups.create` `dataproc.nodeGroups.get` `dataproc.nodeGroups.update`
Dataproc	Supported In Custom Roles	`dataproc.nodeGroups.create` `dataproc.nodeGroups.get` `dataproc.nodeGroups.update`
Dataproc	Now GA	`dataproc.nodeGroups.create` `dataproc.nodeGroups.get` `dataproc.nodeGroups.update`
Google Analytics	Added	`firebaseanalytics.resources.googleAnalyticsAdditionalAccess` `firebaseanalytics.resources.googleAnalyticsRestrictedAccess`
Google Analytics	Supported In Custom Roles	`firebaseanalytics.resources.googleAnalyticsAdditionalAccess` `firebaseanalytics.resources.googleAnalyticsRestrictedAccess`
Backup for GKE	Now GA	`gkebackup.backupPlans.create` `gkebackup.backupPlans.delete` `gkebackup.backupPlans.get` `gkebackup.backupPlans.getIamPolicy` `gkebackup.backupPlans.list` `gkebackup.backupPlans.setIamPolicy` `gkebackup.backupPlans.update` `gkebackup.backups.create` `gkebackup.backups.delete` `gkebackup.backups.get` `gkebackup.backups.list` `gkebackup.backups.update` `gkebackup.locations.get` `gkebackup.locations.list` `gkebackup.operations.cancel` `gkebackup.operations.delete` `gkebackup.operations.get` `gkebackup.operations.list` `gkebackup.restorePlans.create` `gkebackup.restorePlans.delete` `gkebackup.restorePlans.get` `gkebackup.restorePlans.getIamPolicy` `gkebackup.restorePlans.list` `gkebackup.restorePlans.setIamPolicy` `gkebackup.restorePlans.update` `gkebackup.restores.create` `gkebackup.restores.delete` `gkebackup.restores.get` `gkebackup.restores.list` `gkebackup.restores.update` `gkebackup.volumeBackups.get` `gkebackup.volumeBackups.list` `gkebackup.volumeRestores.get` `gkebackup.volumeRestores.list`
Cloud Logging	Added	`logging.settings.get` `logging.settings.update`
Cloud Logging	Added	`logging.googleapis.com/settings.get` `logging.googleapis.com/settings.update`
Managed Service for Microsoft Active Directory	Added	`managedidentities.domains.domainJoinMachine`
Maps Platform Datasets	Added	`mapsplatformdatasets.datasets.create` `mapsplatformdatasets.datasets.delete` `mapsplatformdatasets.datasets.get` `mapsplatformdatasets.datasets.import` `mapsplatformdatasets.datasets.list` `mapsplatformdatasets.datasets.update`
Cloud Monitoring	Added	`monitoring.snoozes.create` `monitoring.snoozes.get` `monitoring.snoozes.list` `monitoring.snoozes.update`
Cloud Monitoring	Supported In Custom Roles	`monitoring.snoozes.create` `monitoring.snoozes.get` `monitoring.snoozes.list` `monitoring.snoozes.update`
Nest Console	Added	`nestconsole.smarthomePreviews.update` `nestconsole.smarthomeProjects.create` `nestconsole.smarthomeProjects.delete` `nestconsole.smarthomeProjects.get` `nestconsole.smarthomeProjects.update` `nestconsole.smarthomeVersions.create` `nestconsole.smarthomeVersions.get` `nestconsole.smarthomeVersions.submit`
Nest Console	Now GA	`nestconsole.smarthomePreviews.update` `nestconsole.smarthomeProjects.create` `nestconsole.smarthomeProjects.delete` `nestconsole.smarthomeProjects.get` `nestconsole.smarthomeProjects.update` `nestconsole.smarthomeVersions.create` `nestconsole.smarthomeVersions.get` `nestconsole.smarthomeVersions.submit`
Network Connectivity Center	Added	`networkconnectivity.internalRanges.create` `networkconnectivity.internalRanges.delete` `networkconnectivity.internalRanges.get` `networkconnectivity.internalRanges.getIamPolicy` `networkconnectivity.internalRanges.list` `networkconnectivity.internalRanges.setIamPolicy` `networkconnectivity.internalRanges.update`
Network Connectivity Center	Supported In Custom Roles	`networkconnectivity.internalRanges.create` `networkconnectivity.internalRanges.delete` `networkconnectivity.internalRanges.get` `networkconnectivity.internalRanges.getIamPolicy` `networkconnectivity.internalRanges.list` `networkconnectivity.internalRanges.setIamPolicy` `networkconnectivity.internalRanges.update`
Network Connectivity Center	Now GA	`networkconnectivity.internalRanges.create` `networkconnectivity.internalRanges.delete` `networkconnectivity.internalRanges.get` `networkconnectivity.internalRanges.getIamPolicy` `networkconnectivity.internalRanges.list` `networkconnectivity.internalRanges.setIamPolicy` `networkconnectivity.internalRanges.update`
Recommender	Added	`recommender.cloudsqlInstanceOomProbabilityInsights.get` `recommender.cloudsqlInstanceOomProbabilityInsights.list` `recommender.cloudsqlInstanceOomProbabilityInsights.update` `recommender.cloudsqlInstanceUnderprovisionedCpuUsageInsights.get` `recommender.cloudsqlInstanceUnderprovisionedCpuUsageInsights.list` `recommender.cloudsqlInstanceUnderprovisionedCpuUsageInsights.update` `recommender.cloudsqlInstanceUnderprovisionedMemoryUsageInsights.get` `recommender.cloudsqlInstanceUnderprovisionedMemoryUsageInsights.list` `recommender.cloudsqlInstanceUnderprovisionedMemoryUsageInsights.update` `recommender.cloudsqlUnderProvisionedInstanceRecommendations.get` `recommender.cloudsqlUnderProvisionedInstanceRecommendations.list` `recommender.cloudsqlUnderProvisionedInstanceRecommendations.update`
Recommender	Supported In Custom Roles	`recommender.cloudsqlInstanceOomProbabilityInsights.get` `recommender.cloudsqlInstanceOomProbabilityInsights.list` `recommender.cloudsqlInstanceOomProbabilityInsights.update` `recommender.cloudsqlInstanceUnderprovisionedCpuUsageInsights.get` `recommender.cloudsqlInstanceUnderprovisionedCpuUsageInsights.list` `recommender.cloudsqlInstanceUnderprovisionedCpuUsageInsights.update` `recommender.cloudsqlInstanceUnderprovisionedMemoryUsageInsights.get` `recommender.cloudsqlInstanceUnderprovisionedMemoryUsageInsights.list` `recommender.cloudsqlInstanceUnderprovisionedMemoryUsageInsights.update` `recommender.cloudsqlUnderProvisionedInstanceRecommendations.get` `recommender.cloudsqlUnderProvisionedInstanceRecommendations.list` `recommender.cloudsqlUnderProvisionedInstanceRecommendations.update`
Recommender	Now GA	`recommender.resourcemanagerProjectUtilizationInsightTypeConfigs.get` `recommender.resourcemanagerProjectUtilizationInsightTypeConfigs.update` `recommender.resourcemanagerProjectUtilizationRecommenderConfigs.get` `recommender.resourcemanagerProjectUtilizationRecommenderConfigs.update`
Retail API	Added	`retail.models.pause` `retail.models.resume` `retail.models.tune` `retail.models.update`
Google Cloud Observability	Added	`stackdriver.resourceMetadata.list`
Google Cloud Observability	Supported In Custom Roles	`stackdriver.resourceMetadata.list`
Storage Insights	Added	`storageinsights.locations.get` `storageinsights.locations.list` `storageinsights.operations.cancel` `storageinsights.operations.delete` `storageinsights.operations.get` `storageinsights.operations.list` `storageinsights.reportConfigs.create` `storageinsights.reportConfigs.delete` `storageinsights.reportConfigs.get` `storageinsights.reportConfigs.list` `storageinsights.reportConfigs.update` `storageinsights.reportDetails.get` `storageinsights.reportDetails.list`
Storage Insights	Now GA	`storageinsights.locations.get` `storageinsights.locations.list` `storageinsights.operations.cancel` `storageinsights.operations.delete` `storageinsights.operations.get` `storageinsights.operations.list` `storageinsights.reportConfigs.create` `storageinsights.reportConfigs.delete` `storageinsights.reportConfigs.get` `storageinsights.reportConfigs.list` `storageinsights.reportConfigs.update` `storageinsights.reportDetails.get` `storageinsights.reportDetails.list`
VM Migration	Added	`vmmigration.replicationCycles.get` `vmmigration.replicationCycles.list`

Cloud IAM changes as of 2022-12-02

Service	Change	Description
Backup and Disaster Recovery	Role Updated	The following permissions have been added to the role `roles/backupdr.viewer` (Backup and DR Viewer): `backupdr.managementServers.backupAccess`
Cloud Billing	Role Updated	The following permissions have been added to the role `roles/billing.admin` (Billing Account Administrator): `compute.commitments.create` `compute.commitments.get` `compute.commitments.list` `compute.commitments.update` `compute.commitments.updateReservations`
Cloud Build	Role Updated	The following permissions have been added to the role `roles/cloudbuild.serviceAgent` (Cloud Build Service Agent): `iam.serviceAccounts.getOpenIdToken`
Cloud Commerce Consumer Procurement	Role Updated	The following permissions have been added to the role `roles/consumerprocurement.orderAdmin` (Consumer Procurement Order Administrator): `billing.accounts.get` `billing.accounts.getIamPolicy` `billing.accounts.list` `billing.accounts.redeemPromotion` `billing.credits.list` `billing.resourceAssociations.create`
Cloud Commerce Consumer Procurement	Role Updated	The following permissions have been added to the role `roles/consumerprocurement.orderViewer` (Consumer Procurement Order Viewer): `billing.accounts.get` `billing.accounts.getIamPolicy` `billing.accounts.list` `billing.credits.list`
Cloud Logging	Role Updated	The following permissions have been added to the role `roles/logging.serviceAgent` (Cloud Logging Service Agent): `bigquery.datasets.get`
RISC Configuration Service	Role Updated	The following permissions have been added to the role `roles/riscconfigs.admin` (RISC Configuration Admin): `clientauthconfig.clients.list`
RISC Configuration Service	Role Updated	The following permissions have been added to the role `roles/riscconfigs.viewer` (RISC Configuration Viewer): `clientauthconfig.clients.list`
Security Command Center	Role Updated	The following permissions have been added to the role `roles/securitycenter.controlServiceAgent` (Security Center Control Service Agent): `iam.denypolicies.get` `iam.denypolicies.list` `iam.googleapis.com/denypolicies.get` `iam.googleapis.com/denypolicies.list`
Security Command Center	Role Updated	The following permissions have been added to the role `roles/securitycenter.serviceAgent` (Security Center Service Agent): `iam.denypolicies.get` `iam.denypolicies.list` `iam.googleapis.com/denypolicies.get` `iam.googleapis.com/denypolicies.list`
Basic Role	Role Updated	The following permissions have been added to the role `roles/viewer` (Viewer): `backupdr.managementServers.backupAccess`
Commerce Business Enablement	Added	`commercebusinessenablement.leadgenConfig.get` `commercebusinessenablement.leadgenConfig.update` `commercebusinessenablement.paymentConfig.get` `commercebusinessenablement.paymentConfig.update`
Google Distributed Cloud	Added	`gkeonprem.bareMetalAdminClusters.create` `gkeonprem.bareMetalAdminClusters.enroll` `gkeonprem.bareMetalAdminClusters.get` `gkeonprem.bareMetalAdminClusters.getIamPolicy` `gkeonprem.bareMetalAdminClusters.list` `gkeonprem.bareMetalAdminClusters.queryVersionConfig` `gkeonprem.bareMetalAdminClusters.setIamPolicy` `gkeonprem.bareMetalAdminClusters.unenroll` `gkeonprem.bareMetalAdminClusters.update` `gkeonprem.vmwareAdminClusters.enroll` `gkeonprem.vmwareAdminClusters.get` `gkeonprem.vmwareAdminClusters.getIamPolicy` `gkeonprem.vmwareAdminClusters.list` `gkeonprem.vmwareAdminClusters.setIamPolicy` `gkeonprem.vmwareAdminClusters.unenroll` `gkeonprem.vmwareAdminClusters.update`
Google Distributed Cloud	Supported In Custom Roles	`gkeonprem.bareMetalAdminClusters.create` `gkeonprem.bareMetalAdminClusters.enroll` `gkeonprem.bareMetalAdminClusters.get` `gkeonprem.bareMetalAdminClusters.getIamPolicy` `gkeonprem.bareMetalAdminClusters.list` `gkeonprem.bareMetalAdminClusters.queryVersionConfig` `gkeonprem.bareMetalAdminClusters.setIamPolicy` `gkeonprem.bareMetalAdminClusters.unenroll` `gkeonprem.bareMetalAdminClusters.update` `gkeonprem.vmwareAdminClusters.enroll` `gkeonprem.vmwareAdminClusters.get` `gkeonprem.vmwareAdminClusters.getIamPolicy` `gkeonprem.vmwareAdminClusters.list` `gkeonprem.vmwareAdminClusters.setIamPolicy` `gkeonprem.vmwareAdminClusters.unenroll` `gkeonprem.vmwareAdminClusters.update`
Google Distributed Cloud	Now GA	`gkeonprem.bareMetalAdminClusters.create` `gkeonprem.bareMetalAdminClusters.enroll` `gkeonprem.bareMetalAdminClusters.get` `gkeonprem.bareMetalAdminClusters.getIamPolicy` `gkeonprem.bareMetalAdminClusters.list` `gkeonprem.bareMetalAdminClusters.queryVersionConfig` `gkeonprem.bareMetalAdminClusters.setIamPolicy` `gkeonprem.bareMetalAdminClusters.unenroll` `gkeonprem.bareMetalAdminClusters.update` `gkeonprem.vmwareAdminClusters.enroll` `gkeonprem.vmwareAdminClusters.get` `gkeonprem.vmwareAdminClusters.getIamPolicy` `gkeonprem.vmwareAdminClusters.list` `gkeonprem.vmwareAdminClusters.setIamPolicy` `gkeonprem.vmwareAdminClusters.unenroll` `gkeonprem.vmwareAdminClusters.update`
Network Connectivity Center	Added	`networkconnectivity.policyBasedRoutes.create` `networkconnectivity.policyBasedRoutes.delete` `networkconnectivity.policyBasedRoutes.get` `networkconnectivity.policyBasedRoutes.getIamPolicy` `networkconnectivity.policyBasedRoutes.list` `networkconnectivity.policyBasedRoutes.setIamPolicy`
Network Connectivity Center	Now GA	`networkconnectivity.policyBasedRoutes.create` `networkconnectivity.policyBasedRoutes.delete` `networkconnectivity.policyBasedRoutes.get` `networkconnectivity.policyBasedRoutes.getIamPolicy` `networkconnectivity.policyBasedRoutes.list` `networkconnectivity.policyBasedRoutes.setIamPolicy`
VM Migration	Supported In Custom Roles	`vmmigration.migratingVms.get`

Cloud IAM changes as of 2022-11-04

Service	Change	Description
Backup and Disaster Recovery	Role Updated	The following permissions have been added to the role `roles/backupdr.computeEngineOperator` (Backup and DR Compute Engine Operator): `compute.snapshots.delete` `resourcemanager.projects.list`
Cloud Deploy	Now GA	The role `roles/clouddeploy.admin` (Cloud Deploy Admin) is now GA.
Cloud Deploy	Now GA	The role `roles/clouddeploy.approver` (Cloud Deploy Approver) is now GA.
Cloud Deploy	Now GA	The role `roles/clouddeploy.developer` (Cloud Deploy Developer) is now GA.
Cloud Deploy	Now GA	The role `roles/clouddeploy.jobRunner` (Cloud Deploy Runner) is now GA.
Cloud Deploy	Now GA	The role `roles/clouddeploy.operator` (Cloud Deploy Operator) is now GA.
Cloud Deploy	Now GA	The role `roles/clouddeploy.releaser` (Cloud Deploy Releaser) is now GA.
Cloud Deploy	Now GA	The role `roles/clouddeploy.viewer` (Cloud Deploy Viewer) is now GA.
Cloud Deploy	Role Updated	The following permissions have been added to the role `roles/clouddeploy.developer` (Cloud Deploy Developer): `clouddeploy.deliveryPipelines.delete`
Cloud Deploy	Role Updated	The following permissions have been added to the role `roles/clouddeploy.operator` (Cloud Deploy Operator): `clouddeploy.deliveryPipelines.delete` `clouddeploy.targets.delete`
Firebase installations	Now GA	The role `roles/firebaseinstallations.admin` (Firebase Installations Admin) is now GA.
Security Command Center	Role Updated	The following permissions have been added to the role `roles/securitycenter.admin` (Security Center Admin): `resourcemanager.tagValues.get`
Security Command Center	Role Updated	The following permissions have been added to the role `roles/securitycenter.adminEditor` (Security Center Admin Editor): `resourcemanager.tagValues.get`
Security Command Center	Role Updated	The following permissions have been added to the role `roles/securitycenter.adminViewer` (Security Center Admin Viewer): `resourcemanager.tagValues.get`
Security Command Center	Role Updated	The following permissions have been added to the role `roles/securitycenter.controlServiceAgent` (Security Center Control Service Agent): `resourcemanager.tagValues.get`
Security Command Center	Role Updated	The following permissions have been added to the role `roles/securitycenter.securityHealthAnalyticsServiceAgent` (Security Health Analytics Service Agent): `resourcemanager.tagValues.get`
Security Command Center	Role Updated	The following permissions have been added to the role `roles/securitycenter.serviceAgent` (Security Center Service Agent): `resourcemanager.tagValues.get`
Cloud Deploy	Now GA	`clouddeploy.config.get` `clouddeploy.deliveryPipelines.create` `clouddeploy.deliveryPipelines.delete` `clouddeploy.deliveryPipelines.get` `clouddeploy.deliveryPipelines.getIamPolicy` `clouddeploy.deliveryPipelines.list` `clouddeploy.deliveryPipelines.setIamPolicy` `clouddeploy.deliveryPipelines.update` `clouddeploy.locations.get` `clouddeploy.locations.list` `clouddeploy.operations.cancel` `clouddeploy.operations.delete` `clouddeploy.operations.get` `clouddeploy.operations.list` `clouddeploy.releases.abandon` `clouddeploy.releases.create` `clouddeploy.releases.delete` `clouddeploy.releases.get` `clouddeploy.releases.list` `clouddeploy.rollouts.approve` `clouddeploy.rollouts.create` `clouddeploy.rollouts.get` `clouddeploy.rollouts.list` `clouddeploy.targets.create` `clouddeploy.targets.delete` `clouddeploy.targets.get` `clouddeploy.targets.getIamPolicy` `clouddeploy.targets.list` `clouddeploy.targets.setIamPolicy` `clouddeploy.targets.update`
Cloud Composer	Added	`composer.dags.getSourceCode`
Cloud Composer	Now GA	`composer.dags.getSourceCode`
Compute Engine	Added	`compute.regionSslPolicies.create` `compute.regionSslPolicies.delete` `compute.regionSslPolicies.get` `compute.regionSslPolicies.list` `compute.regionSslPolicies.listAvailableFeatures` `compute.regionSslPolicies.update` `compute.regionSslPolicies.use`
Compute Engine	Now GA	`compute.regionSslPolicies.create` `compute.regionSslPolicies.delete` `compute.regionSslPolicies.get` `compute.regionSslPolicies.list` `compute.regionSslPolicies.listAvailableFeatures` `compute.regionSslPolicies.update` `compute.regionSslPolicies.use`
Firebase installations	Added	`firebaseinstallations.instances.delete`
Firebase installations	Now GA	`firebaseinstallations.instances.delete`
Remote Build Execution	Added	`remotebuildexecution.instances.update`
Remote Build Execution	Supported In Custom Roles	`remotebuildexecution.instances.update`

Cloud IAM changes as of 2022-10-28

Service	Change	Description
Cloud Build	Role Updated	The following permissions have been added to the role `roles/cloudbuild.serviceAgent` (Cloud Build Service Agent): `logging.buckets.create` `logging.buckets.get` `logging.buckets.list`
Dataplex	Now GA	The role `roles/dataplex.dataScanAdmin` (Dataplex DataScan Administrator) is now GA.
Dataplex	Now GA	The role `roles/dataplex.dataScanDataViewer` (Dataplex DataScan DataViewer) is now GA.
Dataplex	Now GA	The role `roles/dataplex.dataScanEditor` (Dataplex DataScan Editor) is now GA.
Dataplex	Now GA	The role `roles/dataplex.dataScanViewer` (Dataplex DataScan Viewer) is now GA.
Document AI	Role Updated	The following permissions have been added to the role `roles/documentai.admin` (Document AI Administrator): `documentai.processedDocumentsSets.get` `documentai.processedDocumentsSets.getDocuments` `documentai.processedDocumentsSets.listDocuments`
Document AI	Role Updated	The following permissions have been added to the role `roles/documentai.editor` (Document AI Editor): `documentai.processedDocumentsSets.get` `documentai.processedDocumentsSets.getDocuments` `documentai.processedDocumentsSets.listDocuments`
Document AI	Role Updated	The following permissions have been added to the role `roles/documentai.viewer` (Document AI Viewer): `documentai.processedDocumentsSets.get` `documentai.processedDocumentsSets.getDocuments` `documentai.processedDocumentsSets.listDocuments`
Serverless Integrations	Role Updated	The following permissions have been added to the role `roles/runapps.serviceAgent` (Serverless Integrations Service Agent): `storage.objects.delete`
Google Cloud VMware Engine	Now GA	The role `roles/vmwareengine.serviceAgent` (VMware Engine Service Agent) is now GA.
Artifact Registry	Added	`artifactregistry.projectsettings.get` `artifactregistry.projectsettings.update`
Artifact Registry	Supported In Custom Roles	`artifactregistry.projectsettings.get` `artifactregistry.projectsettings.update`
Artifact Registry	Now GA	`artifactregistry.projectsettings.get` `artifactregistry.projectsettings.update`
Bigtable	Added	`bigtable.backups.read`
Bigtable	Supported In Custom Roles	`bigtable.backups.read`
Bigtable	Now GA	`bigtable.backups.read`
Commerce Org Governance	Added	`commerceorggovernance.collections.create` `commerceorggovernance.collections.delete` `commerceorggovernance.collections.get` `commerceorggovernance.collections.list` `commerceorggovernance.collections.update` `commerceorggovernance.consumerSharingPolicies.get` `commerceorggovernance.consumerSharingPolicies.update` `commerceorggovernance.organizationSettings.get` `commerceorggovernance.organizationSettings.update` `commerceorggovernance.services.list`
Compute Engine	Added	`compute.backendBuckets.addSignedUrlKey` `compute.backendBuckets.deleteSignedUrlKey` `compute.backendBuckets.getIamPolicy` `compute.backendBuckets.setIamPolicy` `compute.backendServices.addSignedUrlKey` `compute.backendServices.deleteSignedUrlKey` `compute.regionTargetHttpProxies.update` `compute.regionTargetTcpProxies.create` `compute.regionTargetTcpProxies.delete` `compute.regionTargetTcpProxies.get` `compute.regionTargetTcpProxies.list` `compute.regionTargetTcpProxies.use` `compute.resourcePolicies.getIamPolicy` `compute.resourcePolicies.setIamPolicy` `compute.targetHttpProxies.update` `compute.targetHttpsProxies.setCertificateMap` `compute.targetHttpsProxies.setQuicOverride` `compute.targetSslProxies.setCertificateMap` `compute.targetSslProxies.setSslPolicy` `compute.targetSslProxies.update`
Compute Engine	Supported In Custom Roles	`compute.resourcePolicies.getIamPolicy` `compute.resourcePolicies.setIamPolicy`
Compute Engine	Now GA	`compute.backendBuckets.addSignedUrlKey` `compute.backendBuckets.deleteSignedUrlKey` `compute.backendServices.addSignedUrlKey` `compute.backendServices.deleteSignedUrlKey` `compute.regionTargetHttpProxies.update` `compute.regionTargetTcpProxies.create` `compute.regionTargetTcpProxies.delete` `compute.regionTargetTcpProxies.get` `compute.regionTargetTcpProxies.list` `compute.regionTargetTcpProxies.use` `compute.resourcePolicies.getIamPolicy` `compute.resourcePolicies.setIamPolicy` `compute.targetHttpProxies.update` `compute.targetHttpsProxies.setCertificateMap` `compute.targetHttpsProxies.setQuicOverride` `compute.targetSslProxies.setCertificateMap` `compute.targetSslProxies.setSslPolicy` `compute.targetSslProxies.update`
Data Catalog	Added	`datacatalog.entryGroups.updateTag`
Data Catalog	Supported In Custom Roles	`datacatalog.entryGroups.updateTag`
Data Catalog	Now GA	`datacatalog.entryGroups.updateTag`
Dataplex	Added	`dataplex.datascans.create` `dataplex.datascans.delete` `dataplex.datascans.get` `dataplex.datascans.getData` `dataplex.datascans.getIamPolicy` `dataplex.datascans.list` `dataplex.datascans.run` `dataplex.datascans.setIamPolicy` `dataplex.datascans.update`
Dataplex	Now GA	`dataplex.datascans.create` `dataplex.datascans.delete` `dataplex.datascans.get` `dataplex.datascans.getData` `dataplex.datascans.getIamPolicy` `dataplex.datascans.list` `dataplex.datascans.run` `dataplex.datascans.setIamPolicy` `dataplex.datascans.update`
Discovery Engine	Added	`discoveryengine.documents.create` `discoveryengine.documents.delete` `discoveryengine.documents.get` `discoveryengine.documents.import` `discoveryengine.documents.list` `discoveryengine.documents.update` `discoveryengine.operations.get` `discoveryengine.operations.list` `discoveryengine.servingConfigs.recommend` `discoveryengine.userEvents.create` `discoveryengine.userEvents.import`
Document AI	Added	`documentai.processedDocumentsSets.get` `documentai.processedDocumentsSets.getDocuments` `documentai.processedDocumentsSets.listDocuments`
Enterprise Knowledge Graph	Added	`enterpriseknowledgegraph.cloudKnowledgeGraphEntities.lookup` `enterpriseknowledgegraph.cloudKnowledgeGraphEntities.search` `enterpriseknowledgegraph.publicKnowledgeGraphEntities.lookup` `enterpriseknowledgegraph.publicKnowledgeGraphEntities.search`
Identity Toolkit	Added	`identitytoolkit.tenants.create` `identitytoolkit.tenants.delete` `identitytoolkit.tenants.get` `identitytoolkit.tenants.getIamPolicy` `identitytoolkit.tenants.list` `identitytoolkit.tenants.setIamPolicy` `identitytoolkit.tenants.update`
Identity Toolkit	Supported In Custom Roles	`identitytoolkit.tenants.create` `identitytoolkit.tenants.delete` `identitytoolkit.tenants.get` `identitytoolkit.tenants.getIamPolicy` `identitytoolkit.tenants.list` `identitytoolkit.tenants.setIamPolicy` `identitytoolkit.tenants.update`
Identity Toolkit	Now GA	`identitytoolkit.tenants.create` `identitytoolkit.tenants.delete` `identitytoolkit.tenants.get` `identitytoolkit.tenants.getIamPolicy` `identitytoolkit.tenants.list` `identitytoolkit.tenants.setIamPolicy` `identitytoolkit.tenants.update`
Dataproc Metastore	Added	`metastore.services.mutateMetadata` `metastore.services.queryMetadata`
Dataproc Metastore	Supported In Custom Roles	`metastore.services.mutateMetadata` `metastore.services.queryMetadata`
Recommender	Supported In Custom Roles	`recommender.costInsights.get` `recommender.costInsights.list` `recommender.costInsights.update`
Retail API	Added	`retail.products.purge`
Retail API	Now GA	`retail.products.purge`
Cloud Run	Supported In Custom Roles	`run.routes.invoke`
Vision AI	Added	`visionai.corpora.suggest` `visionai.uistreams.create` `visionai.uistreams.delete` `visionai.uistreams.generateStreamThumbnails` `visionai.uistreams.get` `visionai.uistreams.list`
Google Cloud VMware Engine	Added	`vmwareengine.clusters.create` `vmwareengine.clusters.delete` `vmwareengine.clusters.get` `vmwareengine.clusters.getIamPolicy` `vmwareengine.clusters.list` `vmwareengine.clusters.setIamPolicy` `vmwareengine.clusters.update` `vmwareengine.hcxActivationKeys.create` `vmwareengine.hcxActivationKeys.get` `vmwareengine.hcxActivationKeys.getIamPolicy` `vmwareengine.hcxActivationKeys.list` `vmwareengine.hcxActivationKeys.setIamPolicy` `vmwareengine.locations.get` `vmwareengine.locations.list` `vmwareengine.networkPolicies.create` `vmwareengine.networkPolicies.delete` `vmwareengine.networkPolicies.get` `vmwareengine.networkPolicies.list` `vmwareengine.networkPolicies.update` `vmwareengine.nodeTypes.get` `vmwareengine.nodeTypes.list` `vmwareengine.operations.delete` `vmwareengine.operations.get` `vmwareengine.operations.list` `vmwareengine.privateClouds.create` `vmwareengine.privateClouds.delete` `vmwareengine.privateClouds.get` `vmwareengine.privateClouds.getIamPolicy` `vmwareengine.privateClouds.list` `vmwareengine.privateClouds.resetNsxCredentials` `vmwareengine.privateClouds.resetVcenterCredentials` `vmwareengine.privateClouds.setIamPolicy` `vmwareengine.privateClouds.showNsxCredentials` `vmwareengine.privateClouds.showVcenterCredentials` `vmwareengine.privateClouds.undelete` `vmwareengine.privateClouds.update` `vmwareengine.subnets.list` `vmwareengine.vmwareEngineNetworks.create` `vmwareengine.vmwareEngineNetworks.delete` `vmwareengine.vmwareEngineNetworks.get` `vmwareengine.vmwareEngineNetworks.list` `vmwareengine.vmwareEngineNetworks.update`
Google Cloud VMware Engine	Supported In Custom Roles	`vmwareengine.clusters.create` `vmwareengine.clusters.delete` `vmwareengine.clusters.get` `vmwareengine.clusters.getIamPolicy` `vmwareengine.clusters.list` `vmwareengine.clusters.setIamPolicy` `vmwareengine.clusters.update` `vmwareengine.hcxActivationKeys.create` `vmwareengine.hcxActivationKeys.get` `vmwareengine.hcxActivationKeys.getIamPolicy` `vmwareengine.hcxActivationKeys.list` `vmwareengine.hcxActivationKeys.setIamPolicy` `vmwareengine.locations.get` `vmwareengine.locations.list` `vmwareengine.networkPolicies.create` `vmwareengine.networkPolicies.delete` `vmwareengine.networkPolicies.get` `vmwareengine.networkPolicies.list` `vmwareengine.networkPolicies.update` `vmwareengine.nodeTypes.get` `vmwareengine.nodeTypes.list` `vmwareengine.operations.delete` `vmwareengine.operations.get` `vmwareengine.operations.list` `vmwareengine.privateClouds.create` `vmwareengine.privateClouds.delete` `vmwareengine.privateClouds.get` `vmwareengine.privateClouds.getIamPolicy` `vmwareengine.privateClouds.list` `vmwareengine.privateClouds.resetNsxCredentials` `vmwareengine.privateClouds.resetVcenterCredentials` `vmwareengine.privateClouds.setIamPolicy` `vmwareengine.privateClouds.showNsxCredentials` `vmwareengine.privateClouds.showVcenterCredentials` `vmwareengine.privateClouds.undelete` `vmwareengine.privateClouds.update` `vmwareengine.subnets.list` `vmwareengine.vmwareEngineNetworks.create` `vmwareengine.vmwareEngineNetworks.delete` `vmwareengine.vmwareEngineNetworks.get` `vmwareengine.vmwareEngineNetworks.list` `vmwareengine.vmwareEngineNetworks.update`
Google Cloud VMware Engine	Now GA	`vmwareengine.clusters.create` `vmwareengine.clusters.delete` `vmwareengine.clusters.get` `vmwareengine.clusters.getIamPolicy` `vmwareengine.clusters.list` `vmwareengine.clusters.setIamPolicy` `vmwareengine.clusters.update` `vmwareengine.hcxActivationKeys.create` `vmwareengine.hcxActivationKeys.get` `vmwareengine.hcxActivationKeys.getIamPolicy` `vmwareengine.hcxActivationKeys.list` `vmwareengine.hcxActivationKeys.setIamPolicy` `vmwareengine.locations.get` `vmwareengine.locations.list` `vmwareengine.networkPolicies.create` `vmwareengine.networkPolicies.delete` `vmwareengine.networkPolicies.get` `vmwareengine.networkPolicies.list` `vmwareengine.networkPolicies.update` `vmwareengine.nodeTypes.get` `vmwareengine.nodeTypes.list` `vmwareengine.operations.delete` `vmwareengine.operations.get` `vmwareengine.operations.list` `vmwareengine.privateClouds.create` `vmwareengine.privateClouds.delete` `vmwareengine.privateClouds.get` `vmwareengine.privateClouds.getIamPolicy` `vmwareengine.privateClouds.list` `vmwareengine.privateClouds.resetNsxCredentials` `vmwareengine.privateClouds.resetVcenterCredentials` `vmwareengine.privateClouds.setIamPolicy` `vmwareengine.privateClouds.showNsxCredentials` `vmwareengine.privateClouds.showVcenterCredentials` `vmwareengine.privateClouds.undelete` `vmwareengine.privateClouds.update` `vmwareengine.subnets.list` `vmwareengine.vmwareEngineNetworks.create` `vmwareengine.vmwareEngineNetworks.delete` `vmwareengine.vmwareEngineNetworks.get` `vmwareengine.vmwareEngineNetworks.list` `vmwareengine.vmwareEngineNetworks.update`

Cloud IAM changes as of 2022-10-21

Service	Change	Description
Backup and Disaster Recovery	Role Updated	The following permissions have been added to the role `roles/backupdr.computeEngineOperator` (Backup and DR Compute Engine Operator): `compute.nodeGroups.get` `compute.nodeGroups.list` `compute.nodeTemplates.get` `compute.regions.get` `iam.serviceAccounts.actAs` `iam.serviceAccounts.get` `iam.serviceAccounts.list` `resourcemanager.projects.get`
BigQuery Data Policy	Now GA	The role `roles/bigquerydatapolicy.maskedReader` (Masked Reader) is now GA.
Cloud Composer	Role Updated	The following permissions have been added to the role `roles/composer.serviceAgent` (Cloud Composer API Service Agent): `recommender.iamPolicyInsights.get` `recommender.iamPolicyInsights.list` `recommender.iamPolicyInsights.update` `recommender.iamPolicyRecommendations.get` `recommender.iamPolicyRecommendations.list` `recommender.iamPolicyRecommendations.update`
Compute Engine	Now GA	The role `roles/compute.soleTenantViewer` (Compute Sole Tenant Viewer) is now GA.
Compute Engine	Role Updated	The following permissions have been added to the role `roles/compute.serviceAgent` (Compute Engine Service Agent): `compute.zoneOperations.get`
Conversational Insights	Now GA	The role `roles/contactcenterinsights.editor` (Contact Center AI Insights editor) is now GA.
Conversational Insights	Now GA	The role `roles/contactcenterinsights.viewer` (Contact Center AI Insights viewer) is now GA.
Conversational Insights	Role Updated	The following permissions have been added to the role `roles/contactcenterinsights.serviceAgent` (Contact Center AI Insights Service Agent): `serviceusage.services.use`
Dataflow	Role Updated	The following permissions have been added to the role `roles/dataflow.serviceAgent` (Cloud Dataflow Service Agent): `recommender.iamPolicyInsights.get` `recommender.iamPolicyInsights.list` `recommender.iamPolicyInsights.update` `recommender.iamPolicyRecommendations.get` `recommender.iamPolicyRecommendations.list` `recommender.iamPolicyRecommendations.update`
Cloud Data Fusion	Role Updated	The following permissions have been added to the role `roles/datafusion.serviceAgent` (Cloud Data Fusion API Service Agent): `recommender.iamPolicyInsights.get` `recommender.iamPolicyInsights.list` `recommender.iamPolicyInsights.update` `recommender.iamPolicyRecommendations.get` `recommender.iamPolicyRecommendations.list` `recommender.iamPolicyRecommendations.update`
Data Pipelines	Role Updated	The following permissions have been added to the role `roles/datapipelines.serviceAgent` (Datapipelines Service Agent): `recommender.iamPolicyInsights.get` `recommender.iamPolicyInsights.list` `recommender.iamPolicyInsights.update` `recommender.iamPolicyRecommendations.get` `recommender.iamPolicyRecommendations.list` `recommender.iamPolicyRecommendations.update`
Dataplex	Role Updated	The following permissions have been added to the role `roles/dataplex.serviceAgent` (Cloud Dataplex Service Agent): `recommender.iamPolicyInsights.get` `recommender.iamPolicyInsights.list` `recommender.iamPolicyInsights.update` `recommender.iamPolicyRecommendations.get` `recommender.iamPolicyRecommendations.list` `recommender.iamPolicyRecommendations.update`
Dataproc	Role Updated	The following permissions have been added to the role `roles/dataproc.serviceAgent` (Dataproc Service Agent): `recommender.iamPolicyInsights.get` `recommender.iamPolicyInsights.list` `recommender.iamPolicyInsights.update` `recommender.iamPolicyRecommendations.get` `recommender.iamPolicyRecommendations.list` `recommender.iamPolicyRecommendations.update`
Discovery Engine	Now GA	The role `roles/discoveryengine.serviceAgent` (Discovery Engine Service Agent) is now GA.
Sensitive Data Protection	Role Updated	The following permissions have been added to the role `roles/dlp.serviceAgent` (DLP API Service Agent): `recommender.iamPolicyInsights.get` `recommender.iamPolicyInsights.list` `recommender.iamPolicyInsights.update` `recommender.iamPolicyRecommendations.get` `recommender.iamPolicyRecommendations.list` `recommender.iamPolicyRecommendations.update`
Firebase	Role Updated	The following permissions have been added to the role `roles/firebase.admin` (Firebase Admin): `recommender.iamPolicyInsights.get` `recommender.iamPolicyInsights.list` `recommender.iamPolicyInsights.update` `recommender.iamPolicyRecommendations.get` `recommender.iamPolicyRecommendations.list` `recommender.iamPolicyRecommendations.update`
Firebase	Role Updated	The following permissions have been added to the role `roles/firebase.developAdmin` (Firebase Develop Admin): `recommender.iamPolicyInsights.get` `recommender.iamPolicyInsights.list` `recommender.iamPolicyInsights.update` `recommender.iamPolicyRecommendations.get` `recommender.iamPolicyRecommendations.list` `recommender.iamPolicyRecommendations.update`
Cloud Integrations	Role Updated	The following permissions have been added to the role `roles/integrations.integrationAdmin` (Application Integration Admin): `integrations.executions.get`
Cloud Integrations	Role Updated	The following permissions have been added to the role `roles/integrations.integrationEditor` (Application Integration Editor): `integrations.executions.get`
Cloud Integrations	Role Updated	The following permissions have been added to the role `roles/integrations.integrationInvoker` (Application Integration Invoker): `integrations.executions.get`
Cloud Integrations	Role Updated	The following permissions have been added to the role `roles/integrations.integrationViewer` (Application Integration Viewer): `integrations.executions.get`
Dataproc Metastore	Role Updated	The following permissions have been added to the role `roles/metastore.serviceAgent` (Dataproc Metastore Service Agent): `metastore.databases.get` `metastore.databases.update` `metastore.tables.get` `metastore.tables.update`
AI Platform	Role Updated	The following permissions have been added to the role `roles/ml.serviceAgent` (AI Platform Service Agent): `recommender.iamPolicyInsights.get` `recommender.iamPolicyInsights.list` `recommender.iamPolicyInsights.update` `recommender.iamPolicyRecommendations.get` `recommender.iamPolicyRecommendations.list` `recommender.iamPolicyRecommendations.update`
Recommender	Now GA	The role `roles/recommender.networkAnalyzerAdmin` (Network Analyzer Recommender Admin) is now GA.
Recommender	Now GA	The role `roles/recommender.networkAnalyzerCloudSqlAdmin` (Network Analyzer Cloud SQL Recommender Admin) is now GA.
Recommender	Now GA	The role `roles/recommender.networkAnalyzerCloudSqlViewer` (Network Analyzer Cloud SQL Recommender Viewer) is now GA.
Recommender	Now GA	The role `roles/recommender.networkAnalyzerDynamicRouteAdmin` (Network Analyzer Dynamic Route Recommender Admin) is now GA.
Recommender	Now GA	The role `roles/recommender.networkAnalyzerDynamicRouteViewer` (Network Analyzer Dynamic Route Recommender Viewer) is now GA.
Recommender	Now GA	The role `roles/recommender.networkAnalyzerGkeConnectivityAdmin` (Network Analyzer GKE Connectivity Recommender Admin) is now GA.
Recommender	Now GA	The role `roles/recommender.networkAnalyzerGkeConnectivityViewer` (Network Analyzer GKE Connectivity Recommender Viewer) is now GA.
Recommender	Now GA	The role `roles/recommender.networkAnalyzerGkeIpAddressAdmin` (Network Analyzer GKE IP Address Recommender Admin) is now GA.
Recommender	Now GA	The role `roles/recommender.networkAnalyzerGkeIpAddressViewer` (Network Analyzer GKE IP Address Recommender Viewer) is now GA.
Recommender	Now GA	The role `roles/recommender.networkAnalyzerIpAddressAdmin` (Network Analyzer IP Address Recommender Admin) is now GA.
Recommender	Now GA	The role `roles/recommender.networkAnalyzerIpAddressViewer` (Network Analyzer IP Address Recommender Viewer) is now GA.
Recommender	Now GA	The role `roles/recommender.networkAnalyzerLoadBalancerAdmin` (Network Analyzer Load Balancer Recommender Admin) is now GA.
Recommender	Now GA	The role `roles/recommender.networkAnalyzerLoadBalancerViewer` (Network Analyzer Load Balancer Recommender Viewer) is now GA.
Recommender	Now GA	The role `roles/recommender.networkAnalyzerViewer` (Network Analyzer Recommender Viewer) is now GA.
Recommender	Now GA	The role `roles/recommender.networkAnalyzerVpcConnectivityAdmin` (Network Analyzer VPC Connectivity Recommender Admin) is now GA.
Recommender	Now GA	The role `roles/recommender.networkAnalyzerVpcConnectivityViewer` (Network Analyzer VPC Connectivity Recommender Viewer) is now GA.
Cloud Storage	Role Updated	The following permissions have been added to the role `roles/storage.admin` (Storage Admin): `recommender.iamPolicyInsights.get` `recommender.iamPolicyInsights.list` `recommender.iamPolicyInsights.update` `recommender.iamPolicyRecommendations.get` `recommender.iamPolicyRecommendations.list` `recommender.iamPolicyRecommendations.update`
Visual Inspection AI	Role Updated	The following permissions have been added to the role `roles/visualinspection.serviceAgent` (Visual Inspection AI Service Agent): `recommender.iamPolicyInsights.get` `recommender.iamPolicyInsights.list` `recommender.iamPolicyInsights.update` `recommender.iamPolicyRecommendations.get` `recommender.iamPolicyRecommendations.list` `recommender.iamPolicyRecommendations.update`
AutoML	Added	`automl.examples.update`
AutoML	Supported In Custom Roles	`automl.examples.update`
Bare Metal Solution	Added	`baremetalsolution.instances.disableInteractiveSerialConsole` `baremetalsolution.instances.enableInteractiveSerialConsole` `baremetalsolution.instances.stop` `baremetalsolution.sshKeys.create` `baremetalsolution.sshKeys.delete` `baremetalsolution.sshKeys.list`
Bare Metal Solution	Supported In Custom Roles	`baremetalsolution.instances.disableInteractiveSerialConsole` `baremetalsolution.instances.enableInteractiveSerialConsole` `baremetalsolution.instances.stop` `baremetalsolution.sshKeys.create` `baremetalsolution.sshKeys.delete` `baremetalsolution.sshKeys.list`
Bare Metal Solution	Now GA	`baremetalsolution.instances.disableInteractiveSerialConsole` `baremetalsolution.instances.enableInteractiveSerialConsole` `baremetalsolution.instances.stop` `baremetalsolution.sshKeys.create` `baremetalsolution.sshKeys.delete` `baremetalsolution.sshKeys.list`
BigQuery	Now GA	`bigquery.dataPolicies.create` `bigquery.dataPolicies.delete` `bigquery.dataPolicies.get` `bigquery.dataPolicies.getIamPolicy` `bigquery.dataPolicies.list` `bigquery.dataPolicies.maskedGet` `bigquery.dataPolicies.setIamPolicy` `bigquery.dataPolicies.update`
Bigtable	Added	`bigtable.hotTablets.list`
Bigtable	Supported In Custom Roles	`bigtable.hotTablets.list`
Bigtable	Now GA	`bigtable.hotTablets.list`
NetApp Cloud Volumes Service	Added	`cloudvolumesgcp-api.netapp.com/volumereplication.authorize` `cloudvolumesgcp-api.netapp.com/volumereplication.break` `cloudvolumesgcp-api.netapp.com/volumereplication.create` `cloudvolumesgcp-api.netapp.com/volumereplication.delete` `cloudvolumesgcp-api.netapp.com/volumereplication.get` `cloudvolumesgcp-api.netapp.com/volumereplication.list` `cloudvolumesgcp-api.netapp.com/volumereplication.release` `cloudvolumesgcp-api.netapp.com/volumereplication.resync` `cloudvolumesgcp-api.netapp.com/volumereplication.update`
Compute Engine	Added	`compute.instances.setName` `compute.networkAttachments.create` `compute.networkAttachments.delete` `compute.networkAttachments.get` `compute.networkAttachments.list`
Compute Engine	Supported In Custom Roles	`compute.instances.setName` `compute.networkAttachments.create` `compute.networkAttachments.delete` `compute.networkAttachments.get` `compute.networkAttachments.list`
Conversational Insights	Added	`contactcenterinsights.conversations.export` `contactcenterinsights.views.create` `contactcenterinsights.views.delete` `contactcenterinsights.views.get` `contactcenterinsights.views.list` `contactcenterinsights.views.update`
Conversational Insights	Now GA	`contactcenterinsights.analyses.create` `contactcenterinsights.analyses.delete` `contactcenterinsights.analyses.get` `contactcenterinsights.analyses.list` `contactcenterinsights.conversations.create` `contactcenterinsights.conversations.delete` `contactcenterinsights.conversations.export` `contactcenterinsights.conversations.get` `contactcenterinsights.conversations.list` `contactcenterinsights.conversations.update` `contactcenterinsights.issueModels.create` `contactcenterinsights.issueModels.delete` `contactcenterinsights.issueModels.deploy` `contactcenterinsights.issueModels.get` `contactcenterinsights.issueModels.list` `contactcenterinsights.issueModels.undeploy` `contactcenterinsights.issueModels.update` `contactcenterinsights.issues.get` `contactcenterinsights.issues.list` `contactcenterinsights.issues.update` `contactcenterinsights.operations.get` `contactcenterinsights.operations.list` `contactcenterinsights.phraseMatchers.create` `contactcenterinsights.phraseMatchers.delete` `contactcenterinsights.phraseMatchers.get` `contactcenterinsights.phraseMatchers.list` `contactcenterinsights.phraseMatchers.update` `contactcenterinsights.settings.get` `contactcenterinsights.settings.update` `contactcenterinsights.views.create` `contactcenterinsights.views.delete` `contactcenterinsights.views.get` `contactcenterinsights.views.list` `contactcenterinsights.views.update`
Dataflow	Added	`dataflow.streamingWorkItems.ImportState` `dataflow.streamingWorkItems.getWorkerMetadata`
Dataflow	Supported In Custom Roles	`dataflow.streamingWorkItems.ImportState` `dataflow.streamingWorkItems.getWorkerMetadata`
Dataflow	Now GA	`dataflow.streamingWorkItems.ImportState` `dataflow.streamingWorkItems.getWorkerMetadata`
Cloud Integrations	Added	`integrations.executions.get`
Cloud Integrations	Now GA	`integrations.executions.get`
Recommender	Added	`recommender.runServiceSecurityInsights.get` `recommender.runServiceSecurityInsights.list` `recommender.runServiceSecurityInsights.update` `recommender.runServiceSecurityRecommendations.get` `recommender.runServiceSecurityRecommendations.list` `recommender.runServiceSecurityRecommendations.update`
Recommender	Supported In Custom Roles	`recommender.runServiceSecurityInsights.get` `recommender.runServiceSecurityInsights.list` `recommender.runServiceSecurityInsights.update` `recommender.runServiceSecurityRecommendations.get` `recommender.runServiceSecurityRecommendations.list` `recommender.runServiceSecurityRecommendations.update`
Recommender	Now GA	`recommender.networkAnalyzerCloudSqlInsights.get` `recommender.networkAnalyzerCloudSqlInsights.list` `recommender.networkAnalyzerCloudSqlInsights.update` `recommender.networkAnalyzerDynamicRouteInsights.get` `recommender.networkAnalyzerDynamicRouteInsights.list` `recommender.networkAnalyzerDynamicRouteInsights.update` `recommender.networkAnalyzerGkeConnectivityInsights.get` `recommender.networkAnalyzerGkeConnectivityInsights.list` `recommender.networkAnalyzerGkeConnectivityInsights.update` `recommender.networkAnalyzerGkeIpAddressInsights.get` `recommender.networkAnalyzerGkeIpAddressInsights.list` `recommender.networkAnalyzerGkeIpAddressInsights.update` `recommender.networkAnalyzerIpAddressInsights.get` `recommender.networkAnalyzerIpAddressInsights.list` `recommender.networkAnalyzerIpAddressInsights.update` `recommender.networkAnalyzerLoadBalancerInsights.get` `recommender.networkAnalyzerLoadBalancerInsights.list` `recommender.networkAnalyzerLoadBalancerInsights.update` `recommender.networkAnalyzerVpcConnectivityInsights.get` `recommender.networkAnalyzerVpcConnectivityInsights.list` `recommender.networkAnalyzerVpcConnectivityInsights.update` `recommender.runServiceSecurityInsights.get` `recommender.runServiceSecurityInsights.list` `recommender.runServiceSecurityInsights.update` `recommender.runServiceSecurityRecommendations.get` `recommender.runServiceSecurityRecommendations.list` `recommender.runServiceSecurityRecommendations.update`
RISC Configuration Service	Added	`riscconfigurationservice.riscconfigs.createOrUpdate` `riscconfigurationservice.riscconfigs.delete` `riscconfigurationservice.riscconfigs.get`
RISC Configuration Service	Supported In Custom Roles	`riscconfigurationservice.riscconfigs.createOrUpdate` `riscconfigurationservice.riscconfigs.delete` `riscconfigurationservice.riscconfigs.get`
Service Usage	Supported In Custom Roles	`serviceusage.services.use`
Service Usage	Now GA	`serviceusage.services.use`
Cloud TPU	Added	`tpu.nodes.simulateMaintenanceEvent` `tpu.runtimeversions.get` `tpu.runtimeversions.list`
Cloud TPU	Supported In Custom Roles	`tpu.nodes.simulateMaintenanceEvent` `tpu.runtimeversions.get` `tpu.runtimeversions.list`
Cloud TPU	Now GA	`tpu.nodes.simulateMaintenanceEvent` `tpu.runtimeversions.get` `tpu.runtimeversions.list`

Cloud IAM changes as of 2022-09-30

Service	Change	Description
Vertex AI	Role Updated	The following permissions have been added to the role `roles/aiplatform.admin` (Vertex AI Administrator): `aiplatform.nasTrialDetails.get` `aiplatform.nasTrialDetails.list`
Vertex AI	Role Updated	The following permissions have been added to the role `roles/aiplatform.customCodeServiceAgent` (Vertex AI Custom Code Service Agent): `aiplatform.nasTrialDetails.get` `aiplatform.nasTrialDetails.list`
Vertex AI	Role Updated	The following permissions have been added to the role `roles/aiplatform.serviceAgent` (Vertex AI Service Agent): `aiplatform.nasTrialDetails.get` `aiplatform.nasTrialDetails.list`
Vertex AI	Role Updated	The following permissions have been added to the role `roles/aiplatform.user` (Vertex AI User): `aiplatform.nasTrialDetails.get` `aiplatform.nasTrialDetails.list`
Vertex AI	Role Updated	The following permissions have been added to the role `roles/aiplatform.viewer` (Vertex AI Viewer): `aiplatform.nasTrialDetails.get` `aiplatform.nasTrialDetails.list`
Backup and Disaster Recovery	Now GA	The role `roles/backupdr.cloudStorageOperator` (Backup and DR Cloud Storage Operator) is now GA.
Backup and Disaster Recovery	Now GA	The role `roles/backupdr.computeEngineOperator` (Backup and DR Compute Engine Operator) is now GA.
Chrome Enterprise Premium	Role Updated	The following permissions have been added to the role `roles/beyondcorp.viewer` (Cloud BeyondCorp Viewer): `resourcemanager.organizations.get`
Google Security Operations	Now GA	The role `roles/chronicle.admin` (Chronicle Data Plane API Admin) is now GA.
Google Security Operations	Now GA	The role `roles/chronicle.viewer` (Chronicle Data Plane API Viewer) is now GA.
Basic Role	Role Updated	The following permissions have been added to the role `roles/editor` (Editor): `managedidentities.domains.checkMigrationPermission` `managedidentities.domains.disableMigration` `managedidentities.domains.enableMigration`
Managed Service for Microsoft Active Directory	Role Updated	The following permissions have been added to the role `roles/managedidentities.admin` (Google Cloud Managed Identities Admin): `managedidentities.domains.checkMigrationPermission` `managedidentities.domains.disableMigration` `managedidentities.domains.enableMigration`
Managed Service for Microsoft Active Directory	Role Updated	The following permissions have been added to the role `roles/managedidentities.domainAdmin` (Google Cloud Managed Identities Domain Admin): `managedidentities.domains.checkMigrationPermission` `managedidentities.domains.disableMigration` `managedidentities.domains.enableMigration`
Google Cloud Migration Center	Role Updated	The following permissions have been added to the role `roles/migrationcenter.viewer` (Migration Center Viewer): `rma.annotations.get` `rma.collectors.get` `rma.collectors.list` `rma.locations.get` `rma.locations.list` `rma.operations.get` `rma.operations.list`
Basic Role	Role Updated	The following permissions have been added to the role `roles/owner` (Owner): `managedidentities.domains.checkMigrationPermission` `managedidentities.domains.disableMigration` `managedidentities.domains.enableMigration`
Serverless Integrations	Now GA	The role `roles/runapps.serviceAgent` (Serverless Integrations Service Agent) is now GA.
Video Stitcher API	Now GA	The role `roles/videostitcher.admin` (Video Stitcher Admin) is now GA.
Video Stitcher API	Now GA	The role `roles/videostitcher.user` (Video Stitcher User) is now GA.
Video Stitcher API	Now GA	The role `roles/videostitcher.viewer` (Video Stitcher Viewer) is now GA.
Basic Role	Role Updated	The following permissions have been added to the role `roles/viewer` (Viewer): `managedidentities.domains.checkMigrationPermission`
Visual Inspection AI	Role Updated	The following permissions have been added to the role `roles/visualinspection.serviceAgent` (Visual Inspection AI Service Agent): `aiplatform.nasTrialDetails.get` `aiplatform.nasTrialDetails.list`
Vertex AI	Added	`aiplatform.nasTrialDetails.get` `aiplatform.nasTrialDetails.list`
API Keys	Added	`apikeys.keys.getKeyString` `apikeys.keys.undelete`
API Keys	Supported In Custom Roles	`apikeys.keys.getKeyString` `apikeys.keys.undelete`
API Keys	Now GA	`apikeys.keys.getKeyString` `apikeys.keys.undelete`
Artifact Registry	Added	`artifactregistry.kfpartifacts.create`
Artifact Registry	Now GA	`artifactregistry.kfpartifacts.create`
Bare Metal Solution	Added	`baremetalsolution.instances.attachNetwork` `baremetalsolution.instances.detachNetwork` `baremetalsolution.networks.create` `baremetalsolution.networks.delete`
Bare Metal Solution	Supported In Custom Roles	`baremetalsolution.instances.attachNetwork` `baremetalsolution.instances.detachNetwork` `baremetalsolution.networks.create` `baremetalsolution.networks.delete`
Bare Metal Solution	Now GA	`baremetalsolution.instances.attachNetwork` `baremetalsolution.instances.detachNetwork` `baremetalsolution.networks.create` `baremetalsolution.networks.delete`
Bigtable	Added	`bigtable.instances.ping`
Bigtable	Now GA	`bigtable.instances.ping`
Certificate Manager	Added	`certificatemanager.certissuanceconfigs.create` `certificatemanager.certissuanceconfigs.delete` `certificatemanager.certissuanceconfigs.get` `certificatemanager.certissuanceconfigs.list` `certificatemanager.certissuanceconfigs.update` `certificatemanager.certissuanceconfigs.use`
Certificate Manager	Supported In Custom Roles	`certificatemanager.certissuanceconfigs.create` `certificatemanager.certissuanceconfigs.delete` `certificatemanager.certissuanceconfigs.get` `certificatemanager.certissuanceconfigs.list` `certificatemanager.certissuanceconfigs.update` `certificatemanager.certissuanceconfigs.use`
Google Security Operations	Added	`chronicle.dashboards.copy` `chronicle.dashboards.create` `chronicle.dashboards.delete` `chronicle.dashboards.get` `chronicle.dashboards.list` `chronicle.multitenantDirectories.get`
Google Security Operations	Supported In Custom Roles	`chronicle.dashboards.copy` `chronicle.dashboards.create` `chronicle.dashboards.delete` `chronicle.dashboards.get` `chronicle.dashboards.list`
Google Security Operations	Now GA	`chronicle.dashboards.copy` `chronicle.dashboards.create` `chronicle.dashboards.delete` `chronicle.dashboards.get` `chronicle.dashboards.list` `chronicle.multitenantDirectories.get`
Cloud Asset Inventory	Added	`cloudasset.assets.exportAiplatformBatchPredictionJobs` `cloudasset.assets.exportAiplatformCustomJobs` `cloudasset.assets.exportAiplatformDataLabelingJobs` `cloudasset.assets.exportAiplatformDatasets` `cloudasset.assets.exportAiplatformEndpoints` `cloudasset.assets.exportAiplatformHyperparameterTuningJobs` `cloudasset.assets.exportAiplatformMetadataStores` `cloudasset.assets.exportAiplatformModelDeploymentMonitoringJobs` `cloudasset.assets.exportAiplatformModels` `cloudasset.assets.exportAiplatformPipelineJobs` `cloudasset.assets.exportAiplatformSpecialistPools` `cloudasset.assets.exportAiplatformTrainingPipelines` `cloudasset.assets.exportAnthosConnectedCluster` `cloudasset.assets.exportAnthosedgeCluster` `cloudasset.assets.exportApigatewayApi` `cloudasset.assets.exportApigatewayApiConfig` `cloudasset.assets.exportApigatewayGateway` `cloudasset.assets.exportApikeysKeys` `cloudasset.assets.exportArtifactregistryDockerImages` `cloudasset.assets.exportArtifactregistryRepositories` `cloudasset.assets.exportAssuredWorkloadsWorkloads` `cloudasset.assets.exportBeyondCorpApiGateways` `cloudasset.assets.exportBeyondCorpAppConnections` `cloudasset.assets.exportBeyondCorpAppConnectors` `cloudasset.assets.exportBeyondCorpClientConnectorServices` `cloudasset.assets.exportBeyondCorpClientGateways` `cloudasset.assets.exportBigqueryModels` `cloudasset.assets.exportBigtableAppProfile` `cloudasset.assets.exportBigtableBackup` `cloudasset.assets.exportCloudAssetFeeds` `cloudasset.assets.exportCloudDeployDeliveryPipelines` `cloudasset.assets.exportCloudDeployReleases` `cloudasset.assets.exportCloudDeployRollouts` `cloudasset.assets.exportCloudDeployTargets` `cloudasset.assets.exportCloudDocumentAIEvaluation` `cloudasset.assets.exportCloudDocumentAIHumanReviewConfig` `cloudasset.assets.exportCloudDocumentAILabelerPool` `cloudasset.assets.exportCloudDocumentAIProcessor` `cloudasset.assets.exportCloudDocumentAIProcessorVersion` `cloudasset.assets.exportCloudbillingProjectBillingInfos` `cloudasset.assets.exportCloudfunctionsFunctions` `cloudasset.assets.exportCloudfunctionsGen2Functions` `cloudasset.assets.exportCloudkmsEkmConnections` `cloudasset.assets.exportCloudmemcacheInstances` `cloudasset.assets.exportCloudresourcemanagerTagBindings` `cloudasset.assets.exportCloudresourcemanagerTagKeys` `cloudasset.assets.exportCloudresourcemanagerTagValues` `cloudasset.assets.exportComposerEnvironments` `cloudasset.assets.exportComputeCommitments` `cloudasset.assets.exportComputeExternalVpnGateways` `cloudasset.assets.exportComputeFirewallPolicies` `cloudasset.assets.exportComputeNetworkEndpointGroups` `cloudasset.assets.exportComputeNodeGroups` `cloudasset.assets.exportComputeNodeTemplates` `cloudasset.assets.exportComputePacketMirrorings` `cloudasset.assets.exportComputeReservations` `cloudasset.assets.exportComputeResourcePolicies` `cloudasset.assets.exportComputeServiceAttachments` `cloudasset.assets.exportComputeSslPolicies` `cloudasset.assets.exportComputeVpnGateways` `cloudasset.assets.exportConnectorsConnections` `cloudasset.assets.exportConnectorsConnectorVersions` `cloudasset.assets.exportConnectorsConnectors` `cloudasset.assets.exportConnectorsProviders` `cloudasset.assets.exportConnectorsRuntimeConfigs` `cloudasset.assets.exportContainerAppsDeployment` `cloudasset.assets.exportContainerAppsReplicaSets` `cloudasset.assets.exportContainerBatchJobs` `cloudasset.assets.exportContainerExtensionsIngresses` `cloudasset.assets.exportContainerJobs` `cloudasset.assets.exportContainerNetworkingIngresses` `cloudasset.assets.exportContainerNetworkingNetworkPolicies` `cloudasset.assets.exportContainerReplicaSets` `cloudasset.assets.exportContainerServices` `cloudasset.assets.exportDataMigrationConnectionProfiles` `cloudasset.assets.exportDataMigrationMigrationJobs` `cloudasset.assets.exportDataflowJobs` `cloudasset.assets.exportDataplexAssets` `cloudasset.assets.exportDataplexLakes` `cloudasset.assets.exportDataplexTasks` `cloudasset.assets.exportDataplexZones` `cloudasset.assets.exportDataprocAutoscalingPolicies` `cloudasset.assets.exportDataprocBatches` `cloudasset.assets.exportDataprocSessions` `cloudasset.assets.exportDataprocWorkflowTemplates` `cloudasset.assets.exportDatastreamConnectionProfile` `cloudasset.assets.exportDatastreamPrivateConnection` `cloudasset.assets.exportDatastreamStream` `cloudasset.assets.exportDialogflowAgents` `cloudasset.assets.exportDialogflowConversationProfiles` `cloudasset.assets.exportDialogflowKnowledgeBases` `cloudasset.assets.exportDialogflowLocationSettings` `cloudasset.assets.exportDlpDeidentifyTemplates` `cloudasset.assets.exportDlpDlpJobs` `cloudasset.assets.exportDlpInspectTemplates` `cloudasset.assets.exportDlpJobTriggers` `cloudasset.assets.exportDlpStoredInfoTypes` `cloudasset.assets.exportDomainsRegistrations` `cloudasset.assets.exportEventarcTriggers` `cloudasset.assets.exportFileBackups` `cloudasset.assets.exportFileInstances` `cloudasset.assets.exportFirebaseAppInfos` `cloudasset.assets.exportFirebaseProjects` `cloudasset.assets.exportFirestoreDatabases` `cloudasset.assets.exportGKEHubFeatures` `cloudasset.assets.exportGKEHubMemberships` `cloudasset.assets.exportGameservicesGameServerClusters` `cloudasset.assets.exportGameservicesGameServerConfigs` `cloudasset.assets.exportGameservicesGameServerDeployments` `cloudasset.assets.exportGameservicesRealms` `cloudasset.assets.exportGkeBackupBackupPlans` `cloudasset.assets.exportGkeBackupBackups` `cloudasset.assets.exportGkeBackupRestorePlans` `cloudasset.assets.exportGkeBackupRestores` `cloudasset.assets.exportGkeBackupVolumeBackups` `cloudasset.assets.exportGkeBackupVolumeRestores` `cloudasset.assets.exportHealthcareConsentStores` `cloudasset.assets.exportHealthcareDatasets` `cloudasset.assets.exportHealthcareDicomStores` `cloudasset.assets.exportHealthcareFhirStores` `cloudasset.assets.exportHealthcareHl7V2Stores` `cloudasset.assets.exportIapTunnel` `cloudasset.assets.exportIapTunnelInstances` `cloudasset.assets.exportIapTunnelZones` `cloudasset.assets.exportIapWeb` `cloudasset.assets.exportIapWebServiceVersion` `cloudasset.assets.exportIapWebServices` `cloudasset.assets.exportIapWebType` `cloudasset.assets.exportIdsEndpoints` `cloudasset.assets.exportIntegrationsAuthConfigs` `cloudasset.assets.exportIntegrationsCertificates` `cloudasset.assets.exportIntegrationsExecutions` `cloudasset.assets.exportIntegrationsIntegrationVersions` `cloudasset.assets.exportIntegrationsIntegrations` `cloudasset.assets.exportIntegrationsSfdcChannels` `cloudasset.assets.exportIntegrationsSfdcInstances` `cloudasset.assets.exportIntegrationsSuspensions` `cloudasset.assets.exportLoggingLogMetrics` `cloudasset.assets.exportLoggingLogSinks` `cloudasset.assets.exportMetastoreBackups` `cloudasset.assets.exportMetastoreMetadataImports` `cloudasset.assets.exportMetastoreServices` `cloudasset.assets.exportMonitoringAlertPolicies` `cloudasset.assets.exportNetworkConnectivityHubs` `cloudasset.assets.exportNetworkConnectivitySpokes` `cloudasset.assets.exportNetworkManagementConnectivityTests` `cloudasset.assets.exportNetworkServicesEndpointPolicies` `cloudasset.assets.exportNetworkServicesGateways` `cloudasset.assets.exportNetworkServicesGrpcRoutes` `cloudasset.assets.exportNetworkServicesHttpRoutes` `cloudasset.assets.exportNetworkServicesMeshes` `cloudasset.assets.exportNetworkServicesServiceBindings` `cloudasset.assets.exportNetworkServicesTcpRoutes` `cloudasset.assets.exportNetworkServicesTlsRoutes` `cloudasset.assets.exportOSConfigOSPolicyAssignmentReports` `cloudasset.assets.exportOSConfigOSPolicyAssignments` `cloudasset.assets.exportOSConfigVulnerabilityReports` `cloudasset.assets.exportPatchDeployments` `cloudasset.assets.exportPubsubSnapshots` `cloudasset.assets.exportRedisInstances` `cloudasset.assets.exportServiceDirectoryNamespaces` `cloudasset.assets.exportServiceconsumermanagementConsumerProperty` `cloudasset.assets.exportServiceconsumermanagementConsumerQuotaLimits` `cloudasset.assets.exportServiceconsumermanagementConsumers` `cloudasset.assets.exportServiceconsumermanagementProducerOverrides` `cloudasset.assets.exportServiceconsumermanagementTenancyUnits` `cloudasset.assets.exportServiceconsumermanagementVisibility` `cloudasset.assets.exportServiceusageAdminOverrides` `cloudasset.assets.exportServiceusageConsumerOverrides` `cloudasset.assets.exportServiceusageServices` `cloudasset.assets.exportSpannerBackups` `cloudasset.assets.exportSpeakerIdPhrases` `cloudasset.assets.exportSpeakerIdSettings` `cloudasset.assets.exportSpeakerIdSpeakers` `cloudasset.assets.exportSpeechCustomClasses` `cloudasset.assets.exportSpeechPhraseSets` `cloudasset.assets.exportSqladminBackupRuns` `cloudasset.assets.exportTpuNodes` `cloudasset.assets.exportVpcaccessConnector` `cloudasset.assets.listAccessLevel` `cloudasset.assets.listAiplatformBatchPredictionJobs` `cloudasset.assets.listAiplatformCustomJobs` `cloudasset.assets.listAiplatformDataLabelingJobs` `cloudasset.assets.listAiplatformDatasets` `cloudasset.assets.listAiplatformEndpoints` `cloudasset.assets.listAiplatformHyperparameterTuningJobs` `cloudasset.assets.listAiplatformMetadataStores` `cloudasset.assets.listAiplatformModelDeploymentMonitoringJobs` `cloudasset.assets.listAiplatformModels` `cloudasset.assets.listAiplatformPipelineJobs` `cloudasset.assets.listAiplatformSpecialistPools` `cloudasset.assets.listAiplatformTrainingPipelines` `cloudasset.assets.listAllAccessPolicy` `cloudasset.assets.listAnthosConnectedCluster` `cloudasset.assets.listAnthosedgeCluster` `cloudasset.assets.listApigatewayApi` `cloudasset.assets.listApigatewayApiConfig` `cloudasset.assets.listApigatewayGateway` `cloudasset.assets.listApikeysKeys` `cloudasset.assets.listAppengineApplications` `cloudasset.assets.listAppengineServices` `cloudasset.assets.listAppengineVersions` `cloudasset.assets.listArtifactregistryDockerImages` `cloudasset.assets.listArtifactregistryRepositories` `cloudasset.assets.listAssuredWorkloadsWorkloads` `cloudasset.assets.listBeyondCorpApiGateways` `cloudasset.assets.listBeyondCorpAppConnections` `cloudasset.assets.listBeyondCorpAppConnectors` `cloudasset.assets.listBeyondCorpClientConnectorServices` `cloudasset.assets.listBeyondCorpClientGateways` `cloudasset.assets.listBigqueryDatasets` `cloudasset.assets.listBigqueryModels` `cloudasset.assets.listBigqueryTables` `cloudasset.assets.listBigtableAppProfile` `cloudasset.assets.listBigtableBackup` `cloudasset.assets.listBigtableCluster` `cloudasset.assets.listBigtableInstance` `cloudasset.assets.listBigtableTable` `cloudasset.assets.listCloudAssetFeeds` `cloudasset.assets.listCloudDeployDeliveryPipelines` `cloudasset.assets.listCloudDeployReleases` `cloudasset.assets.listCloudDeployRollouts` `cloudasset.assets.listCloudDeployTargets` `cloudasset.assets.listCloudDocumentAIEvaluation` `cloudasset.assets.listCloudDocumentAIHumanReviewConfig` `cloudasset.assets.listCloudDocumentAILabelerPool` `cloudasset.assets.listCloudDocumentAIProcessor` `cloudasset.assets.listCloudDocumentAIProcessorVersion` `cloudasset.assets.listCloudbillingBillingAccounts` `cloudasset.assets.listCloudbillingProjectBillingInfos` `cloudasset.assets.listCloudfunctionsFunctions` `cloudasset.assets.listCloudfunctionsGen2Functions` `cloudasset.assets.listCloudkmsCryptoKeyVersions` `cloudasset.assets.listCloudkmsEkmConnections` `cloudasset.assets.listCloudkmsImportJobs` `cloudasset.assets.listCloudkmsKeyRings` `cloudasset.assets.listCloudmemcacheInstances` `cloudasset.assets.listCloudresourcemanagerFolders` `cloudasset.assets.listCloudresourcemanagerOrganizations` `cloudasset.assets.listCloudresourcemanagerProjects` `cloudasset.assets.listCloudresourcemanagerTagBindings` `cloudasset.assets.listCloudresourcemanagerTagKeys` `cloudasset.assets.listCloudresourcemanagerTagValues` `cloudasset.assets.listComposerEnvironments` `cloudasset.assets.listComputeAddress` `cloudasset.assets.listComputeAutoscalers` `cloudasset.assets.listComputeBackendBuckets` `cloudasset.assets.listComputeBackendServices` `cloudasset.assets.listComputeCommitments` `cloudasset.assets.listComputeDisks` `cloudasset.assets.listComputeExternalVpnGateways` `cloudasset.assets.listComputeFirewallPolicies` `cloudasset.assets.listComputeFirewalls` `cloudasset.assets.listComputeForwardingRules` `cloudasset.assets.listComputeGlobalAddress` `cloudasset.assets.listComputeGlobalForwardingRules` `cloudasset.assets.listComputeHealthChecks` `cloudasset.assets.listComputeHttpHealthChecks` `cloudasset.assets.listComputeHttpsHealthChecks` `cloudasset.assets.listComputeImages` `cloudasset.assets.listComputeInstanceGroupManagers` `cloudasset.assets.listComputeInstanceGroups` `cloudasset.assets.listComputeInstanceTemplates` `cloudasset.assets.listComputeInstances` `cloudasset.assets.listComputeInterconnect` `cloudasset.assets.listComputeInterconnectAttachment` `cloudasset.assets.listComputeLicenses` `cloudasset.assets.listComputeNetworkEndpointGroups` `cloudasset.assets.listComputeNetworks` `cloudasset.assets.listComputeNodeGroups` `cloudasset.assets.listComputeNodeTemplates` `cloudasset.assets.listComputePacketMirrorings` `cloudasset.assets.listComputeProjects` `cloudasset.assets.listComputeRegionAutoscaler` `cloudasset.assets.listComputeRegionBackendServices` `cloudasset.assets.listComputeRegionDisk` `cloudasset.assets.listComputeRegionInstanceGroup` `cloudasset.assets.listComputeRegionInstanceGroupManager` `cloudasset.assets.listComputeReservations` `cloudasset.assets.listComputeResourcePolicies` `cloudasset.assets.listComputeRouters` `cloudasset.assets.listComputeRoutes` `cloudasset.assets.listComputeSecurityPolicy` `cloudasset.assets.listComputeServiceAttachments` `cloudasset.assets.listComputeSnapshots` `cloudasset.assets.listComputeSslCertificates` `cloudasset.assets.listComputeSslPolicies` `cloudasset.assets.listComputeSubnetworks` `cloudasset.assets.listComputeTargetHttpProxies` `cloudasset.assets.listComputeTargetHttpsProxies` `cloudasset.assets.listComputeTargetInstances` `cloudasset.assets.listComputeTargetPools` `cloudasset.assets.listComputeTargetSslProxies` `cloudasset.assets.listComputeTargetTcpProxies` `cloudasset.assets.listComputeTargetVpnGateways` `cloudasset.assets.listComputeUrlMaps` `cloudasset.assets.listComputeVpnGateways` `cloudasset.assets.listComputeVpnTunnels` `cloudasset.assets.listConnectorsConnections` `cloudasset.assets.listConnectorsConnectorVersions` `cloudasset.assets.listConnectorsConnectors` `cloudasset.assets.listConnectorsProviders` `cloudasset.assets.listConnectorsRuntimeConfigs` `cloudasset.assets.listContainerAppsDeployment` `cloudasset.assets.listContainerAppsReplicaSets` `cloudasset.assets.listContainerBatchJobs` `cloudasset.assets.listContainerClusterrole` `cloudasset.assets.listContainerClusterrolebinding` `cloudasset.assets.listContainerClusters` `cloudasset.assets.listContainerExtensionsIngresses` `cloudasset.assets.listContainerJobs` `cloudasset.assets.listContainerNamespace` `cloudasset.assets.listContainerNetworkingIngresses` `cloudasset.assets.listContainerNetworkingNetworkPolicies` `cloudasset.assets.listContainerNode` `cloudasset.assets.listContainerNodepool` `cloudasset.assets.listContainerPod` `cloudasset.assets.listContainerReplicaSets` `cloudasset.assets.listContainerRole` `cloudasset.assets.listContainerRolebinding` `cloudasset.assets.listContainerServices` `cloudasset.assets.listContainerregistryImage` `cloudasset.assets.listDataMigrationConnectionProfiles` `cloudasset.assets.listDataMigrationMigrationJobs` `cloudasset.assets.listDataflowJobs` `cloudasset.assets.listDatafusionInstance` `cloudasset.assets.listDataplexAssets` `cloudasset.assets.listDataplexLakes` `cloudasset.assets.listDataplexTasks` `cloudasset.assets.listDataplexZones` `cloudasset.assets.listDataprocAutoscalingPolicies` `cloudasset.assets.listDataprocBatches` `cloudasset.assets.listDataprocClusters` `cloudasset.assets.listDataprocJobs` `cloudasset.assets.listDataprocSessions` `cloudasset.assets.listDataprocWorkflowTemplates` `cloudasset.assets.listDatastreamConnectionProfile` `cloudasset.assets.listDatastreamPrivateConnection` `cloudasset.assets.listDatastreamStream` `cloudasset.assets.listDialogflowAgents` `cloudasset.assets.listDialogflowConversationProfiles` `cloudasset.assets.listDialogflowKnowledgeBases` `cloudasset.assets.listDialogflowLocationSettings` `cloudasset.assets.listDlpDeidentifyTemplates` `cloudasset.assets.listDlpDlpJobs` `cloudasset.assets.listDlpInspectTemplates` `cloudasset.assets.listDlpJobTriggers` `cloudasset.assets.listDlpStoredInfoTypes` `cloudasset.assets.listDnsManagedZones` `cloudasset.assets.listDnsPolicies` `cloudasset.assets.listDomainsRegistrations` `cloudasset.assets.listEventarcTriggers` `cloudasset.assets.listFileBackups` `cloudasset.assets.listFileInstances` `cloudasset.assets.listFirebaseAppInfos` `cloudasset.assets.listFirebaseProjects` `cloudasset.assets.listFirestoreDatabases` `cloudasset.assets.listGKEHubFeatures` `cloudasset.assets.listGKEHubMemberships` `cloudasset.assets.listGameservicesGameServerClusters` `cloudasset.assets.listGameservicesGameServerConfigs` `cloudasset.assets.listGameservicesGameServerDeployments` `cloudasset.assets.listGameservicesRealms` `cloudasset.assets.listGkeBackupBackupPlans` `cloudasset.assets.listGkeBackupBackups` `cloudasset.assets.listGkeBackupRestorePlans` `cloudasset.assets.listGkeBackupRestores` `cloudasset.assets.listGkeBackupVolumeBackups` `cloudasset.assets.listGkeBackupVolumeRestores` `cloudasset.assets.listHealthcareConsentStores` `cloudasset.assets.listHealthcareDatasets` `cloudasset.assets.listHealthcareDicomStores` `cloudasset.assets.listHealthcareFhirStores` `cloudasset.assets.listHealthcareHl7V2Stores` `cloudasset.assets.listIamRoles` `cloudasset.assets.listIamServiceAccountKeys` `cloudasset.assets.listIamServiceAccounts` `cloudasset.assets.listIapTunnel` `cloudasset.assets.listIapTunnelInstances` `cloudasset.assets.listIapTunnelZones` `cloudasset.assets.listIapWeb` `cloudasset.assets.listIapWebServiceVersion` `cloudasset.assets.listIapWebServices` `cloudasset.assets.listIapWebType` `cloudasset.assets.listIdsEndpoints` `cloudasset.assets.listIntegrationsAuthConfigs` `cloudasset.assets.listIntegrationsCertificates` `cloudasset.assets.listIntegrationsExecutions` `cloudasset.assets.listIntegrationsIntegrationVersions` `cloudasset.assets.listIntegrationsIntegrations` `cloudasset.assets.listIntegrationsSfdcChannels` `cloudasset.assets.listIntegrationsSfdcInstances` `cloudasset.assets.listIntegrationsSuspensions` `cloudasset.assets.listLoggingLogMetrics` `cloudasset.assets.listLoggingLogSinks` `cloudasset.assets.listManagedidentitiesDomain` `cloudasset.assets.listMetastoreBackups` `cloudasset.assets.listMetastoreMetadataImports` `cloudasset.assets.listMetastoreServices` `cloudasset.assets.listMonitoringAlertPolicies` `cloudasset.assets.listNetworkConnectivityHubs` `cloudasset.assets.listNetworkConnectivitySpokes` `cloudasset.assets.listNetworkManagementConnectivityTests` `cloudasset.assets.listNetworkServicesEndpointPolicies` `cloudasset.assets.listNetworkServicesGateways` `cloudasset.assets.listNetworkServicesGrpcRoutes` `cloudasset.assets.listNetworkServicesHttpRoutes` `cloudasset.assets.listNetworkServicesMeshes` `cloudasset.assets.listNetworkServicesServiceBindings` `cloudasset.assets.listNetworkServicesTcpRoutes` `cloudasset.assets.listNetworkServicesTlsRoutes` `cloudasset.assets.listOSConfigOSPolicyAssignmentReports` `cloudasset.assets.listOSConfigOSPolicyAssignments` `cloudasset.assets.listOSConfigVulnerabilityReports` `cloudasset.assets.listPatchDeployments` `cloudasset.assets.listPubsubSnapshots` `cloudasset.assets.listPubsubSubscriptions` `cloudasset.assets.listPubsubTopics` `cloudasset.assets.listRedisInstances` `cloudasset.assets.listRunDomainMapping` `cloudasset.assets.listRunRevision` `cloudasset.assets.listRunService` `cloudasset.assets.listServiceDirectoryNamespaces` `cloudasset.assets.listServicePerimeter` `cloudasset.assets.listServiceconsumermanagementConsumerProperty` `cloudasset.assets.listServiceconsumermanagementConsumerQuotaLimits` `cloudasset.assets.listServiceconsumermanagementConsumers` `cloudasset.assets.listServiceconsumermanagementProducerOverrides` `cloudasset.assets.listServiceconsumermanagementTenancyUnits` `cloudasset.assets.listServiceconsumermanagementVisibility` `cloudasset.assets.listServicemanagementServices` `cloudasset.assets.listServiceusageAdminOverrides` `cloudasset.assets.listServiceusageConsumerOverrides` `cloudasset.assets.listServiceusageServices` `cloudasset.assets.listSpannerBackups` `cloudasset.assets.listSpannerDatabases` `cloudasset.assets.listSpannerInstances` `cloudasset.assets.listSpeakerIdPhrases` `cloudasset.assets.listSpeakerIdSettings` `cloudasset.assets.listSpeakerIdSpeakers` `cloudasset.assets.listSpeechCustomClasses` `cloudasset.assets.listSpeechPhraseSets` `cloudasset.assets.listSqladminBackupRuns` `cloudasset.assets.listSqladminInstances` `cloudasset.assets.listStorageBuckets` `cloudasset.assets.listTpuNodes` `cloudasset.assets.listVpcaccessConnector`
Cloud Asset Inventory	Supported In Custom Roles	`cloudasset.assets.exportAccessLevel` `cloudasset.assets.exportAiplatformBatchPredictionJobs` `cloudasset.assets.exportAiplatformCustomJobs` `cloudasset.assets.exportAiplatformDataLabelingJobs` `cloudasset.assets.exportAiplatformDatasets` `cloudasset.assets.exportAiplatformEndpoints` `cloudasset.assets.exportAiplatformHyperparameterTuningJobs` `cloudasset.assets.exportAiplatformMetadataStores` `cloudasset.assets.exportAiplatformModelDeploymentMonitoringJobs` `cloudasset.assets.exportAiplatformModels` `cloudasset.assets.exportAiplatformPipelineJobs` `cloudasset.assets.exportAiplatformSpecialistPools` `cloudasset.assets.exportAiplatformTrainingPipelines` `cloudasset.assets.exportAllAccessPolicy` `cloudasset.assets.exportAnthosConnectedCluster` `cloudasset.assets.exportAnthosedgeCluster` `cloudasset.assets.exportApigatewayApi` `cloudasset.assets.exportApigatewayApiConfig` `cloudasset.assets.exportApigatewayGateway` `cloudasset.assets.exportApikeysKeys` `cloudasset.assets.exportAppengineApplications` `cloudasset.assets.exportAppengineServices` `cloudasset.assets.exportAppengineVersions` `cloudasset.assets.exportArtifactregistryDockerImages` `cloudasset.assets.exportArtifactregistryRepositories` `cloudasset.assets.exportAssuredWorkloadsWorkloads` `cloudasset.assets.exportBeyondCorpApiGateways` `cloudasset.assets.exportBeyondCorpAppConnections` `cloudasset.assets.exportBeyondCorpAppConnectors` `cloudasset.assets.exportBeyondCorpClientConnectorServices` `cloudasset.assets.exportBeyondCorpClientGateways` `cloudasset.assets.exportBigqueryDatasets` `cloudasset.assets.exportBigqueryModels` `cloudasset.assets.exportBigqueryTables` `cloudasset.assets.exportBigtableAppProfile` `cloudasset.assets.exportBigtableBackup` `cloudasset.assets.exportBigtableCluster` `cloudasset.assets.exportBigtableInstance` `cloudasset.assets.exportBigtableTable` `cloudasset.assets.exportCloudAssetFeeds` `cloudasset.assets.exportCloudDeployDeliveryPipelines` `cloudasset.assets.exportCloudDeployReleases` `cloudasset.assets.exportCloudDeployRollouts` `cloudasset.assets.exportCloudDeployTargets` `cloudasset.assets.exportCloudDocumentAIEvaluation` `cloudasset.assets.exportCloudDocumentAIHumanReviewConfig` `cloudasset.assets.exportCloudDocumentAILabelerPool` `cloudasset.assets.exportCloudDocumentAIProcessor` `cloudasset.assets.exportCloudDocumentAIProcessorVersion` `cloudasset.assets.exportCloudbillingBillingAccounts` `cloudasset.assets.exportCloudbillingProjectBillingInfos` `cloudasset.assets.exportCloudfunctionsFunctions` `cloudasset.assets.exportCloudfunctionsGen2Functions` `cloudasset.assets.exportCloudkmsCryptoKeyVersions` `cloudasset.assets.exportCloudkmsCryptoKeys` `cloudasset.assets.exportCloudkmsEkmConnections` `cloudasset.assets.exportCloudkmsKeyRings` `cloudasset.assets.exportCloudmemcacheInstances` `cloudasset.assets.exportCloudresourcemanagerFolders` `cloudasset.assets.exportCloudresourcemanagerOrganizations` `cloudasset.assets.exportCloudresourcemanagerProjects` `cloudasset.assets.exportCloudresourcemanagerTagBindings` `cloudasset.assets.exportCloudresourcemanagerTagKeys` `cloudasset.assets.exportCloudresourcemanagerTagValues` `cloudasset.assets.exportComposerEnvironments` `cloudasset.assets.exportComputeAddress` `cloudasset.assets.exportComputeAutoscalers` `cloudasset.assets.exportComputeBackendBuckets` `cloudasset.assets.exportComputeBackendServices` `cloudasset.assets.exportComputeCommitments` `cloudasset.assets.exportComputeDisks` `cloudasset.assets.exportComputeExternalVpnGateways` `cloudasset.assets.exportComputeFirewallPolicies` `cloudasset.assets.exportComputeFirewalls` `cloudasset.assets.exportComputeForwardingRules` `cloudasset.assets.exportComputeGlobalAddress` `cloudasset.assets.exportComputeGlobalForwardingRules` `cloudasset.assets.exportComputeHealthChecks` `cloudasset.assets.exportComputeHttpHealthChecks` `cloudasset.assets.exportComputeHttpsHealthChecks` `cloudasset.assets.exportComputeImages` `cloudasset.assets.exportComputeInstanceGroupManagers` `cloudasset.assets.exportComputeInstanceGroups` `cloudasset.assets.exportComputeInstanceTemplates` `cloudasset.assets.exportComputeInstances` `cloudasset.assets.exportComputeInterconnect` `cloudasset.assets.exportComputeInterconnectAttachment` `cloudasset.assets.exportComputeLicenses` `cloudasset.assets.exportComputeNetworkEndpointGroups` `cloudasset.assets.exportComputeNetworks` `cloudasset.assets.exportComputeNodeGroups` `cloudasset.assets.exportComputeNodeTemplates` `cloudasset.assets.exportComputePacketMirrorings` `cloudasset.assets.exportComputeProjects` `cloudasset.assets.exportComputeRegionAutoscaler` `cloudasset.assets.exportComputeRegionBackendServices` `cloudasset.assets.exportComputeRegionDisk` `cloudasset.assets.exportComputeRegionInstanceGroup` `cloudasset.assets.exportComputeRegionInstanceGroupManager` `cloudasset.assets.exportComputeReservations` `cloudasset.assets.exportComputeResourcePolicies` `cloudasset.assets.exportComputeRouters` `cloudasset.assets.exportComputeRoutes` `cloudasset.assets.exportComputeSecurityPolicy` `cloudasset.assets.exportComputeServiceAttachments` `cloudasset.assets.exportComputeSnapshots` `cloudasset.assets.exportComputeSslCertificates` `cloudasset.assets.exportComputeSslPolicies` `cloudasset.assets.exportComputeSubnetworks` `cloudasset.assets.exportComputeTargetHttpProxies` `cloudasset.assets.exportComputeTargetHttpsProxies` `cloudasset.assets.exportComputeTargetInstances` `cloudasset.assets.exportComputeTargetPools` `cloudasset.assets.exportComputeTargetSslProxies` `cloudasset.assets.exportComputeTargetTcpProxies` `cloudasset.assets.exportComputeTargetVpnGateways` `cloudasset.assets.exportComputeUrlMaps` `cloudasset.assets.exportComputeVpnGateways` `cloudasset.assets.exportComputeVpnTunnels` `cloudasset.assets.exportConnectorsConnections` `cloudasset.assets.exportConnectorsConnectorVersions` `cloudasset.assets.exportConnectorsConnectors` `cloudasset.assets.exportConnectorsProviders` `cloudasset.assets.exportConnectorsRuntimeConfigs` `cloudasset.assets.exportContainerAppsDeployment` `cloudasset.assets.exportContainerAppsReplicaSets` `cloudasset.assets.exportContainerBatchJobs` `cloudasset.assets.exportContainerClusterrole` `cloudasset.assets.exportContainerClusterrolebinding` `cloudasset.assets.exportContainerClusters` `cloudasset.assets.exportContainerExtensionsIngresses` `cloudasset.assets.exportContainerJobs` `cloudasset.assets.exportContainerNamespace` `cloudasset.assets.exportContainerNetworkingIngresses` `cloudasset.assets.exportContainerNetworkingNetworkPolicies` `cloudasset.assets.exportContainerNode` `cloudasset.assets.exportContainerNodepool` `cloudasset.assets.exportContainerPod` `cloudasset.assets.exportContainerReplicaSets` `cloudasset.assets.exportContainerRole` `cloudasset.assets.exportContainerRolebinding` `cloudasset.assets.exportContainerServices` `cloudasset.assets.exportContainerregistryImage` `cloudasset.assets.exportDataMigrationConnectionProfiles` `cloudasset.assets.exportDataMigrationMigrationJobs` `cloudasset.assets.exportDataflowJobs` `cloudasset.assets.exportDatafusionInstance` `cloudasset.assets.exportDataplexAssets` `cloudasset.assets.exportDataplexLakes` `cloudasset.assets.exportDataplexTasks` `cloudasset.assets.exportDataplexZones` `cloudasset.assets.exportDataprocAutoscalingPolicies` `cloudasset.assets.exportDataprocBatches` `cloudasset.assets.exportDataprocClusters` `cloudasset.assets.exportDataprocJobs` `cloudasset.assets.exportDataprocSessions` `cloudasset.assets.exportDataprocWorkflowTemplates` `cloudasset.assets.exportDatastreamConnectionProfile` `cloudasset.assets.exportDatastreamPrivateConnection` `cloudasset.assets.exportDatastreamStream` `cloudasset.assets.exportDialogflowAgents` `cloudasset.assets.exportDialogflowConversationProfiles` `cloudasset.assets.exportDialogflowKnowledgeBases` `cloudasset.assets.exportDialogflowLocationSettings` `cloudasset.assets.exportDlpDeidentifyTemplates` `cloudasset.assets.exportDlpDlpJobs` `cloudasset.assets.exportDlpInspectTemplates` `cloudasset.assets.exportDlpJobTriggers` `cloudasset.assets.exportDlpStoredInfoTypes` `cloudasset.assets.exportDnsManagedZones` `cloudasset.assets.exportDnsPolicies` `cloudasset.assets.exportDomainsRegistrations` `cloudasset.assets.exportEventarcTriggers` `cloudasset.assets.exportFileBackups` `cloudasset.assets.exportFileInstances` `cloudasset.assets.exportFirebaseAppInfos` `cloudasset.assets.exportFirebaseProjects` `cloudasset.assets.exportFirestoreDatabases` `cloudasset.assets.exportGKEHubFeatures` `cloudasset.assets.exportGKEHubMemberships` `cloudasset.assets.exportGameservicesGameServerClusters` `cloudasset.assets.exportGameservicesGameServerConfigs` `cloudasset.assets.exportGameservicesGameServerDeployments` `cloudasset.assets.exportGameservicesRealms` `cloudasset.assets.exportGkeBackupBackupPlans` `cloudasset.assets.exportGkeBackupBackups` `cloudasset.assets.exportGkeBackupRestorePlans` `cloudasset.assets.exportGkeBackupRestores` `cloudasset.assets.exportGkeBackupVolumeBackups` `cloudasset.assets.exportGkeBackupVolumeRestores` `cloudasset.assets.exportHealthcareConsentStores` `cloudasset.assets.exportHealthcareDatasets` `cloudasset.assets.exportHealthcareDicomStores` `cloudasset.assets.exportHealthcareFhirStores` `cloudasset.assets.exportHealthcareHl7V2Stores` `cloudasset.assets.exportIamRoles` `cloudasset.assets.exportIamServiceAccountKeys` `cloudasset.assets.exportIamServiceAccounts` `cloudasset.assets.exportIdsEndpoints` `cloudasset.assets.exportIntegrationsAuthConfigs` `cloudasset.assets.exportIntegrationsCertificates` `cloudasset.assets.exportIntegrationsExecutions` `cloudasset.assets.exportIntegrationsIntegrationVersions` `cloudasset.assets.exportIntegrationsIntegrations` `cloudasset.assets.exportIntegrationsSfdcChannels` `cloudasset.assets.exportIntegrationsSfdcInstances` `cloudasset.assets.exportIntegrationsSuspensions` `cloudasset.assets.exportManagedidentitiesDomain` `cloudasset.assets.exportMetastoreBackups` `cloudasset.assets.exportMetastoreMetadataImports` `cloudasset.assets.exportMetastoreServices` `cloudasset.assets.exportMonitoringAlertPolicies` `cloudasset.assets.exportNetworkConnectivityHubs` `cloudasset.assets.exportNetworkConnectivitySpokes` `cloudasset.assets.exportNetworkManagementConnectivityTests` `cloudasset.assets.exportNetworkServicesEndpointPolicies` `cloudasset.assets.exportNetworkServicesGateways` `cloudasset.assets.exportNetworkServicesGrpcRoutes` `cloudasset.assets.exportNetworkServicesHttpRoutes` `cloudasset.assets.exportNetworkServicesMeshes` `cloudasset.assets.exportNetworkServicesServiceBindings` `cloudasset.assets.exportNetworkServicesTcpRoutes` `cloudasset.assets.exportNetworkServicesTlsRoutes` `cloudasset.assets.exportOSConfigOSPolicyAssignmentReports` `cloudasset.assets.exportOSConfigOSPolicyAssignments` `cloudasset.assets.exportOSConfigVulnerabilityReports` `cloudasset.assets.exportPatchDeployments` `cloudasset.assets.exportPubsubSnapshots` `cloudasset.assets.exportPubsubSubscriptions` `cloudasset.assets.exportPubsubTopics` `cloudasset.assets.exportRedisInstances` `cloudasset.assets.exportServiceDirectoryNamespaces` `cloudasset.assets.exportServicePerimeter` `cloudasset.assets.exportServiceconsumermanagementConsumerProperty` `cloudasset.assets.exportServiceconsumermanagementConsumerQuotaLimits` `cloudasset.assets.exportServiceconsumermanagementConsumers` `cloudasset.assets.exportServiceconsumermanagementProducerOverrides` `cloudasset.assets.exportServiceconsumermanagementTenancyUnits` `cloudasset.assets.exportServiceconsumermanagementVisibility` `cloudasset.assets.exportServicemanagementServices` `cloudasset.assets.exportServiceusageAdminOverrides` `cloudasset.assets.exportServiceusageConsumerOverrides` `cloudasset.assets.exportServiceusageServices` `cloudasset.assets.exportSpannerBackups` `cloudasset.assets.exportSpannerDatabases` `cloudasset.assets.exportSpannerInstances` `cloudasset.assets.exportSpeakerIdPhrases` `cloudasset.assets.exportSpeakerIdSettings` `cloudasset.assets.exportSpeakerIdSpeakers` `cloudasset.assets.exportSpeechCustomClasses` `cloudasset.assets.exportSpeechPhraseSets` `cloudasset.assets.exportSqladminBackupRuns` `cloudasset.assets.exportSqladminInstances` `cloudasset.assets.exportStorageBuckets` `cloudasset.assets.exportTpuNodes` `cloudasset.assets.exportVpcaccessConnector` `cloudasset.assets.listAccessLevel` `cloudasset.assets.listAiplatformBatchPredictionJobs` `cloudasset.assets.listAiplatformCustomJobs` `cloudasset.assets.listAiplatformDataLabelingJobs` `cloudasset.assets.listAiplatformDatasets` `cloudasset.assets.listAiplatformEndpoints` `cloudasset.assets.listAiplatformHyperparameterTuningJobs` `cloudasset.assets.listAiplatformMetadataStores` `cloudasset.assets.listAiplatformModelDeploymentMonitoringJobs` `cloudasset.assets.listAiplatformModels` `cloudasset.assets.listAiplatformPipelineJobs` `cloudasset.assets.listAiplatformSpecialistPools` `cloudasset.assets.listAiplatformTrainingPipelines` `cloudasset.assets.listAllAccessPolicy` `cloudasset.assets.listAnthosConnectedCluster` `cloudasset.assets.listAnthosedgeCluster` `cloudasset.assets.listApigatewayApi` `cloudasset.assets.listApigatewayApiConfig` `cloudasset.assets.listApigatewayGateway` `cloudasset.assets.listApikeysKeys` `cloudasset.assets.listAppengineApplications` `cloudasset.assets.listAppengineServices` `cloudasset.assets.listAppengineVersions` `cloudasset.assets.listArtifactregistryDockerImages` `cloudasset.assets.listArtifactregistryRepositories` `cloudasset.assets.listAssuredWorkloadsWorkloads` `cloudasset.assets.listBeyondCorpApiGateways` `cloudasset.assets.listBeyondCorpAppConnections` `cloudasset.assets.listBeyondCorpAppConnectors` `cloudasset.assets.listBeyondCorpClientConnectorServices` `cloudasset.assets.listBeyondCorpClientGateways` `cloudasset.assets.listBigqueryDatasets` `cloudasset.assets.listBigqueryModels` `cloudasset.assets.listBigqueryTables` `cloudasset.assets.listBigtableAppProfile` `cloudasset.assets.listBigtableBackup` `cloudasset.assets.listBigtableCluster` `cloudasset.assets.listBigtableInstance` `cloudasset.assets.listBigtableTable` `cloudasset.assets.listCloudAssetFeeds` `cloudasset.assets.listCloudDeployDeliveryPipelines` `cloudasset.assets.listCloudDeployReleases` `cloudasset.assets.listCloudDeployRollouts` `cloudasset.assets.listCloudDeployTargets` `cloudasset.assets.listCloudDocumentAIEvaluation` `cloudasset.assets.listCloudDocumentAIHumanReviewConfig` `cloudasset.assets.listCloudDocumentAILabelerPool` `cloudasset.assets.listCloudDocumentAIProcessor` `cloudasset.assets.listCloudDocumentAIProcessorVersion` `cloudasset.assets.listCloudbillingBillingAccounts` `cloudasset.assets.listCloudbillingProjectBillingInfos` `cloudasset.assets.listCloudfunctionsFunctions` `cloudasset.assets.listCloudfunctionsGen2Functions` `cloudasset.assets.listCloudkmsCryptoKeyVersions` `cloudasset.assets.listCloudkmsEkmConnections` `cloudasset.assets.listCloudkmsImportJobs` `cloudasset.assets.listCloudkmsKeyRings` `cloudasset.assets.listCloudmemcacheInstances` `cloudasset.assets.listCloudresourcemanagerFolders` `cloudasset.assets.listCloudresourcemanagerOrganizations` `cloudasset.assets.listCloudresourcemanagerProjects` `cloudasset.assets.listCloudresourcemanagerTagBindings` `cloudasset.assets.listCloudresourcemanagerTagKeys` `cloudasset.assets.listCloudresourcemanagerTagValues` `cloudasset.assets.listComposerEnvironments` `cloudasset.assets.listComputeAddress` `cloudasset.assets.listComputeAutoscalers` `cloudasset.assets.listComputeBackendBuckets` `cloudasset.assets.listComputeBackendServices` `cloudasset.assets.listComputeCommitments` `cloudasset.assets.listComputeDisks` `cloudasset.assets.listComputeExternalVpnGateways` `cloudasset.assets.listComputeFirewallPolicies` `cloudasset.assets.listComputeFirewalls` `cloudasset.assets.listComputeForwardingRules` `cloudasset.assets.listComputeGlobalAddress` `cloudasset.assets.listComputeGlobalForwardingRules` `cloudasset.assets.listComputeHealthChecks` `cloudasset.assets.listComputeHttpHealthChecks` `cloudasset.assets.listComputeHttpsHealthChecks` `cloudasset.assets.listComputeImages` `cloudasset.assets.listComputeInstanceGroupManagers` `cloudasset.assets.listComputeInstanceGroups` `cloudasset.assets.listComputeInstanceTemplates` `cloudasset.assets.listComputeInstances` `cloudasset.assets.listComputeInterconnect` `cloudasset.assets.listComputeInterconnectAttachment` `cloudasset.assets.listComputeLicenses` `cloudasset.assets.listComputeNetworkEndpointGroups` `cloudasset.assets.listComputeNetworks` `cloudasset.assets.listComputeNodeGroups` `cloudasset.assets.listComputeNodeTemplates` `cloudasset.assets.listComputePacketMirrorings` `cloudasset.assets.listComputeProjects` `cloudasset.assets.listComputeRegionAutoscaler` `cloudasset.assets.listComputeRegionBackendServices` `cloudasset.assets.listComputeRegionDisk` `cloudasset.assets.listComputeRegionInstanceGroup` `cloudasset.assets.listComputeRegionInstanceGroupManager` `cloudasset.assets.listComputeReservations` `cloudasset.assets.listComputeResourcePolicies` `cloudasset.assets.listComputeRouters` `cloudasset.assets.listComputeRoutes` `cloudasset.assets.listComputeSecurityPolicy` `cloudasset.assets.listComputeServiceAttachments` `cloudasset.assets.listComputeSnapshots` `cloudasset.assets.listComputeSslCertificates` `cloudasset.assets.listComputeSslPolicies` `cloudasset.assets.listComputeSubnetworks` `cloudasset.assets.listComputeTargetHttpProxies` `cloudasset.assets.listComputeTargetHttpsProxies` `cloudasset.assets.listComputeTargetInstances` `cloudasset.assets.listComputeTargetPools` `cloudasset.assets.listComputeTargetSslProxies` `cloudasset.assets.listComputeTargetTcpProxies` `cloudasset.assets.listComputeTargetVpnGateways` `cloudasset.assets.listComputeUrlMaps` `cloudasset.assets.listComputeVpnGateways` `cloudasset.assets.listComputeVpnTunnels` `cloudasset.assets.listConnectorsConnections` `cloudasset.assets.listConnectorsConnectorVersions` `cloudasset.assets.listConnectorsConnectors` `cloudasset.assets.listConnectorsProviders` `cloudasset.assets.listConnectorsRuntimeConfigs` `cloudasset.assets.listContainerAppsDeployment` `cloudasset.assets.listContainerAppsReplicaSets` `cloudasset.assets.listContainerBatchJobs` `cloudasset.assets.listContainerClusterrole` `cloudasset.assets.listContainerClusterrolebinding` `cloudasset.assets.listContainerClusters` `cloudasset.assets.listContainerExtensionsIngresses` `cloudasset.assets.listContainerJobs` `cloudasset.assets.listContainerNamespace` `cloudasset.assets.listContainerNetworkingIngresses` `cloudasset.assets.listContainerNetworkingNetworkPolicies` `cloudasset.assets.listContainerNode` `cloudasset.assets.listContainerNodepool` `cloudasset.assets.listContainerPod` `cloudasset.assets.listContainerReplicaSets` `cloudasset.assets.listContainerRole` `cloudasset.assets.listContainerRolebinding` `cloudasset.assets.listContainerServices` `cloudasset.assets.listContainerregistryImage` `cloudasset.assets.listDataMigrationConnectionProfiles` `cloudasset.assets.listDataMigrationMigrationJobs` `cloudasset.assets.listDataflowJobs` `cloudasset.assets.listDatafusionInstance` `cloudasset.assets.listDataplexAssets` `cloudasset.assets.listDataplexLakes` `cloudasset.assets.listDataplexTasks` `cloudasset.assets.listDataplexZones` `cloudasset.assets.listDataprocAutoscalingPolicies` `cloudasset.assets.listDataprocBatches` `cloudasset.assets.listDataprocClusters` `cloudasset.assets.listDataprocJobs` `cloudasset.assets.listDataprocSessions` `cloudasset.assets.listDataprocWorkflowTemplates` `cloudasset.assets.listDatastreamConnectionProfile` `cloudasset.assets.listDatastreamPrivateConnection` `cloudasset.assets.listDatastreamStream` `cloudasset.assets.listDialogflowAgents` `cloudasset.assets.listDialogflowConversationProfiles` `cloudasset.assets.listDialogflowKnowledgeBases` `cloudasset.assets.listDialogflowLocationSettings` `cloudasset.assets.listDlpDeidentifyTemplates` `cloudasset.assets.listDlpDlpJobs` `cloudasset.assets.listDlpInspectTemplates` `cloudasset.assets.listDlpJobTriggers` `cloudasset.assets.listDlpStoredInfoTypes` `cloudasset.assets.listDnsManagedZones` `cloudasset.assets.listDnsPolicies` `cloudasset.assets.listDomainsRegistrations` `cloudasset.assets.listEventarcTriggers` `cloudasset.assets.listFileBackups` `cloudasset.assets.listFileInstances` `cloudasset.assets.listFirebaseAppInfos` `cloudasset.assets.listFirebaseProjects` `cloudasset.assets.listFirestoreDatabases` `cloudasset.assets.listGKEHubFeatures` `cloudasset.assets.listGKEHubMemberships` `cloudasset.assets.listGameservicesGameServerClusters` `cloudasset.assets.listGameservicesGameServerConfigs` `cloudasset.assets.listGameservicesGameServerDeployments` `cloudasset.assets.listGameservicesRealms` `cloudasset.assets.listGkeBackupBackupPlans` `cloudasset.assets.listGkeBackupBackups` `cloudasset.assets.listGkeBackupRestorePlans` `cloudasset.assets.listGkeBackupRestores` `cloudasset.assets.listGkeBackupVolumeBackups` `cloudasset.assets.listGkeBackupVolumeRestores` `cloudasset.assets.listHealthcareConsentStores` `cloudasset.assets.listHealthcareDatasets` `cloudasset.assets.listHealthcareDicomStores` `cloudasset.assets.listHealthcareFhirStores` `cloudasset.assets.listHealthcareHl7V2Stores` `cloudasset.assets.listIamRoles` `cloudasset.assets.listIamServiceAccountKeys` `cloudasset.assets.listIamServiceAccounts` `cloudasset.assets.listIdsEndpoints` `cloudasset.assets.listIntegrationsAuthConfigs` `cloudasset.assets.listIntegrationsCertificates` `cloudasset.assets.listIntegrationsExecutions` `cloudasset.assets.listIntegrationsIntegrationVersions` `cloudasset.assets.listIntegrationsIntegrations` `cloudasset.assets.listIntegrationsSfdcChannels` `cloudasset.assets.listIntegrationsSfdcInstances` `cloudasset.assets.listIntegrationsSuspensions` `cloudasset.assets.listManagedidentitiesDomain` `cloudasset.assets.listMetastoreBackups` `cloudasset.assets.listMetastoreMetadataImports` `cloudasset.assets.listMetastoreServices` `cloudasset.assets.listMonitoringAlertPolicies` `cloudasset.assets.listNetworkConnectivityHubs` `cloudasset.assets.listNetworkConnectivitySpokes` `cloudasset.assets.listNetworkManagementConnectivityTests` `cloudasset.assets.listNetworkServicesEndpointPolicies` `cloudasset.assets.listNetworkServicesGateways` `cloudasset.assets.listNetworkServicesGrpcRoutes` `cloudasset.assets.listNetworkServicesHttpRoutes` `cloudasset.assets.listNetworkServicesMeshes` `cloudasset.assets.listNetworkServicesServiceBindings` `cloudasset.assets.listNetworkServicesTcpRoutes` `cloudasset.assets.listNetworkServicesTlsRoutes` `cloudasset.assets.listOSConfigOSPolicyAssignmentReports` `cloudasset.assets.listOSConfigOSPolicyAssignments` `cloudasset.assets.listOSConfigVulnerabilityReports` `cloudasset.assets.listPatchDeployments` `cloudasset.assets.listPubsubSnapshots` `cloudasset.assets.listPubsubSubscriptions` `cloudasset.assets.listPubsubTopics` `cloudasset.assets.listRedisInstances` `cloudasset.assets.listRunDomainMapping` `cloudasset.assets.listRunRevision` `cloudasset.assets.listRunService` `cloudasset.assets.listServiceDirectoryNamespaces` `cloudasset.assets.listServicePerimeter` `cloudasset.assets.listServiceconsumermanagementConsumerProperty` `cloudasset.assets.listServiceconsumermanagementConsumerQuotaLimits` `cloudasset.assets.listServiceconsumermanagementConsumers` `cloudasset.assets.listServiceconsumermanagementProducerOverrides` `cloudasset.assets.listServiceconsumermanagementTenancyUnits` `cloudasset.assets.listServiceconsumermanagementVisibility` `cloudasset.assets.listServicemanagementServices` `cloudasset.assets.listServiceusageAdminOverrides` `cloudasset.assets.listServiceusageConsumerOverrides` `cloudasset.assets.listServiceusageServices` `cloudasset.assets.listSpannerBackups` `cloudasset.assets.listSpannerDatabases` `cloudasset.assets.listSpannerInstances` `cloudasset.assets.listSpeakerIdPhrases` `cloudasset.assets.listSpeakerIdSettings` `cloudasset.assets.listSpeakerIdSpeakers` `cloudasset.assets.listSpeechCustomClasses` `cloudasset.assets.listSpeechPhraseSets` `cloudasset.assets.listSqladminBackupRuns` `cloudasset.assets.listSqladminInstances` `cloudasset.assets.listStorageBuckets` `cloudasset.assets.listTpuNodes` `cloudasset.assets.listVpcaccessConnector`
Compute Engine	Added	`compute.serviceAttachments.getIamPolicy` `compute.serviceAttachments.setIamPolicy` `compute.serviceAttachments.use`
Compute Engine	Supported In Custom Roles	`compute.serviceAttachments.getIamPolicy` `compute.serviceAttachments.setIamPolicy` `compute.serviceAttachments.use`
Looker Studio	Added	`datastudio.datasources.delete` `datastudio.datasources.get` `datastudio.datasources.getIamPolicy` `datastudio.datasources.move` `datastudio.datasources.restoreTrash` `datastudio.datasources.search` `datastudio.datasources.setIamPolicy` `datastudio.datasources.settingsShare` `datastudio.datasources.share` `datastudio.datasources.trash` `datastudio.datasources.update` `datastudio.reports.delete` `datastudio.reports.get` `datastudio.reports.getIamPolicy` `datastudio.reports.move` `datastudio.reports.restoreTrash` `datastudio.reports.search` `datastudio.reports.setIamPolicy` `datastudio.reports.settingsShare` `datastudio.reports.share` `datastudio.reports.trash` `datastudio.reports.update` `datastudio.workspaces.createUnder` `datastudio.workspaces.delete` `datastudio.workspaces.get` `datastudio.workspaces.getIamPolicy` `datastudio.workspaces.moveIn` `datastudio.workspaces.moveOut` `datastudio.workspaces.restoreTrash` `datastudio.workspaces.search` `datastudio.workspaces.setIamPolicy` `datastudio.workspaces.trash` `datastudio.workspaces.update`
Enterprise Knowledge Graph	Added	`enterpriseknowledgegraph.entityReconciliationJobs.cancel` `enterpriseknowledgegraph.entityReconciliationJobs.create` `enterpriseknowledgegraph.entityReconciliationJobs.delete` `enterpriseknowledgegraph.entityReconciliationJobs.get` `enterpriseknowledgegraph.entityReconciliationJobs.list`
Enterprise Knowledge Graph	Supported In Custom Roles	`enterpriseknowledgegraph.entityReconciliationJobs.delete`
Google Distributed Cloud	Added	`gkeonprem.bareMetalClusters.queryVersionConfig` `gkeonprem.vmwareClusters.queryVersionConfig`
Google Distributed Cloud	Supported In Custom Roles	`gkeonprem.bareMetalClusters.queryVersionConfig` `gkeonprem.vmwareClusters.queryVersionConfig`
Google Distributed Cloud	Now GA	`gkeonprem.bareMetalClusters.queryVersionConfig` `gkeonprem.vmwareClusters.queryVersionConfig`
Managed Service for Microsoft Active Directory	Added	`managedidentities.domains.checkMigrationPermission` `managedidentities.domains.disableMigration` `managedidentities.domains.enableMigration`
Dataproc Metastore	Added	`metastore.backups.getIamPolicy` `metastore.backups.setIamPolicy`
Dataproc Metastore	Supported In Custom Roles	`metastore.backups.getIamPolicy` `metastore.backups.setIamPolicy`
Dataproc Metastore	Now GA	`metastore.backups.getIamPolicy` `metastore.backups.setIamPolicy`
Public Certificate Authority	Added	`publicca.externalAccountKeys.create`
Recommender	Added	`recommender.computeFirewallInsightTypeConfigs.get` `recommender.computeFirewallInsightTypeConfigs.update` `recommender.gmpGuidedExperienceInsights.get` `recommender.gmpGuidedExperienceInsights.list` `recommender.gmpGuidedExperienceInsights.update` `recommender.gmpGuidedExperienceRecommendations.get` `recommender.gmpGuidedExperienceRecommendations.list` `recommender.gmpGuidedExperienceRecommendations.update`
Recommender	Supported In Custom Roles	`recommender.computeFirewallInsightTypeConfigs.get` `recommender.computeFirewallInsightTypeConfigs.update` `recommender.gmpGuidedExperienceInsights.get` `recommender.gmpGuidedExperienceInsights.list` `recommender.gmpGuidedExperienceInsights.update` `recommender.gmpGuidedExperienceRecommendations.get` `recommender.gmpGuidedExperienceRecommendations.list` `recommender.gmpGuidedExperienceRecommendations.update`
Recommender	Now GA	`recommender.computeFirewallInsightTypeConfigs.get` `recommender.computeFirewallInsightTypeConfigs.update` `recommender.gmpGuidedExperienceInsights.get` `recommender.gmpGuidedExperienceInsights.list` `recommender.gmpGuidedExperienceInsights.update` `recommender.gmpGuidedExperienceRecommendations.get` `recommender.gmpGuidedExperienceRecommendations.list` `recommender.gmpGuidedExperienceRecommendations.update`
Service Networking	Added	`servicenetworking.services.addDnsRecordSet` `servicenetworking.services.addDnsZone` `servicenetworking.services.deleteConnection` `servicenetworking.services.disableVpcServiceControls` `servicenetworking.services.enableVpcServiceControls` `servicenetworking.services.getConsumerConfig` `servicenetworking.services.removeDnsRecordSet` `servicenetworking.services.removeDnsZone` `servicenetworking.services.updateConsumerConfig` `servicenetworking.services.updateDnsRecordSet`
Service Networking	Supported In Custom Roles	`servicenetworking.services.addDnsRecordSet` `servicenetworking.services.addDnsZone` `servicenetworking.services.deleteConnection` `servicenetworking.services.disableVpcServiceControls` `servicenetworking.services.enableVpcServiceControls` `servicenetworking.services.getConsumerConfig` `servicenetworking.services.removeDnsRecordSet` `servicenetworking.services.removeDnsZone` `servicenetworking.services.updateConsumerConfig` `servicenetworking.services.updateDnsRecordSet`
Spanner	Added	`spanner.instanceConfigOperations.cancel` `spanner.instanceConfigOperations.delete` `spanner.instanceConfigOperations.get` `spanner.instanceConfigOperations.list` `spanner.instanceConfigs.create` `spanner.instanceConfigs.delete` `spanner.instanceConfigs.update`
Spanner	Supported In Custom Roles	`spanner.instanceConfigOperations.cancel` `spanner.instanceConfigOperations.delete` `spanner.instanceConfigOperations.get` `spanner.instanceConfigOperations.list` `spanner.instanceConfigs.create` `spanner.instanceConfigs.delete` `spanner.instanceConfigs.update`
Spanner	Now GA	`spanner.instanceConfigOperations.cancel` `spanner.instanceConfigOperations.delete` `spanner.instanceConfigOperations.get` `spanner.instanceConfigOperations.list` `spanner.instanceConfigs.create` `spanner.instanceConfigs.delete` `spanner.instanceConfigs.update`
Video Stitcher API	Now GA	`videostitcher.cdnKeys.create` `videostitcher.cdnKeys.delete` `videostitcher.cdnKeys.get` `videostitcher.cdnKeys.list` `videostitcher.cdnKeys.update` `videostitcher.liveAdTagDetails.get` `videostitcher.liveAdTagDetails.list` `videostitcher.liveSessions.create` `videostitcher.liveSessions.get` `videostitcher.slates.create` `videostitcher.slates.delete` `videostitcher.slates.get` `videostitcher.slates.list` `videostitcher.slates.update` `videostitcher.vodAdTagDetails.get` `videostitcher.vodAdTagDetails.list` `videostitcher.vodSessions.create` `videostitcher.vodSessions.get` `videostitcher.vodStitchDetails.get` `videostitcher.vodStitchDetails.list`
Vision AI	Added	`visionai.analyses.create` `visionai.analyses.delete` `visionai.analyses.get` `visionai.analyses.getIamPolicy` `visionai.analyses.list` `visionai.analyses.setIamPolicy` `visionai.analyses.update` `visionai.annotations.create` `visionai.annotations.delete` `visionai.annotations.get` `visionai.annotations.list` `visionai.annotations.update` `visionai.applications.create` `visionai.applications.delete` `visionai.applications.deploy` `visionai.applications.get` `visionai.applications.list` `visionai.applications.undeploy` `visionai.applications.update` `visionai.assets.clip` `visionai.assets.create` `visionai.assets.delete` `visionai.assets.generateHlsUri` `visionai.assets.get` `visionai.assets.ingest` `visionai.assets.list` `visionai.assets.search` `visionai.assets.update` `visionai.clusters.create` `visionai.clusters.delete` `visionai.clusters.get` `visionai.clusters.getIamPolicy` `visionai.clusters.list` `visionai.clusters.setIamPolicy` `visionai.clusters.update` `visionai.clusters.watch` `visionai.corpora.create` `visionai.corpora.delete` `visionai.corpora.get` `visionai.corpora.list` `visionai.corpora.update` `visionai.dataSchemas.create` `visionai.dataSchemas.delete` `visionai.dataSchemas.get` `visionai.dataSchemas.list` `visionai.dataSchemas.update` `visionai.dataSchemas.validate` `visionai.drafts.create` `visionai.drafts.delete` `visionai.drafts.get` `visionai.drafts.list` `visionai.drafts.update` `visionai.events.create` `visionai.events.delete` `visionai.events.get` `visionai.events.getIamPolicy` `visionai.events.list` `visionai.events.setIamPolicy` `visionai.events.update` `visionai.instances.get` `visionai.instances.list` `visionai.locations.get` `visionai.locations.list` `visionai.operations.cancel` `visionai.operations.delete` `visionai.operations.get` `visionai.operations.list` `visionai.operations.wait` `visionai.operators.create` `visionai.operators.delete` `visionai.operators.get` `visionai.operators.getIamPolicy` `visionai.operators.list` `visionai.operators.setIamPolicy` `visionai.operators.update` `visionai.processors.create` `visionai.processors.delete` `visionai.processors.get` `visionai.processors.list` `visionai.processors.listPrebuilt` `visionai.processors.update` `visionai.searchConfigs.create` `visionai.searchConfigs.delete` `visionai.searchConfigs.get` `visionai.searchConfigs.list` `visionai.searchConfigs.update` `visionai.series.acquireLease` `visionai.series.create` `visionai.series.delete` `visionai.series.get` `visionai.series.getIamPolicy` `visionai.series.list` `visionai.series.receive` `visionai.series.releaseLease` `visionai.series.renewLease` `visionai.series.send` `visionai.series.setIamPolicy` `visionai.series.update` `visionai.streams.create` `visionai.streams.delete` `visionai.streams.get` `visionai.streams.getIamPolicy` `visionai.streams.list` `visionai.streams.receive` `visionai.streams.send` `visionai.streams.setIamPolicy` `visionai.streams.update`
Vision AI	Supported In Custom Roles	`visionai.analyses.create` `visionai.analyses.delete` `visionai.analyses.get` `visionai.analyses.getIamPolicy` `visionai.analyses.list` `visionai.analyses.setIamPolicy` `visionai.analyses.update` `visionai.applications.create` `visionai.applications.delete` `visionai.applications.deploy` `visionai.applications.get` `visionai.applications.list` `visionai.applications.undeploy` `visionai.applications.update` `visionai.clusters.create` `visionai.clusters.delete` `visionai.clusters.get` `visionai.clusters.getIamPolicy` `visionai.clusters.list` `visionai.clusters.setIamPolicy` `visionai.clusters.update` `visionai.drafts.create` `visionai.drafts.delete` `visionai.drafts.get` `visionai.drafts.list` `visionai.drafts.update` `visionai.events.create` `visionai.events.delete` `visionai.events.get` `visionai.events.getIamPolicy` `visionai.events.list` `visionai.events.setIamPolicy` `visionai.events.update` `visionai.instances.get` `visionai.instances.list` `visionai.locations.get` `visionai.locations.list` `visionai.operators.create` `visionai.operators.delete` `visionai.operators.get` `visionai.operators.getIamPolicy` `visionai.operators.list` `visionai.operators.setIamPolicy` `visionai.operators.update` `visionai.processors.create` `visionai.processors.delete` `visionai.processors.get` `visionai.processors.list` `visionai.processors.listPrebuilt` `visionai.processors.update` `visionai.series.create` `visionai.series.delete` `visionai.series.get` `visionai.series.getIamPolicy` `visionai.series.list` `visionai.series.setIamPolicy` `visionai.series.update` `visionai.streams.create` `visionai.streams.delete` `visionai.streams.get` `visionai.streams.getIamPolicy` `visionai.streams.list` `visionai.streams.setIamPolicy` `visionai.streams.update`

Cloud IAM changes as of 2022-09-23

Service	Change	Description
Bare Metal Solution	Now GA	The role `roles/baremetalsolution.volumesnapshotsadmin` (Snapshots Admin) is now GA.
Bare Metal Solution	Now GA	The role `roles/baremetalsolution.volumesnapshotseditor` (Snapshots Editor) is now GA.
Bare Metal Solution	Now GA	The role `roles/baremetalsolution.volumesnapshotsviewer` (Snapshots Viewer) is now GA.
Content Warehouse	Now GA	The role `roles/contentwarehouse.admin` (Content Warehouse Admin) is now GA.
Content Warehouse	Now GA	The role `roles/contentwarehouse.documentAdmin` (Content Warehouse Document Admin) is now GA.
Content Warehouse	Now GA	The role `roles/contentwarehouse.documentCreator` (Content Warehouse document creator) is now GA.
Content Warehouse	Now GA	The role `roles/contentwarehouse.documentEditor` (Content Warehouse Document Editor) is now GA.
Content Warehouse	Now GA	The role `roles/contentwarehouse.documentSchemaViewer` (Content Warehouse document schema viewer) is now GA.
Content Warehouse	Now GA	The role `roles/contentwarehouse.documentViewer` (Content Warehouse Viewer) is now GA.
Basic Role	Role Updated	The following permissions have been removed from the role `roles/editor` (Editor): `workstations.workstations.use`
Multi-Cluster Ingress	Role Updated	The following permissions have been added to the role `roles/multiclusteringress.serviceAgent` (Multi Cluster Ingress Service Agent): `serviceusage.services.use`
Basic Role	Role Updated	The following permissions have been removed from the role `roles/owner` (Owner): `workstations.workstations.use`
Cloud Workstations	Role Updated	The following permissions have been removed from the role `roles/workstations.admin` (Cloud Workstations Admin): `workstations.workstations.use`
Bare Metal Solution	Added	`baremetalsolution.nfsshares.create` `baremetalsolution.nfsshares.delete`
Bare Metal Solution	Supported In Custom Roles	`baremetalsolution.nfsshares.create` `baremetalsolution.nfsshares.delete`
Bare Metal Solution	Now GA	`baremetalsolution.nfsshares.create` `baremetalsolution.nfsshares.delete`
Compute Engine	Added	`compute.networkEdgeSecurityServices.create` `compute.networkEdgeSecurityServices.delete` `compute.networkEdgeSecurityServices.get` `compute.networkEdgeSecurityServices.list` `compute.networkEdgeSecurityServices.update` `compute.regionSecurityPolicies.create` `compute.regionSecurityPolicies.delete` `compute.regionSecurityPolicies.get` `compute.regionSecurityPolicies.list` `compute.regionSecurityPolicies.update` `compute.regionSecurityPolicies.use` `compute.securityPolicies.setLabels`
Compute Engine	Supported In Custom Roles	`compute.securityPolicies.setLabels`
Compute Engine	Now GA	`compute.disks.listEffectiveTags` `compute.images.listEffectiveTags` `compute.instances.listEffectiveTags` `compute.securityPolicies.setLabels` `compute.snapshots.listEffectiveTags`
Container Security	Added	`containersecurity.findings.list`
Content Warehouse	Now GA	`contentwarehouse.documentSchemas.create` `contentwarehouse.documentSchemas.delete` `contentwarehouse.documentSchemas.get` `contentwarehouse.documentSchemas.list` `contentwarehouse.documentSchemas.update` `contentwarehouse.documents.create` `contentwarehouse.documents.delete` `contentwarehouse.documents.get` `contentwarehouse.documents.getIamPolicy` `contentwarehouse.documents.setIamPolicy` `contentwarehouse.documents.update` `contentwarehouse.locations.initialize` `contentwarehouse.operations.get` `contentwarehouse.rawDocuments.download` `contentwarehouse.rawDocuments.upload` `contentwarehouse.ruleSets.create` `contentwarehouse.ruleSets.delete` `contentwarehouse.ruleSets.get` `contentwarehouse.ruleSets.list` `contentwarehouse.ruleSets.update` `contentwarehouse.synonymSets.create` `contentwarehouse.synonymSets.delete` `contentwarehouse.synonymSets.get` `contentwarehouse.synonymSets.list` `contentwarehouse.synonymSets.update`
Document AI	Added	`documentai.evaluationDocuments.get`
Managed Service for Microsoft Active Directory	Now GA	`managedidentities.domains.extendSchema`
Organization Policy Service	Added	`orgpolicy.customConstraints.create` `orgpolicy.customConstraints.delete` `orgpolicy.customConstraints.get` `orgpolicy.customConstraints.list` `orgpolicy.customConstraints.update`
Organization Policy Service	Supported In Custom Roles	`orgpolicy.customConstraints.get` `orgpolicy.customConstraints.list`
Recommender	Added	`recommender.resourcemanagerProjectUtilizationInsightTypeConfigs.get` `recommender.resourcemanagerProjectUtilizationInsightTypeConfigs.update` `recommender.resourcemanagerProjectUtilizationRecommenderConfigs.get` `recommender.resourcemanagerProjectUtilizationRecommenderConfigs.update`
Recommender	Supported In Custom Roles	`recommender.resourcemanagerProjectUtilizationInsightTypeConfigs.get` `recommender.resourcemanagerProjectUtilizationInsightTypeConfigs.update` `recommender.resourcemanagerProjectUtilizationRecommenderConfigs.get` `recommender.resourcemanagerProjectUtilizationRecommenderConfigs.update`
Resource Manager	Now GA	`resourcemanager.hierarchyNodes.listEffectiveTags`

Cloud IAM changes as of 2022-09-10

Service	Change	Description
Apigee	Role Updated	The following permissions have been added to the role `roles/apigee.serviceAgent` (Apigee Service Agent): `apigee.developers.delete`
Dialogflow	Role Updated	The following permissions have been added to the role `roles/dialogflow.serviceAgent` (Dialogflow Service Agent): `bigquery.tables.get` `bigquery.tables.updateData`
GKE Hub	Role Updated	The following permissions have been added to the role `roles/gkehub.serviceAgent` (GKE Hub Service Agent): `monitoring.metricsScopes.link` `resourcemanager.projects.get` `resourcemanager.projects.list`
Cloud Monitoring	Role Updated	The following permissions have been added to the role `roles/monitoring.notificationServiceAgent` (Monitoring Service Agent): `monitoring.metricDescriptors.get` `monitoring.metricDescriptors.list` `monitoring.monitoredResourceDescriptors.get` `monitoring.monitoredResourceDescriptors.list`
Storage Transfer Service	Now GA	The role `roles/storagetransfer.serviceAgent` (Storage Transfer Service Agent) is now GA.
Access Approval	Added	`accessapproval.serviceAccounts.get`
Document AI	Added	`documentai.dataLabelingJobs.cancel` `documentai.dataLabelingJobs.create` `documentai.dataLabelingJobs.delete` `documentai.dataLabelingJobs.list` `documentai.dataLabelingJobs.update` `documentai.datasets.createDocuments` `documentai.datasets.deleteDocuments` `documentai.datasets.getDocuments` `documentai.datasets.listDocuments` `documentai.datasets.updateDocuments`
Notebooks	Added	`notebooks.instances.diagnose` `notebooks.runtimes.diagnose`
Notebooks	Now GA	`notebooks.instances.diagnose` `notebooks.runtimes.diagnose`
Recommender	Added	`recommender.networkAnalyzerCloudSqlInsights.get` `recommender.networkAnalyzerCloudSqlInsights.list` `recommender.networkAnalyzerCloudSqlInsights.update` `recommender.networkAnalyzerDynamicRouteInsights.get` `recommender.networkAnalyzerDynamicRouteInsights.list` `recommender.networkAnalyzerDynamicRouteInsights.update` `recommender.networkAnalyzerGkeConnectivityInsights.get` `recommender.networkAnalyzerGkeConnectivityInsights.list` `recommender.networkAnalyzerGkeConnectivityInsights.update` `recommender.networkAnalyzerGkeIpAddressInsights.get` `recommender.networkAnalyzerGkeIpAddressInsights.list` `recommender.networkAnalyzerGkeIpAddressInsights.update` `recommender.networkAnalyzerIpAddressInsights.get` `recommender.networkAnalyzerIpAddressInsights.list` `recommender.networkAnalyzerIpAddressInsights.update` `recommender.networkAnalyzerLoadBalancerInsights.get` `recommender.networkAnalyzerLoadBalancerInsights.list` `recommender.networkAnalyzerLoadBalancerInsights.update` `recommender.networkAnalyzerVpcConnectivityInsights.get` `recommender.networkAnalyzerVpcConnectivityInsights.list` `recommender.networkAnalyzerVpcConnectivityInsights.update`
Recommender	Supported In Custom Roles	`recommender.networkAnalyzerCloudSqlInsights.get` `recommender.networkAnalyzerCloudSqlInsights.list` `recommender.networkAnalyzerCloudSqlInsights.update` `recommender.networkAnalyzerDynamicRouteInsights.get` `recommender.networkAnalyzerDynamicRouteInsights.list` `recommender.networkAnalyzerDynamicRouteInsights.update` `recommender.networkAnalyzerGkeConnectivityInsights.get` `recommender.networkAnalyzerGkeConnectivityInsights.list` `recommender.networkAnalyzerGkeConnectivityInsights.update` `recommender.networkAnalyzerGkeIpAddressInsights.get` `recommender.networkAnalyzerGkeIpAddressInsights.list` `recommender.networkAnalyzerGkeIpAddressInsights.update` `recommender.networkAnalyzerIpAddressInsights.get` `recommender.networkAnalyzerIpAddressInsights.list` `recommender.networkAnalyzerIpAddressInsights.update` `recommender.networkAnalyzerLoadBalancerInsights.get` `recommender.networkAnalyzerLoadBalancerInsights.list` `recommender.networkAnalyzerLoadBalancerInsights.update` `recommender.networkAnalyzerVpcConnectivityInsights.get` `recommender.networkAnalyzerVpcConnectivityInsights.list` `recommender.networkAnalyzerVpcConnectivityInsights.update`

Cloud IAM changes as of 2022-09-02

Service	Change	Description
Compute Engine	Role Updated	The following permissions have been added to the role `roles/compute.securityAdmin` (Compute Security Admin): `compute.backendBuckets.list` `compute.backendServices.list` `compute.instances.list` `compute.regionBackendServices.list` `compute.targetInstances.list` `compute.targetPools.list`
Dataplex	Role Updated	The following permissions have been added to the role `roles/dataplex.serviceAgent` (Cloud Dataplex Service Agent): `dataplex.environments.execute`
Basic Role	Role Updated	The following permissions have been added to the role `roles/editor` (Editor): `batch.jobs.create`
Firebase App Distribution	Now GA	The role `roles/firebaseappdistro.admin` (Firebase App Distribution Admin) is now GA.
Firebase App Distribution	Now GA	The role `roles/firebaseappdistro.viewer` (Firebase App Distribution Viewer) is now GA.
Google Distributed Cloud	Now GA	The role `roles/gkeonprem.admin` (GKE on-prem Admin) is now GA.
Google Distributed Cloud	Now GA	The role `roles/gkeonprem.viewer` (GKE on-prem Viewer) is now GA.
Rapid Migration Assessment	Now GA	The role `roles/rapidmigrationassessment.serviceAgent` (RMA Service Agent) is now GA.
Spanner	Now GA	The role `roles/spanner.databaseRoleUser` (Cloud Spanner Database Role User) is now GA.
Spanner	Now GA	The role `roles/spanner.fineGrainedAccessUser` (Cloud Spanner Fine-grained Access User) is now GA.
Stream	Now GA	The role `roles/stream.admin` (Stream Admin) is now GA.
Stream	Now GA	The role `roles/stream.contentAdmin` (Stream Content Admin) is now GA.
Stream	Now GA	The role `roles/stream.contentBuilder` (Stream Content Builder) is now GA.
Stream	Now GA	The role `roles/stream.instanceAdmin` (Stream Instance Admin) is now GA.
Stream	Now GA	The role `roles/stream.viewer` (Stream Viewer) is now GA.
Data Catalog	Added	`datacatalog.entries.updateContacts` `datacatalog.entries.updateOverview`
Data Catalog	Supported In Custom Roles	`datacatalog.entries.updateContacts` `datacatalog.entries.updateOverview`
Firebase App Distribution	Now GA	`firebaseappdistro.groups.list` `firebaseappdistro.groups.update` `firebaseappdistro.releases.list` `firebaseappdistro.releases.update` `firebaseappdistro.testers.list` `firebaseappdistro.testers.update`
Google Distributed Cloud	Now GA	`gkeonprem.bareMetalClusters.create` `gkeonprem.bareMetalClusters.delete` `gkeonprem.bareMetalClusters.enroll` `gkeonprem.bareMetalClusters.get` `gkeonprem.bareMetalClusters.getIamPolicy` `gkeonprem.bareMetalClusters.list` `gkeonprem.bareMetalClusters.setIamPolicy` `gkeonprem.bareMetalClusters.unenroll` `gkeonprem.bareMetalClusters.update` `gkeonprem.bareMetalNodePools.create` `gkeonprem.bareMetalNodePools.delete` `gkeonprem.bareMetalNodePools.get` `gkeonprem.bareMetalNodePools.getIamPolicy` `gkeonprem.bareMetalNodePools.list` `gkeonprem.bareMetalNodePools.setIamPolicy` `gkeonprem.bareMetalNodePools.update` `gkeonprem.locations.get` `gkeonprem.locations.list` `gkeonprem.operations.cancel` `gkeonprem.operations.delete` `gkeonprem.operations.get` `gkeonprem.operations.list` `gkeonprem.vmwareClusters.create` `gkeonprem.vmwareClusters.delete` `gkeonprem.vmwareClusters.enroll` `gkeonprem.vmwareClusters.get` `gkeonprem.vmwareClusters.getIamPolicy` `gkeonprem.vmwareClusters.list` `gkeonprem.vmwareClusters.setIamPolicy` `gkeonprem.vmwareClusters.unenroll` `gkeonprem.vmwareClusters.update` `gkeonprem.vmwareNodePools.create` `gkeonprem.vmwareNodePools.delete` `gkeonprem.vmwareNodePools.get` `gkeonprem.vmwareNodePools.getIamPolicy` `gkeonprem.vmwareNodePools.list` `gkeonprem.vmwareNodePools.setIamPolicy` `gkeonprem.vmwareNodePools.update`
Payment Gateway issuer switch	Added	`issuerswitch.complaintTransactions.list` `issuerswitch.complaints.create` `issuerswitch.complaints.resolve` `issuerswitch.disputes.create` `issuerswitch.disputes.resolve` `issuerswitch.financialTransactions.list` `issuerswitch.mandateTransactions.list` `issuerswitch.metadataTransactions.list` `issuerswitch.operations.cancel` `issuerswitch.operations.delete` `issuerswitch.operations.get` `issuerswitch.operations.list` `issuerswitch.operations.wait` `issuerswitch.ruleMetadata.list` `issuerswitch.ruleMetadataValues.create` `issuerswitch.ruleMetadataValues.delete` `issuerswitch.ruleMetadataValues.list` `issuerswitch.rules.list`
Recommender	Added	`recommender.cloudsqlInstanceSecurityInsights.get` `recommender.cloudsqlInstanceSecurityInsights.list` `recommender.cloudsqlInstanceSecurityInsights.update` `recommender.cloudsqlInstanceSecurityRecommendations.get` `recommender.cloudsqlInstanceSecurityRecommendations.list` `recommender.cloudsqlInstanceSecurityRecommendations.update`
Recommender	Supported In Custom Roles	`recommender.cloudsqlInstanceSecurityInsights.get` `recommender.cloudsqlInstanceSecurityInsights.list` `recommender.cloudsqlInstanceSecurityInsights.update` `recommender.cloudsqlInstanceSecurityRecommendations.get` `recommender.cloudsqlInstanceSecurityRecommendations.list` `recommender.cloudsqlInstanceSecurityRecommendations.update`
Rapid Migration Assessment	Added	`rma.annotations.create` `rma.annotations.get` `rma.collectors.create` `rma.collectors.delete` `rma.collectors.get` `rma.collectors.list` `rma.collectors.update` `rma.locations.get` `rma.locations.list` `rma.operations.cancel` `rma.operations.delete` `rma.operations.get` `rma.operations.list`
Rapid Migration Assessment	Supported In Custom Roles	`rma.annotations.create` `rma.annotations.get` `rma.collectors.create` `rma.collectors.delete` `rma.collectors.get` `rma.collectors.list` `rma.collectors.update` `rma.locations.get` `rma.locations.list` `rma.operations.cancel` `rma.operations.delete` `rma.operations.get` `rma.operations.list`
Spanner	Added	`spanner.databaseRoles.list` `spanner.databaseRoles.use` `spanner.databases.useRoleBasedAccess`
Spanner	Now GA	`spanner.databaseRoles.list` `spanner.databaseRoles.use` `spanner.databases.useRoleBasedAccess`
Speech-to-Text	Added	`speech.config.get` `speech.config.update` `speech.customClasses.undelete` `speech.operations.cancel` `speech.operations.delete` `speech.operations.get` `speech.operations.list` `speech.operations.wait` `speech.phraseSets.undelete` `speech.recognizers.create` `speech.recognizers.delete` `speech.recognizers.get` `speech.recognizers.list` `speech.recognizers.recognize` `speech.recognizers.undelete` `speech.recognizers.update`
Speech-to-Text	Now GA	`speech.config.get` `speech.config.update` `speech.customClasses.undelete` `speech.operations.cancel` `speech.operations.delete` `speech.operations.get` `speech.operations.list` `speech.operations.wait` `speech.phraseSets.undelete` `speech.recognizers.create` `speech.recognizers.delete` `speech.recognizers.get` `speech.recognizers.list` `speech.recognizers.recognize` `speech.recognizers.undelete` `speech.recognizers.update`
Stream	Added	`stream.locations.get` `stream.locations.list` `stream.operations.cancel` `stream.operations.delete` `stream.operations.get` `stream.operations.list` `stream.streamContents.build` `stream.streamContents.create` `stream.streamContents.delete` `stream.streamContents.get` `stream.streamContents.list` `stream.streamContents.update` `stream.streamInstances.create` `stream.streamInstances.delete` `stream.streamInstances.get` `stream.streamInstances.list` `stream.streamInstances.rollout` `stream.streamInstances.update`
Stream	Supported In Custom Roles	`stream.locations.get` `stream.locations.list` `stream.operations.cancel` `stream.operations.delete` `stream.operations.get` `stream.operations.list` `stream.streamContents.build` `stream.streamContents.create` `stream.streamContents.delete` `stream.streamContents.get` `stream.streamContents.list` `stream.streamContents.update` `stream.streamInstances.create` `stream.streamInstances.delete` `stream.streamInstances.get` `stream.streamInstances.list` `stream.streamInstances.rollout` `stream.streamInstances.update`
Stream	Now GA	`stream.locations.get` `stream.locations.list` `stream.operations.cancel` `stream.operations.delete` `stream.operations.get` `stream.operations.list` `stream.streamContents.build` `stream.streamContents.create` `stream.streamContents.delete` `stream.streamContents.get` `stream.streamContents.list` `stream.streamContents.update` `stream.streamInstances.create` `stream.streamInstances.delete` `stream.streamInstances.get` `stream.streamInstances.list` `stream.streamInstances.rollout` `stream.streamInstances.update`

Cloud IAM changes as of 2022-08-26

Service	Change	Description
App Engine	Now GA	The role `roles/appengine.memcacheDataAdmin` (App Engine Memcache Data Admin) is now GA.
Container Threat Detection	Role Updated	The following permissions have been added to the role `roles/containerthreatdetection.serviceAgent` (Container Threat Detection Service Agent): `container.clusterRoles.escalate` `container.customResourceDefinitions.create` `container.customResourceDefinitions.delete` `container.customResourceDefinitions.update` `container.roles.bind` `container.roles.create` `container.roles.delete` `container.roles.escalate` `container.roles.update`
Identity and Access Management	Now GA	The role `roles/iam.serviceAccountOpenIdTokenCreator` (Service Account OpenID Connect Identity Token Creator) is now GA.
Cloud Integrations	Role Updated	The following permissions have been added to the role `roles/integrations.serviceAgent` (Integrations Service Agent): `run.jobs.run` `run.routes.invoke`
Workload Manager	Now GA	The role `roles/workloadmanager.serviceAgent` (Workload Manager Service Agent) is now GA.
Firebase In-App Messaging Campaigns	Added	`firebasemessagingcampaigns.campaigns.create` `firebasemessagingcampaigns.campaigns.delete` `firebasemessagingcampaigns.campaigns.get` `firebasemessagingcampaigns.campaigns.list` `firebasemessagingcampaigns.campaigns.start` `firebasemessagingcampaigns.campaigns.stop` `firebasemessagingcampaigns.campaigns.update`
Firebase In-App Messaging Campaigns	Supported In Custom Roles	`firebasemessagingcampaigns.campaigns.create` `firebasemessagingcampaigns.campaigns.delete` `firebasemessagingcampaigns.campaigns.get` `firebasemessagingcampaigns.campaigns.list` `firebasemessagingcampaigns.campaigns.start` `firebasemessagingcampaigns.campaigns.stop` `firebasemessagingcampaigns.campaigns.update`
Cloud Logging	Added	`logging.links.create` `logging.links.delete` `logging.links.get` `logging.links.list`
Recommender	Added	`recommender.cloudsqlInstancePerformanceInsights.get` `recommender.cloudsqlInstancePerformanceInsights.list` `recommender.cloudsqlInstancePerformanceInsights.update` `recommender.cloudsqlInstancePerformanceRecommendations.get` `recommender.cloudsqlInstancePerformanceRecommendations.list` `recommender.cloudsqlInstancePerformanceRecommendations.update`
Recommender	Supported In Custom Roles	`recommender.cloudsqlInstancePerformanceInsights.get` `recommender.cloudsqlInstancePerformanceInsights.list` `recommender.cloudsqlInstancePerformanceInsights.update` `recommender.cloudsqlInstancePerformanceRecommendations.get` `recommender.cloudsqlInstancePerformanceRecommendations.list` `recommender.cloudsqlInstancePerformanceRecommendations.update`
Retail API	Now GA	`retail.controls.create` `retail.controls.delete` `retail.controls.get` `retail.controls.list` `retail.controls.update` `retail.servingConfigs.create` `retail.servingConfigs.delete` `retail.servingConfigs.get` `retail.servingConfigs.list` `retail.servingConfigs.update`

Cloud IAM changes as of 2022-08-19

Service	Change	Description
Analytics Hub	Now GA	The role `roles/analyticshub.admin` (Analytics Hub Admin) is now GA.
Analytics Hub	Now GA	The role `roles/analyticshub.listingAdmin` (Analytics Hub Listing Admin) is now GA.
Analytics Hub	Now GA	The role `roles/analyticshub.publisher` (Analytics Hub Publisher) is now GA.
Analytics Hub	Now GA	The role `roles/analyticshub.subscriber` (Analytics Hub Subscriber) is now GA.
Analytics Hub	Now GA	The role `roles/analyticshub.viewer` (Analytics Hub Viewer) is now GA.
Cloud Service Mesh	Role Updated	The following permissions have been added to the role `roles/anthosservicemesh.serviceAgent` (Anthos Service Mesh Service Agent): `container.clusters.update` `container.operations.get` `gkehub.gateway.delete` `gkehub.gateway.get` `gkehub.gateway.patch` `gkehub.gateway.post` `gkehub.gateway.put` `logging.logEntries.create` `monitoring.metricDescriptors.create` `monitoring.metricDescriptors.get` `monitoring.metricDescriptors.list` `monitoring.monitoredResourceDescriptors.get` `monitoring.monitoredResourceDescriptors.list` `monitoring.timeSeries.create` `serviceusage.services.get` `serviceusage.services.use`
Recommendations	Role Updated	The following permissions have been added to the role `roles/automlrecommendations.serviceAgent` (Recommendations AI Service Agent): `bigquery.tables.update`
Google Cloud Contact Center as a Service	Now GA	The role `roles/contactcenteraiplatform.admin` (Contact Center AI Platform Admin) is now GA.
Google Cloud Contact Center as a Service	Now GA	The role `roles/contactcenteraiplatform.viewer` (Contact Center AI Platform Viewer) is now GA.
Google Kubernetes Engine	Now GA	The role `roles/container.nodeServiceAccount` (Kubernetes Engine Node Service Account) is now GA.
Retail API	Role Updated	The following permissions have been added to the role `roles/retail.serviceAgent` (Retail Service Agent): `bigquery.tables.update`
Storage Transfer Service	Role Updated	The following permissions have been added to the role `roles/storagetransfer.transferAgent` (Storage Transfer Agent): `monitoring.timeSeries.create`
Analytics Hub	Now GA	`analyticshub.dataExchanges.create` `analyticshub.dataExchanges.delete` `analyticshub.dataExchanges.get` `analyticshub.dataExchanges.getIamPolicy` `analyticshub.dataExchanges.list` `analyticshub.dataExchanges.setIamPolicy` `analyticshub.dataExchanges.update` `analyticshub.listings.create` `analyticshub.listings.delete` `analyticshub.listings.get` `analyticshub.listings.getIamPolicy` `analyticshub.listings.list` `analyticshub.listings.setIamPolicy` `analyticshub.listings.subscribe` `analyticshub.listings.update`
Bare Metal Solution	Added	`baremetalsolution.instances.detachLun`
Bare Metal Solution	Supported In Custom Roles	`baremetalsolution.instances.detachLun`
Bare Metal Solution	Now GA	`baremetalsolution.instances.detachLun`
Cloud Deploy	Added	`clouddeploy.jobRuns.get` `clouddeploy.jobRuns.list` `clouddeploy.rollouts.retryJob`
Cloud Deploy	Supported In Custom Roles	`clouddeploy.jobRuns.get` `clouddeploy.jobRuns.list` `clouddeploy.rollouts.retryJob`
Google Cloud Contact Center as a Service	Added	`contactcenteraiplatform.contactCenters.create` `contactcenteraiplatform.contactCenters.delete` `contactcenteraiplatform.contactCenters.get` `contactcenteraiplatform.contactCenters.list` `contactcenteraiplatform.contactCenters.update` `contactcenteraiplatform.locations.get` `contactcenteraiplatform.locations.list` `contactcenteraiplatform.operations.cancel` `contactcenteraiplatform.operations.delete` `contactcenteraiplatform.operations.get` `contactcenteraiplatform.operations.list`
Google Cloud Contact Center as a Service	Now GA	`contactcenteraiplatform.contactCenters.create` `contactcenteraiplatform.contactCenters.delete` `contactcenteraiplatform.contactCenters.get` `contactcenteraiplatform.contactCenters.list` `contactcenteraiplatform.contactCenters.update` `contactcenteraiplatform.locations.get` `contactcenteraiplatform.locations.list` `contactcenteraiplatform.operations.cancel` `contactcenteraiplatform.operations.delete` `contactcenteraiplatform.operations.get` `contactcenteraiplatform.operations.list`
Content Warehouse	Added	`contentwarehouse.operations.get`
Firebase	Added	`firebase.clients.undelete`
Firebase	Now GA	`firebase.clients.undelete`
Identity and Access Management	Added	`iam.workforcePoolProviders.create` `iam.workforcePoolProviders.delete` `iam.workforcePoolProviders.get` `iam.workforcePoolProviders.list` `iam.workforcePoolProviders.undelete` `iam.workforcePoolProviders.update` `iam.workforcePoolSubjects.delete` `iam.workforcePoolSubjects.undelete` `iam.workforcePools.create` `iam.workforcePools.delete` `iam.workforcePools.get` `iam.workforcePools.getIamPolicy` `iam.workforcePools.list` `iam.workforcePools.setIamPolicy` `iam.workforcePools.undelete` `iam.workforcePools.update`
Identity and Access Management	Supported In Custom Roles	`iam.workforcePoolProviders.create` `iam.workforcePoolProviders.delete` `iam.workforcePoolProviders.get` `iam.workforcePoolProviders.list` `iam.workforcePoolProviders.undelete` `iam.workforcePoolProviders.update` `iam.workforcePoolSubjects.delete` `iam.workforcePoolSubjects.undelete` `iam.workforcePools.create` `iam.workforcePools.delete` `iam.workforcePools.get` `iam.workforcePools.getIamPolicy` `iam.workforcePools.list` `iam.workforcePools.setIamPolicy` `iam.workforcePools.undelete` `iam.workforcePools.update`
Identity and Access Management	Added	`iam.googleapis.com/workforcePoolProviders.create` `iam.googleapis.com/workforcePoolProviders.delete` `iam.googleapis.com/workforcePoolProviders.get` `iam.googleapis.com/workforcePoolProviders.list` `iam.googleapis.com/workforcePoolProviders.undelete` `iam.googleapis.com/workforcePoolProviders.update` `iam.googleapis.com/workforcePoolSubjects.delete` `iam.googleapis.com/workforcePoolSubjects.undelete` `iam.googleapis.com/workforcePools.create` `iam.googleapis.com/workforcePools.delete` `iam.googleapis.com/workforcePools.get` `iam.googleapis.com/workforcePools.getIamPolicy` `iam.googleapis.com/workforcePools.list` `iam.googleapis.com/workforcePools.setIamPolicy` `iam.googleapis.com/workforcePools.undelete` `iam.googleapis.com/workforcePools.update`
Identity and Access Management	Supported In Custom Roles	`iam.googleapis.com/workforcePoolProviders.create` `iam.googleapis.com/workforcePoolProviders.delete` `iam.googleapis.com/workforcePoolProviders.get` `iam.googleapis.com/workforcePoolProviders.list` `iam.googleapis.com/workforcePoolProviders.undelete` `iam.googleapis.com/workforcePoolProviders.update` `iam.googleapis.com/workforcePoolSubjects.delete` `iam.googleapis.com/workforcePoolSubjects.undelete` `iam.googleapis.com/workforcePools.create` `iam.googleapis.com/workforcePools.delete` `iam.googleapis.com/workforcePools.get` `iam.googleapis.com/workforcePools.getIamPolicy` `iam.googleapis.com/workforcePools.list` `iam.googleapis.com/workforcePools.setIamPolicy` `iam.googleapis.com/workforcePools.undelete` `iam.googleapis.com/workforcePools.update`
VM Migration	Supported In Custom Roles	`vmmigration.cloneJobs.create` `vmmigration.cloneJobs.get` `vmmigration.cloneJobs.list` `vmmigration.cloneJobs.update` `vmmigration.cutoverJobs.create` `vmmigration.cutoverJobs.get` `vmmigration.cutoverJobs.list` `vmmigration.cutoverJobs.update` `vmmigration.datacenterConnectors.create` `vmmigration.datacenterConnectors.delete` `vmmigration.datacenterConnectors.get` `vmmigration.datacenterConnectors.list` `vmmigration.groups.create` `vmmigration.groups.delete` `vmmigration.groups.get` `vmmigration.groups.list` `vmmigration.groups.update` `vmmigration.locations.get` `vmmigration.locations.list` `vmmigration.migratingVms.create` `vmmigration.migratingVms.delete` `vmmigration.migratingVms.list` `vmmigration.migratingVms.update` `vmmigration.operations.cancel` `vmmigration.operations.delete` `vmmigration.operations.get` `vmmigration.operations.list` `vmmigration.sources.create` `vmmigration.sources.delete` `vmmigration.sources.get` `vmmigration.sources.list` `vmmigration.sources.update` `vmmigration.targets.create` `vmmigration.targets.delete` `vmmigration.targets.get` `vmmigration.targets.list` `vmmigration.targets.update` `vmmigration.utilizationReports.create` `vmmigration.utilizationReports.delete` `vmmigration.utilizationReports.get` `vmmigration.utilizationReports.list`
Workload Manager	Added	`workloadmanager.evaluations.create` `workloadmanager.evaluations.delete` `workloadmanager.evaluations.get` `workloadmanager.evaluations.list` `workloadmanager.evaluations.run` `workloadmanager.evaluations.update` `workloadmanager.executions.delete` `workloadmanager.executions.get` `workloadmanager.executions.list` `workloadmanager.locations.get` `workloadmanager.locations.list` `workloadmanager.operations.cancel` `workloadmanager.operations.delete` `workloadmanager.operations.get` `workloadmanager.operations.list` `workloadmanager.results.list` `workloadmanager.rules.list`
Workload Manager	Supported In Custom Roles	`workloadmanager.evaluations.create` `workloadmanager.evaluations.delete` `workloadmanager.evaluations.get` `workloadmanager.evaluations.list` `workloadmanager.evaluations.run` `workloadmanager.evaluations.update` `workloadmanager.executions.delete` `workloadmanager.executions.get` `workloadmanager.executions.list` `workloadmanager.locations.get` `workloadmanager.locations.list` `workloadmanager.operations.cancel` `workloadmanager.operations.delete` `workloadmanager.operations.get` `workloadmanager.operations.list` `workloadmanager.results.list` `workloadmanager.rules.list`

Cloud IAM changes as of 2022-08-12

Service	Change	Description
Vertex AI	Role Updated	The following permissions have been added to the role `roles/aiplatform.serviceAgent` (Vertex AI Service Agent): `bigquery.models.create` `bigquery.models.getData` `bigquery.readsessions.getData`
Connectors	Now GA	The role `roles/connectors.invoker` (Connector Invoker) is now GA.
Firebase App Check	Role Updated	The following permissions have been added to the role `roles/firebaseappcheck.serviceAgent` (Firebase App Check Service Agent): `serviceusage.services.use`
Cloud Integrations	Role Updated	The following permissions have been added to the role `roles/integrations.serviceAgent` (Integrations Service Agent): `connectors.actions.execute` `connectors.actions.list` `connectors.connections.executeSqlQuery` `connectors.entities.create` `connectors.entities.delete` `connectors.entities.deleteEntitiesWithConditions` `connectors.entities.get` `connectors.entities.list` `connectors.entities.update` `connectors.entities.updateEntitiesWithConditions` `connectors.entityTypes.list` `integrations.apigeeSuspensions.lift` `integrations.authConfigs.create` `integrations.authConfigs.delete` `integrations.authConfigs.get` `integrations.authConfigs.list` `integrations.authConfigs.update` `integrations.certificates.create` `integrations.certificates.delete` `integrations.certificates.get` `integrations.certificates.list` `integrations.certificates.update` `integrations.executions.list` `integrations.integrationVersions.create` `integrations.integrationVersions.delete` `integrations.integrationVersions.deploy` `integrations.integrationVersions.get` `integrations.integrationVersions.list` `integrations.integrationVersions.update` `integrations.integrations.create` `integrations.integrations.delete` `integrations.integrations.deploy` `integrations.integrations.get` `integrations.integrations.list` `integrations.integrations.update` `integrations.sfdcChannels.create` `integrations.sfdcChannels.delete` `integrations.sfdcChannels.get` `integrations.sfdcChannels.list` `integrations.sfdcChannels.update` `integrations.sfdcInstances.create` `integrations.sfdcInstances.delete` `integrations.sfdcInstances.get` `integrations.sfdcInstances.list` `integrations.sfdcInstances.update` `integrations.suspensions.lift` `integrations.suspensions.list` `integrations.suspensions.resolve` `pubsub.schemas.attach` `pubsub.schemas.create` `pubsub.schemas.delete` `pubsub.schemas.get` `pubsub.schemas.list` `pubsub.schemas.validate` `pubsub.snapshots.get` `pubsub.snapshots.list` `pubsub.snapshots.seek` `pubsub.topics.attachSubscription` `pubsub.topics.get` `pubsub.topics.list` `pubsub.topics.publish` `resourcemanager.projects.get` `resourcemanager.projects.list` `serviceusage.quotas.get` `serviceusage.services.get` `serviceusage.services.list`
Google Cloud Migration Center	Now GA	The role `roles/migrationcenter.serviceAgent` (Migration Center Service Agent) is now GA.
Bigtable	Added	`bigtable.instances.createTagBinding` `bigtable.instances.deleteTagBinding` `bigtable.instances.listEffectiveTags` `bigtable.instances.listTagBindings`
Bigtable	Now GA	`bigtable.instances.createTagBinding` `bigtable.instances.deleteTagBinding` `bigtable.instances.listEffectiveTags` `bigtable.instances.listTagBindings`
Connectors	Added	`connectors.actions.execute` `connectors.actions.list` `connectors.connections.executeSqlQuery` `connectors.entities.create` `connectors.entities.delete` `connectors.entities.deleteEntitiesWithConditions` `connectors.entities.get` `connectors.entities.list` `connectors.entities.update` `connectors.entities.updateEntitiesWithConditions` `connectors.entityTypes.list`
Connectors	Supported In Custom Roles	`connectors.actions.execute` `connectors.actions.list` `connectors.connections.executeSqlQuery` `connectors.entities.create` `connectors.entities.delete` `connectors.entities.deleteEntitiesWithConditions` `connectors.entities.get` `connectors.entities.list` `connectors.entities.update` `connectors.entities.updateEntitiesWithConditions` `connectors.entityTypes.list`
Connectors	Now GA	`connectors.actions.execute` `connectors.actions.list` `connectors.connections.executeSqlQuery` `connectors.entities.create` `connectors.entities.delete` `connectors.entities.deleteEntitiesWithConditions` `connectors.entities.get` `connectors.entities.list` `connectors.entities.update` `connectors.entities.updateEntitiesWithConditions` `connectors.entityTypes.list`
Google Cloud Migration Center	Added	`migrationcenter.assets.create` `migrationcenter.assets.delete` `migrationcenter.assets.get` `migrationcenter.assets.list` `migrationcenter.assets.reportFrames` `migrationcenter.assets.update` `migrationcenter.groups.create` `migrationcenter.groups.delete` `migrationcenter.groups.get` `migrationcenter.groups.list` `migrationcenter.groups.update` `migrationcenter.importJobs.create` `migrationcenter.importJobs.delete` `migrationcenter.importJobs.get` `migrationcenter.importJobs.list` `migrationcenter.importJobs.update` `migrationcenter.locations.get` `migrationcenter.locations.list` `migrationcenter.operations.cancel` `migrationcenter.operations.delete` `migrationcenter.operations.get` `migrationcenter.operations.list` `migrationcenter.sources.create` `migrationcenter.sources.delete` `migrationcenter.sources.get` `migrationcenter.sources.list` `migrationcenter.sources.update`
Google Cloud Migration Center	Supported In Custom Roles	`migrationcenter.assets.create` `migrationcenter.assets.delete` `migrationcenter.assets.get` `migrationcenter.assets.list` `migrationcenter.assets.reportFrames` `migrationcenter.assets.update` `migrationcenter.groups.create` `migrationcenter.groups.delete` `migrationcenter.groups.get` `migrationcenter.groups.list` `migrationcenter.groups.update` `migrationcenter.importJobs.create` `migrationcenter.importJobs.delete` `migrationcenter.importJobs.get` `migrationcenter.importJobs.list` `migrationcenter.importJobs.update` `migrationcenter.locations.get` `migrationcenter.locations.list` `migrationcenter.operations.cancel` `migrationcenter.operations.delete` `migrationcenter.operations.get` `migrationcenter.operations.list` `migrationcenter.sources.create` `migrationcenter.sources.delete` `migrationcenter.sources.get` `migrationcenter.sources.list` `migrationcenter.sources.update`
Retail API	Now GA	`retail.attributesConfigs.addCatalogAttribute` `retail.attributesConfigs.get` `retail.attributesConfigs.removeCatalogAttribute` `retail.attributesConfigs.replaceCatalogAttribute` `retail.attributesConfigs.update`

Cloud IAM changes as of 2022-08-05

Service	Change	Description
Artifact Registry	Role Updated	The following permissions have been added to the role `roles/artifactregistry.serviceAgent` (Artifact Registry Service Agent): `artifactregistry.versions.delete`
Backup and Disaster Recovery	Now GA	The role `roles/backupdr.admin` (Backup and DR Admin) is now GA.
Backup and Disaster Recovery	Now GA	The role `roles/backupdr.user` (Backup and DR User) is now GA.
Backup and Disaster Recovery	Now GA	The role `roles/backupdr.viewer` (Backup and DR Viewer) is now GA.
Multi-Cluster Ingress	Role Updated	The following permissions have been added to the role `roles/multiclusteringress.serviceAgent` (Multi Cluster Ingress Service Agent): `container.customResourceDefinitions.list`
Backup and Disaster Recovery	Added	`backupdr.locations.get` `backupdr.locations.list` `backupdr.managementServers.backupAccess` `backupdr.managementServers.create` `backupdr.managementServers.delete` `backupdr.managementServers.get` `backupdr.managementServers.getIamPolicy` `backupdr.managementServers.list` `backupdr.managementServers.manageInternalACL` `backupdr.managementServers.setIamPolicy` `backupdr.operations.cancel` `backupdr.operations.delete` `backupdr.operations.get` `backupdr.operations.list`
Backup and Disaster Recovery	Supported In Custom Roles	`backupdr.locations.get` `backupdr.locations.list` `backupdr.managementServers.backupAccess` `backupdr.managementServers.create` `backupdr.managementServers.delete` `backupdr.managementServers.get` `backupdr.managementServers.getIamPolicy` `backupdr.managementServers.list` `backupdr.managementServers.manageInternalACL` `backupdr.managementServers.setIamPolicy` `backupdr.operations.cancel` `backupdr.operations.delete` `backupdr.operations.get` `backupdr.operations.list`
Backup and Disaster Recovery	Now GA	`backupdr.locations.get` `backupdr.locations.list` `backupdr.managementServers.backupAccess` `backupdr.managementServers.create` `backupdr.managementServers.delete` `backupdr.managementServers.get` `backupdr.managementServers.getIamPolicy` `backupdr.managementServers.list` `backupdr.managementServers.manageInternalACL` `backupdr.managementServers.setIamPolicy` `backupdr.operations.cancel` `backupdr.operations.delete` `backupdr.operations.get` `backupdr.operations.list`
Commerce Offer Catalog	Added	`commerceoffercatalog.documents.get`
Cloud Commerce Consumer Procurement	Added	`consumerprocurement.consents.check` `consumerprocurement.consents.grant` `consumerprocurement.consents.list` `consumerprocurement.consents.revoke`
Maps Admin	Added	`mapsadmin.styleSnapshots.list` `mapsadmin.styleSnapshots.update`
Maps Admin	Now GA	`mapsadmin.styleSnapshots.list` `mapsadmin.styleSnapshots.update`

Cloud IAM changes as of 2022-07-29

Service	Change	Description
Network Management API	Role Updated	The following permissions have been added to the role `roles/networkmanagement.admin` (Network Management Admin): `resourcemanager.organizations.get`
Network Management API	Role Updated	The following permissions have been added to the role `roles/networkmanagement.viewer` (Network Management Viewer): `resourcemanager.organizations.get`
Cloud Run	Role Updated	The following permissions have been added to the role `roles/run.serviceAgent` (Cloud Run Service Agent): `compute.networks.get`
Cloud Run	Role Updated	The following permissions have been added to the role `roles/serverless.serviceAgent` (Cloud Run Service Agent): `compute.networks.get`
Assured Workloads	Added	`assuredworkloads.violations.update`
Assured Workloads	Supported In Custom Roles	`assuredworkloads.violations.update`
Assured Workloads	Now GA	`assuredworkloads.violations.update`
Cloud Asset Inventory	Added	`cloudasset.assets.exportOSInventories`
Cloud Asset Inventory	Supported In Custom Roles	`cloudasset.assets.exportOSInventories`
Cloud Asset Inventory	Now GA	`cloudasset.assets.exportOSInventories`
Translation	Added	`cloudtranslate.glossaries.update` `cloudtranslate.glossaryentries.create` `cloudtranslate.glossaryentries.delete` `cloudtranslate.glossaryentries.get` `cloudtranslate.glossaryentries.list` `cloudtranslate.glossaryentries.update`
Translation	Supported In Custom Roles	`cloudtranslate.glossaries.update`
Translation	Now GA	`cloudtranslate.glossaries.update` `cloudtranslate.glossaryentries.create` `cloudtranslate.glossaryentries.delete` `cloudtranslate.glossaryentries.get` `cloudtranslate.glossaryentries.list` `cloudtranslate.glossaryentries.update`
Compute Engine	Added	`compute.regionTargetHttpsProxies.update` `compute.targetHttpsProxies.update`
Compute Engine	Now GA	`compute.regionTargetHttpsProxies.update` `compute.targetHttpsProxies.update`
Timeseries Insights API	Added	`timeseriesinsights.locations.get` `timeseriesinsights.locations.list`
Timeseries Insights API	Supported In Custom Roles	`timeseriesinsights.locations.get` `timeseriesinsights.locations.list`

Cloud IAM changes as of 2022-07-22

Service	Change	Description
Cloud Billing	Role Updated	The following permissions have been added to the role `roles/billing.admin` (Billing Account Administrator): `cloudsupport.properties.get` `cloudsupport.techCases.create` `cloudsupport.techCases.escalate` `cloudsupport.techCases.get` `cloudsupport.techCases.list` `cloudsupport.techCases.update` `resourcemanager.projects.get` `resourcemanager.projects.list`
Workload Certificate	Role Updated	The following permissions have been added to the role `roles/workloadcertificate.serviceAgent` (Workload Certificate Service Agent): `container.customResourceDefinitions.create` `container.customResourceDefinitions.get` `container.customResourceDefinitions.list`
Bare Metal Solution	Added	`baremetalsolution.volumes.resize`
Bare Metal Solution	Supported In Custom Roles	`baremetalsolution.volumes.resize`
Bare Metal Solution	Now GA	`baremetalsolution.volumes.resize`
Eventarc	Added	`eventarc.channels.attach` `eventarc.googleChannelConfigs.get` `eventarc.googleChannelConfigs.update`
Eventarc	Supported In Custom Roles	`eventarc.channels.attach` `eventarc.googleChannelConfigs.get` `eventarc.googleChannelConfigs.update`
Firebase Realtime Database	Added	`firebasedatabase.instances.delete` `firebasedatabase.instances.disable` `firebasedatabase.instances.reenable` `firebasedatabase.instances.undelete`
Firebase Realtime Database	Supported In Custom Roles	`firebasedatabase.instances.delete` `firebasedatabase.instances.disable` `firebasedatabase.instances.reenable` `firebasedatabase.instances.undelete`
Firebase Realtime Database	Now GA	`firebasedatabase.instances.delete` `firebasedatabase.instances.disable` `firebasedatabase.instances.reenable` `firebasedatabase.instances.undelete`
Retail API	Added	`retail.servingConfigs.predict` `retail.servingConfigs.search`

Cloud IAM changes as of 2022-07-15

Service	Change	Description
Vertex AI	Role Updated	The following permissions have been added to the role `roles/aiplatform.admin` (Vertex AI Administrator): `aiplatform.entityTypes.getIamPolicy` `aiplatform.entityTypes.setIamPolicy` `aiplatform.featurestores.getIamPolicy` `aiplatform.featurestores.setIamPolicy`
Google Kubernetes Engine	Now GA	The role `roles/container.nodeServiceAgent` (Kubernetes Engine Node Service Agent) is now GA.
Eventarc	Role Updated	The following permissions have been added to the role `roles/eventarc.serviceAgent` (Eventarc Service Agent): `cloudfunctions.functions.get`
Identity-Aware Proxy	Now GA	The role `roles/iap.tunnelDestGroupEditor` (IAP-secured Tunnel Destination Group Editor) is now GA.
Identity-Aware Proxy	Now GA	The role `roles/iap.tunnelDestGroupViewer` (IAP-secured Tunnel Destination Group Viewer) is now GA.
Cloud Integrations	Now GA	The role `roles/integrations.certificateViewer` (Certificate Viewer) is now GA.
Cloud Integrations	Now GA	The role `roles/integrations.integrationAdmin` (Application Integration Admin) is now GA.
Cloud Integrations	Now GA	The role `roles/integrations.integrationDeployer` (Application Integration Deployer) is now GA.
Cloud Integrations	Now GA	The role `roles/integrations.integrationEditor` (Application Integration Editor) is now GA.
Cloud Integrations	Now GA	The role `roles/integrations.integrationInvoker` (Application Integration Invoker) is now GA.
Cloud Integrations	Now GA	The role `roles/integrations.integrationViewer` (Application Integration Viewer) is now GA.
Cloud Integrations	Now GA	The role `roles/integrations.sfdcInstanceAdmin` (Application Integration SFDC Instance Admin) is now GA.
Cloud Integrations	Now GA	The role `roles/integrations.sfdcInstanceEditor` (Application Integration SFDC Instance Editor) is now GA.
Cloud Integrations	Now GA	The role `roles/integrations.sfdcInstanceViewer` (Application Integration SFDC Instance Viewer) is now GA.
Cloud Integrations	Now GA	The role `roles/integrations.suspensionResolver` (Application Integration Suspension Resolver) is now GA.
Cloud Service Mesh control plane	Role Updated	The following permissions have been added to the role `roles/meshcontrolplane.serviceAgent` (Mesh Managed Control Plane Service Agent): `container.clusters.update`
Visual Inspection AI	Role Updated	The following permissions have been added to the role `roles/visualinspection.serviceAgent` (Visual Inspection AI Service Agent): `aiplatform.entityTypes.getIamPolicy` `aiplatform.entityTypes.setIamPolicy` `aiplatform.featurestores.getIamPolicy` `aiplatform.featurestores.setIamPolicy`
Vertex AI	Added	`aiplatform.entityTypes.deleteFeatureValues`
Chrome Enterprise Premium	Added	`beyondcorp.appConnections.create` `beyondcorp.appConnections.delete` `beyondcorp.appConnections.get` `beyondcorp.appConnections.getIamPolicy` `beyondcorp.appConnections.list` `beyondcorp.appConnections.setIamPolicy` `beyondcorp.appConnections.update` `beyondcorp.appConnectors.create` `beyondcorp.appConnectors.delete` `beyondcorp.appConnectors.get` `beyondcorp.appConnectors.getIamPolicy` `beyondcorp.appConnectors.list` `beyondcorp.appConnectors.reportStatus` `beyondcorp.appConnectors.setIamPolicy` `beyondcorp.appConnectors.update` `beyondcorp.appGateways.create` `beyondcorp.appGateways.delete` `beyondcorp.appGateways.get` `beyondcorp.appGateways.getIamPolicy` `beyondcorp.appGateways.list` `beyondcorp.appGateways.setIamPolicy` `beyondcorp.appGateways.update` `beyondcorp.clientConnectorServices.access` `beyondcorp.clientConnectorServices.create` `beyondcorp.clientConnectorServices.delete` `beyondcorp.clientConnectorServices.get` `beyondcorp.clientConnectorServices.getIamPolicy` `beyondcorp.clientConnectorServices.list` `beyondcorp.clientConnectorServices.setIamPolicy` `beyondcorp.clientConnectorServices.update` `beyondcorp.clientGateways.create` `beyondcorp.clientGateways.delete` `beyondcorp.clientGateways.get` `beyondcorp.clientGateways.getIamPolicy` `beyondcorp.clientGateways.list` `beyondcorp.clientGateways.setIamPolicy` `beyondcorp.locations.get` `beyondcorp.locations.list` `beyondcorp.operations.cancel` `beyondcorp.operations.delete` `beyondcorp.operations.get` `beyondcorp.operations.list`
Chrome Enterprise Premium	Supported In Custom Roles	`beyondcorp.appConnections.create` `beyondcorp.appConnections.delete` `beyondcorp.appConnections.get` `beyondcorp.appConnections.getIamPolicy` `beyondcorp.appConnections.list` `beyondcorp.appConnections.setIamPolicy` `beyondcorp.appConnections.update` `beyondcorp.appConnectors.create` `beyondcorp.appConnectors.delete` `beyondcorp.appConnectors.get` `beyondcorp.appConnectors.getIamPolicy` `beyondcorp.appConnectors.list` `beyondcorp.appConnectors.reportStatus` `beyondcorp.appConnectors.setIamPolicy` `beyondcorp.appConnectors.update` `beyondcorp.appGateways.create` `beyondcorp.appGateways.delete` `beyondcorp.appGateways.get` `beyondcorp.appGateways.getIamPolicy` `beyondcorp.appGateways.list` `beyondcorp.appGateways.setIamPolicy` `beyondcorp.appGateways.update` `beyondcorp.clientConnectorServices.access` `beyondcorp.clientConnectorServices.create` `beyondcorp.clientConnectorServices.delete` `beyondcorp.clientConnectorServices.get` `beyondcorp.clientConnectorServices.getIamPolicy` `beyondcorp.clientConnectorServices.list` `beyondcorp.clientConnectorServices.setIamPolicy` `beyondcorp.clientConnectorServices.update` `beyondcorp.clientGateways.create` `beyondcorp.clientGateways.delete` `beyondcorp.clientGateways.get` `beyondcorp.clientGateways.getIamPolicy` `beyondcorp.clientGateways.list` `beyondcorp.clientGateways.setIamPolicy` `beyondcorp.locations.get` `beyondcorp.locations.list` `beyondcorp.operations.cancel` `beyondcorp.operations.delete` `beyondcorp.operations.get` `beyondcorp.operations.list`
Identity-Aware Proxy	Now GA	`iap.tunnelDestGroups.accessViaIAP` `iap.tunnelDestGroups.create` `iap.tunnelDestGroups.delete` `iap.tunnelDestGroups.get` `iap.tunnelDestGroups.getIamPolicy` `iap.tunnelDestGroups.list` `iap.tunnelDestGroups.setIamPolicy` `iap.tunnelDestGroups.update` `iap.tunnelLocations.getIamPolicy` `iap.tunnelLocations.setIamPolicy`
Cloud Integrations	Added	`integrations.authConfigs.create` `integrations.authConfigs.delete` `integrations.authConfigs.get` `integrations.authConfigs.list` `integrations.authConfigs.update` `integrations.certificates.create` `integrations.certificates.delete` `integrations.certificates.get` `integrations.certificates.list` `integrations.certificates.update` `integrations.executions.list` `integrations.integrationVersions.create` `integrations.integrationVersions.delete` `integrations.integrationVersions.deploy` `integrations.integrationVersions.get` `integrations.integrationVersions.invoke` `integrations.integrationVersions.list` `integrations.integrationVersions.update` `integrations.integrations.create` `integrations.integrations.delete` `integrations.integrations.deploy` `integrations.integrations.get` `integrations.integrations.invoke` `integrations.integrations.list` `integrations.integrations.update` `integrations.sfdcChannels.create` `integrations.sfdcChannels.delete` `integrations.sfdcChannels.get` `integrations.sfdcChannels.list` `integrations.sfdcChannels.update` `integrations.sfdcInstances.create` `integrations.sfdcInstances.delete` `integrations.sfdcInstances.get` `integrations.sfdcInstances.list` `integrations.sfdcInstances.update` `integrations.suspensions.lift` `integrations.suspensions.list` `integrations.suspensions.resolve`
Cloud Integrations	Now GA	`integrations.authConfigs.create` `integrations.authConfigs.delete` `integrations.authConfigs.get` `integrations.authConfigs.list` `integrations.authConfigs.update` `integrations.certificates.create` `integrations.certificates.delete` `integrations.certificates.get` `integrations.certificates.list` `integrations.certificates.update` `integrations.executions.list` `integrations.integrationVersions.create` `integrations.integrationVersions.delete` `integrations.integrationVersions.deploy` `integrations.integrationVersions.get` `integrations.integrationVersions.invoke` `integrations.integrationVersions.list` `integrations.integrationVersions.update` `integrations.integrations.create` `integrations.integrations.delete` `integrations.integrations.deploy` `integrations.integrations.get` `integrations.integrations.invoke` `integrations.integrations.list` `integrations.integrations.update` `integrations.sfdcChannels.create` `integrations.sfdcChannels.delete` `integrations.sfdcChannels.get` `integrations.sfdcChannels.list` `integrations.sfdcChannels.update` `integrations.sfdcInstances.create` `integrations.sfdcInstances.delete` `integrations.sfdcInstances.get` `integrations.sfdcInstances.list` `integrations.sfdcInstances.update` `integrations.suspensions.lift` `integrations.suspensions.list` `integrations.suspensions.resolve`
Secured Landing Zone	Added	`securedlandingzone.operations.get` `securedlandingzone.overwatches.activate` `securedlandingzone.overwatches.create` `securedlandingzone.overwatches.delete` `securedlandingzone.overwatches.get` `securedlandingzone.overwatches.list` `securedlandingzone.overwatches.suspend` `securedlandingzone.overwatches.update`
Secured Landing Zone	Supported In Custom Roles	`securedlandingzone.overwatches.activate` `securedlandingzone.overwatches.suspend`

Cloud IAM changes as of 2022-06-24

Service	Change	Description
Config Management	Role Updated	The following permissions have been added to the role `roles/anthosconfigmanagement.serviceAgent` (Anthos Config Management Service Agent): `container.clusters.get`
Batch	Now GA	The role `roles/batch.serviceAgent` (Google Batch Service Agent) is now GA.
Firebase Test Lab	Role Updated	The following permissions have been added to the role `roles/cloudtestservice.testAdmin` (Firebase Test Lab Admin): `storage.objects.delete`
Apigee	Added	`apigee.securityProfileEnvironments.computeScore` `apigee.securityProfileEnvironments.create` `apigee.securityProfileEnvironments.delete` `apigee.securityProfiles.get` `apigee.securityProfiles.list` `apigee.securityStats.queryTabularStats` `apigee.securityStats.queryTimeSeriesStats`
Apigee	Now GA	`apigee.securityProfileEnvironments.computeScore` `apigee.securityProfileEnvironments.create` `apigee.securityProfileEnvironments.delete` `apigee.securityProfiles.get` `apigee.securityProfiles.list` `apigee.securityStats.queryTabularStats` `apigee.securityStats.queryTimeSeriesStats`

Cloud IAM changes as of 2022-06-17

Service	Change	Description
Care Studio	Now GA	The role `roles/carestudio.viewer` (Care Studio Patients Viewer) is now GA.
Translation	Role Updated	The following permissions have been added to the role `roles/cloudtranslate.serviceAgent` (Cloud Translation API Service Agent): `automl.datasets.export` `automl.datasets.get` `automl.datasets.list` `automl.models.get` `automl.models.list` `automl.operations.get`
Cloud Composer	Role Updated	The following permissions have been added to the role `roles/composer.serviceAgent` (Cloud Composer API Service Agent): `resourcemanager.projects.getIamPolicy`
Google Kubernetes Engine	Role Updated	The following permissions have been added to the role `roles/container.serviceAgent` (Kubernetes Engine Service Agent): `dns.managedZones.getIamPolicy` `dns.policies.getIamPolicy`
Dialogflow	Role Updated	The following permissions have been added to the role `roles/dialogflow.serviceAgent` (Dialogflow Service Agent): `pubsub.snapshots.seek` `pubsub.subscriptions.consume` `pubsub.topics.attachSubscription`
Cloud DNS	Role Updated	The following permissions have been added to the role `roles/dns.admin` (DNS Administrator): `dns.managedZones.getIamPolicy` `dns.policies.getIamPolicy`
Document AI	Role Updated	The following permissions have been added to the role `roles/documentaicore.serviceAgent` (DocumentAI Core Service Agent): `documentai.humanReviewConfigs.review`
Basic Role	Role Updated	The following permissions have been added to the role `roles/editor` (Editor): `dns.managedZones.getIamPolicy` `dns.policies.getIamPolicy`
Cloud Integrations	Role Updated	The following permissions have been added to the role `roles/integrations.serviceAgent` (Integrations Service Agent): `pubsub.snapshots.create` `pubsub.snapshots.delete` `pubsub.snapshots.update` `pubsub.topics.create` `pubsub.topics.delete` `pubsub.topics.detachSubscription` `pubsub.topics.update` `pubsub.topics.updateTag`
Service Networking	Role Updated	The following permissions have been added to the role `roles/servicenetworking.serviceAgent` (Service Networking Service Agent): `dns.managedZones.getIamPolicy` `dns.policies.getIamPolicy`
Basic Role	Role Updated	The following permissions have been added to the role `roles/viewer` (Viewer): `dns.managedZones.getIamPolicy` `dns.policies.getIamPolicy`
Basic Role	Role Updated	The following permissions have been removed from the role `roles/viewer` (Viewer): `apigee.archivedeployments.upload`
Bare Metal Solution	Added	`baremetalsolution.instancequotas.list` `baremetalsolution.networkquotas.list` `baremetalsolution.volumequotas.list`
Bare Metal Solution	Supported In Custom Roles	`baremetalsolution.instancequotas.list` `baremetalsolution.networkquotas.list` `baremetalsolution.volumequotas.list`
Bare Metal Solution	Now GA	`baremetalsolution.instancequotas.list` `baremetalsolution.networkquotas.list` `baremetalsolution.volumequotas.list`
Batch	Added	`batch.jobs.create` `batch.jobs.delete` `batch.jobs.get` `batch.jobs.list` `batch.locations.get` `batch.locations.list` `batch.operations.get` `batch.operations.list` `batch.states.report` `batch.tasks.get` `batch.tasks.list`
Batch	Supported In Custom Roles	`batch.jobs.create` `batch.jobs.delete` `batch.jobs.get` `batch.jobs.list` `batch.locations.get` `batch.locations.list` `batch.operations.get` `batch.operations.list` `batch.states.report` `batch.tasks.get` `batch.tasks.list`
BigQuery	Supported In Custom Roles	`bigquery.dataPolicies.create` `bigquery.dataPolicies.delete` `bigquery.dataPolicies.get` `bigquery.dataPolicies.getIamPolicy` `bigquery.dataPolicies.list` `bigquery.dataPolicies.maskedGet` `bigquery.dataPolicies.setIamPolicy` `bigquery.dataPolicies.update`
Bigtable	Added	`bigtable.tables.undelete`
Bigtable	Now GA	`bigtable.tables.undelete`
Care Studio	Now GA	`carestudio.patients.get` `carestudio.patients.list`
Cloud Integrations	Added	`integrations.apigeeSuspensions.lift`
Cloud Integrations	Now GA	`integrations.apigeeSuspensions.lift`
Service Networking	Added	`servicenetworking.services.createPeeredDnsDomain` `servicenetworking.services.deletePeeredDnsDomain` `servicenetworking.services.listPeeredDnsDomains`
Service Networking	Supported In Custom Roles	`servicenetworking.services.createPeeredDnsDomain` `servicenetworking.services.deletePeeredDnsDomain` `servicenetworking.services.listPeeredDnsDomains`
Timeseries Insights API	Added	`timeseriesinsights.datasets.create` `timeseriesinsights.datasets.delete` `timeseriesinsights.datasets.evaluate` `timeseriesinsights.datasets.list` `timeseriesinsights.datasets.query` `timeseriesinsights.datasets.update`

Cloud IAM changes as of 2022-06-10

Service	Change	Description
App Engine	Role Updated	The following permissions have been added to the role `roles/appengine.appAdmin` (App Engine Admin): `appengine.memcache.addKey` `appengine.memcache.flush` `appengine.memcache.get` `appengine.memcache.update`
Cloud Composer	Role Updated	The following permissions have been added to the role `roles/composer.serviceAgent` (Cloud Composer API Service Agent): `appengine.memcache.addKey` `appengine.memcache.flush` `appengine.memcache.get` `appengine.memcache.update`
Compute Engine	Role Updated	The following permissions have been added to the role `roles/compute.serviceAgent` (Compute Engine Service Agent): `storage.objects.create` `storage.objects.get` `storage.objects.list` `storage.objects.update`
Dataplex	Role Updated	The following permissions have been added to the role `roles/dataplex.admin` (Dataplex Administrator): `cloudasset.assets.analyzeIamPolicy` `cloudasset.assets.searchAllIamPolicies` `cloudasset.assets.searchAllResources`
Dataplex	Role Updated	The following permissions have been added to the role `roles/dataplex.editor` (Dataplex Editor): `cloudasset.assets.analyzeIamPolicy`
Dataplex	Role Updated	The following permissions have been added to the role `roles/dataplex.viewer` (Dataplex Viewer): `cloudasset.assets.analyzeIamPolicy`
Cloud Integrations	Now GA	The role `roles/integrations.serviceAgent` (Integrations Service Agent) is now GA.
Dataproc Metastore	Now GA	The role `roles/metastore.federationAccessor` (Metastore Federation Accessor) is now GA.
Resource Manager	Now GA	The role `roles/resourcemanager.tagAdmin` (Tag Administrator) is now GA.
Resource Manager	Now GA	The role `roles/resourcemanager.tagHoldAdmin` (Tag Hold Administrator) is now GA.
Resource Manager	Now GA	The role `roles/resourcemanager.tagUser` (Tag User) is now GA.
Resource Manager	Now GA	The role `roles/resourcemanager.tagViewer` (Tag Viewer) is now GA.
Access Approval	Added	`accessapproval.requests.invalidate`
Access Approval	Supported In Custom Roles	`accessapproval.requests.invalidate`
AlloyDB for PostgreSQL	Added	`alloydb.backups.create` `alloydb.backups.delete` `alloydb.backups.get` `alloydb.backups.list` `alloydb.backups.update` `alloydb.clusters.create` `alloydb.clusters.delete` `alloydb.clusters.generateClientCertificate` `alloydb.clusters.get` `alloydb.clusters.list` `alloydb.clusters.update` `alloydb.instances.connect` `alloydb.instances.create` `alloydb.instances.delete` `alloydb.instances.failover` `alloydb.instances.get` `alloydb.instances.list` `alloydb.instances.restart` `alloydb.instances.update` `alloydb.locations.get` `alloydb.locations.list` `alloydb.operations.cancel` `alloydb.operations.delete` `alloydb.operations.get` `alloydb.operations.list` `alloydb.supportedDatabaseFlags.get` `alloydb.supportedDatabaseFlags.list`
Artifact Registry	Added	`artifactregistry.mavenartifacts.get` `artifactregistry.mavenartifacts.list` `artifactregistry.npmpackages.get` `artifactregistry.npmpackages.list` `artifactregistry.pythonpackages.get` `artifactregistry.pythonpackages.list`
Artifact Registry	Now GA	`artifactregistry.mavenartifacts.get` `artifactregistry.mavenartifacts.list` `artifactregistry.npmpackages.get` `artifactregistry.npmpackages.list` `artifactregistry.pythonpackages.get` `artifactregistry.pythonpackages.list`
AutoML	Added	`automl.files.delete` `automl.files.list`
Bare Metal Solution	Added	`baremetalsolution.instances.attachVolume` `baremetalsolution.instances.detachVolume`
Bare Metal Solution	Supported In Custom Roles	`baremetalsolution.instances.attachVolume` `baremetalsolution.instances.detachVolume`
Bare Metal Solution	Now GA	`baremetalsolution.instances.attachVolume` `baremetalsolution.instances.detachVolume`
Cloud Billing	Added	`billing.accounts.getCarbonInformation`
Cloud Billing	Supported In Custom Roles	`billing.accounts.getCarbonInformation`
Cloud Billing	Now GA	`billing.accounts.getCarbonInformation`
Cloud Deploy	Added	`clouddeploy.releases.abandon`
Cloud Deploy	Supported In Custom Roles	`clouddeploy.releases.abandon`
Commerce Price Management	Added	`commerceprice.privateoffers.cancel`
Commerce Price Management	Supported In Custom Roles	`commerceprice.privateoffers.cancel`
Datastream	Added	`datastream.connectionProfiles.createTagBinding` `datastream.connectionProfiles.deleteTagBinding` `datastream.connectionProfiles.listEffectiveTags` `datastream.connectionProfiles.listTagBindings` `datastream.privateConnections.createTagBinding` `datastream.privateConnections.deleteTagBinding` `datastream.privateConnections.listEffectiveTags` `datastream.privateConnections.listTagBindings` `datastream.streams.createTagBinding` `datastream.streams.deleteTagBinding` `datastream.streams.listEffectiveTags` `datastream.streams.listTagBindings`
Cloud DNS	Added	`dns.managedZones.getIamPolicy` `dns.managedZones.setIamPolicy`
Cloud DNS	Supported In Custom Roles	`dns.managedZones.getIamPolicy` `dns.managedZones.setIamPolicy`
Identity and Access Management	Added	`iam.serviceAccountKeys.disable` `iam.serviceAccountKeys.enable`
Identity and Access Management	Supported In Custom Roles	`iam.serviceAccountKeys.disable` `iam.serviceAccountKeys.enable`
Identity and Access Management	Now GA	`iam.serviceAccountKeys.disable` `iam.serviceAccountKeys.enable`
Dataproc Metastore	Added	`metastore.federations.create` `metastore.federations.delete` `metastore.federations.get` `metastore.federations.getIamPolicy` `metastore.federations.list` `metastore.federations.setIamPolicy` `metastore.federations.update` `metastore.federations.use`
Dataproc Metastore	Supported In Custom Roles	`metastore.federations.create` `metastore.federations.delete` `metastore.federations.get` `metastore.federations.getIamPolicy` `metastore.federations.list` `metastore.federations.setIamPolicy` `metastore.federations.update` `metastore.federations.use`
Dataproc Metastore	Now GA	`metastore.federations.create` `metastore.federations.delete` `metastore.federations.get` `metastore.federations.getIamPolicy` `metastore.federations.list` `metastore.federations.setIamPolicy` `metastore.federations.update` `metastore.federations.use`
Resource Manager	Now GA	`resourcemanager.hierarchyNodes.createTagBinding` `resourcemanager.hierarchyNodes.deleteTagBinding` `resourcemanager.hierarchyNodes.listTagBindings` `resourcemanager.resourceTagBindings.create` `resourcemanager.resourceTagBindings.delete` `resourcemanager.resourceTagBindings.list` `resourcemanager.tagHolds.create` `resourcemanager.tagHolds.delete` `resourcemanager.tagHolds.list` `resourcemanager.tagKeys.create` `resourcemanager.tagKeys.delete` `resourcemanager.tagKeys.get` `resourcemanager.tagKeys.getIamPolicy` `resourcemanager.tagKeys.list` `resourcemanager.tagKeys.setIamPolicy` `resourcemanager.tagKeys.update` `resourcemanager.tagValueBindings.create` `resourcemanager.tagValueBindings.delete` `resourcemanager.tagValues.create` `resourcemanager.tagValues.delete` `resourcemanager.tagValues.get` `resourcemanager.tagValues.getIamPolicy` `resourcemanager.tagValues.list` `resourcemanager.tagValues.setIamPolicy` `resourcemanager.tagValues.update`

Cloud IAM changes as of 2022-05-27

Service	Change	Description
AlloyDB for PostgreSQL	Now GA	The role `roles/alloydb.serviceAgent` (AlloyDB Service Agent) is now GA.
Compute Engine	Role Updated	The following permissions have been added to the role `roles/compute.serviceAgent` (Compute Engine Service Agent): `compute.addresses.use` `compute.addresses.useInternal` `compute.disks.create` `compute.disks.setLabels` `compute.disks.use` `compute.disks.useReadOnly` `compute.images.useReadOnly` `compute.instanceTemplates.useReadOnly` `compute.instances.create` `compute.instances.createTagBinding` `compute.instances.setDeletionProtection` `compute.instances.setLabels` `compute.instances.setMetadata` `compute.instances.setServiceAccount` `compute.instances.setTags` `compute.instances.updateDisplayDevice` `compute.machineImages.useReadOnly` `compute.networks.use` `compute.networks.useExternalIp` `compute.resourcePolicies.use` `compute.snapshots.useReadOnly` `compute.subnetworks.use` `compute.subnetworks.useExternalIp`
Dataflow	Role Updated	The following permissions have been added to the role `roles/dataflow.worker` (Dataflow Worker): `monitoring.timeSeries.create`
Live Stream	Role Updated	The following permissions have been added to the role `roles/livestream.serviceAgent` (Live Stream Service Agent): `storage.objects.get` `storage.objects.list`
Cloud Run	Role Updated	The following permissions have been added to the role `roles/run.serviceAgent` (Cloud Run Service Agent): `compute.addresses.createInternal` `compute.addresses.deleteInternal` `compute.addresses.get` `compute.addresses.list` `compute.subnetworks.get` `compute.subnetworks.use`
Cloud Run	Role Updated	The following permissions have been added to the role `roles/serverless.serviceAgent` (Cloud Run Service Agent): `compute.addresses.createInternal` `compute.addresses.deleteInternal` `compute.addresses.get` `compute.addresses.list` `compute.subnetworks.get` `compute.subnetworks.use`
Vertex AI	Added	`aiplatform.entityTypes.getIamPolicy` `aiplatform.entityTypes.setIamPolicy` `aiplatform.featurestores.getIamPolicy` `aiplatform.featurestores.setIamPolicy`
Container Security	Added	`containersecurity.locations.get` `containersecurity.locations.list`
Network Management API	Added	`networkmanagement.config.get` `networkmanagement.config.startFreeTrial` `networkmanagement.config.update`
Network Management API	Supported In Custom Roles	`networkmanagement.config.get` `networkmanagement.config.startFreeTrial` `networkmanagement.config.update`
Network Management API	Now GA	`networkmanagement.config.get` `networkmanagement.config.startFreeTrial` `networkmanagement.config.update`
Network Services	Added	`networkservices.tlsRoutes.create` `networkservices.tlsRoutes.delete` `networkservices.tlsRoutes.get` `networkservices.tlsRoutes.list` `networkservices.tlsRoutes.update` `networkservices.tlsRoutes.use`
Network Services	Supported In Custom Roles	`networkservices.tlsRoutes.create` `networkservices.tlsRoutes.delete` `networkservices.tlsRoutes.get` `networkservices.tlsRoutes.list` `networkservices.tlsRoutes.update` `networkservices.tlsRoutes.use`
reCAPTCHA	Added	`recaptchaenterprise.keys.retrievelegacysecretkey`
Transfer Appliance	Added	`transferappliance.appliances.create` `transferappliance.appliances.delete` `transferappliance.appliances.get` `transferappliance.appliances.list` `transferappliance.appliances.update` `transferappliance.locations.get` `transferappliance.locations.list` `transferappliance.operations.cancel` `transferappliance.operations.delete` `transferappliance.operations.get` `transferappliance.operations.list` `transferappliance.orders.create` `transferappliance.orders.delete` `transferappliance.orders.get` `transferappliance.orders.list` `transferappliance.orders.update`
Transfer Appliance	Supported In Custom Roles	`transferappliance.appliances.create` `transferappliance.appliances.delete` `transferappliance.appliances.get` `transferappliance.appliances.list` `transferappliance.appliances.update` `transferappliance.locations.get` `transferappliance.locations.list` `transferappliance.operations.cancel` `transferappliance.operations.delete` `transferappliance.operations.get` `transferappliance.operations.list` `transferappliance.orders.create` `transferappliance.orders.delete` `transferappliance.orders.get` `transferappliance.orders.list` `transferappliance.orders.update`

Cloud IAM changes as of 2022-05-20

Service	Change	Description
Cloud Service Mesh	Role Updated	The following permissions have been added to the role `roles/anthosservicemesh.serviceAgent` (Anthos Service Mesh Service Agent): `container.jobs.create` `container.jobs.delete` `container.jobs.get` `container.jobs.list` `container.jobs.update`
Backup for GKE	Role Updated	The following permissions have been added to the role `roles/gkebackup.serviceAgent` (Backup for GKE Service Agent): `compute.disks.list` `compute.disks.setLabels`
Vertex AI	Added	`aiplatform.humanInTheLoops.queryAnnotationStats`
Bare Metal Solution	Added	`baremetalsolution.luns.create` `baremetalsolution.luns.delete` `baremetalsolution.luns.update` `baremetalsolution.volumes.create` `baremetalsolution.volumes.delete`
Bare Metal Solution	Supported In Custom Roles	`baremetalsolution.luns.create` `baremetalsolution.luns.delete` `baremetalsolution.luns.update` `baremetalsolution.volumes.create` `baremetalsolution.volumes.delete`
Bare Metal Solution	Now GA	`baremetalsolution.luns.create` `baremetalsolution.luns.delete` `baremetalsolution.luns.update` `baremetalsolution.volumes.create` `baremetalsolution.volumes.delete`
BigQuery	Added	`bigquery.datasets.createTagBinding` `bigquery.datasets.deleteTagBinding` `bigquery.datasets.listTagBindings`
BigQuery	Supported In Custom Roles	`bigquery.datasets.createTagBinding` `bigquery.datasets.deleteTagBinding` `bigquery.datasets.listTagBindings`
Recommender	Added	`recommender.containerDiagnosisInsights.get` `recommender.containerDiagnosisInsights.list` `recommender.containerDiagnosisInsights.update` `recommender.containerDiagnosisRecommendations.get` `recommender.containerDiagnosisRecommendations.list` `recommender.containerDiagnosisRecommendations.update`
Recommender	Supported In Custom Roles	`recommender.containerDiagnosisInsights.get` `recommender.containerDiagnosisInsights.list` `recommender.containerDiagnosisInsights.update` `recommender.containerDiagnosisRecommendations.get` `recommender.containerDiagnosisRecommendations.list` `recommender.containerDiagnosisRecommendations.update`
Service Security Insights	Added	`servicesecurityinsights.securityInfo.list`
Service Security Insights	Supported In Custom Roles	`servicesecurityinsights.securityInfo.list`

Cloud IAM changes as of 2022-05-13

Service	Change	Description
Assured Workloads	Role Updated	The following permissions have been added to the role `roles/assuredworkloads.admin` (Assured Workloads Administrator): `logging.cmekSettings.update`
Maps Admin	Now GA	The role `roles/mapsadmin.admin` (Maps API Admin) is now GA.
Maps Admin	Now GA	The role `roles/mapsadmin.viewer` (Maps API Viewer) is now GA.
Security Command Center	Role Updated	The following permissions have been added to the role `roles/securitycenter.controlServiceAgent` (Security Center Control Service Agent): `orgpolicy.policies.list`
Security Command Center	Role Updated	The following permissions have been added to the role `roles/securitycenter.serviceAgent` (Security Center Service Agent): `orgpolicy.policies.list`
Service Security Insights	Role Added	The role `roles/servicesecurityinsights.securityInsightsViewer` (Security Insights Viewer) has been added with the following permissions: `servicesecurityinsights.clusterSecurityInfo.get` `servicesecurityinsights.clusterSecurityInfo.list` `servicesecurityinsights.clusters.get` `servicesecurityinsights.clusters.list` `servicesecurityinsights.googleapis.com/clusterSecurityInfo.get` `servicesecurityinsights.googleapis.com/clusterSecurityInfo.list` `servicesecurityinsights.googleapis.com/clusters.get` `servicesecurityinsights.googleapis.com/clusters.list` `servicesecurityinsights.googleapis.com/locations.get` `servicesecurityinsights.googleapis.com/locations.list` `servicesecurityinsights.googleapis.com/namespaces.get` `servicesecurityinsights.googleapis.com/namespaces.list` `servicesecurityinsights.googleapis.com/policies.get` `servicesecurityinsights.googleapis.com/policyTypes.get` `servicesecurityinsights.googleapis.com/policyTypes.list` `servicesecurityinsights.googleapis.com/projectStates.get` `servicesecurityinsights.googleapis.com/securityInfo.list` `servicesecurityinsights.googleapis.com/securityViews.get` `servicesecurityinsights.googleapis.com/workloadPolicies.list` `servicesecurityinsights.googleapis.com/workloadSecurityInfo.get` `servicesecurityinsights.googleapis.com/workloadTypes.get` `servicesecurityinsights.googleapis.com/workloadTypes.list` `servicesecurityinsights.googleapis.com/workloads.get` `servicesecurityinsights.googleapis.com/workloads.list` `servicesecurityinsights.locations.get` `servicesecurityinsights.locations.list` `servicesecurityinsights.namespaces.get` `servicesecurityinsights.namespaces.list` `servicesecurityinsights.policies.get` `servicesecurityinsights.policyTypes.get` `servicesecurityinsights.policyTypes.list` `servicesecurityinsights.projectStates.get` `servicesecurityinsights.securityInfo.list` `servicesecurityinsights.securityViews.get` `servicesecurityinsights.workloadPolicies.list` `servicesecurityinsights.workloadSecurityInfo.get` `servicesecurityinsights.workloadTypes.get` `servicesecurityinsights.workloadTypes.list` `servicesecurityinsights.workloads.get` `servicesecurityinsights.workloads.list`
Apigee	Added	`apigee.keyvaluemapentries.create` `apigee.keyvaluemapentries.delete` `apigee.keyvaluemapentries.get`
Apigee	Supported In Custom Roles	`apigee.keyvaluemapentries.create` `apigee.keyvaluemapentries.delete` `apigee.keyvaluemapentries.get`
Apigee	Now GA	`apigee.keyvaluemapentries.create` `apigee.keyvaluemapentries.delete` `apigee.keyvaluemapentries.get`
Artifact Registry	Added	`artifactregistry.locations.get` `artifactregistry.locations.list`
Artifact Registry	Supported In Custom Roles	`artifactregistry.locations.get` `artifactregistry.locations.list`
Artifact Registry	Now GA	`artifactregistry.locations.get` `artifactregistry.locations.list`
Care Studio	Added	`carestudio.patients.get` `carestudio.patients.list`
Identity-Aware Proxy	Added	`iap.tunnelDestGroups.accessViaIAP` `iap.tunnelDestGroups.create` `iap.tunnelDestGroups.delete` `iap.tunnelDestGroups.get` `iap.tunnelDestGroups.getIamPolicy` `iap.tunnelDestGroups.list` `iap.tunnelDestGroups.setIamPolicy` `iap.tunnelDestGroups.update` `iap.tunnelLocations.getIamPolicy` `iap.tunnelLocations.setIamPolicy`
Identity-Aware Proxy	Supported In Custom Roles	`iap.tunnelDestGroups.accessViaIAP` `iap.tunnelDestGroups.create` `iap.tunnelDestGroups.delete` `iap.tunnelDestGroups.get` `iap.tunnelDestGroups.getIamPolicy` `iap.tunnelDestGroups.list` `iap.tunnelDestGroups.setIamPolicy` `iap.tunnelDestGroups.update` `iap.tunnelLocations.getIamPolicy` `iap.tunnelLocations.setIamPolicy`
Maps Admin	Added	`mapsadmin.clientMaps.create` `mapsadmin.clientMaps.delete` `mapsadmin.clientMaps.get` `mapsadmin.clientMaps.list` `mapsadmin.clientMaps.update` `mapsadmin.clientStyleActivationRules.update` `mapsadmin.clientStyleSheetSnapshots.list` `mapsadmin.clientStyleSheetSnapshots.update` `mapsadmin.clientStyles.create` `mapsadmin.clientStyles.delete` `mapsadmin.clientStyles.get` `mapsadmin.clientStyles.list` `mapsadmin.clientStyles.update` `mapsadmin.styleEditorConfigs.get`
Maps Admin	Supported In Custom Roles	`mapsadmin.clientMaps.create` `mapsadmin.clientMaps.delete` `mapsadmin.clientMaps.get` `mapsadmin.clientMaps.list` `mapsadmin.clientMaps.update` `mapsadmin.clientStyleActivationRules.update` `mapsadmin.clientStyleSheetSnapshots.list` `mapsadmin.clientStyleSheetSnapshots.update` `mapsadmin.clientStyles.create` `mapsadmin.clientStyles.delete` `mapsadmin.clientStyles.get` `mapsadmin.clientStyles.list` `mapsadmin.clientStyles.update` `mapsadmin.styleEditorConfigs.get`
Maps Admin	Now GA	`mapsadmin.clientMaps.create` `mapsadmin.clientMaps.delete` `mapsadmin.clientMaps.get` `mapsadmin.clientMaps.list` `mapsadmin.clientMaps.update` `mapsadmin.clientStyleActivationRules.update` `mapsadmin.clientStyleSheetSnapshots.list` `mapsadmin.clientStyleSheetSnapshots.update` `mapsadmin.clientStyles.create` `mapsadmin.clientStyles.delete` `mapsadmin.clientStyles.get` `mapsadmin.clientStyles.list` `mapsadmin.clientStyles.update` `mapsadmin.styleEditorConfigs.get`
Certificate Authority Service	Added	`privateca.caPools.use`
Certificate Authority Service	Now GA	`privateca.caPools.use`

Cloud IAM changes as of 2022-05-06

Service	Change	Description
Cloud Billing	Now GA	The role `roles/billing.carbonViewer` (Carbon Footprint Viewer) is now GA.
Cloud Run functions	Role Updated	The following permissions have been added to the role `roles/cloudfunctions.developer` (Cloud Functions Developer): `run.operations.delete` `run.operations.get` `run.operations.list`
Cloud Run functions	Role Updated	The following permissions have been added to the role `roles/cloudfunctions.serviceAgent` (Cloud Functions Service Agent): `run.operations.delete` `run.operations.get` `run.operations.list`
Firebase App Check	Now GA	The role `roles/firebaseappcheck.admin` (Firebase App Check Admin) is now GA.
Firebase App Check	Now GA	The role `roles/firebaseappcheck.viewer` (Firebase App Check Viewer) is now GA.
Recommender	Now GA	The role `roles/recommender.gmpAdmin` (Google Maps Platform Insights/Recommendations Admin) is now GA.
Recommender	Now GA	The role `roles/recommender.gmpViewer` (Google Maps Platform Insights/Recommendations Viewer) is now GA.
Cloud Run	Role Updated	The following permissions have been added to the role `roles/run.developer` (Cloud Run Developer): `run.operations.delete` `run.operations.get` `run.operations.list`
Container Security	Added	`containersecurity.clusterSummaries.list` `containersecurity.workloadConfigAudits.list`
Container Security	Supported In Custom Roles	`containersecurity.clusterSummaries.list` `containersecurity.workloadConfigAudits.list`
Eventarc	Added	`eventarc.channelConnections.create` `eventarc.channelConnections.delete` `eventarc.channelConnections.get` `eventarc.channelConnections.getIamPolicy` `eventarc.channelConnections.list` `eventarc.channelConnections.publish` `eventarc.channelConnections.setIamPolicy`
Eventarc	Supported In Custom Roles	`eventarc.channelConnections.create` `eventarc.channelConnections.delete` `eventarc.channelConnections.get` `eventarc.channelConnections.getIamPolicy` `eventarc.channelConnections.list` `eventarc.channelConnections.publish` `eventarc.channelConnections.setIamPolicy`
Firebase App Check	Added	`firebaseappcheck.recaptchaV3Config.get` `firebaseappcheck.recaptchaV3Config.update`
Firebase App Check	Now GA	`firebaseappcheck.appAttestConfig.get` `firebaseappcheck.appAttestConfig.update` `firebaseappcheck.debugTokens.get` `firebaseappcheck.debugTokens.update` `firebaseappcheck.deviceCheckConfig.get` `firebaseappcheck.deviceCheckConfig.update` `firebaseappcheck.playIntegrityConfig.get` `firebaseappcheck.playIntegrityConfig.update` `firebaseappcheck.recaptchaEnterpriseConfig.get` `firebaseappcheck.recaptchaEnterpriseConfig.update` `firebaseappcheck.recaptchaV3Config.get` `firebaseappcheck.recaptchaV3Config.update` `firebaseappcheck.safetyNetConfig.get` `firebaseappcheck.safetyNetConfig.update` `firebaseappcheck.services.get` `firebaseappcheck.services.update`
Managed Service for Microsoft Active Directory	Added	`managedidentities.domains.extendSchema`
Managed Service for Microsoft Active Directory	Supported In Custom Roles	`managedidentities.domains.extendSchema`
Recommender	Added	`recommender.gmpProjectManagementInsights.get` `recommender.gmpProjectManagementInsights.list` `recommender.gmpProjectManagementInsights.update` `recommender.gmpProjectManagementRecommendations.get` `recommender.gmpProjectManagementRecommendations.list` `recommender.gmpProjectManagementRecommendations.update` `recommender.gmpProjectProductSuggestionsInsights.get` `recommender.gmpProjectProductSuggestionsInsights.list` `recommender.gmpProjectProductSuggestionsInsights.update` `recommender.gmpProjectProductSuggestionsRecommendations.get` `recommender.gmpProjectProductSuggestionsRecommendations.list` `recommender.gmpProjectProductSuggestionsRecommendations.update` `recommender.gmpProjectQuotaInsights.get` `recommender.gmpProjectQuotaInsights.list` `recommender.gmpProjectQuotaInsights.update` `recommender.gmpProjectQuotaRecommendations.get` `recommender.gmpProjectQuotaRecommendations.list` `recommender.gmpProjectQuotaRecommendations.update`
Recommender	Supported In Custom Roles	`recommender.gmpProjectManagementInsights.get` `recommender.gmpProjectManagementInsights.list` `recommender.gmpProjectManagementInsights.update` `recommender.gmpProjectManagementRecommendations.get` `recommender.gmpProjectManagementRecommendations.list` `recommender.gmpProjectManagementRecommendations.update` `recommender.gmpProjectProductSuggestionsInsights.get` `recommender.gmpProjectProductSuggestionsInsights.list` `recommender.gmpProjectProductSuggestionsInsights.update` `recommender.gmpProjectProductSuggestionsRecommendations.get` `recommender.gmpProjectProductSuggestionsRecommendations.list` `recommender.gmpProjectProductSuggestionsRecommendations.update` `recommender.gmpProjectQuotaInsights.get` `recommender.gmpProjectQuotaInsights.list` `recommender.gmpProjectQuotaInsights.update` `recommender.gmpProjectQuotaRecommendations.get` `recommender.gmpProjectQuotaRecommendations.list` `recommender.gmpProjectQuotaRecommendations.update`
Recommender	Now GA	`recommender.gmpProjectManagementInsights.get` `recommender.gmpProjectManagementInsights.list` `recommender.gmpProjectManagementInsights.update` `recommender.gmpProjectManagementRecommendations.get` `recommender.gmpProjectManagementRecommendations.list` `recommender.gmpProjectManagementRecommendations.update` `recommender.gmpProjectProductSuggestionsInsights.get` `recommender.gmpProjectProductSuggestionsInsights.list` `recommender.gmpProjectProductSuggestionsInsights.update` `recommender.gmpProjectProductSuggestionsRecommendations.get` `recommender.gmpProjectProductSuggestionsRecommendations.list` `recommender.gmpProjectProductSuggestionsRecommendations.update` `recommender.gmpProjectQuotaInsights.get` `recommender.gmpProjectQuotaInsights.list` `recommender.gmpProjectQuotaInsights.update` `recommender.gmpProjectQuotaRecommendations.get` `recommender.gmpProjectQuotaRecommendations.list` `recommender.gmpProjectQuotaRecommendations.update`
Cloud Run	Added	`run.executions.delete` `run.executions.get` `run.executions.list` `run.jobs.create` `run.jobs.delete` `run.jobs.get` `run.jobs.getIamPolicy` `run.jobs.list` `run.jobs.run` `run.jobs.setIamPolicy` `run.jobs.update` `run.tasks.get` `run.tasks.list`
Cloud Run	Supported In Custom Roles	`run.jobs.run` `run.jobs.update`
Cloud Run	Now GA	`run.executions.delete` `run.executions.get` `run.executions.list` `run.jobs.create` `run.jobs.delete` `run.jobs.get` `run.jobs.getIamPolicy` `run.jobs.list` `run.jobs.run` `run.jobs.setIamPolicy` `run.jobs.update` `run.tasks.get` `run.tasks.list`
Service Security Insights	Added	`servicesecurityinsights.clusterSecurityInfo.get` `servicesecurityinsights.clusterSecurityInfo.list` `servicesecurityinsights.policies.get` `servicesecurityinsights.projectStates.get` `servicesecurityinsights.securityViews.get` `servicesecurityinsights.workloadPolicies.list` `servicesecurityinsights.workloadSecurityInfo.get`

Cloud IAM changes as of 2022-04-29

Service	Change	Description
Apigee	Role Updated	The following permissions have been added to the role `roles/apigee.apiAdminV2` (Apigee API Admin): `apigee.keyvaluemaps.create` `apigee.keyvaluemaps.delete`
Content Warehouse	Role Updated	The following permissions have been removed from the role `roles/contentwarehouse.documentEditor` (Content Warehouse Document Editor): `contentwarehouse.documents.create` `contentwarehouse.documents.delete` `contentwarehouse.documents.setIamPolicy`
Dataflow	Role Updated	The following permissions have been added to the role `roles/dataflow.admin` (Dataflow Admin): `cloudbuild.builds.create` `cloudbuild.builds.get` `cloudbuild.builds.list` `cloudbuild.builds.update` `remotebuildexecution.blobs.get`
Dataflow	Role Updated	The following permissions have been added to the role `roles/dataflow.developer` (Dataflow Developer): `cloudbuild.builds.create` `cloudbuild.builds.get` `cloudbuild.builds.list` `cloudbuild.builds.update` `remotebuildexecution.blobs.get`
Dataflow	Role Updated	The following permissions have been added to the role `roles/dataflow.serviceAgent` (Cloud Dataflow Service Agent): `dataflow.jobs.cancel` `dataflow.jobs.create` `dataflow.jobs.get` `dataflow.jobs.list` `dataflow.jobs.snapshot` `dataflow.jobs.updateContents` `dataflow.messages.list` `dataflow.metrics.get` `dataflow.snapshots.delete` `dataflow.snapshots.get` `dataflow.snapshots.list` `recommender.dataflowDiagnosticsInsights.get` `recommender.dataflowDiagnosticsInsights.list` `recommender.dataflowDiagnosticsInsights.update` `serviceusage.services.use`
Data Pipelines	Role Updated	The following permissions have been added to the role `roles/datapipelines.serviceAgent` (Datapipelines Service Agent): `cloudbuild.builds.create` `cloudbuild.builds.get` `cloudbuild.builds.list` `cloudbuild.builds.update` `remotebuildexecution.blobs.get`
Dataprep by Trifacta	Role Updated	The following permissions have been added to the role `roles/dataprep.serviceAgent` (Dataprep Service Agent): `cloudbuild.builds.create` `cloudbuild.builds.get` `cloudbuild.builds.list` `cloudbuild.builds.update` `remotebuildexecution.blobs.get`
Firebase Mods	Role Updated	The following permissions have been added to the role `roles/firebasemods.serviceAgent` (Firebase Extensions API Service Agent): `iam.serviceAccounts.actAs`
Speech-to-Text	Role Updated	The following permissions have been added to the role `roles/speech.client` (Cloud Speech Client): `speech.customClasses.get` `speech.customClasses.list` `speech.phraseSets.get` `speech.phraseSets.list`
Apigee	Added	`apigee.datalocation.get`
Apigee	Supported In Custom Roles	`apigee.datalocation.get`
Apigee	Now GA	`apigee.datalocation.get`
Compute Engine	Added	`compute.instances.createTagBinding` `compute.instances.deleteTagBinding` `compute.instances.listTagBindings`
Compute Engine	Now GA	`compute.instances.createTagBinding` `compute.instances.deleteTagBinding` `compute.instances.listTagBindings`
Eventarc	Added	`eventarc.channels.create` `eventarc.channels.delete` `eventarc.channels.get` `eventarc.channels.getIamPolicy` `eventarc.channels.list` `eventarc.channels.publish` `eventarc.channels.setIamPolicy` `eventarc.channels.undelete` `eventarc.channels.update`
Eventarc	Supported In Custom Roles	`eventarc.channels.create` `eventarc.channels.delete` `eventarc.channels.get` `eventarc.channels.getIamPolicy` `eventarc.channels.list` `eventarc.channels.publish` `eventarc.channels.setIamPolicy` `eventarc.channels.undelete` `eventarc.channels.update`
Firebase App Check	Added	`firebaseappcheck.playIntegrityConfig.get` `firebaseappcheck.playIntegrityConfig.update`
Firebase App Check	Supported In Custom Roles	`firebaseappcheck.playIntegrityConfig.get` `firebaseappcheck.playIntegrityConfig.update`
Recommender	Added	`recommender.costInsights.get` `recommender.costInsights.list` `recommender.costInsights.update` `recommender.runServiceIdentityInsights.get` `recommender.runServiceIdentityInsights.list` `recommender.runServiceIdentityInsights.update` `recommender.runServiceIdentityRecommendations.get` `recommender.runServiceIdentityRecommendations.list` `recommender.runServiceIdentityRecommendations.update`
Recommender	Supported In Custom Roles	`recommender.runServiceIdentityInsights.get` `recommender.runServiceIdentityInsights.list` `recommender.runServiceIdentityInsights.update` `recommender.runServiceIdentityRecommendations.get` `recommender.runServiceIdentityRecommendations.list` `recommender.runServiceIdentityRecommendations.update`
Recommender	Now GA	`recommender.runServiceIdentityInsights.get` `recommender.runServiceIdentityInsights.list` `recommender.runServiceIdentityInsights.update` `recommender.runServiceIdentityRecommendations.get` `recommender.runServiceIdentityRecommendations.list` `recommender.runServiceIdentityRecommendations.update`

Cloud IAM changes as of 2022-04-22

Service	Change	Description
BigQuery Migration API	Now GA	The role `roles/bigquerymigration.editor` (MigrationWorkflow Editor) is now GA.
BigQuery Migration API	Now GA	The role `roles/bigquerymigration.orchestrator` (Task Orchestrator) is now GA.
BigQuery Migration API	Now GA	The role `roles/bigquerymigration.translationUser` (Migration Translation User) is now GA.
BigQuery Migration API	Now GA	The role `roles/bigquerymigration.viewer` (MigrationWorkflow Viewer) is now GA.
BigQuery Migration API	Now GA	The role `roles/bigquerymigration.worker` (Task Worker) is now GA.
Google Kubernetes Engine	Role Updated	The following permissions have been added to the role `roles/container.serviceAgent` (Kubernetes Engine Service Agent): `serviceusage.services.use`
Storage Transfer Service	Role Updated	The following permissions have been removed from the role `roles/storagetransfer.transferAgent` (Storage Transfer Agent): `pubsub.snapshots.seek`
BigQuery Migration API	Now GA	`bigquerymigration.locations.get` `bigquerymigration.locations.list` `bigquerymigration.subtaskTypes.executeTask` `bigquerymigration.subtasks.create` `bigquerymigration.subtasks.executeTask` `bigquerymigration.subtasks.get` `bigquerymigration.subtasks.list` `bigquerymigration.taskTypes.orchestrateTask` `bigquerymigration.translation.translate` `bigquerymigration.workflows.create` `bigquerymigration.workflows.delete` `bigquerymigration.workflows.get` `bigquerymigration.workflows.list` `bigquerymigration.workflows.orchestrateTask` `bigquerymigration.workflows.update` `bigquerymigration.workflows.writeLogs`
Cloud Key Management Service	Added	`cloudkms.keyRings.listEffectiveTags`
Cloud Key Management Service	Now GA	`cloudkms.keyRings.listEffectiveTags`
Cloud Optimization	Added	`cloudoptimization.operations.create` `cloudoptimization.operations.get`
Cloud Optimization	Supported In Custom Roles	`cloudoptimization.operations.create` `cloudoptimization.operations.get`
Cloud SQL	Added	`cloudsql.instances.listEffectiveTags` `cloudsql.users.get`
Cloud SQL	Supported In Custom Roles	`cloudsql.users.get`
Cloud SQL	Now GA	`cloudsql.instances.listEffectiveTags` `cloudsql.users.get`
Compute Engine	Added	`compute.disks.listEffectiveTags` `compute.images.listEffectiveTags` `compute.instances.listEffectiveTags` `compute.snapshots.listEffectiveTags`
Google Kubernetes Engine	Added	`container.clusters.createTagBinding` `container.clusters.deleteTagBinding` `container.clusters.listEffectiveTags` `container.clusters.listTagBindings`
Google Kubernetes Engine	Now GA	`container.clusters.createTagBinding` `container.clusters.deleteTagBinding` `container.clusters.listEffectiveTags` `container.clusters.listTagBindings`
Cloud Domains	Added	`domains.registrations.listEffectiveTags`
Cloud Domains	Now GA	`domains.registrations.listEffectiveTags`
Filestore	Added	`file.backups.listEffectiveTags` `file.instances.listEffectiveTags` `file.snapshots.listEffectiveTags`
GKE Hub	Supported In Custom Roles	`gkehub.features.create` `gkehub.features.delete` `gkehub.features.get` `gkehub.features.getIamPolicy` `gkehub.features.list` `gkehub.features.setIamPolicy` `gkehub.features.update`
Managed Service for Microsoft Active Directory	Added	`managedidentities.domains.listEffectiveTags`
Managed Service for Microsoft Active Directory	Now GA	`managedidentities.domains.listEffectiveTags`
Recommender	Added	`recommender.computeInstanceCpuUsageInsights.get` `recommender.computeInstanceCpuUsageInsights.list` `recommender.computeInstanceCpuUsageInsights.update` `recommender.computeInstanceCpuUsagePredictionInsights.get` `recommender.computeInstanceCpuUsagePredictionInsights.list` `recommender.computeInstanceCpuUsagePredictionInsights.update` `recommender.computeInstanceCpuUsageTrendInsights.get` `recommender.computeInstanceCpuUsageTrendInsights.list` `recommender.computeInstanceCpuUsageTrendInsights.update` `recommender.computeInstanceGroupManagerCpuUsageInsights.get` `recommender.computeInstanceGroupManagerCpuUsageInsights.list` `recommender.computeInstanceGroupManagerCpuUsageInsights.update` `recommender.computeInstanceGroupManagerCpuUsagePredictionInsights.get` `recommender.computeInstanceGroupManagerCpuUsagePredictionInsights.list` `recommender.computeInstanceGroupManagerCpuUsagePredictionInsights.update` `recommender.computeInstanceGroupManagerCpuUsageTrendInsights.get` `recommender.computeInstanceGroupManagerCpuUsageTrendInsights.list` `recommender.computeInstanceGroupManagerCpuUsageTrendInsights.update` `recommender.computeInstanceGroupManagerMemoryUsageInsights.get` `recommender.computeInstanceGroupManagerMemoryUsageInsights.list` `recommender.computeInstanceGroupManagerMemoryUsageInsights.update` `recommender.computeInstanceGroupManagerMemoryUsagePredictionInsights.get` `recommender.computeInstanceGroupManagerMemoryUsagePredictionInsights.list` `recommender.computeInstanceGroupManagerMemoryUsagePredictionInsights.update` `recommender.computeInstanceMemoryUsageInsights.get` `recommender.computeInstanceMemoryUsageInsights.list` `recommender.computeInstanceMemoryUsageInsights.update` `recommender.computeInstanceMemoryUsagePredictionInsights.get` `recommender.computeInstanceMemoryUsagePredictionInsights.list` `recommender.computeInstanceMemoryUsagePredictionInsights.update` `recommender.computeInstanceNetworkThroughputInsights.get` `recommender.computeInstanceNetworkThroughputInsights.list` `recommender.computeInstanceNetworkThroughputInsights.update` `recommender.spendBasedCommitmentInsights.get` `recommender.spendBasedCommitmentInsights.list` `recommender.spendBasedCommitmentInsights.update` `recommender.spendBasedCommitmentRecommendations.get` `recommender.spendBasedCommitmentRecommendations.list` `recommender.spendBasedCommitmentRecommendations.update`
Recommender	Supported In Custom Roles	`recommender.computeInstanceCpuUsageInsights.get` `recommender.computeInstanceCpuUsageInsights.list` `recommender.computeInstanceCpuUsageInsights.update` `recommender.computeInstanceCpuUsagePredictionInsights.get` `recommender.computeInstanceCpuUsagePredictionInsights.list` `recommender.computeInstanceCpuUsagePredictionInsights.update` `recommender.computeInstanceCpuUsageTrendInsights.get` `recommender.computeInstanceCpuUsageTrendInsights.list` `recommender.computeInstanceCpuUsageTrendInsights.update` `recommender.computeInstanceGroupManagerCpuUsageInsights.get` `recommender.computeInstanceGroupManagerCpuUsageInsights.list` `recommender.computeInstanceGroupManagerCpuUsageInsights.update` `recommender.computeInstanceGroupManagerCpuUsagePredictionInsights.get` `recommender.computeInstanceGroupManagerCpuUsagePredictionInsights.list` `recommender.computeInstanceGroupManagerCpuUsagePredictionInsights.update` `recommender.computeInstanceGroupManagerCpuUsageTrendInsights.get` `recommender.computeInstanceGroupManagerCpuUsageTrendInsights.list` `recommender.computeInstanceGroupManagerCpuUsageTrendInsights.update` `recommender.computeInstanceGroupManagerMemoryUsageInsights.get` `recommender.computeInstanceGroupManagerMemoryUsageInsights.list` `recommender.computeInstanceGroupManagerMemoryUsageInsights.update` `recommender.computeInstanceGroupManagerMemoryUsagePredictionInsights.get` `recommender.computeInstanceGroupManagerMemoryUsagePredictionInsights.list` `recommender.computeInstanceGroupManagerMemoryUsagePredictionInsights.update` `recommender.computeInstanceMemoryUsageInsights.get` `recommender.computeInstanceMemoryUsageInsights.list` `recommender.computeInstanceMemoryUsageInsights.update` `recommender.computeInstanceMemoryUsagePredictionInsights.get` `recommender.computeInstanceMemoryUsagePredictionInsights.list` `recommender.computeInstanceMemoryUsagePredictionInsights.update` `recommender.computeInstanceNetworkThroughputInsights.get` `recommender.computeInstanceNetworkThroughputInsights.list` `recommender.computeInstanceNetworkThroughputInsights.update` `recommender.spendBasedCommitmentInsights.get` `recommender.spendBasedCommitmentInsights.list` `recommender.spendBasedCommitmentInsights.update` `recommender.spendBasedCommitmentRecommendations.get` `recommender.spendBasedCommitmentRecommendations.list` `recommender.spendBasedCommitmentRecommendations.update`
Recommender	Now GA	`recommender.computeInstanceCpuUsageInsights.get` `recommender.computeInstanceCpuUsageInsights.list` `recommender.computeInstanceCpuUsageInsights.update` `recommender.computeInstanceCpuUsagePredictionInsights.get` `recommender.computeInstanceCpuUsagePredictionInsights.list` `recommender.computeInstanceCpuUsagePredictionInsights.update` `recommender.computeInstanceCpuUsageTrendInsights.get` `recommender.computeInstanceCpuUsageTrendInsights.list` `recommender.computeInstanceCpuUsageTrendInsights.update` `recommender.computeInstanceGroupManagerCpuUsageInsights.get` `recommender.computeInstanceGroupManagerCpuUsageInsights.list` `recommender.computeInstanceGroupManagerCpuUsageInsights.update` `recommender.computeInstanceGroupManagerCpuUsagePredictionInsights.get` `recommender.computeInstanceGroupManagerCpuUsagePredictionInsights.list` `recommender.computeInstanceGroupManagerCpuUsagePredictionInsights.update` `recommender.computeInstanceGroupManagerCpuUsageTrendInsights.get` `recommender.computeInstanceGroupManagerCpuUsageTrendInsights.list` `recommender.computeInstanceGroupManagerCpuUsageTrendInsights.update` `recommender.computeInstanceGroupManagerMemoryUsageInsights.get` `recommender.computeInstanceGroupManagerMemoryUsageInsights.list` `recommender.computeInstanceGroupManagerMemoryUsageInsights.update` `recommender.computeInstanceGroupManagerMemoryUsagePredictionInsights.get` `recommender.computeInstanceGroupManagerMemoryUsagePredictionInsights.list` `recommender.computeInstanceGroupManagerMemoryUsagePredictionInsights.update` `recommender.computeInstanceMemoryUsageInsights.get` `recommender.computeInstanceMemoryUsageInsights.list` `recommender.computeInstanceMemoryUsageInsights.update` `recommender.computeInstanceMemoryUsagePredictionInsights.get` `recommender.computeInstanceMemoryUsagePredictionInsights.list` `recommender.computeInstanceMemoryUsagePredictionInsights.update` `recommender.computeInstanceNetworkThroughputInsights.get` `recommender.computeInstanceNetworkThroughputInsights.list` `recommender.computeInstanceNetworkThroughputInsights.update`
Resource Manager	Added	`resourcemanager.hierarchyNodes.listEffectiveTags`
Spanner	Added	`spanner.backups.copy`
Spanner	Supported In Custom Roles	`spanner.backups.copy`
Spanner	Now GA	`spanner.backups.copy`
Cloud Storage	Added	`storage.buckets.listEffectiveTags`
Cloud Storage	Now GA	`storage.buckets.listEffectiveTags`

Cloud IAM changes as of 2022-04-15

Service	Change	Description
Vertex AI	Role Updated	The following permissions have been added to the role `roles/aiplatform.featurestoreDataViewer` (Vertex AI Feature Store Data Viewer): `aiplatform.entityTypes.exportFeatureValues`
Vertex AI	Role Updated	The following permissions have been added to the role `roles/aiplatform.featurestoreDataWriter` (Vertex AI Feature Store Data Writer): `aiplatform.entityTypes.exportFeatureValues`
Cloud Run functions	Role Updated	The following permissions have been added to the role `roles/cloudfunctions.serviceAgent` (Cloud Functions Service Agent): `cloudfunctions.functions.get` `cloudfunctions.functions.list` `cloudfunctions.operations.get` `cloudfunctions.operations.list`
Dataplex	Role Updated	The following permissions have been added to the role `roles/dataplex.editor` (Dataplex Editor): `dataplex.tasks.create` `dataplex.tasks.update`
Speech-to-Text	Now GA	The role `roles/speech.serviceAgent` (Cloud Speech-to-Text Service Agent) is now GA.
BigQuery	Added	`bigquery.dataPolicies.create` `bigquery.dataPolicies.delete` `bigquery.dataPolicies.get` `bigquery.dataPolicies.getIamPolicy` `bigquery.dataPolicies.list` `bigquery.dataPolicies.maskedGet` `bigquery.dataPolicies.setIamPolicy` `bigquery.dataPolicies.update`
BigQuery Migration API	Added	`bigquerymigration.locations.get` `bigquerymigration.locations.list` `bigquerymigration.subtaskTypes.executeTask` `bigquerymigration.subtasks.create` `bigquerymigration.subtasks.executeTask` `bigquerymigration.subtasks.get` `bigquerymigration.subtasks.list` `bigquerymigration.taskTypes.orchestrateTask` `bigquerymigration.translation.translate` `bigquerymigration.workflows.create` `bigquerymigration.workflows.delete` `bigquerymigration.workflows.get` `bigquerymigration.workflows.list` `bigquerymigration.workflows.orchestrateTask` `bigquerymigration.workflows.update` `bigquerymigration.workflows.writeLogs`
Compute Engine	Added	`compute.packetMirrorings.create` `compute.packetMirrorings.delete` `compute.packetMirrorings.get` `compute.packetMirrorings.list`
Compute Engine	Now GA	`compute.packetMirrorings.create` `compute.packetMirrorings.delete` `compute.packetMirrorings.get` `compute.packetMirrorings.list`

Cloud IAM changes as of 2022-04-08

Service	Change	Description
Assured Workloads	Role Updated	The following permissions have been removed from the role `roles/assuredworkloads.serviceAgent` (Assured Workloads Service Agent): `cloudasset.assets.exportResource` `cloudasset.feeds.create` `cloudasset.feeds.delete` `cloudasset.feeds.get` `cloudasset.feeds.update`
Cloud Data Fusion	Role Updated	The following permissions have been added to the role `roles/datafusion.serviceAgent` (Cloud Data Fusion API Service Agent): `dns.managedZones.create` `dns.managedZones.delete` `dns.managedZones.get` `dns.managedZones.list` `dns.networks.bindPrivateDNSZone` `dns.networks.targetWithPeeringZone`
Dataproc	Role Updated	The following permissions have been added to the role `roles/dataproc.serviceAgent` (Dataproc Service Agent): `container.clusterRoleBindings.create` `container.clusterRoleBindings.delete` `container.clusterRoleBindings.get` `container.clusterRoleBindings.list` `container.clusterRoleBindings.update` `container.clusterRoles.bind` `container.clusterRoles.create` `container.clusterRoles.delete` `container.clusterRoles.escalate` `container.clusterRoles.get` `container.clusterRoles.list` `container.clusterRoles.update` `container.clusters.get` `container.clusters.update` `container.customResourceDefinitions.create` `container.customResourceDefinitions.delete` `container.customResourceDefinitions.get` `container.customResourceDefinitions.list` `container.customResourceDefinitions.update` `container.namespaces.create` `container.namespaces.delete` `container.namespaces.get` `container.namespaces.list` `container.namespaces.update` `container.operations.get` `container.roleBindings.create` `container.roleBindings.delete` `container.roleBindings.get` `container.roleBindings.list` `container.roleBindings.update` `container.roles.bind` `container.roles.escalate`
Recommender	Now GA	The role `roles/recommender.errorReportingAdmin` (Error Reporting Recommender Admin) is now GA.
Recommender	Now GA	The role `roles/recommender.errorReportingViewer` (Error Reporting Recommender Viewer) is now GA.
Apigee Registry	Added	`apigeeregistry.apis.create` `apigeeregistry.apis.delete` `apigeeregistry.apis.get` `apigeeregistry.apis.getIamPolicy` `apigeeregistry.apis.list` `apigeeregistry.apis.setIamPolicy` `apigeeregistry.apis.update` `apigeeregistry.artifacts.create` `apigeeregistry.artifacts.delete` `apigeeregistry.artifacts.get` `apigeeregistry.artifacts.getIamPolicy` `apigeeregistry.artifacts.list` `apigeeregistry.artifacts.setIamPolicy` `apigeeregistry.artifacts.update` `apigeeregistry.deployments.create` `apigeeregistry.deployments.delete` `apigeeregistry.deployments.get` `apigeeregistry.deployments.list` `apigeeregistry.deployments.update` `apigeeregistry.instances.get` `apigeeregistry.instances.update` `apigeeregistry.locations.get` `apigeeregistry.locations.list` `apigeeregistry.operations.cancel` `apigeeregistry.operations.delete` `apigeeregistry.operations.get` `apigeeregistry.operations.list` `apigeeregistry.specs.create` `apigeeregistry.specs.delete` `apigeeregistry.specs.get` `apigeeregistry.specs.getIamPolicy` `apigeeregistry.specs.list` `apigeeregistry.specs.setIamPolicy` `apigeeregistry.specs.update` `apigeeregistry.versions.create` `apigeeregistry.versions.delete` `apigeeregistry.versions.get` `apigeeregistry.versions.getIamPolicy` `apigeeregistry.versions.list` `apigeeregistry.versions.setIamPolicy` `apigeeregistry.versions.update`
Apigee Registry	Supported In Custom Roles	`apigeeregistry.apis.create` `apigeeregistry.apis.delete` `apigeeregistry.apis.get` `apigeeregistry.apis.getIamPolicy` `apigeeregistry.apis.list` `apigeeregistry.apis.setIamPolicy` `apigeeregistry.apis.update` `apigeeregistry.artifacts.create` `apigeeregistry.artifacts.delete` `apigeeregistry.artifacts.get` `apigeeregistry.artifacts.getIamPolicy` `apigeeregistry.artifacts.list` `apigeeregistry.artifacts.setIamPolicy` `apigeeregistry.artifacts.update` `apigeeregistry.deployments.create` `apigeeregistry.deployments.delete` `apigeeregistry.deployments.get` `apigeeregistry.deployments.list` `apigeeregistry.deployments.update` `apigeeregistry.instances.get` `apigeeregistry.instances.update` `apigeeregistry.locations.get` `apigeeregistry.locations.list` `apigeeregistry.operations.cancel` `apigeeregistry.operations.delete` `apigeeregistry.operations.get` `apigeeregistry.operations.list` `apigeeregistry.specs.create` `apigeeregistry.specs.delete` `apigeeregistry.specs.get` `apigeeregistry.specs.getIamPolicy` `apigeeregistry.specs.list` `apigeeregistry.specs.setIamPolicy` `apigeeregistry.specs.update` `apigeeregistry.versions.create` `apigeeregistry.versions.delete` `apigeeregistry.versions.get` `apigeeregistry.versions.getIamPolicy` `apigeeregistry.versions.list` `apigeeregistry.versions.setIamPolicy` `apigeeregistry.versions.update`
Google Distributed Cloud	Added	`gkeonprem.locations.get` `gkeonprem.locations.list` `gkeonprem.operations.cancel` `gkeonprem.operations.delete` `gkeonprem.operations.get` `gkeonprem.operations.list` `gkeonprem.vmwareClusters.create` `gkeonprem.vmwareClusters.delete` `gkeonprem.vmwareClusters.enroll` `gkeonprem.vmwareClusters.get` `gkeonprem.vmwareClusters.getIamPolicy` `gkeonprem.vmwareClusters.list` `gkeonprem.vmwareClusters.setIamPolicy` `gkeonprem.vmwareClusters.unenroll` `gkeonprem.vmwareClusters.update` `gkeonprem.vmwareNodePools.create` `gkeonprem.vmwareNodePools.delete` `gkeonprem.vmwareNodePools.get` `gkeonprem.vmwareNodePools.getIamPolicy` `gkeonprem.vmwareNodePools.list` `gkeonprem.vmwareNodePools.setIamPolicy` `gkeonprem.vmwareNodePools.update`
Google Distributed Cloud	Supported In Custom Roles	`gkeonprem.locations.get` `gkeonprem.locations.list` `gkeonprem.operations.cancel` `gkeonprem.operations.delete` `gkeonprem.operations.get` `gkeonprem.operations.list` `gkeonprem.vmwareClusters.create` `gkeonprem.vmwareClusters.delete` `gkeonprem.vmwareClusters.enroll` `gkeonprem.vmwareClusters.get` `gkeonprem.vmwareClusters.getIamPolicy` `gkeonprem.vmwareClusters.list` `gkeonprem.vmwareClusters.setIamPolicy` `gkeonprem.vmwareClusters.unenroll` `gkeonprem.vmwareClusters.update` `gkeonprem.vmwareNodePools.create` `gkeonprem.vmwareNodePools.delete` `gkeonprem.vmwareNodePools.get` `gkeonprem.vmwareNodePools.getIamPolicy` `gkeonprem.vmwareNodePools.list` `gkeonprem.vmwareNodePools.setIamPolicy` `gkeonprem.vmwareNodePools.update`
Memorystore for Memcached	Added	`memcache.instances.rescheduleMaintenance`
Memorystore for Memcached	Supported In Custom Roles	`memcache.instances.rescheduleMaintenance`
Memorystore for Memcached	Now GA	`memcache.instances.rescheduleMaintenance`
Recommender	Now GA	`recommender.errorReportingInsights.get` `recommender.errorReportingInsights.list` `recommender.errorReportingInsights.update` `recommender.errorReportingRecommendations.get` `recommender.errorReportingRecommendations.list` `recommender.errorReportingRecommendations.update`
Resource Manager	Added	`resourcemanager.tagHolds.create` `resourcemanager.tagHolds.delete` `resourcemanager.tagHolds.list`
Resource Manager	Supported In Custom Roles	`resourcemanager.tagHolds.create` `resourcemanager.tagHolds.delete` `resourcemanager.tagHolds.list`

Cloud IAM changes as of 2022-04-01

Service	Change	Description
Apigee	Role Updated	The following permissions have been added to the role `roles/apigee.admin` (Apigee Organization Admin): `monitoring.timeSeries.list`
Apigee	Role Updated	The following permissions have been added to the role `roles/apigee.readOnlyAdmin` (Apigee Read-only Admin): `monitoring.timeSeries.list`
Bare Metal Solution	Role Updated	The following permissions have been added to the role `roles/baremetalsolution.admin` (Bare Metal Solution Admin): `baremetalsolution.luns.get` `baremetalsolution.luns.list`
Bare Metal Solution	Role Updated	The following permissions have been added to the role `roles/baremetalsolution.editor` (Bare Metal Solution Editor): `baremetalsolution.luns.get` `baremetalsolution.luns.list`
Bare Metal Solution	Role Updated	The following permissions have been added to the role `roles/baremetalsolution.viewer` (Bare Metal Solution Viewer): `baremetalsolution.luns.get` `baremetalsolution.luns.list`
Dataflow	Role Updated	The following permissions have been added to the role `roles/dataflow.admin` (Dataflow Admin): `recommender.dataflowDiagnosticsInsights.get` `recommender.dataflowDiagnosticsInsights.list` `recommender.dataflowDiagnosticsInsights.update`
Dataflow	Role Updated	The following permissions have been added to the role `roles/dataflow.developer` (Dataflow Developer): `recommender.dataflowDiagnosticsInsights.get` `recommender.dataflowDiagnosticsInsights.list` `recommender.dataflowDiagnosticsInsights.update`
Dataflow	Role Updated	The following permissions have been added to the role `roles/dataflow.viewer` (Dataflow Viewer): `recommender.dataflowDiagnosticsInsights.get` `recommender.dataflowDiagnosticsInsights.list`
Data Pipelines	Role Updated	The following permissions have been added to the role `roles/datapipelines.serviceAgent` (Datapipelines Service Agent): `recommender.dataflowDiagnosticsInsights.get` `recommender.dataflowDiagnosticsInsights.list` `recommender.dataflowDiagnosticsInsights.update`
Dataprep by Trifacta	Role Updated	The following permissions have been added to the role `roles/dataprep.serviceAgent` (Dataprep Service Agent): `recommender.dataflowDiagnosticsInsights.get` `recommender.dataflowDiagnosticsInsights.list` `recommender.dataflowDiagnosticsInsights.update`
Filestore	Added	`file.backups.createTagBinding` `file.backups.deleteTagBinding` `file.backups.listTagBindings` `file.instances.createTagBinding` `file.instances.deleteTagBinding` `file.instances.listTagBindings` `file.snapshots.createTagBinding` `file.snapshots.deleteTagBinding` `file.snapshots.listTagBindings`
GKE Hub	Available In Custom Roles	`gkehub.features.create` `gkehub.features.delete` `gkehub.features.get` `gkehub.features.getIamPolicy` `gkehub.features.list` `gkehub.features.setIamPolicy` `gkehub.features.update`
Notebooks	Added	`notebooks.runtimes.update`
Notebooks	Now GA	`notebooks.runtimes.update`

Cloud IAM changes as of 2022-03-25

Service	Change	Description
Recommendations	Role Updated	The following permissions have been added to the role `roles/automlrecommendations.admin` (Recommendations AI Admin): `retail.retailProjects.get`
Recommendations	Role Updated	The following permissions have been added to the role `roles/automlrecommendations.adminViewer` (Recommendations AI Admin Viewer): `retail.retailProjects.get`
Recommendations	Role Updated	The following permissions have been added to the role `roles/automlrecommendations.editor` (Recommendations AI Editor): `retail.retailProjects.get`
Recommendations	Role Updated	The following permissions have been added to the role `roles/automlrecommendations.viewer` (Recommendations AI Viewer): `retail.retailProjects.get`
Firewall Insights	Role Updated	The following permissions have been added to the role `roles/firewallinsights.serviceAgent` (Cloud Firewall Insights Service Agent): `compute.networks.getEffectiveFirewalls`
Cloud Run	Role Updated	The following permissions have been added to the role `roles/run.serviceAgent` (Cloud Run Service Agent): `binaryauthorization.platformPolicies.evaluatePolicy`
Cloud Run	Role Updated	The following permissions have been added to the role `roles/serverless.serviceAgent` (Cloud Run Service Agent): `binaryauthorization.platformPolicies.evaluatePolicy`
Advisory Notifications	Added	`advisorynotifications.notifications.get` `advisorynotifications.notifications.list`
Analytics Hub	Added	`analyticshub.dataExchanges.create` `analyticshub.dataExchanges.delete` `analyticshub.dataExchanges.get` `analyticshub.dataExchanges.getIamPolicy` `analyticshub.dataExchanges.list` `analyticshub.dataExchanges.setIamPolicy` `analyticshub.dataExchanges.update` `analyticshub.listings.create` `analyticshub.listings.delete` `analyticshub.listings.get` `analyticshub.listings.getIamPolicy` `analyticshub.listings.list` `analyticshub.listings.setIamPolicy` `analyticshub.listings.subscribe` `analyticshub.listings.update`
Analytics Hub	Supported In Custom Roles	`analyticshub.dataExchanges.create` `analyticshub.dataExchanges.delete` `analyticshub.dataExchanges.get` `analyticshub.dataExchanges.getIamPolicy` `analyticshub.dataExchanges.list` `analyticshub.dataExchanges.setIamPolicy` `analyticshub.dataExchanges.update` `analyticshub.listings.create` `analyticshub.listings.delete` `analyticshub.listings.get` `analyticshub.listings.getIamPolicy` `analyticshub.listings.list` `analyticshub.listings.setIamPolicy` `analyticshub.listings.subscribe` `analyticshub.listings.update`
Apigee	Added	`apigee.keyvaluemapentries.list`
Apigee	Supported In Custom Roles	`apigee.keyvaluemapentries.list`
Apigee	Now GA	`apigee.keyvaluemapentries.list`
Artifact Registry	Added	`artifactregistry.repositories.createTagBinding` `artifactregistry.repositories.deleteTagBinding` `artifactregistry.repositories.listEffectiveTags` `artifactregistry.repositories.listTagBindings`
Artifact Registry	Supported In Custom Roles	`artifactregistry.repositories.createTagBinding` `artifactregistry.repositories.deleteTagBinding` `artifactregistry.repositories.listEffectiveTags` `artifactregistry.repositories.listTagBindings`
Artifact Registry	Now GA	`artifactregistry.repositories.createTagBinding` `artifactregistry.repositories.deleteTagBinding` `artifactregistry.repositories.listEffectiveTags` `artifactregistry.repositories.listTagBindings`
BigQuery	Added	`bigquery.tables.createIndex` `bigquery.tables.deleteIndex`
BigQuery	Supported In Custom Roles	`bigquery.tables.createIndex` `bigquery.tables.deleteIndex`
Compute Engine	Added	`compute.backendBuckets.setSecurityPolicy`
Compute Engine	Now GA	`compute.backendBuckets.setSecurityPolicy`
Datastore	Supported In Custom Roles	`datastore.databases.create` `datastore.databases.getMetadata` `datastore.databases.list` `datastore.databases.update`
Cloud Domains	Added	`domains.registrations.createTagBinding` `domains.registrations.deleteTagBinding` `domains.registrations.listTagBindings`
Cloud Domains	Now GA	`domains.registrations.createTagBinding` `domains.registrations.deleteTagBinding` `domains.registrations.listTagBindings`
Retail API	Added	`retail.retailProjects.get`
Cloud Run	Added	`run.services.createTagBinding` `run.services.deleteTagBinding` `run.services.listEffectiveTags` `run.services.listTagBindings`
Cloud Run	Supported In Custom Roles	`run.services.createTagBinding` `run.services.deleteTagBinding` `run.services.listEffectiveTags` `run.services.listTagBindings`
Cloud Run	Now GA	`run.services.createTagBinding` `run.services.deleteTagBinding` `run.services.listEffectiveTags` `run.services.listTagBindings`

Cloud IAM changes as of 2022-03-18

Service	Change	Description
Assured Workloads	Role Updated	The following permissions have been added to the role `roles/assuredworkloads.admin` (Assured Workloads Administrator): `assuredworkloads.violations.get` `assuredworkloads.violations.list`
Assured Workloads	Role Updated	The following permissions have been added to the role `roles/assuredworkloads.editor` (Assured Workloads Editor): `assuredworkloads.violations.get` `assuredworkloads.violations.list`
Assured Workloads	Role Updated	The following permissions have been added to the role `roles/assuredworkloads.reader` (Assured Workloads Reader): `assuredworkloads.violations.get` `assuredworkloads.violations.list`
Bare Metal Solution	Now GA	The role `roles/baremetalsolution.lunsadmin` (Luns Admin) is now GA.
Bare Metal Solution	Now GA	The role `roles/baremetalsolution.lunsviewer` (Luns Viewer) is now GA.
Bare Metal Solution	Now GA	The role `roles/baremetalsolution.nfssharesadmin` (NFS Shares Admin) is now GA.
Bare Metal Solution	Now GA	The role `roles/baremetalsolution.nfsshareseditor` (NFS Shares Editor) is now GA.
Bare Metal Solution	Now GA	The role `roles/baremetalsolution.nfssharesviewer` (NFS Shares Viewer) is now GA.
Bare Metal Solution	Now GA	The role `roles/baremetalsolution.volumesadmin` (Volume Admin) is now GA.
Bare Metal Solution	Now GA	The role `roles/baremetalsolution.volumeseditor` (Volumes Editor) is now GA.
Bare Metal Solution	Now GA	The role `roles/baremetalsolution.volumessviewer` (Volumes Viewer) is now GA.
Bare Metal Solution	Role Updated	The following permissions have been added to the role `roles/baremetalsolution.editor` (Bare Metal Solution Editor): `baremetalsolution.instances.start`
Basic Role	Role Updated	The following permissions have been added to the role `roles/editor` (Editor): `assuredworkloads.violations.get` `assuredworkloads.violations.list`
Identity and Access Management	Role Updated	The following permissions have been added to the role `roles/iam.securityAdmin` (Security Admin): `assuredworkloads.violations.list`
Identity and Access Management	Role Updated	The following permissions have been added to the role `roles/iam.securityReviewer` (Security Reviewer): `assuredworkloads.violations.list`
Basic Role	Role Updated	The following permissions have been added to the role `roles/owner` (Owner): `assuredworkloads.violations.get` `assuredworkloads.violations.list`
Recommender	Now GA	The role `roles/recommender.dataflowDiagnosticsAdmin` (Dataflow Diagnostics Admin) is now GA.
Recommender	Now GA	The role `roles/recommender.dataflowDiagnosticsViewer` (Dataflow Diagnostics Viewer) is now GA.
Basic Role	Role Updated	The following permissions have been added to the role `roles/viewer` (Viewer): `assuredworkloads.violations.get` `assuredworkloads.violations.list`
Assured Workloads	Added	`assuredworkloads.violations.get` `assuredworkloads.violations.list`
Bare Metal Solution	Added	`baremetalsolution.instances.start` `baremetalsolution.instances.update` `baremetalsolution.networks.update` `baremetalsolution.nfsshares.get` `baremetalsolution.nfsshares.list` `baremetalsolution.nfsshares.update`
Bare Metal Solution	Supported In Custom Roles	`baremetalsolution.instances.start` `baremetalsolution.instances.update` `baremetalsolution.networks.update` `baremetalsolution.nfsshares.get` `baremetalsolution.nfsshares.list` `baremetalsolution.nfsshares.update`
Bare Metal Solution	Now GA	`baremetalsolution.instances.start` `baremetalsolution.instances.update` `baremetalsolution.networks.update` `baremetalsolution.nfsshares.get` `baremetalsolution.nfsshares.list` `baremetalsolution.nfsshares.update`
Recommender	Added	`recommender.dataflowDiagnosticsInsights.get` `recommender.dataflowDiagnosticsInsights.list` `recommender.dataflowDiagnosticsInsights.update` `recommender.errorReportingInsights.get` `recommender.errorReportingInsights.list` `recommender.errorReportingInsights.update` `recommender.errorReportingRecommendations.get` `recommender.errorReportingRecommendations.list` `recommender.errorReportingRecommendations.update`
Recommender	Supported In Custom Roles	`recommender.dataflowDiagnosticsInsights.get` `recommender.dataflowDiagnosticsInsights.list` `recommender.dataflowDiagnosticsInsights.update` `recommender.errorReportingInsights.get` `recommender.errorReportingInsights.list` `recommender.errorReportingInsights.update` `recommender.errorReportingRecommendations.get` `recommender.errorReportingRecommendations.list` `recommender.errorReportingRecommendations.update`
Recommender	Now GA	`recommender.dataflowDiagnosticsInsights.get` `recommender.dataflowDiagnosticsInsights.list` `recommender.dataflowDiagnosticsInsights.update`

Cloud IAM changes as of 2022-03-11

Service	Change	Description
App Engine flexible environment	Role Updated	The following permissions have been added to the role `roles/appengineflex.serviceAgent` (App Engine flexible environment Service Agent): `compute.routes.list`
Distributed Cloud Edge Container	Now GA	The role `roles/edgecontainer.admin` (Edge Container Admin) is now GA.
Distributed Cloud Edge Container	Now GA	The role `roles/edgecontainer.machineUser` (Edge Container Machine User) is now GA.
Distributed Cloud Edge Container	Now GA	The role `roles/edgecontainer.viewer` (Edge Container Viewer) is now GA.
Basic Role	Role Updated	The following permissions have been added to the role `roles/editor` (Editor): `servicedirectory.networks.attach`
Backup for GKE	Now GA	The role `roles/gkebackup.serviceAgent` (Backup for GKE Service Agent) is now GA.
Basic Role	Role Updated	The following permissions have been added to the role `roles/owner` (Owner): `servicedirectory.networks.attach`
Retail API	Role Updated	The following permissions have been added to the role `roles/retail.viewer` (Retail Viewer): `retail.attributesConfigs.exportCatalogAttributes` `retail.controls.export`
Basic Role	Role Updated	The following permissions have been added to the role `roles/viewer` (Viewer): `retail.attributesConfigs.exportCatalogAttributes` `retail.controls.export`
Distributed Cloud Edge Container	Added	`edgecontainer.clusters.create` `edgecontainer.clusters.delete` `edgecontainer.clusters.generateAccessToken` `edgecontainer.clusters.get` `edgecontainer.clusters.getIamPolicy` `edgecontainer.clusters.list` `edgecontainer.clusters.setIamPolicy` `edgecontainer.clusters.update` `edgecontainer.locations.get` `edgecontainer.locations.list` `edgecontainer.machines.create` `edgecontainer.machines.delete` `edgecontainer.machines.get` `edgecontainer.machines.getIamPolicy` `edgecontainer.machines.list` `edgecontainer.machines.setIamPolicy` `edgecontainer.machines.update` `edgecontainer.machines.use` `edgecontainer.nodePools.create` `edgecontainer.nodePools.delete` `edgecontainer.nodePools.get` `edgecontainer.nodePools.getIamPolicy` `edgecontainer.nodePools.list` `edgecontainer.nodePools.setIamPolicy` `edgecontainer.nodePools.update` `edgecontainer.operations.cancel` `edgecontainer.operations.delete` `edgecontainer.operations.get` `edgecontainer.operations.list` `edgecontainer.vpnConnections.create` `edgecontainer.vpnConnections.delete` `edgecontainer.vpnConnections.get` `edgecontainer.vpnConnections.getIamPolicy` `edgecontainer.vpnConnections.list` `edgecontainer.vpnConnections.setIamPolicy` `edgecontainer.vpnConnections.update`
Distributed Cloud Edge Container	Supported In Custom Roles	`edgecontainer.clusters.create` `edgecontainer.clusters.delete` `edgecontainer.clusters.generateAccessToken` `edgecontainer.clusters.get` `edgecontainer.clusters.getIamPolicy` `edgecontainer.clusters.list` `edgecontainer.clusters.setIamPolicy` `edgecontainer.clusters.update` `edgecontainer.locations.get` `edgecontainer.locations.list` `edgecontainer.machines.create` `edgecontainer.machines.delete` `edgecontainer.machines.get` `edgecontainer.machines.getIamPolicy` `edgecontainer.machines.list` `edgecontainer.machines.setIamPolicy` `edgecontainer.machines.update` `edgecontainer.machines.use` `edgecontainer.nodePools.create` `edgecontainer.nodePools.delete` `edgecontainer.nodePools.get` `edgecontainer.nodePools.getIamPolicy` `edgecontainer.nodePools.list` `edgecontainer.nodePools.setIamPolicy` `edgecontainer.nodePools.update` `edgecontainer.operations.cancel` `edgecontainer.operations.delete` `edgecontainer.operations.get` `edgecontainer.operations.list` `edgecontainer.vpnConnections.create` `edgecontainer.vpnConnections.delete` `edgecontainer.vpnConnections.get` `edgecontainer.vpnConnections.getIamPolicy` `edgecontainer.vpnConnections.list` `edgecontainer.vpnConnections.setIamPolicy` `edgecontainer.vpnConnections.update`
Distributed Cloud Edge Container	Now GA	`edgecontainer.clusters.create` `edgecontainer.clusters.delete` `edgecontainer.clusters.generateAccessToken` `edgecontainer.clusters.get` `edgecontainer.clusters.getIamPolicy` `edgecontainer.clusters.list` `edgecontainer.clusters.setIamPolicy` `edgecontainer.clusters.update` `edgecontainer.locations.get` `edgecontainer.locations.list` `edgecontainer.machines.create` `edgecontainer.machines.delete` `edgecontainer.machines.get` `edgecontainer.machines.getIamPolicy` `edgecontainer.machines.list` `edgecontainer.machines.setIamPolicy` `edgecontainer.machines.update` `edgecontainer.machines.use` `edgecontainer.nodePools.create` `edgecontainer.nodePools.delete` `edgecontainer.nodePools.get` `edgecontainer.nodePools.getIamPolicy` `edgecontainer.nodePools.list` `edgecontainer.nodePools.setIamPolicy` `edgecontainer.nodePools.update` `edgecontainer.operations.cancel` `edgecontainer.operations.delete` `edgecontainer.operations.get` `edgecontainer.operations.list` `edgecontainer.vpnConnections.create` `edgecontainer.vpnConnections.delete` `edgecontainer.vpnConnections.get` `edgecontainer.vpnConnections.getIamPolicy` `edgecontainer.vpnConnections.list` `edgecontainer.vpnConnections.setIamPolicy` `edgecontainer.vpnConnections.update`
Retail API	Added	`retail.attributesConfigs.addCatalogAttribute` `retail.attributesConfigs.batchRemoveCatalogAttributes` `retail.attributesConfigs.exportCatalogAttributes` `retail.attributesConfigs.importCatalogAttributes` `retail.attributesConfigs.removeCatalogAttribute` `retail.attributesConfigs.replaceCatalogAttribute` `retail.controls.export` `retail.controls.import`
Storage Transfer Service	Added	`storagetransfer.agentpools.report` `storagetransfer.operations.assign` `storagetransfer.operations.report`
Storage Transfer Service	Now GA	`storagetransfer.agentpools.report` `storagetransfer.operations.assign` `storagetransfer.operations.report`

Cloud IAM changes as of 2022-03-04

Service	Change	Description
Apigee	Role Updated	The following permissions have been added to the role `roles/apigee.securityAdmin` (Apigee Security Admin): `apigee.envgroupattachments.get` `apigee.envgroupattachments.list` `apigee.envgroups.get` `apigee.envgroups.list` `apigee.environments.get` `apigee.environments.list` `apigee.organizations.get` `apigee.organizations.list` `resourcemanager.projects.get` `resourcemanager.projects.list`
Apigee	Role Updated	The following permissions have been added to the role `roles/apigee.securityViewer` (Apigee Security Viewer): `apigee.envgroupattachments.get` `apigee.envgroupattachments.list` `apigee.envgroups.get` `apigee.envgroups.list` `apigee.environments.get` `apigee.environments.list` `apigee.organizations.get` `apigee.organizations.list` `resourcemanager.projects.get` `resourcemanager.projects.list`
Dataplex	Role Updated	The following permissions have been added to the role `roles/dataplex.editor` (Dataplex Editor): `dataplex.operations.cancel` `dataplex.operations.delete` `dataplex.operations.get` `dataplex.operations.list`
Dataplex	Role Updated	The following permissions have been added to the role `roles/dataplex.viewer` (Dataplex Viewer): `dataplex.operations.get` `dataplex.operations.list`
Firebase	Role Updated	The following permissions have been added to the role `roles/firebase.managementServiceAgent` (Firebase Service Management Service Agent): `storage.buckets.list`
FleetEngine	Now GA	The role `roles/fleetengine.deliveryConsumer` (Fleet Engine Delivery Consumer User) is now GA.
FleetEngine	Now GA	The role `roles/fleetengine.deliveryFleetReader` (Fleet Engine Delivery Fleet Reader User) is now GA.
FleetEngine	Now GA	The role `roles/fleetengine.deliverySuperUser` (Fleet Engine Delivery Super User) is now GA.
FleetEngine	Now GA	The role `roles/fleetengine.deliveryTrustedDriver` (Fleet Engine Delivery Trusted Driver User) is now GA.
FleetEngine	Now GA	The role `roles/fleetengine.deliveryUntrustedDriver` (Fleet Engine Delivery Untrusted Driver User) is now GA.
Identity and Access Management	Now GA	The role `roles/iam.serviceAccountViewer` (View Service Accounts) is now GA.
Managed Service for Microsoft Active Directory	Now GA	The role `roles/managedidentities.domaincontrollerOperator` (Google Cloud Managed Identities Domain Controller Operator) is now GA.
Notebooks	Role Updated	The following permissions have been added to the role `roles/notebooks.serviceAgent` (AI Platform Notebooks Service Agent): `iam.serviceAccounts.getAccessToken`
Vertex AI	Added	`aiplatform.deploymentResourcePools.create` `aiplatform.deploymentResourcePools.delete` `aiplatform.deploymentResourcePools.get` `aiplatform.deploymentResourcePools.list` `aiplatform.deploymentResourcePools.queryDeployedModels` `aiplatform.deploymentResourcePools.update`
BigQuery	Added	`bigquery.connections.delegate` `bigquery.jobs.listExecutionMetadata`
BigQuery	Supported In Custom Roles	`bigquery.connections.delegate` `bigquery.jobs.listExecutionMetadata`
Cloud Key Management Service	Now GA	`cloudkms.ekmConnections.create` `cloudkms.ekmConnections.get` `cloudkms.ekmConnections.getIamPolicy` `cloudkms.ekmConnections.list` `cloudkms.ekmConnections.setIamPolicy` `cloudkms.ekmConnections.update` `cloudkms.ekmConnections.use`
FleetEngine	Added	`fleetengine.deliveryvehicles.create` `fleetengine.deliveryvehicles.get` `fleetengine.deliveryvehicles.list` `fleetengine.deliveryvehicles.update` `fleetengine.deliveryvehicles.updateLocation` `fleetengine.deliveryvehicles.updateVehicleStops` `fleetengine.tasks.create` `fleetengine.tasks.get` `fleetengine.tasks.list` `fleetengine.tasks.searchWithTrackingId` `fleetengine.tasks.update`
FleetEngine	Supported In Custom Roles	`fleetengine.deliveryvehicles.create` `fleetengine.deliveryvehicles.get` `fleetengine.deliveryvehicles.list` `fleetengine.deliveryvehicles.update` `fleetengine.deliveryvehicles.updateLocation` `fleetengine.deliveryvehicles.updateVehicleStops` `fleetengine.tasks.create` `fleetengine.tasks.get` `fleetengine.tasks.list` `fleetengine.tasks.searchWithTrackingId` `fleetengine.tasks.update`
FleetEngine	Now GA	`fleetengine.deliveryvehicles.create` `fleetengine.deliveryvehicles.get` `fleetengine.deliveryvehicles.list` `fleetengine.deliveryvehicles.update` `fleetengine.deliveryvehicles.updateLocation` `fleetengine.deliveryvehicles.updateVehicleStops` `fleetengine.tasks.create` `fleetengine.tasks.get` `fleetengine.tasks.list` `fleetengine.tasks.searchWithTrackingId` `fleetengine.tasks.update`

Cloud IAM changes as of 2022-02-25

Service	Change	Description
Dataform	Now GA	The role `roles/dataform.serviceAgent` (Dataform Service Agent) is now GA.
Firestore	Role Updated	The following permissions have been added to the role `roles/firestore.serviceAgent` (Firestore Service Agent): `storage.objects.delete`
KRM API Hosting	Now GA	The role `roles/krmapihosting.admin` (Config Controller Admin) is now GA.
KRM API Hosting	Now GA	The role `roles/krmapihosting.viewer` (Config Controller Viewer) is now GA.
Managed Service for Microsoft Active Directory	Now GA	The role `roles/managedidentities.backupAdmin` (Google Cloud Managed Identities Backup Admin) is now GA.
Managed Service for Microsoft Active Directory	Now GA	The role `roles/managedidentities.backupViewer` (Google Cloud Managed Identities Backup Viewer) is now GA.
Dataform	Now GA	The role `roles/sqlx.serviceAgent` (Dataform Service Agent) is now GA.
Dialogflow	Added	`dialogflow.integrations.create` `dialogflow.integrations.delete` `dialogflow.integrations.get` `dialogflow.integrations.list` `dialogflow.integrations.update`
Dialogflow	Now GA	`dialogflow.integrations.create` `dialogflow.integrations.delete` `dialogflow.integrations.get` `dialogflow.integrations.list` `dialogflow.integrations.update`
Sensitive Data Protection	Added	`dlp.locations.get` `dlp.locations.list`
Sensitive Data Protection	Supported In Custom Roles	`dlp.locations.get` `dlp.locations.list`
Sensitive Data Protection	Now GA	`dlp.locations.get` `dlp.locations.list`
Eventarc	Added	`eventarc.providers.get` `eventarc.providers.list`
Eventarc	Supported In Custom Roles	`eventarc.providers.get` `eventarc.providers.list`
Eventarc	Now GA	`eventarc.providers.get` `eventarc.providers.list`
KRM API Hosting	Now GA	`krmapihosting.krmApiHosts.create` `krmapihosting.krmApiHosts.delete` `krmapihosting.krmApiHosts.get` `krmapihosting.krmApiHosts.getIamPolicy` `krmapihosting.krmApiHosts.list` `krmapihosting.krmApiHosts.setIamPolicy` `krmapihosting.krmApiHosts.update` `krmapihosting.locations.get` `krmapihosting.locations.list` `krmapihosting.operations.cancel` `krmapihosting.operations.delete` `krmapihosting.operations.get` `krmapihosting.operations.list`
Managed Service for Microsoft Active Directory	Added	`managedidentities.backups.create` `managedidentities.backups.delete` `managedidentities.backups.get` `managedidentities.backups.getIamPolicy` `managedidentities.backups.list` `managedidentities.backups.setIamPolicy` `managedidentities.backups.update` `managedidentities.domains.createTagBinding` `managedidentities.domains.deleteTagBinding` `managedidentities.domains.listTagBindings` `managedidentities.domains.restore`
Managed Service for Microsoft Active Directory	Supported In Custom Roles	`managedidentities.backups.create` `managedidentities.backups.delete` `managedidentities.backups.get` `managedidentities.backups.getIamPolicy` `managedidentities.backups.list` `managedidentities.backups.setIamPolicy` `managedidentities.backups.update` `managedidentities.domains.restore`
Managed Service for Microsoft Active Directory	Now GA	`managedidentities.backups.create` `managedidentities.backups.delete` `managedidentities.backups.get` `managedidentities.backups.getIamPolicy` `managedidentities.backups.list` `managedidentities.backups.setIamPolicy` `managedidentities.backups.update` `managedidentities.domains.createTagBinding` `managedidentities.domains.deleteTagBinding` `managedidentities.domains.listTagBindings` `managedidentities.domains.restore`

Cloud IAM changes as of 2022-02-18

Service	Change	Description
Datastore	Role Updated	The following permissions have been added to the role `roles/datastore.importExportAdmin` (Cloud Datastore Import Export Admin): `datastore.databases.getMetadata`
Datastore	Role Updated	The following permissions have been added to the role `roles/datastore.indexAdmin` (Cloud Datastore Index Admin): `datastore.databases.getMetadata`
Datastore	Role Updated	The following permissions have been added to the role `roles/datastore.keyVisualizerViewer` (Cloud Datastore Key Visualizer Viewer): `datastore.databases.getMetadata`
Firebase Mods	Role Updated	The following permissions have been added to the role `roles/firebasemods.serviceAgent` (Firebase Extensions API Service Agent): `appengine.applications.get` `cloudtasks.locations.get` `cloudtasks.locations.list` `cloudtasks.queues.create` `cloudtasks.queues.delete` `cloudtasks.queues.get` `cloudtasks.queues.getIamPolicy` `cloudtasks.queues.list` `cloudtasks.queues.pause` `cloudtasks.queues.purge` `cloudtasks.queues.resume` `cloudtasks.queues.setIamPolicy` `cloudtasks.queues.update` `cloudtasks.tasks.create` `cloudtasks.tasks.fullView`
GKE Hub	Role Updated	The following permissions have been added to the role `roles/gkehub.serviceAgent` (GKE Hub Service Agent): `gkehub.fleet.create` `gkehub.fleet.get`
Binary Authorization	Added	`binaryauthorization.platformPolicies.create` `binaryauthorization.platformPolicies.delete` `binaryauthorization.platformPolicies.evaluatePolicy` `binaryauthorization.platformPolicies.get` `binaryauthorization.platformPolicies.list` `binaryauthorization.platformPolicies.replace` `binaryauthorization.policy.evaluatePolicy`
Binary Authorization	Supported In Custom Roles	`binaryauthorization.platformPolicies.create` `binaryauthorization.platformPolicies.delete` `binaryauthorization.platformPolicies.evaluatePolicy` `binaryauthorization.platformPolicies.get` `binaryauthorization.platformPolicies.list` `binaryauthorization.platformPolicies.replace` `binaryauthorization.policy.evaluatePolicy`
Compute Engine	Added	`compute.networks.getRegionEffectiveFirewalls` `compute.networks.setFirewallPolicy` `compute.regionFirewallPolicies.cloneRules` `compute.regionFirewallPolicies.create` `compute.regionFirewallPolicies.delete` `compute.regionFirewallPolicies.get` `compute.regionFirewallPolicies.getIamPolicy` `compute.regionFirewallPolicies.list` `compute.regionFirewallPolicies.setIamPolicy` `compute.regionFirewallPolicies.update` `compute.regionFirewallPolicies.use`
Compute Engine	Now GA	`compute.networks.getRegionEffectiveFirewalls` `compute.networks.setFirewallPolicy` `compute.regionFirewallPolicies.cloneRules` `compute.regionFirewallPolicies.create` `compute.regionFirewallPolicies.delete` `compute.regionFirewallPolicies.get` `compute.regionFirewallPolicies.getIamPolicy` `compute.regionFirewallPolicies.list` `compute.regionFirewallPolicies.setIamPolicy` `compute.regionFirewallPolicies.update` `compute.regionFirewallPolicies.use`
KRM API Hosting	Added	`krmapihosting.krmApiHosts.create` `krmapihosting.krmApiHosts.delete` `krmapihosting.krmApiHosts.get` `krmapihosting.krmApiHosts.getIamPolicy` `krmapihosting.krmApiHosts.list` `krmapihosting.krmApiHosts.setIamPolicy` `krmapihosting.krmApiHosts.update` `krmapihosting.locations.get` `krmapihosting.locations.list` `krmapihosting.operations.cancel` `krmapihosting.operations.delete` `krmapihosting.operations.get` `krmapihosting.operations.list`
KRM API Hosting	Supported In Custom Roles	`krmapihosting.krmApiHosts.create` `krmapihosting.krmApiHosts.delete` `krmapihosting.krmApiHosts.get` `krmapihosting.krmApiHosts.getIamPolicy` `krmapihosting.krmApiHosts.list` `krmapihosting.krmApiHosts.setIamPolicy` `krmapihosting.krmApiHosts.update` `krmapihosting.locations.get` `krmapihosting.locations.list` `krmapihosting.operations.cancel` `krmapihosting.operations.delete` `krmapihosting.operations.get` `krmapihosting.operations.list`
Cloud OS Config	Added	`osconfig.patchDeployments.pause` `osconfig.patchDeployments.resume`
Cloud OS Config	Now GA	`osconfig.patchDeployments.pause` `osconfig.patchDeployments.resume`
Service Networking	Added	`servicenetworking.services.use`

Cloud IAM changes as of 2022-02-11

Service	Change	Description
Vertex AI	Role Added	The role `roles/aiplatform.tensorboardWebAppUser` (Vertex AI Tensorboard Web App User) has been added with the following permissions: `aiplatform.googleapis.com/tensorboards.recordAccess` `aiplatform.tensorboards.recordAccess`
Vertex AI	Role Updated	The following permissions have been added to the role `roles/aiplatform.admin` (Vertex AI Administrator): `aiplatform.tensorboards.recordAccess`
App Engine flexible environment	Role Updated	The following permissions have been added to the role `roles/appengineflex.serviceAgent` (App Engine flexible environment Service Agent): `compute.routes.get` `compute.subnetworks.get`
Binary Authorization	Role Updated	The following permissions have been added to the role `roles/binaryauthorization.serviceAgent` (Binary Authorization Service Agent): `cloudasset.assets.exportResource`
Firebase	Role Updated	The following permissions have been added to the role `roles/firebase.developViewer` (Firebase Develop Viewer): `datastore.databases.getMetadata`
Firebase	Role Updated	The following permissions have been added to the role `roles/firebase.managementServiceAgent` (Firebase Service Management Service Agent): `serviceusage.services.use`
Firebase	Role Updated	The following permissions have been added to the role `roles/firebase.viewer` (Firebase Viewer): `datastore.databases.getMetadata`
Notebooks	Role Updated	The following permissions have been added to the role `roles/notebooks.serviceAgent` (AI Platform Notebooks Service Agent): `dataproc.clusters.use`
Recommender	Role Updated	The following permissions have been added to the role `roles/recommender.firewallAdmin` (Firewall Recommender Admin): `monitoring.timeSeries.list`
Recommender	Role Updated	The following permissions have been added to the role `roles/recommender.firewallViewer` (Firewall Recommender Viewer): `monitoring.timeSeries.list`
Security Command Center	Now GA	The role `roles/securitycenter.bigQueryExportsEditor` (Security Center BigQuery Exports Editor) is now GA.
Security Command Center	Now GA	The role `roles/securitycenter.bigQueryExportsViewer` (Security Center BigQuery Exports Viewer) is now GA.
Visual Inspection AI	Role Updated	The following permissions have been added to the role `roles/visualinspection.serviceAgent` (Visual Inspection AI Service Agent): `aiplatform.tensorboards.recordAccess`
Vertex AI	Added	`aiplatform.tensorboards.recordAccess`
Cloud Healthcare API	Added	`healthcare.nlpservice.analyzeEntities`
Cloud Healthcare API	Now GA	`healthcare.nlpservice.analyzeEntities`
Dataproc Metastore	Added	`metastore.services.use`
Dataproc Metastore	Supported In Custom Roles	`metastore.services.use`
Security Command Center	Added	`securitycenter.bigQueryExports.create` `securitycenter.bigQueryExports.delete` `securitycenter.bigQueryExports.get` `securitycenter.bigQueryExports.list` `securitycenter.bigQueryExports.update`
Security Command Center	Supported In Custom Roles	`securitycenter.bigQueryExports.create` `securitycenter.bigQueryExports.delete` `securitycenter.bigQueryExports.get` `securitycenter.bigQueryExports.list` `securitycenter.bigQueryExports.update`
Security Command Center	Now GA	`securitycenter.bigQueryExports.create` `securitycenter.bigQueryExports.delete` `securitycenter.bigQueryExports.get` `securitycenter.bigQueryExports.list` `securitycenter.bigQueryExports.update`
Cloud TPU	Added	`tpu.nodes.update`
Cloud TPU	Supported In Custom Roles	`tpu.nodes.update`
Cloud TPU	Now GA	`tpu.nodes.update`

Cloud IAM changes as of 2022-01-28

Service	Change	Description
Cloud Composer	Role Updated	The following permissions have been added to the role `roles/composer.environmentAndStorageObjectAdmin` (Environment and Storage Object Administrator): `storage.multipartUploads.abort` `storage.multipartUploads.create` `storage.multipartUploads.list` `storage.multipartUploads.listParts`
Cloud Composer	Role Updated	The following permissions have been added to the role `roles/composer.worker` (Composer Worker): `storage.multipartUploads.abort` `storage.multipartUploads.create` `storage.multipartUploads.list` `storage.multipartUploads.listParts`
Dataplex	Now GA	The role `roles/dataplex.serviceAgent` (Cloud Dataplex Service Agent) is now GA.
Dataprep by Trifacta	Role Updated	The following permissions have been added to the role `roles/dataprep.serviceAgent` (Dataprep Service Agent): `storage.multipartUploads.abort` `storage.multipartUploads.create` `storage.multipartUploads.list` `storage.multipartUploads.listParts`
Basic Role	Role Updated	The following permissions have been added to the role `roles/editor` (Editor): `bigquery.config.update`
Firebase	Role Updated	The following permissions have been added to the role `roles/firebase.sdkAdminServiceAgent` (Firebase Admin SDK Administrator Service Agent): `storage.multipartUploads.abort` `storage.multipartUploads.create` `storage.multipartUploads.list` `storage.multipartUploads.listParts`
Notebooks	Role Updated	The following permissions have been added to the role `roles/notebooks.serviceAgent` (AI Platform Notebooks Service Agent): `dataproc.clusters.get` `dataproc.jobs.cancel` `dataproc.jobs.create` `dataproc.jobs.delete` `dataproc.jobs.get` `dataproc.jobs.list` `dataproc.jobs.update`
Cloud Storage	Role Updated	The following permissions have been added to the role `roles/storage.objectAdmin` (Storage Object Admin): `storage.multipartUploads.abort` `storage.multipartUploads.create` `storage.multipartUploads.list` `storage.multipartUploads.listParts`
Data Pipelines	Added	`datapipelines.jobs.list`
Data Pipelines	Supported In Custom Roles	`datapipelines.jobs.list`
Data Pipelines	Now GA	`datapipelines.jobs.list`
Dataproc	Added	`dataproc.batches.cancel` `dataproc.batches.create` `dataproc.batches.delete` `dataproc.batches.get` `dataproc.batches.list`
Dataproc	Supported In Custom Roles	`dataproc.batches.cancel` `dataproc.batches.create` `dataproc.batches.delete` `dataproc.batches.get` `dataproc.batches.list`
Dataproc	Now GA	`dataproc.batches.cancel` `dataproc.batches.create` `dataproc.batches.delete` `dataproc.batches.get` `dataproc.batches.list`
Identity and Access Management	Supported In Custom Roles	`iam.denypolicies.get` `iam.denypolicies.list`
Dataproc Metastore	Added	`metastore.databases.create` `metastore.databases.delete` `metastore.databases.get` `metastore.databases.getIamPolicy` `metastore.databases.list` `metastore.databases.setIamPolicy` `metastore.databases.update` `metastore.tables.create` `metastore.tables.delete` `metastore.tables.get` `metastore.tables.getIamPolicy` `metastore.tables.list` `metastore.tables.setIamPolicy` `metastore.tables.update`
Dataproc Metastore	Supported In Custom Roles	`metastore.databases.create` `metastore.databases.delete` `metastore.databases.get` `metastore.databases.getIamPolicy` `metastore.databases.list` `metastore.databases.setIamPolicy` `metastore.databases.update` `metastore.tables.create` `metastore.tables.delete` `metastore.tables.get` `metastore.tables.getIamPolicy` `metastore.tables.list` `metastore.tables.setIamPolicy` `metastore.tables.update`
Workflows	Added	`workflows.callbacks.send`
Workflows	Supported In Custom Roles	`workflows.callbacks.send`
Workflows	Now GA	`workflows.callbacks.send`

Cloud IAM changes as of 2022-01-14

Service	Change	Description
Data Catalog	Now GA	The role `roles/datacatalog.categoryAdmin` (Policy Tag Admin) is now GA.
Data Catalog	Now GA	The role `roles/datacatalog.categoryFineGrainedReader` (Fine-Grained Reader) is now GA.
Dataplex	Now GA	The role `roles/dataplex.admin` (Dataplex Administrator) is now GA.
Dataplex	Now GA	The role `roles/dataplex.dataOwner` (Dataplex Data Owner) is now GA.
Dataplex	Now GA	The role `roles/dataplex.dataReader` (Dataplex Data Reader) is now GA.
Dataplex	Now GA	The role `roles/dataplex.dataWriter` (Dataplex Data Writer) is now GA.
Dataplex	Now GA	The role `roles/dataplex.developer` (Dataplex Developer) is now GA.
Dataplex	Now GA	The role `roles/dataplex.editor` (Dataplex Editor) is now GA.
Dataplex	Now GA	The role `roles/dataplex.metadataReader` (Dataplex Metadata Reader) is now GA.
Dataplex	Now GA	The role `roles/dataplex.metadataWriter` (Dataplex Metadata Writer) is now GA.
Dataplex	Now GA	The role `roles/dataplex.storageDataOwner` (Dataplex Storage Data Owner) is now GA.
Dataplex	Now GA	The role `roles/dataplex.storageDataReader` (Dataplex Storage Data Reader) is now GA.
Dataplex	Now GA	The role `roles/dataplex.storageDataWriter` (Dataplex Storage Data Writer) is now GA.
Dataplex	Now GA	The role `roles/dataplex.viewer` (Dataplex Viewer) is now GA.
Dialogflow	Role Updated	The following permissions have been added to the role `roles/dialogflow.serviceAgent` (Dialogflow Service Agent): `speech.customClasses.get` `speech.customClasses.list` `speech.phraseSets.get` `speech.phraseSets.list`
Firebase Mods	Role Updated	The following permissions have been added to the role `roles/firebasemods.serviceAgent` (Firebase Extensions API Service Agent): `artifactregistry.packages.delete`
Cloud OS Config	Now GA	The role `roles/osconfig.osPolicyAssignmentAdmin` (OSPolicyAssignment Admin) is now GA.
Cloud OS Config	Now GA	The role `roles/osconfig.osPolicyAssignmentEditor` (OSPolicyAssignment Editor) is now GA.
Cloud OS Config	Now GA	The role `roles/osconfig.osPolicyAssignmentReportViewer` (OSPolicyAssignmentReport Viewer) is now GA.
Cloud OS Config	Now GA	The role `roles/osconfig.osPolicyAssignmentViewer` (OSPolicyAssignment Viewer) is now GA.
Recommender	Now GA	The role `roles/recommender.projectUtilAdmin` (Project Utilization Recommender Admin) is now GA.
Recommender	Now GA	The role `roles/recommender.projectUtilViewer` (Project Utilization Recommender Viewer) is now GA.
Security Command Center	Role Updated	The following permissions have been added to the role `roles/securitycenter.securityResponseServiceAgent` (Google Cloud Security Response Service Agent): `compute.instances.get`
Cloud Run functions	Added	`cloudfunctions.runtimes.list`
Cloud Run functions	Now GA	`cloudfunctions.runtimes.list`
Cloud Key Management Service	Added	`cloudkms.ekmConnections.create` `cloudkms.ekmConnections.get` `cloudkms.ekmConnections.getIamPolicy` `cloudkms.ekmConnections.list` `cloudkms.ekmConnections.setIamPolicy` `cloudkms.ekmConnections.update` `cloudkms.ekmConnections.use`
Data Catalog	Supported In Custom Roles	`datacatalog.categories.fineGrainedGet` `datacatalog.categories.getIamPolicy` `datacatalog.categories.setIamPolicy` `datacatalog.taxonomies.create` `datacatalog.taxonomies.delete` `datacatalog.taxonomies.get` `datacatalog.taxonomies.getIamPolicy` `datacatalog.taxonomies.list` `datacatalog.taxonomies.setIamPolicy` `datacatalog.taxonomies.update`
Data Catalog	Now GA	`datacatalog.categories.fineGrainedGet` `datacatalog.categories.getIamPolicy` `datacatalog.categories.setIamPolicy` `datacatalog.taxonomies.create` `datacatalog.taxonomies.delete` `datacatalog.taxonomies.get` `datacatalog.taxonomies.getIamPolicy` `datacatalog.taxonomies.list` `datacatalog.taxonomies.setIamPolicy` `datacatalog.taxonomies.update`
Dataflow	Supported In Custom Roles	`dataflow.shuffle.read` `dataflow.shuffle.write` `dataflow.streamingWorkItems.commitWork` `dataflow.streamingWorkItems.getData` `dataflow.streamingWorkItems.getWork` `dataflow.workItems.lease` `dataflow.workItems.sendMessage` `dataflow.workItems.update`
Dataflow	Now GA	`dataflow.shuffle.read` `dataflow.shuffle.write` `dataflow.streamingWorkItems.commitWork` `dataflow.streamingWorkItems.getData` `dataflow.streamingWorkItems.getWork` `dataflow.workItems.lease` `dataflow.workItems.sendMessage` `dataflow.workItems.update`
Dataplex	Added	`dataplex.assetActions.list` `dataplex.assets.create` `dataplex.assets.delete` `dataplex.assets.get` `dataplex.assets.getIamPolicy` `dataplex.assets.list` `dataplex.assets.ownData` `dataplex.assets.readData` `dataplex.assets.setIamPolicy` `dataplex.assets.update` `dataplex.assets.writeData` `dataplex.content.create` `dataplex.content.delete` `dataplex.content.get` `dataplex.content.getIamPolicy` `dataplex.content.list` `dataplex.content.setIamPolicy` `dataplex.content.update` `dataplex.entities.create` `dataplex.entities.delete` `dataplex.entities.get` `dataplex.entities.list` `dataplex.entities.update` `dataplex.environments.create` `dataplex.environments.delete` `dataplex.environments.execute` `dataplex.environments.get` `dataplex.environments.getIamPolicy` `dataplex.environments.list` `dataplex.environments.setIamPolicy` `dataplex.environments.update` `dataplex.lakeActions.list` `dataplex.lakes.create` `dataplex.lakes.delete` `dataplex.lakes.get` `dataplex.lakes.getIamPolicy` `dataplex.lakes.list` `dataplex.lakes.setIamPolicy` `dataplex.lakes.update` `dataplex.locations.get` `dataplex.locations.list` `dataplex.operations.cancel` `dataplex.operations.delete` `dataplex.operations.get` `dataplex.operations.list` `dataplex.partitions.create` `dataplex.partitions.delete` `dataplex.partitions.get` `dataplex.partitions.list` `dataplex.partitions.update` `dataplex.tasks.cancel` `dataplex.tasks.create` `dataplex.tasks.delete` `dataplex.tasks.get` `dataplex.tasks.getIamPolicy` `dataplex.tasks.list` `dataplex.tasks.setIamPolicy` `dataplex.tasks.update` `dataplex.zoneActions.list` `dataplex.zones.create` `dataplex.zones.delete` `dataplex.zones.get` `dataplex.zones.getIamPolicy` `dataplex.zones.list` `dataplex.zones.setIamPolicy` `dataplex.zones.update`
Dataplex	Supported In Custom Roles	`dataplex.assetActions.list` `dataplex.assets.create` `dataplex.assets.delete` `dataplex.assets.get` `dataplex.assets.getIamPolicy` `dataplex.assets.list` `dataplex.assets.setIamPolicy` `dataplex.assets.update` `dataplex.content.create` `dataplex.content.delete` `dataplex.content.get` `dataplex.content.getIamPolicy` `dataplex.content.list` `dataplex.content.setIamPolicy` `dataplex.content.update` `dataplex.entities.create` `dataplex.entities.delete` `dataplex.entities.get` `dataplex.entities.list` `dataplex.entities.update` `dataplex.environments.create` `dataplex.environments.delete` `dataplex.environments.execute` `dataplex.environments.get` `dataplex.environments.getIamPolicy` `dataplex.environments.list` `dataplex.environments.setIamPolicy` `dataplex.environments.update` `dataplex.lakeActions.list` `dataplex.lakes.create` `dataplex.lakes.delete` `dataplex.lakes.get` `dataplex.lakes.getIamPolicy` `dataplex.lakes.list` `dataplex.lakes.setIamPolicy` `dataplex.lakes.update` `dataplex.locations.get` `dataplex.locations.list` `dataplex.operations.cancel` `dataplex.operations.delete` `dataplex.operations.get` `dataplex.operations.list` `dataplex.partitions.create` `dataplex.partitions.delete` `dataplex.partitions.get` `dataplex.partitions.list` `dataplex.partitions.update` `dataplex.tasks.cancel` `dataplex.tasks.create` `dataplex.tasks.delete` `dataplex.tasks.get` `dataplex.tasks.getIamPolicy` `dataplex.tasks.list` `dataplex.tasks.setIamPolicy` `dataplex.tasks.update` `dataplex.zoneActions.list` `dataplex.zones.create` `dataplex.zones.delete` `dataplex.zones.get` `dataplex.zones.getIamPolicy` `dataplex.zones.list` `dataplex.zones.setIamPolicy` `dataplex.zones.update`
Dataplex	Now GA	`dataplex.assetActions.list` `dataplex.assets.create` `dataplex.assets.delete` `dataplex.assets.get` `dataplex.assets.getIamPolicy` `dataplex.assets.list` `dataplex.assets.ownData` `dataplex.assets.readData` `dataplex.assets.setIamPolicy` `dataplex.assets.update` `dataplex.assets.writeData` `dataplex.content.create` `dataplex.content.delete` `dataplex.content.get` `dataplex.content.getIamPolicy` `dataplex.content.list` `dataplex.content.setIamPolicy` `dataplex.content.update` `dataplex.entities.create` `dataplex.entities.delete` `dataplex.entities.get` `dataplex.entities.list` `dataplex.entities.update` `dataplex.environments.create` `dataplex.environments.delete` `dataplex.environments.execute` `dataplex.environments.get` `dataplex.environments.getIamPolicy` `dataplex.environments.list` `dataplex.environments.setIamPolicy` `dataplex.environments.update` `dataplex.lakeActions.list` `dataplex.lakes.create` `dataplex.lakes.delete` `dataplex.lakes.get` `dataplex.lakes.getIamPolicy` `dataplex.lakes.list` `dataplex.lakes.setIamPolicy` `dataplex.lakes.update` `dataplex.locations.get` `dataplex.locations.list` `dataplex.operations.cancel` `dataplex.operations.delete` `dataplex.operations.get` `dataplex.operations.list` `dataplex.partitions.create` `dataplex.partitions.delete` `dataplex.partitions.get` `dataplex.partitions.list` `dataplex.partitions.update` `dataplex.tasks.cancel` `dataplex.tasks.create` `dataplex.tasks.delete` `dataplex.tasks.get` `dataplex.tasks.getIamPolicy` `dataplex.tasks.list` `dataplex.tasks.setIamPolicy` `dataplex.tasks.update` `dataplex.zoneActions.list` `dataplex.zones.create` `dataplex.zones.delete` `dataplex.zones.get` `dataplex.zones.getIamPolicy` `dataplex.zones.list` `dataplex.zones.setIamPolicy` `dataplex.zones.update`
Eventarc	Added	`eventarc.events.receiveEvent`
Eventarc	Now GA	`eventarc.events.receiveEvent`
Cloud OS Config	Now GA	`osconfig.osPolicyAssignmentReports.get` `osconfig.osPolicyAssignmentReports.list` `osconfig.osPolicyAssignments.create` `osconfig.osPolicyAssignments.delete` `osconfig.osPolicyAssignments.get` `osconfig.osPolicyAssignments.list` `osconfig.osPolicyAssignments.update`
Recommender	Now GA	`recommender.resourcemanagerProjectUtilizationInsights.get` `recommender.resourcemanagerProjectUtilizationInsights.list` `recommender.resourcemanagerProjectUtilizationInsights.update` `recommender.resourcemanagerProjectUtilizationRecommendations.get` `recommender.resourcemanagerProjectUtilizationRecommendations.list` `recommender.resourcemanagerProjectUtilizationRecommendations.update`
Security Command Center	Added	`securitycenter.virtualmachinethreatdetectionsettings.calculate` `securitycenter.virtualmachinethreatdetectionsettings.get` `securitycenter.virtualmachinethreatdetectionsettings.update`
Security Command Center	Supported In Custom Roles	`securitycenter.virtualmachinethreatdetectionsettings.calculate` `securitycenter.virtualmachinethreatdetectionsettings.get` `securitycenter.virtualmachinethreatdetectionsettings.update`
Security Command Center	Now GA	`securitycenter.virtualmachinethreatdetectionsettings.calculate` `securitycenter.virtualmachinethreatdetectionsettings.get` `securitycenter.virtualmachinethreatdetectionsettings.update`